Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 04:14
Static task
static1
Behavioral task
behavioral1
Sample
3494a626c0aca2dfe5920be307bd75abb4dc958ff2cfc952a9bdfb084d616de9_NeikiAnalytics.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
3494a626c0aca2dfe5920be307bd75abb4dc958ff2cfc952a9bdfb084d616de9_NeikiAnalytics.dll
Resource
win10v2004-20240508-en
General
-
Target
3494a626c0aca2dfe5920be307bd75abb4dc958ff2cfc952a9bdfb084d616de9_NeikiAnalytics.dll
-
Size
4.8MB
-
MD5
6781bc0cb695bed5e66e297ad8e37440
-
SHA1
8eb2a9293dd631eb2405f4a45fe74be0d89d7057
-
SHA256
3494a626c0aca2dfe5920be307bd75abb4dc958ff2cfc952a9bdfb084d616de9
-
SHA512
eba4bf0f62c8fa3f4b8fefe066563cfeea5b7f3357280db18664500596a1f45e3ff8cc8b5d4eaf437fa35048814f26722cf40fa0cf377f91b417fcbae0e347ca
-
SSDEEP
98304:3GlQZHMwG1wyVVjdqyTT1K/tw4QIgrpeanq9um39JQcuh16/eXD:3GliH0TY/tzgaJMh164
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ rundll32.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion rundll32.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Wine rundll32.exe -
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
rundll32.exedescription ioc process File opened for modification \??\PhysicalDrive0 rundll32.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
rundll32.exepid process 2132 rundll32.exe -
Drops file in Windows directory 1 IoCs
Processes:
rundll32.exedescription ioc process File opened for modification C:\Windows\install23254.log rundll32.exe -
Modifies registry class 10 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{67CBE582-6325-1114-D189-12A35940} rundll32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{67CBE582-6325-1114-D189-12A35940}\ProdID = 06a3371fda08374d5c7c24651e3e0d71be2314fa rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1FED6676-3BE0-52A7-3DD7-D8AB285B} rundll32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1FED6676-3BE0-52A7-3DD7-D8AB285B}\ProdID = 71ccd3653206a0c6b29801f71e449c523375da1e rundll32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{07F742D3-890A-94B3-A3FA-7974748E}\ProdID = fa5cf35b2c01a01eac86020f20449c92a6140b3f rundll32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1FED6676-3BE0-52A7-3DD7-D8AB285B}\ProdID = 91c4339c440727e14efa5eefd479b164d3454ae9 rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8CABD853-6643-30A3-698B-FE3C41E2} rundll32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8CABD853-6643-30A3-698B-FE3C41E2}\ProdID = 1144b3632211986e9e80c6761e40e27eb78d4007 rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{07F742D3-890A-94B3-A3FA-7974748E} rundll32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{07F742D3-890A-94B3-A3FA-7974748E}\ProdID = 00930cac2a061ff128fbe2e81e82138124325d35 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
rundll32.exepid process 2132 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 1216 wrote to memory of 2132 1216 rundll32.exe rundll32.exe PID 1216 wrote to memory of 2132 1216 rundll32.exe rundll32.exe PID 1216 wrote to memory of 2132 1216 rundll32.exe rundll32.exe PID 1216 wrote to memory of 2132 1216 rundll32.exe rundll32.exe PID 1216 wrote to memory of 2132 1216 rundll32.exe rundll32.exe PID 1216 wrote to memory of 2132 1216 rundll32.exe rundll32.exe PID 1216 wrote to memory of 2132 1216 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3494a626c0aca2dfe5920be307bd75abb4dc958ff2cfc952a9bdfb084d616de9_NeikiAnalytics.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3494a626c0aca2dfe5920be307bd75abb4dc958ff2cfc952a9bdfb084d616de9_NeikiAnalytics.dll,#12⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2132-1-0x0000000010000000-0x0000000010674000-memory.dmpFilesize
6.5MB
-
memory/2132-0-0x0000000010000000-0x0000000010674000-memory.dmpFilesize
6.5MB
-
memory/2132-2-0x0000000010000000-0x0000000010674000-memory.dmpFilesize
6.5MB
-
memory/2132-3-0x0000000077E60000-0x0000000077E62000-memory.dmpFilesize
8KB
-
memory/2132-7-0x0000000010001000-0x000000001009A000-memory.dmpFilesize
612KB