Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
28-06-2024 15:42
Behavioral task
behavioral1
Sample
9f230a43561047ce08b5b86de42709197f63a678e9c576fdf1d85619c4c9dfce_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
9f230a43561047ce08b5b86de42709197f63a678e9c576fdf1d85619c4c9dfce_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
General
-
Target
9f230a43561047ce08b5b86de42709197f63a678e9c576fdf1d85619c4c9dfce_NeikiAnalytics.exe
-
Size
592KB
-
MD5
31afe4b9078c5cd3b9a082ff170b7740
-
SHA1
bd880eb7227d7f88ba5b4a92922dc2bf5f124422
-
SHA256
9f230a43561047ce08b5b86de42709197f63a678e9c576fdf1d85619c4c9dfce
-
SHA512
05c66de6de4471c61933e895f483bae43a1eae99a4619174561576983fe84db43bccacb1b7b63a321719feabc675c3104ae4bd27fd9de5e3c4e2219755e95551
-
SSDEEP
12288:wcWRJxhIUKofd9S88itJsL6s8GwUF81yn0FI/6IC0XoSO:TW/xhIUKofSytJsL6HUP0OHCf
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Soundcrd.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate Soundcrd.exe -
Executes dropped EXE 3 IoCs
Processes:
Soundcrd.exeSoundcrd.exeSoundcrd.exepid process 2728 Soundcrd.exe 2492 Soundcrd.exe 2368 Soundcrd.exe -
Loads dropped DLL 6 IoCs
Processes:
9f230a43561047ce08b5b86de42709197f63a678e9c576fdf1d85619c4c9dfce_NeikiAnalytics.exeSoundcrd.exepid process 1612 9f230a43561047ce08b5b86de42709197f63a678e9c576fdf1d85619c4c9dfce_NeikiAnalytics.exe 1612 9f230a43561047ce08b5b86de42709197f63a678e9c576fdf1d85619c4c9dfce_NeikiAnalytics.exe 1612 9f230a43561047ce08b5b86de42709197f63a678e9c576fdf1d85619c4c9dfce_NeikiAnalytics.exe 1612 9f230a43561047ce08b5b86de42709197f63a678e9c576fdf1d85619c4c9dfce_NeikiAnalytics.exe 1612 9f230a43561047ce08b5b86de42709197f63a678e9c576fdf1d85619c4c9dfce_NeikiAnalytics.exe 2728 Soundcrd.exe -
Processes:
resource yara_rule behavioral1/memory/1612-0-0x0000000000400000-0x00000000007EB000-memory.dmp upx C:\Users\Admin\AppData\Roaming\Soundcrd.exe upx behavioral1/memory/1612-42-0x0000000003A20000-0x0000000003E0B000-memory.dmp upx behavioral1/memory/2728-49-0x0000000000400000-0x00000000007EB000-memory.dmp upx behavioral1/memory/1612-48-0x0000000000400000-0x00000000007EB000-memory.dmp upx behavioral1/memory/2492-54-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2492-56-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2492-57-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2492-58-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2368-60-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/2492-61-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2728-63-0x0000000000400000-0x00000000007EB000-memory.dmp upx behavioral1/memory/2492-59-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2368-64-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/2368-65-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/2492-68-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2492-69-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2492-70-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2492-71-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2368-72-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/2492-73-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2492-76-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2492-80-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2492-82-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2492-86-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2492-88-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2492-92-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2492-94-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2492-98-0x0000000000400000-0x00000000004B5000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\Mcrosoftt = "C:\\Users\\Admin\\AppData\\Roaming\\Soundcrd.exe" reg.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
Soundcrd.exedescription pid process target process PID 2728 set thread context of 2492 2728 Soundcrd.exe Soundcrd.exe PID 2728 set thread context of 2368 2728 Soundcrd.exe Soundcrd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
Soundcrd.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier Soundcrd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier Soundcrd.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Soundcrd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Soundcrd.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
Soundcrd.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Soundcrd.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
Soundcrd.exeSoundcrd.exedescription pid process Token: SeDebugPrivilege 2368 Soundcrd.exe Token: SeIncreaseQuotaPrivilege 2492 Soundcrd.exe Token: SeSecurityPrivilege 2492 Soundcrd.exe Token: SeTakeOwnershipPrivilege 2492 Soundcrd.exe Token: SeLoadDriverPrivilege 2492 Soundcrd.exe Token: SeSystemProfilePrivilege 2492 Soundcrd.exe Token: SeSystemtimePrivilege 2492 Soundcrd.exe Token: SeProfSingleProcessPrivilege 2492 Soundcrd.exe Token: SeIncBasePriorityPrivilege 2492 Soundcrd.exe Token: SeCreatePagefilePrivilege 2492 Soundcrd.exe Token: SeBackupPrivilege 2492 Soundcrd.exe Token: SeRestorePrivilege 2492 Soundcrd.exe Token: SeShutdownPrivilege 2492 Soundcrd.exe Token: SeDebugPrivilege 2492 Soundcrd.exe Token: SeSystemEnvironmentPrivilege 2492 Soundcrd.exe Token: SeChangeNotifyPrivilege 2492 Soundcrd.exe Token: SeRemoteShutdownPrivilege 2492 Soundcrd.exe Token: SeUndockPrivilege 2492 Soundcrd.exe Token: SeManageVolumePrivilege 2492 Soundcrd.exe Token: SeImpersonatePrivilege 2492 Soundcrd.exe Token: SeCreateGlobalPrivilege 2492 Soundcrd.exe Token: 33 2492 Soundcrd.exe Token: 34 2492 Soundcrd.exe Token: 35 2492 Soundcrd.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
9f230a43561047ce08b5b86de42709197f63a678e9c576fdf1d85619c4c9dfce_NeikiAnalytics.exeSoundcrd.exeSoundcrd.exepid process 1612 9f230a43561047ce08b5b86de42709197f63a678e9c576fdf1d85619c4c9dfce_NeikiAnalytics.exe 2728 Soundcrd.exe 2368 Soundcrd.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
9f230a43561047ce08b5b86de42709197f63a678e9c576fdf1d85619c4c9dfce_NeikiAnalytics.execmd.exeSoundcrd.exedescription pid process target process PID 1612 wrote to memory of 2592 1612 9f230a43561047ce08b5b86de42709197f63a678e9c576fdf1d85619c4c9dfce_NeikiAnalytics.exe cmd.exe PID 1612 wrote to memory of 2592 1612 9f230a43561047ce08b5b86de42709197f63a678e9c576fdf1d85619c4c9dfce_NeikiAnalytics.exe cmd.exe PID 1612 wrote to memory of 2592 1612 9f230a43561047ce08b5b86de42709197f63a678e9c576fdf1d85619c4c9dfce_NeikiAnalytics.exe cmd.exe PID 1612 wrote to memory of 2592 1612 9f230a43561047ce08b5b86de42709197f63a678e9c576fdf1d85619c4c9dfce_NeikiAnalytics.exe cmd.exe PID 2592 wrote to memory of 2540 2592 cmd.exe reg.exe PID 2592 wrote to memory of 2540 2592 cmd.exe reg.exe PID 2592 wrote to memory of 2540 2592 cmd.exe reg.exe PID 2592 wrote to memory of 2540 2592 cmd.exe reg.exe PID 1612 wrote to memory of 2728 1612 9f230a43561047ce08b5b86de42709197f63a678e9c576fdf1d85619c4c9dfce_NeikiAnalytics.exe Soundcrd.exe PID 1612 wrote to memory of 2728 1612 9f230a43561047ce08b5b86de42709197f63a678e9c576fdf1d85619c4c9dfce_NeikiAnalytics.exe Soundcrd.exe PID 1612 wrote to memory of 2728 1612 9f230a43561047ce08b5b86de42709197f63a678e9c576fdf1d85619c4c9dfce_NeikiAnalytics.exe Soundcrd.exe PID 1612 wrote to memory of 2728 1612 9f230a43561047ce08b5b86de42709197f63a678e9c576fdf1d85619c4c9dfce_NeikiAnalytics.exe Soundcrd.exe PID 2728 wrote to memory of 2492 2728 Soundcrd.exe Soundcrd.exe PID 2728 wrote to memory of 2492 2728 Soundcrd.exe Soundcrd.exe PID 2728 wrote to memory of 2492 2728 Soundcrd.exe Soundcrd.exe PID 2728 wrote to memory of 2492 2728 Soundcrd.exe Soundcrd.exe PID 2728 wrote to memory of 2492 2728 Soundcrd.exe Soundcrd.exe PID 2728 wrote to memory of 2492 2728 Soundcrd.exe Soundcrd.exe PID 2728 wrote to memory of 2492 2728 Soundcrd.exe Soundcrd.exe PID 2728 wrote to memory of 2492 2728 Soundcrd.exe Soundcrd.exe PID 2728 wrote to memory of 2492 2728 Soundcrd.exe Soundcrd.exe PID 2728 wrote to memory of 2368 2728 Soundcrd.exe Soundcrd.exe PID 2728 wrote to memory of 2368 2728 Soundcrd.exe Soundcrd.exe PID 2728 wrote to memory of 2368 2728 Soundcrd.exe Soundcrd.exe PID 2728 wrote to memory of 2368 2728 Soundcrd.exe Soundcrd.exe PID 2728 wrote to memory of 2368 2728 Soundcrd.exe Soundcrd.exe PID 2728 wrote to memory of 2368 2728 Soundcrd.exe Soundcrd.exe PID 2728 wrote to memory of 2368 2728 Soundcrd.exe Soundcrd.exe PID 2728 wrote to memory of 2368 2728 Soundcrd.exe Soundcrd.exe PID 2728 wrote to memory of 2368 2728 Soundcrd.exe Soundcrd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9f230a43561047ce08b5b86de42709197f63a678e9c576fdf1d85619c4c9dfce_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\9f230a43561047ce08b5b86de42709197f63a678e9c576fdf1d85619c4c9dfce_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\Tnrel.bat" "2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Mcrosoftt" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Soundcrd.exe" /f3⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\Soundcrd.exe"C:\Users\Admin\AppData\Roaming\Soundcrd.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Soundcrd.exeC:\Users\Admin\AppData\Roaming\Soundcrd.exe3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Soundcrd.exeC:\Users\Admin\AppData\Roaming\Soundcrd.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Tnrel.batFilesize
139B
MD5173bcce4810d4901872d0ef4f0bfea4e
SHA1561b03fdfe68b6419fddf57f32e1aab9a6126a2f
SHA25610ea37eceabbe80fe9814280b66b957636951dbeeed18a9b4d50a1d24a6f1d1d
SHA5122401e0a5e3f7bf590a0767449da2249d09717e8c1cb71a7475e81d9615580001cfc38705cd1a5b4edc33f7df043bf195e28e4a5442a32bc879dffc6473bd545e
-
C:\Users\Admin\AppData\Roaming\Soundcrd.exeFilesize
592KB
MD510824184206d1bc9622da0a2357df62a
SHA13a5992b5b1cf544d0799b55989ea92de18e6c17e
SHA256c2b2b404074f82ea41755c861da2761e308292fd4aa4db164d74a7a1fb7e351a
SHA5123f4d70fd5d6170ca4652c88c208078f3edb5e9caee2aab97919c00d51e5139b8de2630fb61eac07fdb28c7f3fde2d8b53ce32d1c9ab7bf59c1cef4d818e532aa
-
memory/1612-43-0x0000000003A20000-0x0000000003E0B000-memory.dmpFilesize
3.9MB
-
memory/1612-42-0x0000000003A20000-0x0000000003E0B000-memory.dmpFilesize
3.9MB
-
memory/1612-48-0x0000000000400000-0x00000000007EB000-memory.dmpFilesize
3.9MB
-
memory/1612-45-0x0000000003A20000-0x0000000003E0B000-memory.dmpFilesize
3.9MB
-
memory/1612-44-0x0000000003A20000-0x0000000003E0B000-memory.dmpFilesize
3.9MB
-
memory/1612-0-0x0000000000400000-0x00000000007EB000-memory.dmpFilesize
3.9MB
-
memory/2368-60-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2368-72-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2368-65-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2368-64-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2492-59-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2492-86-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2492-61-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2492-98-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2492-57-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2492-56-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2492-54-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2492-68-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2492-69-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2492-70-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2492-71-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2492-94-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2492-73-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2492-76-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2492-80-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2492-82-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2492-58-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2492-88-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2492-92-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2728-49-0x0000000000400000-0x00000000007EB000-memory.dmpFilesize
3.9MB
-
memory/2728-63-0x0000000000400000-0x00000000007EB000-memory.dmpFilesize
3.9MB