Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 06:00
Static task
static1
Behavioral task
behavioral1
Sample
3a854a86cb00b76c36b5c41e2d8e1f08a8f12ab98c2105690d78e3c65b717e8f_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
3a854a86cb00b76c36b5c41e2d8e1f08a8f12ab98c2105690d78e3c65b717e8f_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
General
-
Target
3a854a86cb00b76c36b5c41e2d8e1f08a8f12ab98c2105690d78e3c65b717e8f_NeikiAnalytics.exe
-
Size
266KB
-
MD5
77a611fd524d39d270036a0d8a8bce30
-
SHA1
680368e32a8696085d3c83ab13fce90aa6a22e3b
-
SHA256
3a854a86cb00b76c36b5c41e2d8e1f08a8f12ab98c2105690d78e3c65b717e8f
-
SHA512
86bd7fc3f5cc6b270630928a5d73301688ad61ffe91238f96699eadd840f60f28af3d2d4bd80fe7a1da88fe9e5268ba3640db1d4535b575c38faf9ee61c0d08e
-
SSDEEP
3072:WdvzDqxs8ORikgogWfiuRXd3YmSffdTKXNXANewGBvskX1pWA/sc:WFzDqa86hV6uRRqX1evPlwAEc
Malware Config
Signatures
-
Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Processes:
resource yara_rule behavioral2/memory/4672-29-0x0000000000400000-0x0000000000430000-memory.dmp disable_win_def -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
3a854a86cb00b76c36b5c41e2d8e1f08a8f12ab98c2105690d78e3c65b717e8f_NeikiAnalytics.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation 3a854a86cb00b76c36b5c41e2d8e1f08a8f12ab98c2105690d78e3c65b717e8f_NeikiAnalytics.exe -
Executes dropped EXE 1 IoCs
Processes:
HiPatchService.exepid process 3156 HiPatchService.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
3a854a86cb00b76c36b5c41e2d8e1f08a8f12ab98c2105690d78e3c65b717e8f_NeikiAnalytics.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HiPatch = "C:\\Users\\Admin\\AppData\\Roaming\\HiPatch\\HiPatchService.exe" 3a854a86cb00b76c36b5c41e2d8e1f08a8f12ab98c2105690d78e3c65b717e8f_NeikiAnalytics.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
HiPatchService.exedescription pid process target process PID 3156 set thread context of 4672 3156 HiPatchService.exe RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
RegAsm.exedescription ioc process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 RegAsm.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz RegAsm.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 3928 timeout.exe -
Suspicious behavior: EnumeratesProcesses 29 IoCs
Processes:
HiPatchService.exeRegAsm.exepid process 3156 HiPatchService.exe 3156 HiPatchService.exe 4672 RegAsm.exe 4672 RegAsm.exe 4672 RegAsm.exe 4672 RegAsm.exe 4672 RegAsm.exe 4672 RegAsm.exe 4672 RegAsm.exe 4672 RegAsm.exe 4672 RegAsm.exe 4672 RegAsm.exe 4672 RegAsm.exe 4672 RegAsm.exe 4672 RegAsm.exe 4672 RegAsm.exe 4672 RegAsm.exe 4672 RegAsm.exe 4672 RegAsm.exe 4672 RegAsm.exe 4672 RegAsm.exe 4672 RegAsm.exe 4672 RegAsm.exe 4672 RegAsm.exe 4672 RegAsm.exe 4672 RegAsm.exe 4672 RegAsm.exe 4672 RegAsm.exe 4672 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
HiPatchService.exedescription pid process Token: SeDebugPrivilege 3156 HiPatchService.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
3a854a86cb00b76c36b5c41e2d8e1f08a8f12ab98c2105690d78e3c65b717e8f_NeikiAnalytics.execmd.exeHiPatchService.exedescription pid process target process PID 4516 wrote to memory of 3156 4516 3a854a86cb00b76c36b5c41e2d8e1f08a8f12ab98c2105690d78e3c65b717e8f_NeikiAnalytics.exe HiPatchService.exe PID 4516 wrote to memory of 3156 4516 3a854a86cb00b76c36b5c41e2d8e1f08a8f12ab98c2105690d78e3c65b717e8f_NeikiAnalytics.exe HiPatchService.exe PID 4516 wrote to memory of 3156 4516 3a854a86cb00b76c36b5c41e2d8e1f08a8f12ab98c2105690d78e3c65b717e8f_NeikiAnalytics.exe HiPatchService.exe PID 4516 wrote to memory of 972 4516 3a854a86cb00b76c36b5c41e2d8e1f08a8f12ab98c2105690d78e3c65b717e8f_NeikiAnalytics.exe cmd.exe PID 4516 wrote to memory of 972 4516 3a854a86cb00b76c36b5c41e2d8e1f08a8f12ab98c2105690d78e3c65b717e8f_NeikiAnalytics.exe cmd.exe PID 4516 wrote to memory of 972 4516 3a854a86cb00b76c36b5c41e2d8e1f08a8f12ab98c2105690d78e3c65b717e8f_NeikiAnalytics.exe cmd.exe PID 972 wrote to memory of 3928 972 cmd.exe timeout.exe PID 972 wrote to memory of 3928 972 cmd.exe timeout.exe PID 972 wrote to memory of 3928 972 cmd.exe timeout.exe PID 3156 wrote to memory of 3400 3156 HiPatchService.exe RegAsm.exe PID 3156 wrote to memory of 3400 3156 HiPatchService.exe RegAsm.exe PID 3156 wrote to memory of 3400 3156 HiPatchService.exe RegAsm.exe PID 3156 wrote to memory of 4672 3156 HiPatchService.exe RegAsm.exe PID 3156 wrote to memory of 4672 3156 HiPatchService.exe RegAsm.exe PID 3156 wrote to memory of 4672 3156 HiPatchService.exe RegAsm.exe PID 3156 wrote to memory of 4672 3156 HiPatchService.exe RegAsm.exe PID 3156 wrote to memory of 4672 3156 HiPatchService.exe RegAsm.exe PID 3156 wrote to memory of 4672 3156 HiPatchService.exe RegAsm.exe PID 3156 wrote to memory of 4672 3156 HiPatchService.exe RegAsm.exe PID 3156 wrote to memory of 4672 3156 HiPatchService.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a854a86cb00b76c36b5c41e2d8e1f08a8f12ab98c2105690d78e3c65b717e8f_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3a854a86cb00b76c36b5c41e2d8e1f08a8f12ab98c2105690d78e3c65b717e8f_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.exe"C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout /t 1803⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4220 --field-trial-handle=2284,i,9807419199535700662,2319175108930815708,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.batFilesize
213B
MD50955cb4b691d44b37f8b6fad48a33b8e
SHA19dae759ae014cc124ab6eed7c8035788c124ae4a
SHA2569092dbb1ca1767d1966b7f79349dd95a802a68248251bf070c0f1d74d5681d71
SHA51208b868a028c1e8d29ed643416850df16f58d44668f9193b46bd3934965e5617a0a4015fc52815c5456023dbde01023450d295b76d936a936f26b602e764b0235
-
C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.exeFilesize
266KB
MD5f506c100d46b2fb913efa5c2e058a65d
SHA13c82413cf672764f26bf9a6bcef5313a2e37dcf4
SHA2560b06eb3a131398e77b0dee5834aa6fca9370e1ab2e87fc599b5abbc6c40b22a0
SHA512fca27e728d1bfc361a9dbcf3a6bbcb1a8475598519f69dd389c396cd90324903dcae0851e7157cc4b6f15d50c08ed51decea2889ada864652bb501899c84c197
-
memory/3156-31-0x0000000074A40000-0x00000000751F0000-memory.dmpFilesize
7.7MB
-
memory/3156-25-0x0000000074A40000-0x00000000751F0000-memory.dmpFilesize
7.7MB
-
memory/3156-22-0x0000000074A40000-0x00000000751F0000-memory.dmpFilesize
7.7MB
-
memory/4516-6-0x00000000058C0000-0x00000000058CA000-memory.dmpFilesize
40KB
-
memory/4516-0-0x0000000074A4E000-0x0000000074A4F000-memory.dmpFilesize
4KB
-
memory/4516-5-0x00000000058D0000-0x00000000058DA000-memory.dmpFilesize
40KB
-
memory/4516-4-0x0000000074A40000-0x00000000751F0000-memory.dmpFilesize
7.7MB
-
memory/4516-24-0x0000000074A4E000-0x0000000074A4F000-memory.dmpFilesize
4KB
-
memory/4516-3-0x0000000005910000-0x00000000059A2000-memory.dmpFilesize
584KB
-
memory/4516-2-0x0000000005E20000-0x00000000063C4000-memory.dmpFilesize
5.6MB
-
memory/4516-28-0x0000000074A40000-0x00000000751F0000-memory.dmpFilesize
7.7MB
-
memory/4516-1-0x0000000000E80000-0x0000000000EC6000-memory.dmpFilesize
280KB
-
memory/4672-29-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB