Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
29-06-2024 12:26
Static task
static1
Behavioral task
behavioral1
Sample
ab5d5afea2926b81471be684fbd1010a896ae85b5aef52001fe5f340f98a1263_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
ab5d5afea2926b81471be684fbd1010a896ae85b5aef52001fe5f340f98a1263_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
ab5d5afea2926b81471be684fbd1010a896ae85b5aef52001fe5f340f98a1263_NeikiAnalytics.exe
-
Size
266KB
-
MD5
d4e7ed34298e33e0254e4c9ffec34bf0
-
SHA1
664dee42a1951d81f61d5ea1446cdbcba677df70
-
SHA256
ab5d5afea2926b81471be684fbd1010a896ae85b5aef52001fe5f340f98a1263
-
SHA512
88716f13d00040bc05a7e2393d0fb2b83b75d5346e692cc27394a31d03731156e14c9d8fa372098e557e8f700d5d6ec5a624dd1e8440156f96d8850bee9e3254
-
SSDEEP
3072:WdvzDqxs8ORikgogWfiuRXd3YmSffdTKXNXANewGBvskX1pWA/sq:WFzDqa86hV6uRRqX1evPlwAEq
Malware Config
Signatures
-
Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Processes:
resource yara_rule behavioral2/memory/2544-28-0x0000000000400000-0x0000000000430000-memory.dmp disable_win_def -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
ab5d5afea2926b81471be684fbd1010a896ae85b5aef52001fe5f340f98a1263_NeikiAnalytics.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation ab5d5afea2926b81471be684fbd1010a896ae85b5aef52001fe5f340f98a1263_NeikiAnalytics.exe -
Executes dropped EXE 1 IoCs
Processes:
HiPatchService.exepid process 2588 HiPatchService.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
ab5d5afea2926b81471be684fbd1010a896ae85b5aef52001fe5f340f98a1263_NeikiAnalytics.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HiPatch = "C:\\Users\\Admin\\AppData\\Roaming\\HiPatch\\HiPatchService.exe" ab5d5afea2926b81471be684fbd1010a896ae85b5aef52001fe5f340f98a1263_NeikiAnalytics.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
HiPatchService.exedescription pid process target process PID 2588 set thread context of 2544 2588 HiPatchService.exe RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
RegAsm.exedescription ioc process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 RegAsm.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz RegAsm.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 732 timeout.exe -
Suspicious behavior: EnumeratesProcesses 28 IoCs
Processes:
HiPatchService.exeRegAsm.exepid process 2588 HiPatchService.exe 2588 HiPatchService.exe 2588 HiPatchService.exe 2588 HiPatchService.exe 2544 RegAsm.exe 2544 RegAsm.exe 2544 RegAsm.exe 2544 RegAsm.exe 2544 RegAsm.exe 2544 RegAsm.exe 2544 RegAsm.exe 2544 RegAsm.exe 2544 RegAsm.exe 2544 RegAsm.exe 2544 RegAsm.exe 2544 RegAsm.exe 2544 RegAsm.exe 2544 RegAsm.exe 2544 RegAsm.exe 2544 RegAsm.exe 2544 RegAsm.exe 2544 RegAsm.exe 2544 RegAsm.exe 2544 RegAsm.exe 2544 RegAsm.exe 2544 RegAsm.exe 2544 RegAsm.exe 2544 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
HiPatchService.exedescription pid process Token: SeDebugPrivilege 2588 HiPatchService.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
ab5d5afea2926b81471be684fbd1010a896ae85b5aef52001fe5f340f98a1263_NeikiAnalytics.execmd.exeHiPatchService.exedescription pid process target process PID 2472 wrote to memory of 2588 2472 ab5d5afea2926b81471be684fbd1010a896ae85b5aef52001fe5f340f98a1263_NeikiAnalytics.exe HiPatchService.exe PID 2472 wrote to memory of 2588 2472 ab5d5afea2926b81471be684fbd1010a896ae85b5aef52001fe5f340f98a1263_NeikiAnalytics.exe HiPatchService.exe PID 2472 wrote to memory of 2588 2472 ab5d5afea2926b81471be684fbd1010a896ae85b5aef52001fe5f340f98a1263_NeikiAnalytics.exe HiPatchService.exe PID 2472 wrote to memory of 2012 2472 ab5d5afea2926b81471be684fbd1010a896ae85b5aef52001fe5f340f98a1263_NeikiAnalytics.exe cmd.exe PID 2472 wrote to memory of 2012 2472 ab5d5afea2926b81471be684fbd1010a896ae85b5aef52001fe5f340f98a1263_NeikiAnalytics.exe cmd.exe PID 2472 wrote to memory of 2012 2472 ab5d5afea2926b81471be684fbd1010a896ae85b5aef52001fe5f340f98a1263_NeikiAnalytics.exe cmd.exe PID 2012 wrote to memory of 732 2012 cmd.exe timeout.exe PID 2012 wrote to memory of 732 2012 cmd.exe timeout.exe PID 2012 wrote to memory of 732 2012 cmd.exe timeout.exe PID 2588 wrote to memory of 3964 2588 HiPatchService.exe RegAsm.exe PID 2588 wrote to memory of 3964 2588 HiPatchService.exe RegAsm.exe PID 2588 wrote to memory of 3964 2588 HiPatchService.exe RegAsm.exe PID 2588 wrote to memory of 1620 2588 HiPatchService.exe RegAsm.exe PID 2588 wrote to memory of 1620 2588 HiPatchService.exe RegAsm.exe PID 2588 wrote to memory of 1620 2588 HiPatchService.exe RegAsm.exe PID 2588 wrote to memory of 2544 2588 HiPatchService.exe RegAsm.exe PID 2588 wrote to memory of 2544 2588 HiPatchService.exe RegAsm.exe PID 2588 wrote to memory of 2544 2588 HiPatchService.exe RegAsm.exe PID 2588 wrote to memory of 2544 2588 HiPatchService.exe RegAsm.exe PID 2588 wrote to memory of 2544 2588 HiPatchService.exe RegAsm.exe PID 2588 wrote to memory of 2544 2588 HiPatchService.exe RegAsm.exe PID 2588 wrote to memory of 2544 2588 HiPatchService.exe RegAsm.exe PID 2588 wrote to memory of 2544 2588 HiPatchService.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ab5d5afea2926b81471be684fbd1010a896ae85b5aef52001fe5f340f98a1263_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\ab5d5afea2926b81471be684fbd1010a896ae85b5aef52001fe5f340f98a1263_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.exe"C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:3964
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:1620
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Windows\SysWOW64\timeout.exetimeout /t 1803⤵
- Delays execution with timeout.exe
PID:732
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:2896
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
213B
MD50955cb4b691d44b37f8b6fad48a33b8e
SHA19dae759ae014cc124ab6eed7c8035788c124ae4a
SHA2569092dbb1ca1767d1966b7f79349dd95a802a68248251bf070c0f1d74d5681d71
SHA51208b868a028c1e8d29ed643416850df16f58d44668f9193b46bd3934965e5617a0a4015fc52815c5456023dbde01023450d295b76d936a936f26b602e764b0235
-
Filesize
266KB
MD5378091b9af12a92c5f197be1b29db0ce
SHA14c778d62986c509bde168ba2fc3b91b360cd6e72
SHA256b176ee93508edb423b6ff8cda4ac56daa9c7161d64a9064a1c90913b66eb0211
SHA512e089e316ea848b1b91d8c3004c27c6244c39c4f8cc992971f196c1d14ebc4e53bcded38b1635e6cb7aa6798f32cf444f82375bf1ef36f6a4be9e68ac77e053af