Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 04:14
Static task
static1
Behavioral task
behavioral1
Sample
3494a626c0aca2dfe5920be307bd75abb4dc958ff2cfc952a9bdfb084d616de9_NeikiAnalytics.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
3494a626c0aca2dfe5920be307bd75abb4dc958ff2cfc952a9bdfb084d616de9_NeikiAnalytics.dll
Resource
win10v2004-20240508-en
General
-
Target
3494a626c0aca2dfe5920be307bd75abb4dc958ff2cfc952a9bdfb084d616de9_NeikiAnalytics.dll
-
Size
4.8MB
-
MD5
6781bc0cb695bed5e66e297ad8e37440
-
SHA1
8eb2a9293dd631eb2405f4a45fe74be0d89d7057
-
SHA256
3494a626c0aca2dfe5920be307bd75abb4dc958ff2cfc952a9bdfb084d616de9
-
SHA512
eba4bf0f62c8fa3f4b8fefe066563cfeea5b7f3357280db18664500596a1f45e3ff8cc8b5d4eaf437fa35048814f26722cf40fa0cf377f91b417fcbae0e347ca
-
SSDEEP
98304:3GlQZHMwG1wyVVjdqyTT1K/tw4QIgrpeanq9um39JQcuh16/eXD:3GliH0TY/tzgaJMh164
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ rundll32.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion rundll32.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Wine rundll32.exe -
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
rundll32.exedescription ioc process File opened for modification \??\PhysicalDrive0 rundll32.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
rundll32.exepid process 1440 rundll32.exe -
Drops file in Windows directory 1 IoCs
Processes:
rundll32.exedescription ioc process File opened for modification C:\Windows\install23254.log rundll32.exe -
Modifies registry class 10 IoCs
Processes:
rundll32.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8CABD853-6643-30A3-698B-FE3C41E2}\ProdID = 11c4b46bfa007d7a8680b4a2c6bfb082d79d5737 rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{07F742D3-890A-94B3-A3FA-7974748E} rundll32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FED6676-3BE0-52A7-3DD7-D8AB285B}\ProdID = 6db4d3729c11f180ccabfdc0c868f0846b9eda52 rundll32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{07F742D3-890A-94B3-A3FA-7974748E}\ProdID = 2ef7ed33d40fd17cc429013dc868d070ae5b1403 rundll32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{67CBE582-6325-1114-D189-12A35940}\ProdID = 4e39722ffaf84445747c1b5d363e2e71ee8762ea rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8CABD853-6643-30A3-698B-FE3C41E2} rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FED6676-3BE0-52A7-3DD7-D8AB285B} rundll32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FED6676-3BE0-52A7-3DD7-D8AB285B}\ProdID = 71b3a375e6efe582d855d9c216191e837b18025f rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{67CBE582-6325-1114-D189-12A35940} rundll32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{07F742D3-890A-94B3-A3FA-7974748E}\ProdID = 500912c40209ae7cb0fbe63cb636c16c5c3b1679 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 1440 rundll32.exe 1440 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 672 wrote to memory of 1440 672 rundll32.exe rundll32.exe PID 672 wrote to memory of 1440 672 rundll32.exe rundll32.exe PID 672 wrote to memory of 1440 672 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3494a626c0aca2dfe5920be307bd75abb4dc958ff2cfc952a9bdfb084d616de9_NeikiAnalytics.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3494a626c0aca2dfe5920be307bd75abb4dc958ff2cfc952a9bdfb084d616de9_NeikiAnalytics.dll,#12⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1440-0-0x0000000010000000-0x0000000010674000-memory.dmpFilesize
6.5MB
-
memory/1440-1-0x0000000077574000-0x0000000077576000-memory.dmpFilesize
8KB
-
memory/1440-14-0x0000000003880000-0x0000000003881000-memory.dmpFilesize
4KB
-
memory/1440-13-0x00000000038B0000-0x00000000038B1000-memory.dmpFilesize
4KB
-
memory/1440-12-0x00000000038C0000-0x00000000038C1000-memory.dmpFilesize
4KB
-
memory/1440-11-0x00000000038A0000-0x00000000038A1000-memory.dmpFilesize
4KB
-
memory/1440-10-0x00000000038D0000-0x00000000038D1000-memory.dmpFilesize
4KB
-
memory/1440-9-0x0000000003830000-0x0000000003831000-memory.dmpFilesize
4KB
-
memory/1440-8-0x0000000003890000-0x0000000003891000-memory.dmpFilesize
4KB
-
memory/1440-7-0x0000000003850000-0x0000000003851000-memory.dmpFilesize
4KB
-
memory/1440-6-0x0000000003860000-0x0000000003861000-memory.dmpFilesize
4KB
-
memory/1440-5-0x0000000010001000-0x000000001009A000-memory.dmpFilesize
612KB