Analysis
-
max time kernel
148s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
28-06-2024 03:30
Static task
static1
Behavioral task
behavioral1
Sample
75adbfdd47b0e66d0774f54187125345f1ecca5f5a5314287f32c82606300bc7_NeikiAnalytics.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
75adbfdd47b0e66d0774f54187125345f1ecca5f5a5314287f32c82606300bc7_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
General
-
Target
75adbfdd47b0e66d0774f54187125345f1ecca5f5a5314287f32c82606300bc7_NeikiAnalytics.exe
-
Size
265KB
-
MD5
3a0b63cac94e79b0cce28ec93ff52dd0
-
SHA1
f47c93a086ee50fc45d66a1bebf962b24702effb
-
SHA256
75adbfdd47b0e66d0774f54187125345f1ecca5f5a5314287f32c82606300bc7
-
SHA512
5a37b035c469dde6ee40a209c6728f2dc791fbe5c1bcd0b30bfa20041f2c6f73b9a0298c46211d27ae0d035f859e9cf7b43f0aa06f7c47db56b20fe52c4da86b
-
SSDEEP
3072:WdvzDqxs8ORikgogWfiuRXd3YmSffdTKXNXANewGBvskX1pWA/sK:WFzDqa86hV6uRRqX1evPlwAEK
Malware Config
Signatures
-
Contains code to disable Windows Defender 5 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Processes:
resource yara_rule behavioral1/memory/2300-34-0x0000000000400000-0x0000000000430000-memory.dmp disable_win_def behavioral1/memory/2300-31-0x0000000000400000-0x0000000000430000-memory.dmp disable_win_def behavioral1/memory/2300-29-0x0000000000400000-0x0000000000430000-memory.dmp disable_win_def behavioral1/memory/2300-36-0x0000000000400000-0x0000000000430000-memory.dmp disable_win_def behavioral1/memory/2300-35-0x0000000000400000-0x0000000000430000-memory.dmp disable_win_def -
Executes dropped EXE 1 IoCs
Processes:
HiPatchService.exepid process 2220 HiPatchService.exe -
Loads dropped DLL 1 IoCs
Processes:
75adbfdd47b0e66d0774f54187125345f1ecca5f5a5314287f32c82606300bc7_NeikiAnalytics.exepid process 2164 75adbfdd47b0e66d0774f54187125345f1ecca5f5a5314287f32c82606300bc7_NeikiAnalytics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
75adbfdd47b0e66d0774f54187125345f1ecca5f5a5314287f32c82606300bc7_NeikiAnalytics.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\HiPatch = "C:\\Users\\Admin\\AppData\\Roaming\\HiPatch\\HiPatchService.exe" 75adbfdd47b0e66d0774f54187125345f1ecca5f5a5314287f32c82606300bc7_NeikiAnalytics.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
HiPatchService.exedescription pid process target process PID 2220 set thread context of 2300 2220 HiPatchService.exe RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
RegAsm.exepid process 2300 RegAsm.exe 2300 RegAsm.exe 2300 RegAsm.exe 2300 RegAsm.exe 2300 RegAsm.exe 2300 RegAsm.exe 2300 RegAsm.exe 2300 RegAsm.exe 2300 RegAsm.exe 2300 RegAsm.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
75adbfdd47b0e66d0774f54187125345f1ecca5f5a5314287f32c82606300bc7_NeikiAnalytics.exeHiPatchService.exedescription pid process target process PID 2164 wrote to memory of 2220 2164 75adbfdd47b0e66d0774f54187125345f1ecca5f5a5314287f32c82606300bc7_NeikiAnalytics.exe HiPatchService.exe PID 2164 wrote to memory of 2220 2164 75adbfdd47b0e66d0774f54187125345f1ecca5f5a5314287f32c82606300bc7_NeikiAnalytics.exe HiPatchService.exe PID 2164 wrote to memory of 2220 2164 75adbfdd47b0e66d0774f54187125345f1ecca5f5a5314287f32c82606300bc7_NeikiAnalytics.exe HiPatchService.exe PID 2164 wrote to memory of 2220 2164 75adbfdd47b0e66d0774f54187125345f1ecca5f5a5314287f32c82606300bc7_NeikiAnalytics.exe HiPatchService.exe PID 2164 wrote to memory of 2220 2164 75adbfdd47b0e66d0774f54187125345f1ecca5f5a5314287f32c82606300bc7_NeikiAnalytics.exe HiPatchService.exe PID 2164 wrote to memory of 2220 2164 75adbfdd47b0e66d0774f54187125345f1ecca5f5a5314287f32c82606300bc7_NeikiAnalytics.exe HiPatchService.exe PID 2164 wrote to memory of 2220 2164 75adbfdd47b0e66d0774f54187125345f1ecca5f5a5314287f32c82606300bc7_NeikiAnalytics.exe HiPatchService.exe PID 2164 wrote to memory of 2760 2164 75adbfdd47b0e66d0774f54187125345f1ecca5f5a5314287f32c82606300bc7_NeikiAnalytics.exe cmd.exe PID 2164 wrote to memory of 2760 2164 75adbfdd47b0e66d0774f54187125345f1ecca5f5a5314287f32c82606300bc7_NeikiAnalytics.exe cmd.exe PID 2164 wrote to memory of 2760 2164 75adbfdd47b0e66d0774f54187125345f1ecca5f5a5314287f32c82606300bc7_NeikiAnalytics.exe cmd.exe PID 2164 wrote to memory of 2760 2164 75adbfdd47b0e66d0774f54187125345f1ecca5f5a5314287f32c82606300bc7_NeikiAnalytics.exe cmd.exe PID 2164 wrote to memory of 2760 2164 75adbfdd47b0e66d0774f54187125345f1ecca5f5a5314287f32c82606300bc7_NeikiAnalytics.exe cmd.exe PID 2164 wrote to memory of 2760 2164 75adbfdd47b0e66d0774f54187125345f1ecca5f5a5314287f32c82606300bc7_NeikiAnalytics.exe cmd.exe PID 2164 wrote to memory of 2760 2164 75adbfdd47b0e66d0774f54187125345f1ecca5f5a5314287f32c82606300bc7_NeikiAnalytics.exe cmd.exe PID 2220 wrote to memory of 2300 2220 HiPatchService.exe RegAsm.exe PID 2220 wrote to memory of 2300 2220 HiPatchService.exe RegAsm.exe PID 2220 wrote to memory of 2300 2220 HiPatchService.exe RegAsm.exe PID 2220 wrote to memory of 2300 2220 HiPatchService.exe RegAsm.exe PID 2220 wrote to memory of 2300 2220 HiPatchService.exe RegAsm.exe PID 2220 wrote to memory of 2300 2220 HiPatchService.exe RegAsm.exe PID 2220 wrote to memory of 2300 2220 HiPatchService.exe RegAsm.exe PID 2220 wrote to memory of 2300 2220 HiPatchService.exe RegAsm.exe PID 2220 wrote to memory of 2300 2220 HiPatchService.exe RegAsm.exe PID 2220 wrote to memory of 2300 2220 HiPatchService.exe RegAsm.exe PID 2220 wrote to memory of 2300 2220 HiPatchService.exe RegAsm.exe PID 2220 wrote to memory of 2300 2220 HiPatchService.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\75adbfdd47b0e66d0774f54187125345f1ecca5f5a5314287f32c82606300bc7_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\75adbfdd47b0e66d0774f54187125345f1ecca5f5a5314287f32c82606300bc7_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.exe"C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2300 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.bat""2⤵PID:2760
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:1644
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
213B
MD50955cb4b691d44b37f8b6fad48a33b8e
SHA19dae759ae014cc124ab6eed7c8035788c124ae4a
SHA2569092dbb1ca1767d1966b7f79349dd95a802a68248251bf070c0f1d74d5681d71
SHA51208b868a028c1e8d29ed643416850df16f58d44668f9193b46bd3934965e5617a0a4015fc52815c5456023dbde01023450d295b76d936a936f26b602e764b0235
-
Filesize
265KB
MD545fa9b9b917f16b31568239a9931ff51
SHA1f8e948a77e78fd06c6c378923c97dd7152254f42
SHA2560325183757ffac4312726ccbb863beb90e899e91f8f5a32cbb762b2a0c782d7d
SHA512c013ff0a90494590394f73fa4c2d66a12f4898309b9894654aaf74e91126cfe367f2626906e21cae98589b7d80c6b2b35ab33c0408b963da9772e9a0cae695fd