572c28165b93d27a7ca5c764119c8b56a114369f0b375b3fce8c9f510872066b

General

Target

572c28165b93d27a7ca5c764119c8b56a114369f0b375b3fce8c9f510872066b_NeikiAnalytics.exe
Size

653KB
MD5

f2f31ebcdcc7a8769e4c9023e2681ef0
SHA1

0f8a5703e2a034d3af8fe6d359bd76dbad264fc5
SHA256

572c28165b93d27a7ca5c764119c8b56a114369f0b375b3fce8c9f510872066b
SHA512

3f09ba6db7c2883026f32bcde7f9ccff887fdeea981f5fcab64c31429a1028d05cdc87d35fb99a8aab7645cf08011882bfdc4b08453887159aa93cc080772226
SSDEEP

12288:JJFZqYMOaQ0q9nV/zsnK23KHVI6nodVdyMLiqyVcxwtVxgpMiuzOT6WIzmc:fFZqhOBnVyK23C6OoYMLiVcKtVx4Miur

Score

6^/10

bootkit persistence

Malware Config

Signatures

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\y:	572c28165b93d27a7ca5c764119c8b56a114369f0b375b3fce8c9f510872066b_NeikiAnalytics.exe
File opened (read-only)	\??\b:	572c28165b93d27a7ca5c764119c8b56a114369f0b375b3fce8c9f510872066b_NeikiAnalytics.exe
File opened (read-only)	\??\j:	572c28165b93d27a7ca5c764119c8b56a114369f0b375b3fce8c9f510872066b_NeikiAnalytics.exe
File opened (read-only)	\??\m:	572c28165b93d27a7ca5c764119c8b56a114369f0b375b3fce8c9f510872066b_NeikiAnalytics.exe
File opened (read-only)	\??\p:	572c28165b93d27a7ca5c764119c8b56a114369f0b375b3fce8c9f510872066b_NeikiAnalytics.exe
File opened (read-only)	\??\q:	572c28165b93d27a7ca5c764119c8b56a114369f0b375b3fce8c9f510872066b_NeikiAnalytics.exe
File opened (read-only)	\??\t:	572c28165b93d27a7ca5c764119c8b56a114369f0b375b3fce8c9f510872066b_NeikiAnalytics.exe
File opened (read-only)	\??\v:	572c28165b93d27a7ca5c764119c8b56a114369f0b375b3fce8c9f510872066b_NeikiAnalytics.exe
File opened (read-only)	\??\w:	572c28165b93d27a7ca5c764119c8b56a114369f0b375b3fce8c9f510872066b_NeikiAnalytics.exe
File opened (read-only)	\??\a:	572c28165b93d27a7ca5c764119c8b56a114369f0b375b3fce8c9f510872066b_NeikiAnalytics.exe
File opened (read-only)	\??\h:	572c28165b93d27a7ca5c764119c8b56a114369f0b375b3fce8c9f510872066b_NeikiAnalytics.exe
File opened (read-only)	\??\n:	572c28165b93d27a7ca5c764119c8b56a114369f0b375b3fce8c9f510872066b_NeikiAnalytics.exe
File opened (read-only)	\??\r:	572c28165b93d27a7ca5c764119c8b56a114369f0b375b3fce8c9f510872066b_NeikiAnalytics.exe
File opened (read-only)	\??\s:	572c28165b93d27a7ca5c764119c8b56a114369f0b375b3fce8c9f510872066b_NeikiAnalytics.exe
File opened (read-only)	\??\x:	572c28165b93d27a7ca5c764119c8b56a114369f0b375b3fce8c9f510872066b_NeikiAnalytics.exe
File opened (read-only)	\??\z:	572c28165b93d27a7ca5c764119c8b56a114369f0b375b3fce8c9f510872066b_NeikiAnalytics.exe
File opened (read-only)	\??\g:	572c28165b93d27a7ca5c764119c8b56a114369f0b375b3fce8c9f510872066b_NeikiAnalytics.exe
File opened (read-only)	\??\i:	572c28165b93d27a7ca5c764119c8b56a114369f0b375b3fce8c9f510872066b_NeikiAnalytics.exe
File opened (read-only)	\??\e:	572c28165b93d27a7ca5c764119c8b56a114369f0b375b3fce8c9f510872066b_NeikiAnalytics.exe
File opened (read-only)	\??\k:	572c28165b93d27a7ca5c764119c8b56a114369f0b375b3fce8c9f510872066b_NeikiAnalytics.exe
File opened (read-only)	\??\l:	572c28165b93d27a7ca5c764119c8b56a114369f0b375b3fce8c9f510872066b_NeikiAnalytics.exe
File opened (read-only)	\??\o:	572c28165b93d27a7ca5c764119c8b56a114369f0b375b3fce8c9f510872066b_NeikiAnalytics.exe
File opened (read-only)	\??\u:	572c28165b93d27a7ca5c764119c8b56a114369f0b375b3fce8c9f510872066b_NeikiAnalytics.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	572c28165b93d27a7ca5c764119c8b56a114369f0b375b3fce8c9f510872066b_NeikiAnalytics.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	572c28165b93d27a7ca5c764119c8b56a114369f0b375b3fce8c9f510872066b_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2200	572c28165b93d27a7ca5c764119c8b56a114369f0b375b3fce8c9f510872066b_NeikiAnalytics.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2200	572c28165b93d27a7ca5c764119c8b56a114369f0b375b3fce8c9f510872066b_NeikiAnalytics.exe
2200	572c28165b93d27a7ca5c764119c8b56a114369f0b375b3fce8c9f510872066b_NeikiAnalytics.exe
2200	572c28165b93d27a7ca5c764119c8b56a114369f0b375b3fce8c9f510872066b_NeikiAnalytics.exe
2200	572c28165b93d27a7ca5c764119c8b56a114369f0b375b3fce8c9f510872066b_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\572c28165b93d27a7ca5c764119c8b56a114369f0b375b3fce8c9f510872066b_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\572c28165b93d27a7ca5c764119c8b56a114369f0b375b3fce8c9f510872066b_NeikiAnalytics.exe"
1⤵
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2200-0-0x0000000000400000-0x0000000000597000-memory.dmp

Filesize
1.6MB

Download
memory/2200-2-0x0000000074E40000-0x0000000074E7B000-memory.dmp

Filesize
236KB

Download
memory/2200-1-0x0000000074E41000-0x0000000074E42000-memory.dmp

Filesize
4KB

Download
memory/2200-17-0x0000000000400000-0x0000000000597000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads