Analysis

  • max time kernel
    118s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    10-05-2024 02:29

General

  • Target

    4d7e0095c7770a52783f6dfc479bafa0_NeikiAnalytics.exe

  • Size

    765KB

  • MD5

    4d7e0095c7770a52783f6dfc479bafa0

  • SHA1

    3f49034d7415ecdeaf887afff1a95199ba2043ff

  • SHA256

    ff5d67d2cfdae5296cda453f2f78fcacd79169bb9dbbe94a2007d9dcb382d2ef

  • SHA512

    2570fa14760448878d9205d832ba52c82558f1776cfc2cb00c8ecc45dd8f6a2953b49ac6c8f02b65cc110c19f11be7eccaaf0dfc9e29f83c6093d2769b5f10a1

  • SSDEEP

    12288:8CqnHvjNIrpf9rN/mc/Ciu2OAgXH/q6tVKfvfOkx6Mnf1SVfeEyuOlQnPssJAMDl:8/PjKr5BNDYEUH/q6tVqvGwtsVmEXksp

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

jn17

Decoy

hynasty.com

africacementreview.com

5280micropantry.com

qcyu2.us

jl777-web.com

hcwsports.com

update-number-au.com

ymymvip.top

postds.buzz

dogwifnobrim.com

usapubpong.com

shopscoopido.com

medical-equipment.company

onyagu.com

tldrparent.com

jvpeople.com

seangalbraithphotography.com

ptt-gov.art

mutcosmeticsec.com

metameme.online

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4d7e0095c7770a52783f6dfc479bafa0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\4d7e0095c7770a52783f6dfc479bafa0_NeikiAnalytics.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2220
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\aBHfONTpHr.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1708
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\aBHfONTpHr" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4A49.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:2724
    • C:\Users\Admin\AppData\Local\Temp\4d7e0095c7770a52783f6dfc479bafa0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\4d7e0095c7770a52783f6dfc479bafa0_NeikiAnalytics.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2776

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp4A49.tmp

    Filesize

    1KB

    MD5

    2a6e27469b97c5b2da2288826e420374

    SHA1

    4ee23c78e14c71afe2f363fff9d6e1846afff4f5

    SHA256

    7d846ac6b48be36eaf5996167aa96d8ddda7034d2f298e4213750ae8a685b8fd

    SHA512

    b603b9ed2066bacaf50f68b57f36468d7885a3fd398edd838ded980ef7ba897be43c6b976c4020a6c89ca88596547abdfdcb5c5392a001f179639b502934b818

  • memory/2220-0-0x000000007456E000-0x000000007456F000-memory.dmp

    Filesize

    4KB

  • memory/2220-1-0x0000000000280000-0x0000000000344000-memory.dmp

    Filesize

    784KB

  • memory/2220-2-0x0000000074560000-0x0000000074C4E000-memory.dmp

    Filesize

    6.9MB

  • memory/2220-3-0x0000000000220000-0x0000000000240000-memory.dmp

    Filesize

    128KB

  • memory/2220-4-0x0000000000250000-0x0000000000264000-memory.dmp

    Filesize

    80KB

  • memory/2220-5-0x0000000004C90000-0x0000000004D06000-memory.dmp

    Filesize

    472KB

  • memory/2220-19-0x0000000074560000-0x0000000074C4E000-memory.dmp

    Filesize

    6.9MB

  • memory/2776-18-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2776-17-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2776-13-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2776-15-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB