Analysis
-
max time kernel
146s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29-06-2024 13:39
Static task
static1
Behavioral task
behavioral1
Sample
adb6f2c6600b62f753a9a0a10f93d391d8a9262303b88e7ae143eeabe71e5839_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
adb6f2c6600b62f753a9a0a10f93d391d8a9262303b88e7ae143eeabe71e5839_NeikiAnalytics.exe
-
Size
280KB
-
MD5
bed05b2e649232a1a5c0dfe131917740
-
SHA1
16891a3e909a77451d34e541fdb5bc3d1460125c
-
SHA256
adb6f2c6600b62f753a9a0a10f93d391d8a9262303b88e7ae143eeabe71e5839
-
SHA512
eec074cdb9864fb74c28be7de186c2ef3ce5c51b25c967ef467d1b764986f613542d7ff623f6cda491630b201d6f0361f1cd94e3cbb346398bb80880fa1f25c5
-
SSDEEP
6144:boy5p178U0MURaGyNXYWQzHazRfXrwSRnWwhrQ66fKkfg:boSeGUA5YZazpXUmZhZ6SF
Malware Config
Extracted
nanocore
1.2.2.0
sysupdate24.ddns.net:45400
ae82ab7f-db07-49ee-9d2b-76075d76f37f
-
activate_away_mode
true
- backup_connection_host
- backup_dns_server
-
buffer_size
65535
-
build_time
2020-04-24T17:41:53.492468936Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
45400
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
ae82ab7f-db07-49ee-9d2b-76075d76f37f
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
sysupdate24.ddns.net
- primary_dns_server
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
a1punf5t2of.exea1punf5t2of.exepid process 2544 a1punf5t2of.exe 2908 a1punf5t2of.exe -
Loads dropped DLL 2 IoCs
Processes:
adb6f2c6600b62f753a9a0a10f93d391d8a9262303b88e7ae143eeabe71e5839_NeikiAnalytics.exea1punf5t2of.exepid process 2964 adb6f2c6600b62f753a9a0a10f93d391d8a9262303b88e7ae143eeabe71e5839_NeikiAnalytics.exe 2544 a1punf5t2of.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
adb6f2c6600b62f753a9a0a10f93d391d8a9262303b88e7ae143eeabe71e5839_NeikiAnalytics.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\b1b2dqljdx3 = "C:\\Users\\Admin\\AppData\\Roaming\\b1b2dqljdx3\\a1punf5t2of.exe" adb6f2c6600b62f753a9a0a10f93d391d8a9262303b88e7ae143eeabe71e5839_NeikiAnalytics.exe -
Processes:
a1punf5t2of.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA a1punf5t2of.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
a1punf5t2of.exedescription pid process target process PID 2544 set thread context of 2908 2544 a1punf5t2of.exe a1punf5t2of.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
a1punf5t2of.exepid process 2908 a1punf5t2of.exe 2908 a1punf5t2of.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
a1punf5t2of.exepid process 2908 a1punf5t2of.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
a1punf5t2of.exedescription pid process Token: SeDebugPrivilege 2908 a1punf5t2of.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
adb6f2c6600b62f753a9a0a10f93d391d8a9262303b88e7ae143eeabe71e5839_NeikiAnalytics.exea1punf5t2of.exedescription pid process target process PID 2964 wrote to memory of 2544 2964 adb6f2c6600b62f753a9a0a10f93d391d8a9262303b88e7ae143eeabe71e5839_NeikiAnalytics.exe a1punf5t2of.exe PID 2964 wrote to memory of 2544 2964 adb6f2c6600b62f753a9a0a10f93d391d8a9262303b88e7ae143eeabe71e5839_NeikiAnalytics.exe a1punf5t2of.exe PID 2964 wrote to memory of 2544 2964 adb6f2c6600b62f753a9a0a10f93d391d8a9262303b88e7ae143eeabe71e5839_NeikiAnalytics.exe a1punf5t2of.exe PID 2964 wrote to memory of 2544 2964 adb6f2c6600b62f753a9a0a10f93d391d8a9262303b88e7ae143eeabe71e5839_NeikiAnalytics.exe a1punf5t2of.exe PID 2964 wrote to memory of 2544 2964 adb6f2c6600b62f753a9a0a10f93d391d8a9262303b88e7ae143eeabe71e5839_NeikiAnalytics.exe a1punf5t2of.exe PID 2964 wrote to memory of 2544 2964 adb6f2c6600b62f753a9a0a10f93d391d8a9262303b88e7ae143eeabe71e5839_NeikiAnalytics.exe a1punf5t2of.exe PID 2964 wrote to memory of 2544 2964 adb6f2c6600b62f753a9a0a10f93d391d8a9262303b88e7ae143eeabe71e5839_NeikiAnalytics.exe a1punf5t2of.exe PID 2544 wrote to memory of 2908 2544 a1punf5t2of.exe a1punf5t2of.exe PID 2544 wrote to memory of 2908 2544 a1punf5t2of.exe a1punf5t2of.exe PID 2544 wrote to memory of 2908 2544 a1punf5t2of.exe a1punf5t2of.exe PID 2544 wrote to memory of 2908 2544 a1punf5t2of.exe a1punf5t2of.exe PID 2544 wrote to memory of 2908 2544 a1punf5t2of.exe a1punf5t2of.exe PID 2544 wrote to memory of 2908 2544 a1punf5t2of.exe a1punf5t2of.exe PID 2544 wrote to memory of 2908 2544 a1punf5t2of.exe a1punf5t2of.exe PID 2544 wrote to memory of 2908 2544 a1punf5t2of.exe a1punf5t2of.exe PID 2544 wrote to memory of 2908 2544 a1punf5t2of.exe a1punf5t2of.exe PID 2544 wrote to memory of 2908 2544 a1punf5t2of.exe a1punf5t2of.exe PID 2544 wrote to memory of 2908 2544 a1punf5t2of.exe a1punf5t2of.exe PID 2544 wrote to memory of 2908 2544 a1punf5t2of.exe a1punf5t2of.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\adb6f2c6600b62f753a9a0a10f93d391d8a9262303b88e7ae143eeabe71e5839_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\adb6f2c6600b62f753a9a0a10f93d391d8a9262303b88e7ae143eeabe71e5839_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe"C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe"C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe"3⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exeFilesize
280KB
MD5885338813f038bc3afda5c61c0cd5ca1
SHA16dd5c84feae0d256093bd39a01a273438636513f
SHA256f83562fd5f25e2f86d17e205984bd569007fc9bd7a037eca973ef43adcadd608
SHA5126777d3c33fca72030fdd0aa7f05549165443c5dfd1b4c39e451f9b6e19bd1caf82918a0540db8375b618da9c8e535fb1e9658c9f6958d5f2098cf5e84c95797d
-
memory/2544-13-0x0000000074D50000-0x00000000752FB000-memory.dmpFilesize
5.7MB
-
memory/2544-14-0x0000000074D50000-0x00000000752FB000-memory.dmpFilesize
5.7MB
-
memory/2544-34-0x0000000074D50000-0x00000000752FB000-memory.dmpFilesize
5.7MB
-
memory/2544-35-0x0000000074D50000-0x00000000752FB000-memory.dmpFilesize
5.7MB
-
memory/2544-15-0x0000000074D50000-0x00000000752FB000-memory.dmpFilesize
5.7MB
-
memory/2908-25-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2908-32-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2908-31-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2908-26-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2908-22-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2908-19-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2908-18-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2908-17-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2964-12-0x0000000074D50000-0x00000000752FB000-memory.dmpFilesize
5.7MB
-
memory/2964-0-0x0000000074D51000-0x0000000074D52000-memory.dmpFilesize
4KB
-
memory/2964-3-0x0000000074D50000-0x00000000752FB000-memory.dmpFilesize
5.7MB
-
memory/2964-1-0x0000000074D50000-0x00000000752FB000-memory.dmpFilesize
5.7MB
-
memory/2964-2-0x0000000074D50000-0x00000000752FB000-memory.dmpFilesize
5.7MB