Analysis
-
max time kernel
148s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
29-06-2024 01:06
Static task
static1
Behavioral task
behavioral1
Sample
4138bf828e5c36e6d955c250d8395d588004dab4d45d8b21ba7f6056a02622e3_NeikiAnalytics.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
4138bf828e5c36e6d955c250d8395d588004dab4d45d8b21ba7f6056a02622e3_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
4138bf828e5c36e6d955c250d8395d588004dab4d45d8b21ba7f6056a02622e3_NeikiAnalytics.exe
-
Size
265KB
-
MD5
060eaec38a633594f42e6adf70133e20
-
SHA1
61d34b14d29059f1756ff762c98a2e587cba01ef
-
SHA256
4138bf828e5c36e6d955c250d8395d588004dab4d45d8b21ba7f6056a02622e3
-
SHA512
3ec62bef5d2fef4bd64245b3c1d4f45320f97c25450dd427d8210349d98a7b4614da25fb4f4c2e070d7ec1b998fbd59167e394e637747bf08208edcc9fe110f6
-
SSDEEP
3072:WdvzDqxs8ORikgogWfiuRXd3YmSffdTKXNXANewGBvskX1pWA/q:WFzDqa86hV6uRRqX1evPlwAC
Malware Config
Signatures
-
Contains code to disable Windows Defender 5 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Processes:
resource yara_rule behavioral1/memory/2704-34-0x0000000000400000-0x0000000000430000-memory.dmp disable_win_def behavioral1/memory/2704-36-0x0000000000400000-0x0000000000430000-memory.dmp disable_win_def behavioral1/memory/2704-35-0x0000000000400000-0x0000000000430000-memory.dmp disable_win_def behavioral1/memory/2704-31-0x0000000000400000-0x0000000000430000-memory.dmp disable_win_def behavioral1/memory/2704-29-0x0000000000400000-0x0000000000430000-memory.dmp disable_win_def -
Executes dropped EXE 1 IoCs
Processes:
HiPatchService.exepid process 2672 HiPatchService.exe -
Loads dropped DLL 1 IoCs
Processes:
4138bf828e5c36e6d955c250d8395d588004dab4d45d8b21ba7f6056a02622e3_NeikiAnalytics.exepid process 2356 4138bf828e5c36e6d955c250d8395d588004dab4d45d8b21ba7f6056a02622e3_NeikiAnalytics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
4138bf828e5c36e6d955c250d8395d588004dab4d45d8b21ba7f6056a02622e3_NeikiAnalytics.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\HiPatch = "C:\\Users\\Admin\\AppData\\Roaming\\HiPatch\\HiPatchService.exe" 4138bf828e5c36e6d955c250d8395d588004dab4d45d8b21ba7f6056a02622e3_NeikiAnalytics.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
HiPatchService.exedescription pid process target process PID 2672 set thread context of 2704 2672 HiPatchService.exe RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 11 IoCs
Processes:
HiPatchService.exeRegAsm.exepid process 2672 HiPatchService.exe 2704 RegAsm.exe 2704 RegAsm.exe 2704 RegAsm.exe 2704 RegAsm.exe 2704 RegAsm.exe 2704 RegAsm.exe 2704 RegAsm.exe 2704 RegAsm.exe 2704 RegAsm.exe 2704 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
HiPatchService.exedescription pid process Token: SeDebugPrivilege 2672 HiPatchService.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
4138bf828e5c36e6d955c250d8395d588004dab4d45d8b21ba7f6056a02622e3_NeikiAnalytics.exeHiPatchService.exedescription pid process target process PID 2356 wrote to memory of 2672 2356 4138bf828e5c36e6d955c250d8395d588004dab4d45d8b21ba7f6056a02622e3_NeikiAnalytics.exe HiPatchService.exe PID 2356 wrote to memory of 2672 2356 4138bf828e5c36e6d955c250d8395d588004dab4d45d8b21ba7f6056a02622e3_NeikiAnalytics.exe HiPatchService.exe PID 2356 wrote to memory of 2672 2356 4138bf828e5c36e6d955c250d8395d588004dab4d45d8b21ba7f6056a02622e3_NeikiAnalytics.exe HiPatchService.exe PID 2356 wrote to memory of 2672 2356 4138bf828e5c36e6d955c250d8395d588004dab4d45d8b21ba7f6056a02622e3_NeikiAnalytics.exe HiPatchService.exe PID 2356 wrote to memory of 2672 2356 4138bf828e5c36e6d955c250d8395d588004dab4d45d8b21ba7f6056a02622e3_NeikiAnalytics.exe HiPatchService.exe PID 2356 wrote to memory of 2672 2356 4138bf828e5c36e6d955c250d8395d588004dab4d45d8b21ba7f6056a02622e3_NeikiAnalytics.exe HiPatchService.exe PID 2356 wrote to memory of 2672 2356 4138bf828e5c36e6d955c250d8395d588004dab4d45d8b21ba7f6056a02622e3_NeikiAnalytics.exe HiPatchService.exe PID 2356 wrote to memory of 2688 2356 4138bf828e5c36e6d955c250d8395d588004dab4d45d8b21ba7f6056a02622e3_NeikiAnalytics.exe cmd.exe PID 2356 wrote to memory of 2688 2356 4138bf828e5c36e6d955c250d8395d588004dab4d45d8b21ba7f6056a02622e3_NeikiAnalytics.exe cmd.exe PID 2356 wrote to memory of 2688 2356 4138bf828e5c36e6d955c250d8395d588004dab4d45d8b21ba7f6056a02622e3_NeikiAnalytics.exe cmd.exe PID 2356 wrote to memory of 2688 2356 4138bf828e5c36e6d955c250d8395d588004dab4d45d8b21ba7f6056a02622e3_NeikiAnalytics.exe cmd.exe PID 2356 wrote to memory of 2688 2356 4138bf828e5c36e6d955c250d8395d588004dab4d45d8b21ba7f6056a02622e3_NeikiAnalytics.exe cmd.exe PID 2356 wrote to memory of 2688 2356 4138bf828e5c36e6d955c250d8395d588004dab4d45d8b21ba7f6056a02622e3_NeikiAnalytics.exe cmd.exe PID 2356 wrote to memory of 2688 2356 4138bf828e5c36e6d955c250d8395d588004dab4d45d8b21ba7f6056a02622e3_NeikiAnalytics.exe cmd.exe PID 2672 wrote to memory of 2800 2672 HiPatchService.exe RegAsm.exe PID 2672 wrote to memory of 2800 2672 HiPatchService.exe RegAsm.exe PID 2672 wrote to memory of 2800 2672 HiPatchService.exe RegAsm.exe PID 2672 wrote to memory of 2800 2672 HiPatchService.exe RegAsm.exe PID 2672 wrote to memory of 2800 2672 HiPatchService.exe RegAsm.exe PID 2672 wrote to memory of 2800 2672 HiPatchService.exe RegAsm.exe PID 2672 wrote to memory of 2800 2672 HiPatchService.exe RegAsm.exe PID 2672 wrote to memory of 2704 2672 HiPatchService.exe RegAsm.exe PID 2672 wrote to memory of 2704 2672 HiPatchService.exe RegAsm.exe PID 2672 wrote to memory of 2704 2672 HiPatchService.exe RegAsm.exe PID 2672 wrote to memory of 2704 2672 HiPatchService.exe RegAsm.exe PID 2672 wrote to memory of 2704 2672 HiPatchService.exe RegAsm.exe PID 2672 wrote to memory of 2704 2672 HiPatchService.exe RegAsm.exe PID 2672 wrote to memory of 2704 2672 HiPatchService.exe RegAsm.exe PID 2672 wrote to memory of 2704 2672 HiPatchService.exe RegAsm.exe PID 2672 wrote to memory of 2704 2672 HiPatchService.exe RegAsm.exe PID 2672 wrote to memory of 2704 2672 HiPatchService.exe RegAsm.exe PID 2672 wrote to memory of 2704 2672 HiPatchService.exe RegAsm.exe PID 2672 wrote to memory of 2704 2672 HiPatchService.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4138bf828e5c36e6d955c250d8395d588004dab4d45d8b21ba7f6056a02622e3_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4138bf828e5c36e6d955c250d8395d588004dab4d45d8b21ba7f6056a02622e3_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.exe"C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:2800
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2704 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.bat""2⤵PID:2688
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:2384
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
213B
MD50955cb4b691d44b37f8b6fad48a33b8e
SHA19dae759ae014cc124ab6eed7c8035788c124ae4a
SHA2569092dbb1ca1767d1966b7f79349dd95a802a68248251bf070c0f1d74d5681d71
SHA51208b868a028c1e8d29ed643416850df16f58d44668f9193b46bd3934965e5617a0a4015fc52815c5456023dbde01023450d295b76d936a936f26b602e764b0235
-
Filesize
265KB
MD5134e1924d648b23df75bb610526d22c6
SHA196785aa24774e8d691d52cba3ea749e78d54f3ce
SHA256a59e8e81586859858ff73bf7f9b05ee6a9d15950215e25d90457ce6554351acd
SHA51258d9b9aeca06ad2ab1f01d672f9e32eb448110f628ce6abc0f4b7fe80364e558a8e9c6fbc471f20204bcc22b2a941f5b1a7273c1a241f29d32533e492f173c7d