Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
29-06-2024 01:06
Static task
static1
Behavioral task
behavioral1
Sample
4138bf828e5c36e6d955c250d8395d588004dab4d45d8b21ba7f6056a02622e3_NeikiAnalytics.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
4138bf828e5c36e6d955c250d8395d588004dab4d45d8b21ba7f6056a02622e3_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
4138bf828e5c36e6d955c250d8395d588004dab4d45d8b21ba7f6056a02622e3_NeikiAnalytics.exe
-
Size
265KB
-
MD5
060eaec38a633594f42e6adf70133e20
-
SHA1
61d34b14d29059f1756ff762c98a2e587cba01ef
-
SHA256
4138bf828e5c36e6d955c250d8395d588004dab4d45d8b21ba7f6056a02622e3
-
SHA512
3ec62bef5d2fef4bd64245b3c1d4f45320f97c25450dd427d8210349d98a7b4614da25fb4f4c2e070d7ec1b998fbd59167e394e637747bf08208edcc9fe110f6
-
SSDEEP
3072:WdvzDqxs8ORikgogWfiuRXd3YmSffdTKXNXANewGBvskX1pWA/q:WFzDqa86hV6uRRqX1evPlwAC
Malware Config
Signatures
-
Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Processes:
resource yara_rule behavioral2/memory/1036-28-0x0000000000400000-0x0000000000430000-memory.dmp disable_win_def -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
4138bf828e5c36e6d955c250d8395d588004dab4d45d8b21ba7f6056a02622e3_NeikiAnalytics.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 4138bf828e5c36e6d955c250d8395d588004dab4d45d8b21ba7f6056a02622e3_NeikiAnalytics.exe -
Executes dropped EXE 1 IoCs
Processes:
HiPatchService.exepid process 1284 HiPatchService.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
4138bf828e5c36e6d955c250d8395d588004dab4d45d8b21ba7f6056a02622e3_NeikiAnalytics.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HiPatch = "C:\\Users\\Admin\\AppData\\Roaming\\HiPatch\\HiPatchService.exe" 4138bf828e5c36e6d955c250d8395d588004dab4d45d8b21ba7f6056a02622e3_NeikiAnalytics.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
HiPatchService.exedescription pid process target process PID 1284 set thread context of 1036 1284 HiPatchService.exe RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
RegAsm.exedescription ioc process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 RegAsm.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz RegAsm.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1984 timeout.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
HiPatchService.exeRegAsm.exepid process 1284 HiPatchService.exe 1284 HiPatchService.exe 1036 RegAsm.exe 1036 RegAsm.exe 1036 RegAsm.exe 1036 RegAsm.exe 1036 RegAsm.exe 1036 RegAsm.exe 1036 RegAsm.exe 1036 RegAsm.exe 1036 RegAsm.exe 1036 RegAsm.exe 1036 RegAsm.exe 1036 RegAsm.exe 1036 RegAsm.exe 1036 RegAsm.exe 1036 RegAsm.exe 1036 RegAsm.exe 1036 RegAsm.exe 1036 RegAsm.exe 1036 RegAsm.exe 1036 RegAsm.exe 1036 RegAsm.exe 1036 RegAsm.exe 1036 RegAsm.exe 1036 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
HiPatchService.exedescription pid process Token: SeDebugPrivilege 1284 HiPatchService.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
4138bf828e5c36e6d955c250d8395d588004dab4d45d8b21ba7f6056a02622e3_NeikiAnalytics.execmd.exeHiPatchService.exedescription pid process target process PID 2680 wrote to memory of 1284 2680 4138bf828e5c36e6d955c250d8395d588004dab4d45d8b21ba7f6056a02622e3_NeikiAnalytics.exe HiPatchService.exe PID 2680 wrote to memory of 1284 2680 4138bf828e5c36e6d955c250d8395d588004dab4d45d8b21ba7f6056a02622e3_NeikiAnalytics.exe HiPatchService.exe PID 2680 wrote to memory of 1284 2680 4138bf828e5c36e6d955c250d8395d588004dab4d45d8b21ba7f6056a02622e3_NeikiAnalytics.exe HiPatchService.exe PID 2680 wrote to memory of 2132 2680 4138bf828e5c36e6d955c250d8395d588004dab4d45d8b21ba7f6056a02622e3_NeikiAnalytics.exe cmd.exe PID 2680 wrote to memory of 2132 2680 4138bf828e5c36e6d955c250d8395d588004dab4d45d8b21ba7f6056a02622e3_NeikiAnalytics.exe cmd.exe PID 2680 wrote to memory of 2132 2680 4138bf828e5c36e6d955c250d8395d588004dab4d45d8b21ba7f6056a02622e3_NeikiAnalytics.exe cmd.exe PID 2132 wrote to memory of 1984 2132 cmd.exe timeout.exe PID 2132 wrote to memory of 1984 2132 cmd.exe timeout.exe PID 2132 wrote to memory of 1984 2132 cmd.exe timeout.exe PID 1284 wrote to memory of 1044 1284 HiPatchService.exe RegAsm.exe PID 1284 wrote to memory of 1044 1284 HiPatchService.exe RegAsm.exe PID 1284 wrote to memory of 1044 1284 HiPatchService.exe RegAsm.exe PID 1284 wrote to memory of 1036 1284 HiPatchService.exe RegAsm.exe PID 1284 wrote to memory of 1036 1284 HiPatchService.exe RegAsm.exe PID 1284 wrote to memory of 1036 1284 HiPatchService.exe RegAsm.exe PID 1284 wrote to memory of 1036 1284 HiPatchService.exe RegAsm.exe PID 1284 wrote to memory of 1036 1284 HiPatchService.exe RegAsm.exe PID 1284 wrote to memory of 1036 1284 HiPatchService.exe RegAsm.exe PID 1284 wrote to memory of 1036 1284 HiPatchService.exe RegAsm.exe PID 1284 wrote to memory of 1036 1284 HiPatchService.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4138bf828e5c36e6d955c250d8395d588004dab4d45d8b21ba7f6056a02622e3_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4138bf828e5c36e6d955c250d8395d588004dab4d45d8b21ba7f6056a02622e3_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.exe"C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:1044
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Windows\SysWOW64\timeout.exetimeout /t 1803⤵
- Delays execution with timeout.exe
PID:1984
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:5080
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
213B
MD50955cb4b691d44b37f8b6fad48a33b8e
SHA19dae759ae014cc124ab6eed7c8035788c124ae4a
SHA2569092dbb1ca1767d1966b7f79349dd95a802a68248251bf070c0f1d74d5681d71
SHA51208b868a028c1e8d29ed643416850df16f58d44668f9193b46bd3934965e5617a0a4015fc52815c5456023dbde01023450d295b76d936a936f26b602e764b0235
-
Filesize
265KB
MD58d4ed5fe154e9af3e08e4ce377ae7440
SHA178ab92f720162391c3c79d00ea04eed550247675
SHA2561379eb274538c555b72313e84f8cb6fe36205ef00a1455647effa3ee10186ec9
SHA51209c90a384aaad62e6cb707f336ed79670e1dfc1783f610f2dc4c3991126aafeed8c5a8938b4365b92919bf2e68e391371f2fe66152c93146b3f3973286cb3edb