3299a29a7eff98ce4b3c23aaee7e3438f3db068cf22bc6db110d07d26503df3a

Analysis

max time kernel
125s
max time network
134s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 03:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3299a29a7eff98ce4b3c23aaee7e3438f3db068cf22bc6db110d07d26503df3a_NeikiAnalytics.exe
Size

1.0MB
MD5

dfbcfdfb44d9f81e32287dddf628ddc0
SHA1

2c6d169bc78f79ad9ec1017ac6284311321dddfa
SHA256

3299a29a7eff98ce4b3c23aaee7e3438f3db068cf22bc6db110d07d26503df3a
SHA512

35b196f2c60cf9f37d545fe9f36a23177fa1f1f99b4ee1b1a71bc3523b13a0dcd1ee85c99bc32bfce2bc4fb397cb1c597839cb591af7fa529ae4d5ce7f90b608
SSDEEP

24576:S6JoReh51zUXshsU9fq0rZe+QK0ltXe9/6s63mpmXaLGxcUAS+TFnk4zQ:SRu1AFUo0rI6Gu91LpmXAGKjS0N7M

Score

7^/10

bootkit persistence

Malware Config

Signatures

Loads dropped DLL 2 IoCs

Processes:

3299a29a7eff98ce4b3c23aaee7e3438f3db068cf22bc6db110d07d26503df3a_NeikiAnalytics.exe

pid process

2860 3299a29a7eff98ce4b3c23aaee7e3438f3db068cf22bc6db110d07d26503df3a_NeikiAnalytics.exe
2860 3299a29a7eff98ce4b3c23aaee7e3438f3db068cf22bc6db110d07d26503df3a_NeikiAnalytics.exe
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

3299a29a7eff98ce4b3c23aaee7e3438f3db068cf22bc6db110d07d26503df3a_NeikiAnalytics.exe

description ioc process

File opened for modification \??\PhysicalDrive0 3299a29a7eff98ce4b3c23aaee7e3438f3db068cf22bc6db110d07d26503df3a_NeikiAnalytics.exe

pid	process
2860	3299a29a7eff98ce4b3c23aaee7e3438f3db068cf22bc6db110d07d26503df3a_NeikiAnalytics.exe
2860	3299a29a7eff98ce4b3c23aaee7e3438f3db068cf22bc6db110d07d26503df3a_NeikiAnalytics.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	3299a29a7eff98ce4b3c23aaee7e3438f3db068cf22bc6db110d07d26503df3a_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\3299a29a7eff98ce4b3c23aaee7e3438f3db068cf22bc6db110d07d26503df3a_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3299a29a7eff98ce4b3c23aaee7e3438f3db068cf22bc6db110d07d26503df3a_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
PID:2860

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\360Base.dll
Filesize
862KB

MD5
ab00bed7cb2b7a8290e247fc34aaa5ff

SHA1
d6014e2920d9b587a8e12ae1ba0f1e1fc9edffa8

SHA256
ceffaedc050688e8dcc11ec30b703c63fefbfcf479558604fdb0ea42bcb497c0

SHA512
fbe3bf5e142d689bb15d05503fcf5c807aad5bcb99a02dc99590589ee66f7942a0d8365d470041972212dbdf9c232ab4bbab25e79d7bcd43f001a95d9012cca6

Download Submit
\Users\Admin\AppData\Local\Temp\360net.dll
Filesize
274KB

MD5
48e996402b35f914dc869f8f529e2444

SHA1
fdcbf945a79ca75b0fc663d3de6ce86ca4a50d2f

SHA256
8c2a4ef1b9ac458d48b2944f90f90527f5b0650aa1107e808bf7716a8d894250

SHA512
233bad9580a906547958643befc1e2bc0707e0a39531fdb74b91212b7514d429e6dd63d589228d42ca2fea4fb3f7cbbf438f3ade94e0832bb83ee42bd6018b3b

Download Submit
memory/2860-3-0x0000000000500000-0x0000000000501000-memory.dmp

Filesize
4KB

Download