Analysis
-
max time kernel
146s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 14:03
Behavioral task
behavioral1
Sample
5726570822f2e9e7dfc387a67129fa4c76876869b403342aed4021b9bd36f030_NeikiAnalytics.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
5726570822f2e9e7dfc387a67129fa4c76876869b403342aed4021b9bd36f030_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
5726570822f2e9e7dfc387a67129fa4c76876869b403342aed4021b9bd36f030_NeikiAnalytics.exe
-
Size
2.0MB
-
MD5
8f05e4a20d8582fb839964fb0f5cd140
-
SHA1
bb65c78eb0ff0e0cc1463756b7a5bba754c1fb17
-
SHA256
5726570822f2e9e7dfc387a67129fa4c76876869b403342aed4021b9bd36f030
-
SHA512
1fc07fd0595a0538959e336d27ed14ae2ef7367721f485ab488b9b8c1c2cec1c735771db2356c876621e1e2bd8f792c41e16f35b96f47a49a520d849e640c06f
-
SSDEEP
49152:PgyBI3cKWfAH/yalDjMoO5LGEf+CejGO9P4JbYzU7H:PgzcFfAfRlDyyO+XRz
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/2972-10-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2972-9-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2972-11-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2972-7-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2972-51-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2972-53-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2972-37-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2972-35-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2972-30-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2972-28-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2972-26-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2972-24-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2972-22-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2972-20-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2972-18-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2972-17-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2972-49-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2972-47-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2972-45-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2972-43-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2972-41-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2972-39-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2972-33-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2972-14-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2972-12-0x0000000010000000-0x000000001003E000-memory.dmp upx -
Processes:
resource yara_rule behavioral2/memory/2972-0-0x0000000000400000-0x00000000008C0000-memory.dmp vmprotect behavioral2/memory/2972-2-0x0000000000400000-0x00000000008C0000-memory.dmp vmprotect behavioral2/memory/2972-5-0x0000000000400000-0x00000000008C0000-memory.dmp vmprotect behavioral2/memory/2972-6-0x0000000000400000-0x00000000008C0000-memory.dmp vmprotect behavioral2/memory/2972-32-0x0000000000400000-0x00000000008C0000-memory.dmp vmprotect behavioral2/memory/2972-54-0x0000000000400000-0x00000000008C0000-memory.dmp vmprotect behavioral2/memory/2972-55-0x0000000000400000-0x00000000008C0000-memory.dmp vmprotect behavioral2/memory/2972-56-0x0000000000400000-0x00000000008C0000-memory.dmp vmprotect behavioral2/memory/2972-57-0x0000000000400000-0x00000000008C0000-memory.dmp vmprotect behavioral2/memory/2972-58-0x0000000000400000-0x00000000008C0000-memory.dmp vmprotect behavioral2/memory/2972-67-0x0000000000400000-0x00000000008C0000-memory.dmp vmprotect behavioral2/memory/2972-68-0x0000000000400000-0x00000000008C0000-memory.dmp vmprotect -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
5726570822f2e9e7dfc387a67129fa4c76876869b403342aed4021b9bd36f030_NeikiAnalytics.exedescription ioc process File opened for modification \??\PhysicalDrive0 5726570822f2e9e7dfc387a67129fa4c76876869b403342aed4021b9bd36f030_NeikiAnalytics.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
5726570822f2e9e7dfc387a67129fa4c76876869b403342aed4021b9bd36f030_NeikiAnalytics.exepid process 2972 5726570822f2e9e7dfc387a67129fa4c76876869b403342aed4021b9bd36f030_NeikiAnalytics.exe 2972 5726570822f2e9e7dfc387a67129fa4c76876869b403342aed4021b9bd36f030_NeikiAnalytics.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
5726570822f2e9e7dfc387a67129fa4c76876869b403342aed4021b9bd36f030_NeikiAnalytics.exepid process 2972 5726570822f2e9e7dfc387a67129fa4c76876869b403342aed4021b9bd36f030_NeikiAnalytics.exe 2972 5726570822f2e9e7dfc387a67129fa4c76876869b403342aed4021b9bd36f030_NeikiAnalytics.exe 2972 5726570822f2e9e7dfc387a67129fa4c76876869b403342aed4021b9bd36f030_NeikiAnalytics.exe 2972 5726570822f2e9e7dfc387a67129fa4c76876869b403342aed4021b9bd36f030_NeikiAnalytics.exe 2972 5726570822f2e9e7dfc387a67129fa4c76876869b403342aed4021b9bd36f030_NeikiAnalytics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5726570822f2e9e7dfc387a67129fa4c76876869b403342aed4021b9bd36f030_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5726570822f2e9e7dfc387a67129fa4c76876869b403342aed4021b9bd36f030_NeikiAnalytics.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4212,i,6576818814118437872,11004518367271063231,262144 --variations-seed-version --mojo-platform-channel-handle=4132 /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2972-0-0x0000000000400000-0x00000000008C0000-memory.dmpFilesize
4.8MB
-
memory/2972-1-0x00000000006D4000-0x00000000006D5000-memory.dmpFilesize
4KB
-
memory/2972-2-0x0000000000400000-0x00000000008C0000-memory.dmpFilesize
4.8MB
-
memory/2972-5-0x0000000000400000-0x00000000008C0000-memory.dmpFilesize
4.8MB
-
memory/2972-6-0x0000000000400000-0x00000000008C0000-memory.dmpFilesize
4.8MB
-
memory/2972-10-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2972-9-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2972-11-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2972-7-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2972-51-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2972-53-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2972-37-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2972-35-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2972-32-0x0000000000400000-0x00000000008C0000-memory.dmpFilesize
4.8MB
-
memory/2972-30-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2972-28-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2972-26-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2972-24-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2972-54-0x0000000000400000-0x00000000008C0000-memory.dmpFilesize
4.8MB
-
memory/2972-55-0x0000000000400000-0x00000000008C0000-memory.dmpFilesize
4.8MB
-
memory/2972-22-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2972-56-0x0000000000400000-0x00000000008C0000-memory.dmpFilesize
4.8MB
-
memory/2972-20-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2972-18-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2972-57-0x0000000000400000-0x00000000008C0000-memory.dmpFilesize
4.8MB
-
memory/2972-17-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2972-58-0x0000000000400000-0x00000000008C0000-memory.dmpFilesize
4.8MB
-
memory/2972-49-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2972-47-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2972-45-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2972-43-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2972-41-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2972-39-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2972-33-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2972-14-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2972-12-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2972-66-0x0000000003B00000-0x0000000003B07000-memory.dmpFilesize
28KB
-
memory/2972-67-0x0000000000400000-0x00000000008C0000-memory.dmpFilesize
4.8MB
-
memory/2972-68-0x0000000000400000-0x00000000008C0000-memory.dmpFilesize
4.8MB