Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 04:42
Behavioral task
behavioral1
Sample
36242437e320f84fe54895b1727d6a9c2e9c00b43f5683f79321288abeadf5e5_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
36242437e320f84fe54895b1727d6a9c2e9c00b43f5683f79321288abeadf5e5_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
36242437e320f84fe54895b1727d6a9c2e9c00b43f5683f79321288abeadf5e5_NeikiAnalytics.exe
-
Size
3.9MB
-
MD5
7ba417399e0bfc1365bdf53dac0aad80
-
SHA1
11a789dd26e9cc92f1f67b1ec48233f53199c8aa
-
SHA256
36242437e320f84fe54895b1727d6a9c2e9c00b43f5683f79321288abeadf5e5
-
SHA512
a033f021b7e661496f7bf7dc840549defb9f2ad25ef8cb2a2cff34dbee70cf22dc9fbd212b9c937ba0541ecefff37e996946491945bd96e0f197fadbc60a5b30
-
SSDEEP
98304:alX3KMj7yBNUVPhd5G0Z5DxdM3hZpmBAlB6D4tyX6kuT4IkQApCgvms0Cv05J5CF:alX3KMj7yBNUVPhd5G0Z5DxdM3hZpmBF
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Soundcrd.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate Soundcrd.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
36242437e320f84fe54895b1727d6a9c2e9c00b43f5683f79321288abeadf5e5_NeikiAnalytics.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 36242437e320f84fe54895b1727d6a9c2e9c00b43f5683f79321288abeadf5e5_NeikiAnalytics.exe -
Executes dropped EXE 3 IoCs
Processes:
Soundcrd.exeSoundcrd.exeSoundcrd.exepid process 3636 Soundcrd.exe 1152 Soundcrd.exe 3040 Soundcrd.exe -
Processes:
resource yara_rule behavioral2/memory/2848-1-0x0000000000400000-0x00000000007EC000-memory.dmp upx C:\Users\Admin\AppData\Roaming\Soundcrd.txt upx behavioral2/memory/2848-28-0x0000000000400000-0x00000000007EC000-memory.dmp upx behavioral2/memory/1152-31-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1152-34-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3040-36-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/3040-39-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/3040-41-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/1152-35-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1152-49-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1152-48-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1152-46-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1152-45-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3636-47-0x0000000000400000-0x00000000007EC000-memory.dmp upx behavioral2/memory/1152-42-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3040-51-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/1152-50-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1152-54-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1152-58-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1152-62-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1152-66-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1152-70-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1152-74-0x0000000000400000-0x00000000004B5000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Mcrosoftt = "C:\\Users\\Admin\\AppData\\Roaming\\Soundcrd.exe" reg.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
Soundcrd.exedescription pid process target process PID 3636 set thread context of 1152 3636 Soundcrd.exe Soundcrd.exe PID 3636 set thread context of 3040 3636 Soundcrd.exe Soundcrd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
Soundcrd.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Soundcrd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Soundcrd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier Soundcrd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier Soundcrd.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
Soundcrd.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Soundcrd.exe -
Suspicious use of AdjustPrivilegeToken 25 IoCs
Processes:
Soundcrd.exeSoundcrd.exedescription pid process Token: SeIncreaseQuotaPrivilege 1152 Soundcrd.exe Token: SeSecurityPrivilege 1152 Soundcrd.exe Token: SeTakeOwnershipPrivilege 1152 Soundcrd.exe Token: SeLoadDriverPrivilege 1152 Soundcrd.exe Token: SeSystemProfilePrivilege 1152 Soundcrd.exe Token: SeSystemtimePrivilege 1152 Soundcrd.exe Token: SeProfSingleProcessPrivilege 1152 Soundcrd.exe Token: SeIncBasePriorityPrivilege 1152 Soundcrd.exe Token: SeCreatePagefilePrivilege 1152 Soundcrd.exe Token: SeBackupPrivilege 1152 Soundcrd.exe Token: SeRestorePrivilege 1152 Soundcrd.exe Token: SeShutdownPrivilege 1152 Soundcrd.exe Token: SeDebugPrivilege 1152 Soundcrd.exe Token: SeSystemEnvironmentPrivilege 1152 Soundcrd.exe Token: SeChangeNotifyPrivilege 1152 Soundcrd.exe Token: SeRemoteShutdownPrivilege 1152 Soundcrd.exe Token: SeUndockPrivilege 1152 Soundcrd.exe Token: SeManageVolumePrivilege 1152 Soundcrd.exe Token: SeImpersonatePrivilege 1152 Soundcrd.exe Token: SeCreateGlobalPrivilege 1152 Soundcrd.exe Token: 33 1152 Soundcrd.exe Token: 34 1152 Soundcrd.exe Token: 35 1152 Soundcrd.exe Token: 36 1152 Soundcrd.exe Token: SeDebugPrivilege 3040 Soundcrd.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
36242437e320f84fe54895b1727d6a9c2e9c00b43f5683f79321288abeadf5e5_NeikiAnalytics.exeSoundcrd.exeSoundcrd.exepid process 2848 36242437e320f84fe54895b1727d6a9c2e9c00b43f5683f79321288abeadf5e5_NeikiAnalytics.exe 3636 Soundcrd.exe 3040 Soundcrd.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
36242437e320f84fe54895b1727d6a9c2e9c00b43f5683f79321288abeadf5e5_NeikiAnalytics.execmd.exeSoundcrd.exedescription pid process target process PID 2848 wrote to memory of 4272 2848 36242437e320f84fe54895b1727d6a9c2e9c00b43f5683f79321288abeadf5e5_NeikiAnalytics.exe cmd.exe PID 2848 wrote to memory of 4272 2848 36242437e320f84fe54895b1727d6a9c2e9c00b43f5683f79321288abeadf5e5_NeikiAnalytics.exe cmd.exe PID 2848 wrote to memory of 4272 2848 36242437e320f84fe54895b1727d6a9c2e9c00b43f5683f79321288abeadf5e5_NeikiAnalytics.exe cmd.exe PID 4272 wrote to memory of 2548 4272 cmd.exe reg.exe PID 4272 wrote to memory of 2548 4272 cmd.exe reg.exe PID 4272 wrote to memory of 2548 4272 cmd.exe reg.exe PID 2848 wrote to memory of 3636 2848 36242437e320f84fe54895b1727d6a9c2e9c00b43f5683f79321288abeadf5e5_NeikiAnalytics.exe Soundcrd.exe PID 2848 wrote to memory of 3636 2848 36242437e320f84fe54895b1727d6a9c2e9c00b43f5683f79321288abeadf5e5_NeikiAnalytics.exe Soundcrd.exe PID 2848 wrote to memory of 3636 2848 36242437e320f84fe54895b1727d6a9c2e9c00b43f5683f79321288abeadf5e5_NeikiAnalytics.exe Soundcrd.exe PID 3636 wrote to memory of 1152 3636 Soundcrd.exe Soundcrd.exe PID 3636 wrote to memory of 1152 3636 Soundcrd.exe Soundcrd.exe PID 3636 wrote to memory of 1152 3636 Soundcrd.exe Soundcrd.exe PID 3636 wrote to memory of 1152 3636 Soundcrd.exe Soundcrd.exe PID 3636 wrote to memory of 1152 3636 Soundcrd.exe Soundcrd.exe PID 3636 wrote to memory of 1152 3636 Soundcrd.exe Soundcrd.exe PID 3636 wrote to memory of 1152 3636 Soundcrd.exe Soundcrd.exe PID 3636 wrote to memory of 1152 3636 Soundcrd.exe Soundcrd.exe PID 3636 wrote to memory of 3040 3636 Soundcrd.exe Soundcrd.exe PID 3636 wrote to memory of 3040 3636 Soundcrd.exe Soundcrd.exe PID 3636 wrote to memory of 3040 3636 Soundcrd.exe Soundcrd.exe PID 3636 wrote to memory of 3040 3636 Soundcrd.exe Soundcrd.exe PID 3636 wrote to memory of 3040 3636 Soundcrd.exe Soundcrd.exe PID 3636 wrote to memory of 3040 3636 Soundcrd.exe Soundcrd.exe PID 3636 wrote to memory of 3040 3636 Soundcrd.exe Soundcrd.exe PID 3636 wrote to memory of 3040 3636 Soundcrd.exe Soundcrd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\36242437e320f84fe54895b1727d6a9c2e9c00b43f5683f79321288abeadf5e5_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\36242437e320f84fe54895b1727d6a9c2e9c00b43f5683f79321288abeadf5e5_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NleHG.bat" "2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Mcrosoftt" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Soundcrd.exe" /f3⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\Soundcrd.exe"C:\Users\Admin\AppData\Roaming\Soundcrd.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Soundcrd.exeC:\Users\Admin\AppData\Roaming\Soundcrd.exe3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Soundcrd.exeC:\Users\Admin\AppData\Roaming\Soundcrd.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\NleHG.txtFilesize
139B
MD5173bcce4810d4901872d0ef4f0bfea4e
SHA1561b03fdfe68b6419fddf57f32e1aab9a6126a2f
SHA25610ea37eceabbe80fe9814280b66b957636951dbeeed18a9b4d50a1d24a6f1d1d
SHA5122401e0a5e3f7bf590a0767449da2249d09717e8c1cb71a7475e81d9615580001cfc38705cd1a5b4edc33f7df043bf195e28e4a5442a32bc879dffc6473bd545e
-
C:\Users\Admin\AppData\Roaming\Soundcrd.txtFilesize
3.9MB
MD545c15a459d747d88fb1149b9cda78b0a
SHA1d5a2deeeb1b3a2fc298f3310a70dddf3d80f7ea0
SHA2561f3b5a2df00fbf46917c24e2eedba3a06b75b020aa5da340be26a097a5d167e3
SHA5128808266e0f7838bde579d286d2c981ea60f506163763a9d18f63a3ef3b0930fce92b7c07e40335e5febc92ce974852c009fee9ac6c091e9c168d3b6e896c5ebd
-
memory/1152-54-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1152-35-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1152-45-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1152-34-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1152-46-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1152-70-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1152-66-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1152-50-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1152-62-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1152-48-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1152-74-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1152-31-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1152-49-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1152-42-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1152-58-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2848-1-0x0000000000400000-0x00000000007EC000-memory.dmpFilesize
3.9MB
-
memory/2848-28-0x0000000000400000-0x00000000007EC000-memory.dmpFilesize
3.9MB
-
memory/3040-51-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3040-41-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3040-39-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3040-36-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3636-47-0x0000000000400000-0x00000000007EC000-memory.dmpFilesize
3.9MB