Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
28-06-2024 15:42
Behavioral task
behavioral1
Sample
9f230a43561047ce08b5b86de42709197f63a678e9c576fdf1d85619c4c9dfce_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
9f230a43561047ce08b5b86de42709197f63a678e9c576fdf1d85619c4c9dfce_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
General
-
Target
9f230a43561047ce08b5b86de42709197f63a678e9c576fdf1d85619c4c9dfce_NeikiAnalytics.exe
-
Size
592KB
-
MD5
31afe4b9078c5cd3b9a082ff170b7740
-
SHA1
bd880eb7227d7f88ba5b4a92922dc2bf5f124422
-
SHA256
9f230a43561047ce08b5b86de42709197f63a678e9c576fdf1d85619c4c9dfce
-
SHA512
05c66de6de4471c61933e895f483bae43a1eae99a4619174561576983fe84db43bccacb1b7b63a321719feabc675c3104ae4bd27fd9de5e3c4e2219755e95551
-
SSDEEP
12288:wcWRJxhIUKofd9S88itJsL6s8GwUF81yn0FI/6IC0XoSO:TW/xhIUKofSytJsL6HUP0OHCf
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Soundcrd.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate Soundcrd.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
9f230a43561047ce08b5b86de42709197f63a678e9c576fdf1d85619c4c9dfce_NeikiAnalytics.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation 9f230a43561047ce08b5b86de42709197f63a678e9c576fdf1d85619c4c9dfce_NeikiAnalytics.exe -
Executes dropped EXE 3 IoCs
Processes:
Soundcrd.exeSoundcrd.exeSoundcrd.exepid process 1796 Soundcrd.exe 1852 Soundcrd.exe 1444 Soundcrd.exe -
Processes:
resource yara_rule behavioral2/memory/4656-0-0x0000000000400000-0x00000000007EB000-memory.dmp upx C:\Users\Admin\AppData\Roaming\Soundcrd.txt upx behavioral2/memory/1796-28-0x0000000000400000-0x00000000007EB000-memory.dmp upx behavioral2/memory/4656-30-0x0000000000400000-0x00000000007EB000-memory.dmp upx behavioral2/memory/1852-33-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1852-35-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1852-36-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1852-37-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1852-38-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1852-39-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1852-41-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1852-43-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1444-48-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/1444-46-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/1796-52-0x0000000000400000-0x00000000007EB000-memory.dmp upx behavioral2/memory/1444-42-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/1852-40-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1852-53-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1444-54-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/1852-57-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1852-61-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1852-65-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1852-69-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1852-73-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1852-77-0x0000000000400000-0x00000000004B5000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Mcrosoftt = "C:\\Users\\Admin\\AppData\\Roaming\\Soundcrd.exe" reg.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
Soundcrd.exedescription pid process target process PID 1796 set thread context of 1852 1796 Soundcrd.exe Soundcrd.exe PID 1796 set thread context of 1444 1796 Soundcrd.exe Soundcrd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
Soundcrd.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Soundcrd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier Soundcrd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier Soundcrd.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Soundcrd.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
Soundcrd.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Soundcrd.exe -
Suspicious use of AdjustPrivilegeToken 25 IoCs
Processes:
Soundcrd.exeSoundcrd.exedescription pid process Token: SeIncreaseQuotaPrivilege 1852 Soundcrd.exe Token: SeSecurityPrivilege 1852 Soundcrd.exe Token: SeTakeOwnershipPrivilege 1852 Soundcrd.exe Token: SeLoadDriverPrivilege 1852 Soundcrd.exe Token: SeSystemProfilePrivilege 1852 Soundcrd.exe Token: SeSystemtimePrivilege 1852 Soundcrd.exe Token: SeProfSingleProcessPrivilege 1852 Soundcrd.exe Token: SeIncBasePriorityPrivilege 1852 Soundcrd.exe Token: SeCreatePagefilePrivilege 1852 Soundcrd.exe Token: SeBackupPrivilege 1852 Soundcrd.exe Token: SeRestorePrivilege 1852 Soundcrd.exe Token: SeShutdownPrivilege 1852 Soundcrd.exe Token: SeDebugPrivilege 1852 Soundcrd.exe Token: SeSystemEnvironmentPrivilege 1852 Soundcrd.exe Token: SeChangeNotifyPrivilege 1852 Soundcrd.exe Token: SeRemoteShutdownPrivilege 1852 Soundcrd.exe Token: SeUndockPrivilege 1852 Soundcrd.exe Token: SeManageVolumePrivilege 1852 Soundcrd.exe Token: SeImpersonatePrivilege 1852 Soundcrd.exe Token: SeCreateGlobalPrivilege 1852 Soundcrd.exe Token: 33 1852 Soundcrd.exe Token: 34 1852 Soundcrd.exe Token: 35 1852 Soundcrd.exe Token: 36 1852 Soundcrd.exe Token: SeDebugPrivilege 1444 Soundcrd.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
9f230a43561047ce08b5b86de42709197f63a678e9c576fdf1d85619c4c9dfce_NeikiAnalytics.exeSoundcrd.exeSoundcrd.exepid process 4656 9f230a43561047ce08b5b86de42709197f63a678e9c576fdf1d85619c4c9dfce_NeikiAnalytics.exe 1796 Soundcrd.exe 1444 Soundcrd.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
9f230a43561047ce08b5b86de42709197f63a678e9c576fdf1d85619c4c9dfce_NeikiAnalytics.execmd.exeSoundcrd.exedescription pid process target process PID 4656 wrote to memory of 3132 4656 9f230a43561047ce08b5b86de42709197f63a678e9c576fdf1d85619c4c9dfce_NeikiAnalytics.exe cmd.exe PID 4656 wrote to memory of 3132 4656 9f230a43561047ce08b5b86de42709197f63a678e9c576fdf1d85619c4c9dfce_NeikiAnalytics.exe cmd.exe PID 4656 wrote to memory of 3132 4656 9f230a43561047ce08b5b86de42709197f63a678e9c576fdf1d85619c4c9dfce_NeikiAnalytics.exe cmd.exe PID 3132 wrote to memory of 1784 3132 cmd.exe reg.exe PID 3132 wrote to memory of 1784 3132 cmd.exe reg.exe PID 3132 wrote to memory of 1784 3132 cmd.exe reg.exe PID 4656 wrote to memory of 1796 4656 9f230a43561047ce08b5b86de42709197f63a678e9c576fdf1d85619c4c9dfce_NeikiAnalytics.exe Soundcrd.exe PID 4656 wrote to memory of 1796 4656 9f230a43561047ce08b5b86de42709197f63a678e9c576fdf1d85619c4c9dfce_NeikiAnalytics.exe Soundcrd.exe PID 4656 wrote to memory of 1796 4656 9f230a43561047ce08b5b86de42709197f63a678e9c576fdf1d85619c4c9dfce_NeikiAnalytics.exe Soundcrd.exe PID 1796 wrote to memory of 1852 1796 Soundcrd.exe Soundcrd.exe PID 1796 wrote to memory of 1852 1796 Soundcrd.exe Soundcrd.exe PID 1796 wrote to memory of 1852 1796 Soundcrd.exe Soundcrd.exe PID 1796 wrote to memory of 1852 1796 Soundcrd.exe Soundcrd.exe PID 1796 wrote to memory of 1852 1796 Soundcrd.exe Soundcrd.exe PID 1796 wrote to memory of 1852 1796 Soundcrd.exe Soundcrd.exe PID 1796 wrote to memory of 1852 1796 Soundcrd.exe Soundcrd.exe PID 1796 wrote to memory of 1852 1796 Soundcrd.exe Soundcrd.exe PID 1796 wrote to memory of 1444 1796 Soundcrd.exe Soundcrd.exe PID 1796 wrote to memory of 1444 1796 Soundcrd.exe Soundcrd.exe PID 1796 wrote to memory of 1444 1796 Soundcrd.exe Soundcrd.exe PID 1796 wrote to memory of 1444 1796 Soundcrd.exe Soundcrd.exe PID 1796 wrote to memory of 1444 1796 Soundcrd.exe Soundcrd.exe PID 1796 wrote to memory of 1444 1796 Soundcrd.exe Soundcrd.exe PID 1796 wrote to memory of 1444 1796 Soundcrd.exe Soundcrd.exe PID 1796 wrote to memory of 1444 1796 Soundcrd.exe Soundcrd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9f230a43561047ce08b5b86de42709197f63a678e9c576fdf1d85619c4c9dfce_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\9f230a43561047ce08b5b86de42709197f63a678e9c576fdf1d85619c4c9dfce_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gpore.bat" "2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Mcrosoftt" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Soundcrd.exe" /f3⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\Soundcrd.exe"C:\Users\Admin\AppData\Roaming\Soundcrd.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Soundcrd.exeC:\Users\Admin\AppData\Roaming\Soundcrd.exe3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Soundcrd.exeC:\Users\Admin\AppData\Roaming\Soundcrd.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\gpore.txtFilesize
139B
MD5173bcce4810d4901872d0ef4f0bfea4e
SHA1561b03fdfe68b6419fddf57f32e1aab9a6126a2f
SHA25610ea37eceabbe80fe9814280b66b957636951dbeeed18a9b4d50a1d24a6f1d1d
SHA5122401e0a5e3f7bf590a0767449da2249d09717e8c1cb71a7475e81d9615580001cfc38705cd1a5b4edc33f7df043bf195e28e4a5442a32bc879dffc6473bd545e
-
C:\Users\Admin\AppData\Roaming\Soundcrd.txtFilesize
592KB
MD54dcf2726b84a030451afb26b9ed4f432
SHA1352e034198aa1907af30b06dab271cff0a9250f9
SHA256aa6403fc00d06de5ef3f73b8a9ff0292761d76159f6aac19bd9b7e43e60cab4f
SHA51214b3bc371ef4cbb50214faf6a9b2f3145a45badf0de58ec37e921e2b779d71628fa1bf051896327db7798f40fa2220be807fa3d9e98e598f49f40d8a2650f814
-
memory/1444-48-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1444-54-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1444-42-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1444-46-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1796-28-0x0000000000400000-0x00000000007EB000-memory.dmpFilesize
3.9MB
-
memory/1796-52-0x0000000000400000-0x00000000007EB000-memory.dmpFilesize
3.9MB
-
memory/1852-43-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1852-40-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1852-39-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1852-41-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1852-77-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1852-37-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1852-36-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1852-35-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1852-33-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1852-38-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1852-53-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1852-73-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1852-57-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1852-61-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1852-65-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1852-69-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/4656-30-0x0000000000400000-0x00000000007EB000-memory.dmpFilesize
3.9MB
-
memory/4656-0-0x0000000000400000-0x00000000007EB000-memory.dmpFilesize
3.9MB