e11bc2981b403e9793dff1f9ce68328d1d5f49ac94e66d756033e051360ae1a1

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 22:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4c490d224709bdc2f3cd98bb25677b10_NEIKI.exe
Size

601KB
MD5

4c490d224709bdc2f3cd98bb25677b10
SHA1

51019fca759782a735a2e128e5d1ecca926ba90b
SHA256

e11bc2981b403e9793dff1f9ce68328d1d5f49ac94e66d756033e051360ae1a1
SHA512

124782cb110435af27cacd10f58a700054a13f5501ec40da698b5768be61927844714291f05d432c3ea7a29a84e0f045893b504ee256f27cba25069ab7b5a944
SSDEEP

12288:0AOvjTd0qa1SJac/vhZHnUWuLGJb1uWGZeVBIcMfcY3ICIl:0zv3ra1Sgc/vfpHoWCeQDf/x4

Score

7^/10

persistence spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2420	k2hiHMQ3cAkbPpV.exe
744	CTS.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1576-0-0x00000000002F0000-0x0000000000308000-memory.dmp	upx
behavioral2/files/0x0008000000023413-8.dat	upx
behavioral2/memory/744-11-0x0000000000EC0000-0x0000000000ED8000-memory.dmp	upx
behavioral2/memory/1576-10-0x00000000002F0000-0x0000000000308000-memory.dmp	upx
behavioral2/files/0x000200000002299f-14.dat	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	4c490d224709bdc2f3cd98bb25677b10_NEIKI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	CTS.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\CTS.exe	4c490d224709bdc2f3cd98bb25677b10_NEIKI.exe
File created	C:\Windows\CTS.exe	CTS.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1576	4c490d224709bdc2f3cd98bb25677b10_NEIKI.exe
Token: SeDebugPrivilege	744	CTS.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1576 wrote to memory of 2420	1576	4c490d224709bdc2f3cd98bb25677b10_NEIKI.exe	83
PID 1576 wrote to memory of 2420	1576	4c490d224709bdc2f3cd98bb25677b10_NEIKI.exe	83
PID 1576 wrote to memory of 744	1576	4c490d224709bdc2f3cd98bb25677b10_NEIKI.exe	84
PID 1576 wrote to memory of 744	1576	4c490d224709bdc2f3cd98bb25677b10_NEIKI.exe	84
PID 1576 wrote to memory of 744	1576	4c490d224709bdc2f3cd98bb25677b10_NEIKI.exe	84

C:\Users\Admin\AppData\Local\Temp\4c490d224709bdc2f3cd98bb25677b10_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\4c490d224709bdc2f3cd98bb25677b10_NEIKI.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1576
- C:\Users\Admin\AppData\Local\Temp\k2hiHMQ3cAkbPpV.exe
  C:\Users\Admin\AppData\Local\Temp\k2hiHMQ3cAkbPpV.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\CTS.exe
  "C:\Windows\CTS.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml

Filesize
350KB

MD5
8028702915fc2e27a042355cf51020e9

SHA1
b98c18a06cd2a2bbb98904330145dc649b24aef2

SHA256
0c1f4e92f3f6358f0a472b1ebfce5f029d76c88cc8949833835d7c9bec8d6a5c

SHA512
f85192a683fad8fc550ef1dd3a529ca28179b8b2a894feb5dc1d471dddada5c5eda7b8aebe0c4e977656a4ba99c51630bb5ddc1d64d5c81ee32444cda192e684

Download Submit
C:\Users\Admin\AppData\Local\Temp\k2hiHMQ3cAkbPpV.exe

Filesize
574KB

MD5
6503efe0a01c2d50c97be27f3cb10a43

SHA1
a0cb3708603a18f02352d01ec672020e5bad5073

SHA256
0cf9864ae3a8679ed503f954a453452c93fa44f99ca6f39bbc5860abde7fd35e

SHA512
ebdbc553ba4348676fd3f2ca12e48af53a229b449a36e653dbfca90efb34d21033e41d1157dcca28c2b1e5f91368c0839298992247cf7d2e8feca5feab8ecea4

Download Submit
C:\Windows\CTS.exe

Filesize
27KB

MD5
a6749b968461644db5cc0ecceffb224a

SHA1
2795aa37b8586986a34437081351cdd791749a90

SHA256
720023737d7ff700818f55612ba069a609a5ddea646bb3509b615ee3523a4ca2

SHA512
2a276816290746ed914af9cf6427aef31ce9395b8e9937090e329a8f74fb84c62d15b196e13346caa086842b3f5f549b9eb20cbf422d18c9c1b63e6342ea90b4

Download Submit
memory/744-11-0x0000000000EC0000-0x0000000000ED8000-memory.dmp

Filesize
96KB

Download
memory/1576-0-0x00000000002F0000-0x0000000000308000-memory.dmp

Filesize
96KB

Download
memory/1576-10-0x00000000002F0000-0x0000000000308000-memory.dmp

Filesize
96KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads