3299a29a7eff98ce4b3c23aaee7e3438f3db068cf22bc6db110d07d26503df3a

Analysis

max time kernel
0s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 03:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3299a29a7eff98ce4b3c23aaee7e3438f3db068cf22bc6db110d07d26503df3a_NeikiAnalytics.exe
Size

1.0MB
MD5

dfbcfdfb44d9f81e32287dddf628ddc0
SHA1

2c6d169bc78f79ad9ec1017ac6284311321dddfa
SHA256

3299a29a7eff98ce4b3c23aaee7e3438f3db068cf22bc6db110d07d26503df3a
SHA512

35b196f2c60cf9f37d545fe9f36a23177fa1f1f99b4ee1b1a71bc3523b13a0dcd1ee85c99bc32bfce2bc4fb397cb1c597839cb591af7fa529ae4d5ce7f90b608
SSDEEP

24576:S6JoReh51zUXshsU9fq0rZe+QK0ltXe9/6s63mpmXaLGxcUAS+TFnk4zQ:SRu1AFUo0rI6Gu91LpmXAGKjS0N7M

Score

8^/10

bootkit persistence

Malware Config

Signatures

Downloads MZ/PE file
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

3299a29a7eff98ce4b3c23aaee7e3438f3db068cf22bc6db110d07d26503df3a_NeikiAnalytics.exe

description ioc process

File opened for modification \??\PhysicalDrive0 3299a29a7eff98ce4b3c23aaee7e3438f3db068cf22bc6db110d07d26503df3a_NeikiAnalytics.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	3299a29a7eff98ce4b3c23aaee7e3438f3db068cf22bc6db110d07d26503df3a_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\3299a29a7eff98ce4b3c23aaee7e3438f3db068cf22bc6db110d07d26503df3a_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3299a29a7eff98ce4b3c23aaee7e3438f3db068cf22bc6db110d07d26503df3a_NeikiAnalytics.exe"
1⤵
- Writes to the Master Boot Record (MBR)
PID:1408

C:\Users\Admin\AppData\Local\Temp\ludashisetup.exe
"C:\Users\Admin\AppData\Local\Temp\ludashisetup.exe" --pid="buychannel_19" /S /VerifyPhone /LOCKHP
2⤵
PID:1080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3704,i,14221647728265121051,6840906015709541562,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:8
1⤵
PID:5044

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\360Base.dll
Filesize
862KB

MD5
ab00bed7cb2b7a8290e247fc34aaa5ff

SHA1
d6014e2920d9b587a8e12ae1ba0f1e1fc9edffa8

SHA256
ceffaedc050688e8dcc11ec30b703c63fefbfcf479558604fdb0ea42bcb497c0

SHA512
fbe3bf5e142d689bb15d05503fcf5c807aad5bcb99a02dc99590589ee66f7942a0d8365d470041972212dbdf9c232ab4bbab25e79d7bcd43f001a95d9012cca6

Download Submit
C:\Users\Admin\AppData\Local\Temp\360net.dll
Filesize
274KB

MD5
48e996402b35f914dc869f8f529e2444

SHA1
fdcbf945a79ca75b0fc663d3de6ce86ca4a50d2f

SHA256
8c2a4ef1b9ac458d48b2944f90f90527f5b0650aa1107e808bf7716a8d894250

SHA512
233bad9580a906547958643befc1e2bc0707e0a39531fdb74b91212b7514d429e6dd63d589228d42ca2fea4fb3f7cbbf438f3ade94e0832bb83ee42bd6018b3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\{7A2B91E2-BA87-4afd-9566-B6731B9E460E}.tmp\NetBridge.dll
Filesize
238KB

MD5
8786d469338c30e0ba9fedfc62bd5197

SHA1
5fb12028ceae9772f938e1b98b699f0e02e32718

SHA256
beeaf8b72f7008e9adabacfcd85e32a50747a0dfb5c86802aeb973bd1f5c3d2f

SHA512
5db1e5b78e62cda81a63e8e712e720f87a7c7a539237a55a9098c076f9fb4e0b5adb83383c23657b4ccc90c117e55e3946a399cdf3d15cb94444b203d9d6c45c

Download Submit
C:\Users\Admin\AppData\Local\Temp\{F70004AB-2EF6-433d-86DA-F580E518797A}.tmp\7z.dll
Filesize
1.1MB

MD5
2706693dda10c6cc79eed24c56d4e5ef

SHA1
4f34ef1bd49273a0d260b9dab15c73eb0ccb6383

SHA256
0edad8a1af22d5b97c1f324791c86243a6ecce7b5a9d2f30415af99aba9129c3

SHA512
7e7f7ae894528587ba33b6e10999549bb9a2ec2748b5662fa1b8806e5f4ce33af47507b3ef2954f2747a76b5b7c775c1cd671061f577c5016d1f8ba165bbe21c

Download Submit
memory/1408-0-0x0000000002BB0000-0x0000000002BB1000-memory.dmp

Filesize
4KB

Download
memory/1408-36-0x0000000002BB0000-0x0000000002BB1000-memory.dmp

Filesize
4KB

Download