Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 04:42
Behavioral task
behavioral1
Sample
36242437e320f84fe54895b1727d6a9c2e9c00b43f5683f79321288abeadf5e5_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
36242437e320f84fe54895b1727d6a9c2e9c00b43f5683f79321288abeadf5e5_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
36242437e320f84fe54895b1727d6a9c2e9c00b43f5683f79321288abeadf5e5_NeikiAnalytics.exe
-
Size
3.9MB
-
MD5
7ba417399e0bfc1365bdf53dac0aad80
-
SHA1
11a789dd26e9cc92f1f67b1ec48233f53199c8aa
-
SHA256
36242437e320f84fe54895b1727d6a9c2e9c00b43f5683f79321288abeadf5e5
-
SHA512
a033f021b7e661496f7bf7dc840549defb9f2ad25ef8cb2a2cff34dbee70cf22dc9fbd212b9c937ba0541ecefff37e996946491945bd96e0f197fadbc60a5b30
-
SSDEEP
98304:alX3KMj7yBNUVPhd5G0Z5DxdM3hZpmBAlB6D4tyX6kuT4IkQApCgvms0Cv05J5CF:alX3KMj7yBNUVPhd5G0Z5DxdM3hZpmBF
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Soundcrd.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate Soundcrd.exe -
Executes dropped EXE 3 IoCs
Processes:
Soundcrd.exeSoundcrd.exeSoundcrd.exepid process 1280 Soundcrd.exe 2480 Soundcrd.exe 2540 Soundcrd.exe -
Loads dropped DLL 7 IoCs
Processes:
36242437e320f84fe54895b1727d6a9c2e9c00b43f5683f79321288abeadf5e5_NeikiAnalytics.exeSoundcrd.exepid process 2756 36242437e320f84fe54895b1727d6a9c2e9c00b43f5683f79321288abeadf5e5_NeikiAnalytics.exe 2756 36242437e320f84fe54895b1727d6a9c2e9c00b43f5683f79321288abeadf5e5_NeikiAnalytics.exe 2756 36242437e320f84fe54895b1727d6a9c2e9c00b43f5683f79321288abeadf5e5_NeikiAnalytics.exe 2756 36242437e320f84fe54895b1727d6a9c2e9c00b43f5683f79321288abeadf5e5_NeikiAnalytics.exe 2756 36242437e320f84fe54895b1727d6a9c2e9c00b43f5683f79321288abeadf5e5_NeikiAnalytics.exe 1280 Soundcrd.exe 1280 Soundcrd.exe -
Processes:
resource yara_rule behavioral1/memory/2756-0-0x0000000000400000-0x00000000007EC000-memory.dmp upx C:\Users\Admin\AppData\Roaming\Soundcrd.exe upx behavioral1/memory/1280-45-0x0000000000400000-0x00000000007EC000-memory.dmp upx behavioral1/memory/2756-44-0x0000000000400000-0x00000000007EC000-memory.dmp upx behavioral1/memory/2480-54-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2480-52-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2480-50-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2540-63-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/1280-62-0x0000000000400000-0x00000000007EC000-memory.dmp upx behavioral1/memory/2480-59-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2540-58-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/2480-57-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/1280-56-0x0000000002C70000-0x000000000305C000-memory.dmp upx behavioral1/memory/2480-55-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2480-69-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2480-68-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2480-65-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2540-64-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/2540-71-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/2480-70-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2480-73-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2480-76-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2480-78-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2480-80-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2480-82-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2480-86-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2480-88-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2480-92-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2480-94-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2480-98-0x0000000000400000-0x00000000004B5000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\Mcrosoftt = "C:\\Users\\Admin\\AppData\\Roaming\\Soundcrd.exe" reg.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
Soundcrd.exedescription pid process target process PID 1280 set thread context of 2480 1280 Soundcrd.exe Soundcrd.exe PID 1280 set thread context of 2540 1280 Soundcrd.exe Soundcrd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
Soundcrd.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Soundcrd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Soundcrd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier Soundcrd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier Soundcrd.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
Soundcrd.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Soundcrd.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
Soundcrd.exeSoundcrd.exedescription pid process Token: SeIncreaseQuotaPrivilege 2480 Soundcrd.exe Token: SeSecurityPrivilege 2480 Soundcrd.exe Token: SeTakeOwnershipPrivilege 2480 Soundcrd.exe Token: SeLoadDriverPrivilege 2480 Soundcrd.exe Token: SeSystemProfilePrivilege 2480 Soundcrd.exe Token: SeSystemtimePrivilege 2480 Soundcrd.exe Token: SeProfSingleProcessPrivilege 2480 Soundcrd.exe Token: SeIncBasePriorityPrivilege 2480 Soundcrd.exe Token: SeCreatePagefilePrivilege 2480 Soundcrd.exe Token: SeBackupPrivilege 2480 Soundcrd.exe Token: SeRestorePrivilege 2480 Soundcrd.exe Token: SeShutdownPrivilege 2480 Soundcrd.exe Token: SeDebugPrivilege 2480 Soundcrd.exe Token: SeSystemEnvironmentPrivilege 2480 Soundcrd.exe Token: SeChangeNotifyPrivilege 2480 Soundcrd.exe Token: SeRemoteShutdownPrivilege 2480 Soundcrd.exe Token: SeUndockPrivilege 2480 Soundcrd.exe Token: SeManageVolumePrivilege 2480 Soundcrd.exe Token: SeImpersonatePrivilege 2480 Soundcrd.exe Token: SeCreateGlobalPrivilege 2480 Soundcrd.exe Token: 33 2480 Soundcrd.exe Token: 34 2480 Soundcrd.exe Token: 35 2480 Soundcrd.exe Token: SeDebugPrivilege 2540 Soundcrd.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
36242437e320f84fe54895b1727d6a9c2e9c00b43f5683f79321288abeadf5e5_NeikiAnalytics.exeSoundcrd.exeSoundcrd.exepid process 2756 36242437e320f84fe54895b1727d6a9c2e9c00b43f5683f79321288abeadf5e5_NeikiAnalytics.exe 1280 Soundcrd.exe 2540 Soundcrd.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
36242437e320f84fe54895b1727d6a9c2e9c00b43f5683f79321288abeadf5e5_NeikiAnalytics.execmd.exeSoundcrd.exedescription pid process target process PID 2756 wrote to memory of 2692 2756 36242437e320f84fe54895b1727d6a9c2e9c00b43f5683f79321288abeadf5e5_NeikiAnalytics.exe cmd.exe PID 2756 wrote to memory of 2692 2756 36242437e320f84fe54895b1727d6a9c2e9c00b43f5683f79321288abeadf5e5_NeikiAnalytics.exe cmd.exe PID 2756 wrote to memory of 2692 2756 36242437e320f84fe54895b1727d6a9c2e9c00b43f5683f79321288abeadf5e5_NeikiAnalytics.exe cmd.exe PID 2756 wrote to memory of 2692 2756 36242437e320f84fe54895b1727d6a9c2e9c00b43f5683f79321288abeadf5e5_NeikiAnalytics.exe cmd.exe PID 2692 wrote to memory of 2484 2692 cmd.exe reg.exe PID 2692 wrote to memory of 2484 2692 cmd.exe reg.exe PID 2692 wrote to memory of 2484 2692 cmd.exe reg.exe PID 2692 wrote to memory of 2484 2692 cmd.exe reg.exe PID 2756 wrote to memory of 1280 2756 36242437e320f84fe54895b1727d6a9c2e9c00b43f5683f79321288abeadf5e5_NeikiAnalytics.exe Soundcrd.exe PID 2756 wrote to memory of 1280 2756 36242437e320f84fe54895b1727d6a9c2e9c00b43f5683f79321288abeadf5e5_NeikiAnalytics.exe Soundcrd.exe PID 2756 wrote to memory of 1280 2756 36242437e320f84fe54895b1727d6a9c2e9c00b43f5683f79321288abeadf5e5_NeikiAnalytics.exe Soundcrd.exe PID 2756 wrote to memory of 1280 2756 36242437e320f84fe54895b1727d6a9c2e9c00b43f5683f79321288abeadf5e5_NeikiAnalytics.exe Soundcrd.exe PID 1280 wrote to memory of 2480 1280 Soundcrd.exe Soundcrd.exe PID 1280 wrote to memory of 2480 1280 Soundcrd.exe Soundcrd.exe PID 1280 wrote to memory of 2480 1280 Soundcrd.exe Soundcrd.exe PID 1280 wrote to memory of 2480 1280 Soundcrd.exe Soundcrd.exe PID 1280 wrote to memory of 2480 1280 Soundcrd.exe Soundcrd.exe PID 1280 wrote to memory of 2480 1280 Soundcrd.exe Soundcrd.exe PID 1280 wrote to memory of 2480 1280 Soundcrd.exe Soundcrd.exe PID 1280 wrote to memory of 2480 1280 Soundcrd.exe Soundcrd.exe PID 1280 wrote to memory of 2480 1280 Soundcrd.exe Soundcrd.exe PID 1280 wrote to memory of 2540 1280 Soundcrd.exe Soundcrd.exe PID 1280 wrote to memory of 2540 1280 Soundcrd.exe Soundcrd.exe PID 1280 wrote to memory of 2540 1280 Soundcrd.exe Soundcrd.exe PID 1280 wrote to memory of 2540 1280 Soundcrd.exe Soundcrd.exe PID 1280 wrote to memory of 2540 1280 Soundcrd.exe Soundcrd.exe PID 1280 wrote to memory of 2540 1280 Soundcrd.exe Soundcrd.exe PID 1280 wrote to memory of 2540 1280 Soundcrd.exe Soundcrd.exe PID 1280 wrote to memory of 2540 1280 Soundcrd.exe Soundcrd.exe PID 1280 wrote to memory of 2540 1280 Soundcrd.exe Soundcrd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\36242437e320f84fe54895b1727d6a9c2e9c00b43f5683f79321288abeadf5e5_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\36242437e320f84fe54895b1727d6a9c2e9c00b43f5683f79321288abeadf5e5_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\ZhEUa.bat" "2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Mcrosoftt" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Soundcrd.exe" /f3⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\Soundcrd.exe"C:\Users\Admin\AppData\Roaming\Soundcrd.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Soundcrd.exeC:\Users\Admin\AppData\Roaming\Soundcrd.exe3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Soundcrd.exeC:\Users\Admin\AppData\Roaming\Soundcrd.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ZhEUa.batFilesize
139B
MD5173bcce4810d4901872d0ef4f0bfea4e
SHA1561b03fdfe68b6419fddf57f32e1aab9a6126a2f
SHA25610ea37eceabbe80fe9814280b66b957636951dbeeed18a9b4d50a1d24a6f1d1d
SHA5122401e0a5e3f7bf590a0767449da2249d09717e8c1cb71a7475e81d9615580001cfc38705cd1a5b4edc33f7df043bf195e28e4a5442a32bc879dffc6473bd545e
-
C:\Users\Admin\AppData\Roaming\Soundcrd.exeFilesize
3.9MB
MD54c577110894db4073f8cdaefb2dba737
SHA17a7dc16335b5e4d4a2d4c22d71dc2f029bb6f5e8
SHA256f869f01390e05c0f30cf2518493fe71ada8998d9e1dc3234133db8de57bb750c
SHA51243bd3ec26584d3fc2f7862789a1cb30a88190ed98c2fe7a71a082410d4972246e11312596b10620f7f326f5e3dc6ea3bf476103f9b7af89bf917b3eafc6d15a1
-
memory/1280-62-0x0000000000400000-0x00000000007EC000-memory.dmpFilesize
3.9MB
-
memory/1280-56-0x0000000002C70000-0x000000000305C000-memory.dmpFilesize
3.9MB
-
memory/1280-45-0x0000000000400000-0x00000000007EC000-memory.dmpFilesize
3.9MB
-
memory/2480-69-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2480-76-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2480-52-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2480-50-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2480-98-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2480-94-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2480-59-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2480-92-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2480-57-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2480-88-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2480-55-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2480-86-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2480-68-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2480-65-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2480-82-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2480-80-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2480-70-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2480-78-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2480-73-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2480-54-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2540-71-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2540-64-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2540-58-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2540-63-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2756-72-0x00000000039B0000-0x0000000003D9C000-memory.dmpFilesize
3.9MB
-
memory/2756-0-0x0000000000400000-0x00000000007EC000-memory.dmpFilesize
3.9MB
-
memory/2756-43-0x00000000039B0000-0x0000000003D9C000-memory.dmpFilesize
3.9MB
-
memory/2756-44-0x0000000000400000-0x00000000007EC000-memory.dmpFilesize
3.9MB