Analysis
-
max time kernel
146s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
28-06-2024 03:30
Static task
static1
Behavioral task
behavioral1
Sample
75adbfdd47b0e66d0774f54187125345f1ecca5f5a5314287f32c82606300bc7_NeikiAnalytics.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
75adbfdd47b0e66d0774f54187125345f1ecca5f5a5314287f32c82606300bc7_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
General
-
Target
75adbfdd47b0e66d0774f54187125345f1ecca5f5a5314287f32c82606300bc7_NeikiAnalytics.exe
-
Size
265KB
-
MD5
3a0b63cac94e79b0cce28ec93ff52dd0
-
SHA1
f47c93a086ee50fc45d66a1bebf962b24702effb
-
SHA256
75adbfdd47b0e66d0774f54187125345f1ecca5f5a5314287f32c82606300bc7
-
SHA512
5a37b035c469dde6ee40a209c6728f2dc791fbe5c1bcd0b30bfa20041f2c6f73b9a0298c46211d27ae0d035f859e9cf7b43f0aa06f7c47db56b20fe52c4da86b
-
SSDEEP
3072:WdvzDqxs8ORikgogWfiuRXd3YmSffdTKXNXANewGBvskX1pWA/sK:WFzDqa86hV6uRRqX1evPlwAEK
Malware Config
Signatures
-
Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Processes:
resource yara_rule behavioral2/memory/5444-28-0x0000000000400000-0x0000000000430000-memory.dmp disable_win_def -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
75adbfdd47b0e66d0774f54187125345f1ecca5f5a5314287f32c82606300bc7_NeikiAnalytics.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation 75adbfdd47b0e66d0774f54187125345f1ecca5f5a5314287f32c82606300bc7_NeikiAnalytics.exe -
Executes dropped EXE 1 IoCs
Processes:
HiPatchService.exepid process 5200 HiPatchService.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
75adbfdd47b0e66d0774f54187125345f1ecca5f5a5314287f32c82606300bc7_NeikiAnalytics.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HiPatch = "C:\\Users\\Admin\\AppData\\Roaming\\HiPatch\\HiPatchService.exe" 75adbfdd47b0e66d0774f54187125345f1ecca5f5a5314287f32c82606300bc7_NeikiAnalytics.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
HiPatchService.exedescription pid process target process PID 5200 set thread context of 5444 5200 HiPatchService.exe RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
RegAsm.exedescription ioc process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 RegAsm.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz RegAsm.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 2928 timeout.exe -
Suspicious behavior: EnumeratesProcesses 25 IoCs
Processes:
RegAsm.exepid process 5444 RegAsm.exe 5444 RegAsm.exe 5444 RegAsm.exe 5444 RegAsm.exe 5444 RegAsm.exe 5444 RegAsm.exe 5444 RegAsm.exe 5444 RegAsm.exe 5444 RegAsm.exe 5444 RegAsm.exe 5444 RegAsm.exe 5444 RegAsm.exe 5444 RegAsm.exe 5444 RegAsm.exe 5444 RegAsm.exe 5444 RegAsm.exe 5444 RegAsm.exe 5444 RegAsm.exe 5444 RegAsm.exe 5444 RegAsm.exe 5444 RegAsm.exe 5444 RegAsm.exe 5444 RegAsm.exe 5444 RegAsm.exe 5444 RegAsm.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
75adbfdd47b0e66d0774f54187125345f1ecca5f5a5314287f32c82606300bc7_NeikiAnalytics.execmd.exeHiPatchService.exedescription pid process target process PID 4008 wrote to memory of 5200 4008 75adbfdd47b0e66d0774f54187125345f1ecca5f5a5314287f32c82606300bc7_NeikiAnalytics.exe HiPatchService.exe PID 4008 wrote to memory of 5200 4008 75adbfdd47b0e66d0774f54187125345f1ecca5f5a5314287f32c82606300bc7_NeikiAnalytics.exe HiPatchService.exe PID 4008 wrote to memory of 5200 4008 75adbfdd47b0e66d0774f54187125345f1ecca5f5a5314287f32c82606300bc7_NeikiAnalytics.exe HiPatchService.exe PID 4008 wrote to memory of 2036 4008 75adbfdd47b0e66d0774f54187125345f1ecca5f5a5314287f32c82606300bc7_NeikiAnalytics.exe cmd.exe PID 4008 wrote to memory of 2036 4008 75adbfdd47b0e66d0774f54187125345f1ecca5f5a5314287f32c82606300bc7_NeikiAnalytics.exe cmd.exe PID 4008 wrote to memory of 2036 4008 75adbfdd47b0e66d0774f54187125345f1ecca5f5a5314287f32c82606300bc7_NeikiAnalytics.exe cmd.exe PID 2036 wrote to memory of 2928 2036 cmd.exe timeout.exe PID 2036 wrote to memory of 2928 2036 cmd.exe timeout.exe PID 2036 wrote to memory of 2928 2036 cmd.exe timeout.exe PID 5200 wrote to memory of 5444 5200 HiPatchService.exe RegAsm.exe PID 5200 wrote to memory of 5444 5200 HiPatchService.exe RegAsm.exe PID 5200 wrote to memory of 5444 5200 HiPatchService.exe RegAsm.exe PID 5200 wrote to memory of 5444 5200 HiPatchService.exe RegAsm.exe PID 5200 wrote to memory of 5444 5200 HiPatchService.exe RegAsm.exe PID 5200 wrote to memory of 5444 5200 HiPatchService.exe RegAsm.exe PID 5200 wrote to memory of 5444 5200 HiPatchService.exe RegAsm.exe PID 5200 wrote to memory of 5444 5200 HiPatchService.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\75adbfdd47b0e66d0774f54187125345f1ecca5f5a5314287f32c82606300bc7_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\75adbfdd47b0e66d0774f54187125345f1ecca5f5a5314287f32c82606300bc7_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.exe"C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5200 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:5444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\SysWOW64\timeout.exetimeout /t 1803⤵
- Delays execution with timeout.exe
PID:2928
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:2804
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
213B
MD50955cb4b691d44b37f8b6fad48a33b8e
SHA19dae759ae014cc124ab6eed7c8035788c124ae4a
SHA2569092dbb1ca1767d1966b7f79349dd95a802a68248251bf070c0f1d74d5681d71
SHA51208b868a028c1e8d29ed643416850df16f58d44668f9193b46bd3934965e5617a0a4015fc52815c5456023dbde01023450d295b76d936a936f26b602e764b0235
-
Filesize
265KB
MD59ad8a036230e431d9c9ca7a9350d3327
SHA11b98c9bd30ed02f3dabb7bc52c55c3b8bca83e03
SHA256f9d8fbeb043bcc7ad32bc3286a43c9f0b5edf6127fd7018605445028b0c339ed
SHA512a37fe9f12b4e673c519aa9ff3f1a74c29a71f09846212ce79a0c13c04568affb1ead75de893ff9846202197ced3bc0dafbaf30b397c23c334302c56f88f77516