4fc456bf20d685a3680a4471535217d0ab1307514c146fe781b0a9e191c7d462

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 11:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4fc456bf20d685a3680a4471535217d0ab1307514c146fe781b0a9e191c7d462_NeikiAnalytics.dll
Size

230KB
MD5

008b7b70837fa1de0234d894f8b06a70
SHA1

2f61df95a15c2cd123187846088ffc480a3738cc
SHA256

4fc456bf20d685a3680a4471535217d0ab1307514c146fe781b0a9e191c7d462
SHA512

c7a5880f880fd00bad40504a47f67664410b1913a43e0b60000307a56bd46a9227ca7c6034c057c1d4cd74e1bca774d7bafe120efa9b7a2e3dc6d00f5408d6fa
SSDEEP

6144:xXt6uOzx9iJvuR5pJ/N7pLG0Kw4DZiUmxokr5cCEjActhc57:ptPgiJuRTJ1BUfiU5kr5EMahQ

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 2 IoCs
Detects executables packed with VMProtect commercial packer.
vmprotect

Processes:

resource yara_rule

behavioral2/memory/2576-2-0x0000000010000000-0x000000001007B000-memory.dmp vmprotect
behavioral2/memory/2576-0-0x0000000010000000-0x000000001007B000-memory.dmp vmprotect

resource	yara_rule
behavioral2/memory/2576-2-0x0000000010000000-0x000000001007B000-memory.dmp	vmprotect
behavioral2/memory/2576-0-0x0000000010000000-0x000000001007B000-memory.dmp	vmprotect

Modifies registry class 51 IoCs

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7BCA6879-A9F8-47DE-AE05-F5CE7EA3A474}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}\ProgID\ = "OverlayIcon.QQQMIcon.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ADF1FA2A-6EAA-4A97-A55F-3C8B92843EF5}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OverlayIcon.QQQMIcon\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ADF1FA2A-6EAA-4A97-A55F-3C8B92843EF5}\1.0\ = "OverlayIcon 1.0 Type Library"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OverlayIcon.QQQMIcon\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OverlayIcon.QQQMIcon\CLSID\ = "{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}\AppID = "{FA8EDCDD-EFA2-477B-B00A-7F28F02CD37E}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7BCA6879-A9F8-47DE-AE05-F5CE7EA3A474}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7BCA6879-A9F8-47DE-AE05-F5CE7EA3A474}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7BCA6879-A9F8-47DE-AE05-F5CE7EA3A474}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{FA8EDCDD-EFA2-477B-B00A-7F28F02CD37E}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7BCA6879-A9F8-47DE-AE05-F5CE7EA3A474}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OverlayIcon.QQQMIcon\CurVer\ = "OverlayIcon.QQQMIcon.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7BCA6879-A9F8-47DE-AE05-F5CE7EA3A474}\ = "IMyOverlayIcon"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OverlayIcon.QQQMIcon.1\ = "QQQMIcon Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ADF1FA2A-6EAA-4A97-A55F-3C8B92843EF5}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\4fc456bf20d685a3680a4471535217d0ab1307514c146fe781b0a9e191c7d462_NeikiAnalytics.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ADF1FA2A-6EAA-4A97-A55F-3C8B92843EF5}\1.0\HELPDIR\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7BCA6879-A9F8-47DE-AE05-F5CE7EA3A474}\ = "IMyOverlayIcon"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7BCA6879-A9F8-47DE-AE05-F5CE7EA3A474}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OverlayIcon.QQQMIcon\ = "QQQMIcon Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OverlayIcon.QQQMIcon	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}\VersionIndependentProgID\ = "OverlayIcon.QQQMIcon"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\OverlayIcon.DLL\AppID = "{FA8EDCDD-EFA2-477B-B00A-7F28F02CD37E}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ADF1FA2A-6EAA-4A97-A55F-3C8B92843EF5}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7BCA6879-A9F8-47DE-AE05-F5CE7EA3A474}\TypeLib\ = "{ADF1FA2A-6EAA-4A97-A55F-3C8B92843EF5}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7BCA6879-A9F8-47DE-AE05-F5CE7EA3A474}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7BCA6879-A9F8-47DE-AE05-F5CE7EA3A474}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}\ = "QQQMIcon Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}\TypeLib\ = "{ADF1FA2A-6EAA-4A97-A55F-3C8B92843EF5}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ADF1FA2A-6EAA-4A97-A55F-3C8B92843EF5}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ADF1FA2A-6EAA-4A97-A55F-3C8B92843EF5}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ADF1FA2A-6EAA-4A97-A55F-3C8B92843EF5}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7BCA6879-A9F8-47DE-AE05-F5CE7EA3A474}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OverlayIcon.QQQMIcon.1\CLSID\ = "{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\4fc456bf20d685a3680a4471535217d0ab1307514c146fe781b0a9e191c7d462_NeikiAnalytics.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7BCA6879-A9F8-47DE-AE05-F5CE7EA3A474}\TypeLib\ = "{ADF1FA2A-6EAA-4A97-A55F-3C8B92843EF5}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7BCA6879-A9F8-47DE-AE05-F5CE7EA3A474}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OverlayIcon.QQQMIcon.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\OverlayIcon.DLL	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ADF1FA2A-6EAA-4A97-A55F-3C8B92843EF5}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ADF1FA2A-6EAA-4A97-A55F-3C8B92843EF5}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{FA8EDCDD-EFA2-477B-B00A-7F28F02CD37E}\ = "OverlayIcon"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OverlayIcon.QQQMIcon.1\CLSID	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1172 wrote to memory of 2576	1172	regsvr32.exe	regsvr32.exe
PID 1172 wrote to memory of 2576	1172	regsvr32.exe	regsvr32.exe
PID 1172 wrote to memory of 2576	1172	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4fc456bf20d685a3680a4471535217d0ab1307514c146fe781b0a9e191c7d462_NeikiAnalytics.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1172

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\4fc456bf20d685a3680a4471535217d0ab1307514c146fe781b0a9e191c7d462_NeikiAnalytics.dll
2⤵
- Modifies registry class
PID:2576

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2576-2-0x0000000010000000-0x000000001007B000-memory.dmp

Filesize
492KB

Download
memory/2576-0-0x0000000010000000-0x000000001007B000-memory.dmp

Filesize
492KB

Download
memory/2576-1-0x0000000010067000-0x0000000010068000-memory.dmp

Filesize
4KB

Download