7814bd5983b7b2eeac7c3dd6418165edc2cae7f2620fb08e1dcfbb3e732258cf

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 05:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

844edf335fe859f103eb793e7cb88400_NeikiAnalytics.exe
Size

211KB
MD5

844edf335fe859f103eb793e7cb88400
SHA1

77aa46bdced118a85b4cebef1ea769f40e2a9399
SHA256

7814bd5983b7b2eeac7c3dd6418165edc2cae7f2620fb08e1dcfbb3e732258cf
SHA512

940a1daf78a8e8b7d4b2aa057ed1682670f235dc1af4eda60ed6e90f8cd77dad6967333cd955e09d3495a76e0e6a688b7d169489ff2673efcb76c3829bf8b405
SSDEEP

3072:EPUHpiKT2t2UHIu05W7SAFJJOUD9cckiKop97f3r8n9t9Ygnt:9rTfUHeeSKOS9ccFKk3Y9t9Y

Score

7^/10

persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4836	Isass.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Isass.exe = "C:\\Users\\Public\\Microsoft Build\\Isass.exe"	844edf335fe859f103eb793e7cb88400_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Isass.exe = "C:\\Users\\Public\\Microsoft Build\\Isass.exe"	844edf335fe859f103eb793e7cb88400_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3476	844edf335fe859f103eb793e7cb88400_NeikiAnalytics.exe
3476	844edf335fe859f103eb793e7cb88400_NeikiAnalytics.exe
4836	Isass.exe
4836	Isass.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3476 wrote to memory of 4836	3476	844edf335fe859f103eb793e7cb88400_NeikiAnalytics.exe	83
PID 3476 wrote to memory of 4836	3476	844edf335fe859f103eb793e7cb88400_NeikiAnalytics.exe	83
PID 3476 wrote to memory of 4836	3476	844edf335fe859f103eb793e7cb88400_NeikiAnalytics.exe	83

C:\Users\Admin\AppData\Local\Temp\844edf335fe859f103eb793e7cb88400_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\844edf335fe859f103eb793e7cb88400_NeikiAnalytics.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3476
- C:\Users\Public\Microsoft Build\Isass.exe
  "C:\Users\Public\Microsoft Build\Isass.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:4836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe

Filesize
674KB

MD5
5074e17e54bcd6c9144b97b828cba2c5

SHA1
2bbe47b9a7ef9dfdca99ee01e6c0827ff8abb6d2

SHA256
6de3ae11320e362f6b3ff7404aba75a84810b3bb6088effa3f50cfbb1e080a97

SHA512
b3916513928efc953bf83594e20f2002bc99752b6e34ee26fd1f4b6df13ad35a775ee847527093fb2831a1a9f850f806dad296fdb2e100c7a472a115891347ed

Download Submit
C:\Users\Public\Microsoft Build\Isass.exe

Filesize
211KB

MD5
844edf335fe859f103eb793e7cb88400

SHA1
77aa46bdced118a85b4cebef1ea769f40e2a9399

SHA256
7814bd5983b7b2eeac7c3dd6418165edc2cae7f2620fb08e1dcfbb3e732258cf

SHA512
940a1daf78a8e8b7d4b2aa057ed1682670f235dc1af4eda60ed6e90f8cd77dad6967333cd955e09d3495a76e0e6a688b7d169489ff2673efcb76c3829bf8b405

Download Submit
memory/3476-4-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/3476-5-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/4836-17-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/4836-27-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/4836-11-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/4836-12-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/4836-13-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/4836-7-0x0000000001B50000-0x0000000001B51000-memory.dmp

Filesize
4KB

Download
memory/4836-6-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/4836-18-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/4836-23-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/4836-8-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/4836-33-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/4836-34-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/4836-41-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/4836-42-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/4836-53-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/4836-54-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download
memory/4836-63-0x0000000000400000-0x00000000016A8000-memory.dmp

Filesize
18.7MB

Download