Analysis
-
max time kernel
148s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 06:00
Static task
static1
Behavioral task
behavioral1
Sample
3a854a86cb00b76c36b5c41e2d8e1f08a8f12ab98c2105690d78e3c65b717e8f_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
3a854a86cb00b76c36b5c41e2d8e1f08a8f12ab98c2105690d78e3c65b717e8f_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
General
-
Target
3a854a86cb00b76c36b5c41e2d8e1f08a8f12ab98c2105690d78e3c65b717e8f_NeikiAnalytics.exe
-
Size
266KB
-
MD5
77a611fd524d39d270036a0d8a8bce30
-
SHA1
680368e32a8696085d3c83ab13fce90aa6a22e3b
-
SHA256
3a854a86cb00b76c36b5c41e2d8e1f08a8f12ab98c2105690d78e3c65b717e8f
-
SHA512
86bd7fc3f5cc6b270630928a5d73301688ad61ffe91238f96699eadd840f60f28af3d2d4bd80fe7a1da88fe9e5268ba3640db1d4535b575c38faf9ee61c0d08e
-
SSDEEP
3072:WdvzDqxs8ORikgogWfiuRXd3YmSffdTKXNXANewGBvskX1pWA/sc:WFzDqa86hV6uRRqX1evPlwAEc
Malware Config
Signatures
-
Contains code to disable Windows Defender 5 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Processes:
resource yara_rule behavioral1/memory/2836-35-0x0000000000400000-0x0000000000430000-memory.dmp disable_win_def behavioral1/memory/2836-36-0x0000000000400000-0x0000000000430000-memory.dmp disable_win_def behavioral1/memory/2836-31-0x0000000000400000-0x0000000000430000-memory.dmp disable_win_def behavioral1/memory/2836-34-0x0000000000400000-0x0000000000430000-memory.dmp disable_win_def behavioral1/memory/2836-30-0x0000000000400000-0x0000000000430000-memory.dmp disable_win_def -
Executes dropped EXE 1 IoCs
Processes:
HiPatchService.exepid process 2600 HiPatchService.exe -
Loads dropped DLL 1 IoCs
Processes:
3a854a86cb00b76c36b5c41e2d8e1f08a8f12ab98c2105690d78e3c65b717e8f_NeikiAnalytics.exepid process 2424 3a854a86cb00b76c36b5c41e2d8e1f08a8f12ab98c2105690d78e3c65b717e8f_NeikiAnalytics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
3a854a86cb00b76c36b5c41e2d8e1f08a8f12ab98c2105690d78e3c65b717e8f_NeikiAnalytics.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\HiPatch = "C:\\Users\\Admin\\AppData\\Roaming\\HiPatch\\HiPatchService.exe" 3a854a86cb00b76c36b5c41e2d8e1f08a8f12ab98c2105690d78e3c65b717e8f_NeikiAnalytics.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
HiPatchService.exedescription pid process target process PID 2600 set thread context of 2836 2600 HiPatchService.exe RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
RegAsm.exepid process 2836 RegAsm.exe 2836 RegAsm.exe 2836 RegAsm.exe 2836 RegAsm.exe 2836 RegAsm.exe 2836 RegAsm.exe 2836 RegAsm.exe 2836 RegAsm.exe 2836 RegAsm.exe 2836 RegAsm.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
3a854a86cb00b76c36b5c41e2d8e1f08a8f12ab98c2105690d78e3c65b717e8f_NeikiAnalytics.exeHiPatchService.exedescription pid process target process PID 2424 wrote to memory of 2600 2424 3a854a86cb00b76c36b5c41e2d8e1f08a8f12ab98c2105690d78e3c65b717e8f_NeikiAnalytics.exe HiPatchService.exe PID 2424 wrote to memory of 2600 2424 3a854a86cb00b76c36b5c41e2d8e1f08a8f12ab98c2105690d78e3c65b717e8f_NeikiAnalytics.exe HiPatchService.exe PID 2424 wrote to memory of 2600 2424 3a854a86cb00b76c36b5c41e2d8e1f08a8f12ab98c2105690d78e3c65b717e8f_NeikiAnalytics.exe HiPatchService.exe PID 2424 wrote to memory of 2600 2424 3a854a86cb00b76c36b5c41e2d8e1f08a8f12ab98c2105690d78e3c65b717e8f_NeikiAnalytics.exe HiPatchService.exe PID 2424 wrote to memory of 2600 2424 3a854a86cb00b76c36b5c41e2d8e1f08a8f12ab98c2105690d78e3c65b717e8f_NeikiAnalytics.exe HiPatchService.exe PID 2424 wrote to memory of 2600 2424 3a854a86cb00b76c36b5c41e2d8e1f08a8f12ab98c2105690d78e3c65b717e8f_NeikiAnalytics.exe HiPatchService.exe PID 2424 wrote to memory of 2600 2424 3a854a86cb00b76c36b5c41e2d8e1f08a8f12ab98c2105690d78e3c65b717e8f_NeikiAnalytics.exe HiPatchService.exe PID 2424 wrote to memory of 2768 2424 3a854a86cb00b76c36b5c41e2d8e1f08a8f12ab98c2105690d78e3c65b717e8f_NeikiAnalytics.exe cmd.exe PID 2424 wrote to memory of 2768 2424 3a854a86cb00b76c36b5c41e2d8e1f08a8f12ab98c2105690d78e3c65b717e8f_NeikiAnalytics.exe cmd.exe PID 2424 wrote to memory of 2768 2424 3a854a86cb00b76c36b5c41e2d8e1f08a8f12ab98c2105690d78e3c65b717e8f_NeikiAnalytics.exe cmd.exe PID 2424 wrote to memory of 2768 2424 3a854a86cb00b76c36b5c41e2d8e1f08a8f12ab98c2105690d78e3c65b717e8f_NeikiAnalytics.exe cmd.exe PID 2424 wrote to memory of 2768 2424 3a854a86cb00b76c36b5c41e2d8e1f08a8f12ab98c2105690d78e3c65b717e8f_NeikiAnalytics.exe cmd.exe PID 2424 wrote to memory of 2768 2424 3a854a86cb00b76c36b5c41e2d8e1f08a8f12ab98c2105690d78e3c65b717e8f_NeikiAnalytics.exe cmd.exe PID 2424 wrote to memory of 2768 2424 3a854a86cb00b76c36b5c41e2d8e1f08a8f12ab98c2105690d78e3c65b717e8f_NeikiAnalytics.exe cmd.exe PID 2600 wrote to memory of 2836 2600 HiPatchService.exe RegAsm.exe PID 2600 wrote to memory of 2836 2600 HiPatchService.exe RegAsm.exe PID 2600 wrote to memory of 2836 2600 HiPatchService.exe RegAsm.exe PID 2600 wrote to memory of 2836 2600 HiPatchService.exe RegAsm.exe PID 2600 wrote to memory of 2836 2600 HiPatchService.exe RegAsm.exe PID 2600 wrote to memory of 2836 2600 HiPatchService.exe RegAsm.exe PID 2600 wrote to memory of 2836 2600 HiPatchService.exe RegAsm.exe PID 2600 wrote to memory of 2836 2600 HiPatchService.exe RegAsm.exe PID 2600 wrote to memory of 2836 2600 HiPatchService.exe RegAsm.exe PID 2600 wrote to memory of 2836 2600 HiPatchService.exe RegAsm.exe PID 2600 wrote to memory of 2836 2600 HiPatchService.exe RegAsm.exe PID 2600 wrote to memory of 2836 2600 HiPatchService.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a854a86cb00b76c36b5c41e2d8e1f08a8f12ab98c2105690d78e3c65b717e8f_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3a854a86cb00b76c36b5c41e2d8e1f08a8f12ab98c2105690d78e3c65b717e8f_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.exe"C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.bat""2⤵
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.batFilesize
213B
MD50955cb4b691d44b37f8b6fad48a33b8e
SHA19dae759ae014cc124ab6eed7c8035788c124ae4a
SHA2569092dbb1ca1767d1966b7f79349dd95a802a68248251bf070c0f1d74d5681d71
SHA51208b868a028c1e8d29ed643416850df16f58d44668f9193b46bd3934965e5617a0a4015fc52815c5456023dbde01023450d295b76d936a936f26b602e764b0235
-
\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.exeFilesize
266KB
MD59341e9d9f56a2d9006266da49a223969
SHA1e3fc88aa74debdb275372c159245ab7b228c3d79
SHA256ca0f3f8820ad31812a59739806351cf47a71eadf5b5f2fbbba787eb532091cd5
SHA5122a5ecc32068229a882ad946d3283f4d4d9d80cb186df61c6343a5392c07edfaf55bf99d6b4ffad7ebc54c0f3575c8c4581dbe24024c13b696896da5806ba9d13
-
memory/2424-0-0x0000000074A2E000-0x0000000074A2F000-memory.dmpFilesize
4KB
-
memory/2424-1-0x00000000008B0000-0x00000000008F6000-memory.dmpFilesize
280KB
-
memory/2424-2-0x00000000002F0000-0x00000000002FA000-memory.dmpFilesize
40KB
-
memory/2424-3-0x0000000074A20000-0x000000007510E000-memory.dmpFilesize
6.9MB
-
memory/2424-22-0x0000000074A20000-0x000000007510E000-memory.dmpFilesize
6.9MB
-
memory/2600-23-0x0000000074A20000-0x000000007510E000-memory.dmpFilesize
6.9MB
-
memory/2600-21-0x0000000000C70000-0x0000000000CB6000-memory.dmpFilesize
280KB
-
memory/2600-37-0x0000000074A20000-0x000000007510E000-memory.dmpFilesize
6.9MB
-
memory/2836-35-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2836-36-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2836-31-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2836-34-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2836-25-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2836-33-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2836-30-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2836-27-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB