e94280d3a5e167b2afa0690358192bf50929ad9f8a51105f531abc63970fba3f

Analysis

max time kernel
149s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 18:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3fff1866d3f49bd95562694a5ba127a0_NeikiAnalytics.exe
Size

90KB
MD5

3fff1866d3f49bd95562694a5ba127a0
SHA1

88f84a234894745e77138f5d20d4e4c787b0e8e6
SHA256

e94280d3a5e167b2afa0690358192bf50929ad9f8a51105f531abc63970fba3f
SHA512

ca4606f84cae896086d889473aa00ca5e4ecd8a60fe278342449849eeaf8af60ea1e8177a5c15f9785ab798445614046dc84e44d7e111fa389b3f7d9c613d303
SSDEEP

1536:Qop4omMoASKRgyKo7NISlMFETgIoUGPlpk:QoW4d9Io7vaFyg4GTk

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Shohdi.hdi	3fff1866d3f49bd95562694a5ba127a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\Shohdi.hdi	3fff1866d3f49bd95562694a5ba127a0_NeikiAnalytics.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	\??\c:\Program Files\Google\Chrome\Application\chrome.exe	3fff1866d3f49bd95562694a5ba127a0_NeikiAnalytics.exe
File created	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe	3fff1866d3f49bd95562694a5ba127a0_NeikiAnalytics.exe
File created	\??\c:\Program Files\Java\jre7\bin\ssvagent.exe	3fff1866d3f49bd95562694a5ba127a0_NeikiAnalytics.exe
File created	\??\c:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	3fff1866d3f49bd95562694a5ba127a0_NeikiAnalytics.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	3fff1866d3f49bd95562694a5ba127a0_NeikiAnalytics.exe
File created	\??\c:\Program Files\Mozilla Firefox\plugin-container.exe	3fff1866d3f49bd95562694a5ba127a0_NeikiAnalytics.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\PPTICO.EXE	3fff1866d3f49bd95562694a5ba127a0_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Microsoft Games\Hearts\Hearts.sho	3fff1866d3f49bd95562694a5ba127a0_NeikiAnalytics.exe
File created	\??\c:\Program Files\Java\jre7\bin\jp2launcher.exe	3fff1866d3f49bd95562694a5ba127a0_NeikiAnalytics.exe
File created	\??\c:\Program Files\Microsoft Games\Minesweeper\MineSweeper.exe	3fff1866d3f49bd95562694a5ba127a0_NeikiAnalytics.exe
File created	\??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe	3fff1866d3f49bd95562694a5ba127a0_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\Wordconv.sho	3fff1866d3f49bd95562694a5ba127a0_NeikiAnalytics.exe
File created	\??\c:\Program Files\7-Zip\Uninstall.exe	3fff1866d3f49bd95562694a5ba127a0_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\javaw.sho	3fff1866d3f49bd95562694a5ba127a0_NeikiAnalytics.exe
File created	\??\c:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE	3fff1866d3f49bd95562694a5ba127a0_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.sho	3fff1866d3f49bd95562694a5ba127a0_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.sho	3fff1866d3f49bd95562694a5ba127a0_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Java\jre7\bin\javaw.sho	3fff1866d3f49bd95562694a5ba127a0_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\7-Zip\7zG.sho	3fff1866d3f49bd95562694a5ba127a0_NeikiAnalytics.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE	3fff1866d3f49bd95562694a5ba127a0_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Microsoft Games\Multiplayer\Spades\shvlzm.sho	3fff1866d3f49bd95562694a5ba127a0_NeikiAnalytics.exe
File created	\??\c:\Program Files\Mozilla Firefox\maintenanceservice.exe	3fff1866d3f49bd95562694a5ba127a0_NeikiAnalytics.exe
File created	\??\c:\Program Files\Mozilla Firefox\updater.exe	3fff1866d3f49bd95562694a5ba127a0_NeikiAnalytics.exe
File created	\??\c:\Program Files\VideoLAN\VLC\vlc.exe	3fff1866d3f49bd95562694a5ba127a0_NeikiAnalytics.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\GROOVEMN.EXE	3fff1866d3f49bd95562694a5ba127a0_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\VPREVIEW.sho	3fff1866d3f49bd95562694a5ba127a0_NeikiAnalytics.exe
File created	\??\c:\Program Files\Microsoft Games\Chess\Chess.exe	3fff1866d3f49bd95562694a5ba127a0_NeikiAnalytics.exe
File created	\??\c:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\airappinstaller.exe	3fff1866d3f49bd95562694a5ba127a0_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\crashreporter.sho	3fff1866d3f49bd95562694a5ba127a0_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.sho	3fff1866d3f49bd95562694a5ba127a0_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Setup.sho	3fff1866d3f49bd95562694a5ba127a0_NeikiAnalytics.exe
File created	\??\c:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe	3fff1866d3f49bd95562694a5ba127a0_NeikiAnalytics.exe
File created	\??\c:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	3fff1866d3f49bd95562694a5ba127a0_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroTextExtractor.sho	3fff1866d3f49bd95562694a5ba127a0_NeikiAnalytics.exe
File created	\??\c:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\FLTLDR.EXE	3fff1866d3f49bd95562694a5ba127a0_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.sho	3fff1866d3f49bd95562694a5ba127a0_NeikiAnalytics.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE	3fff1866d3f49bd95562694a5ba127a0_NeikiAnalytics.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\VPREVIEW.EXE	3fff1866d3f49bd95562694a5ba127a0_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Microsoft Games\Multiplayer\Checkers\chkrzm.sho	3fff1866d3f49bd95562694a5ba127a0_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\plugin-container.sho	3fff1866d3f49bd95562694a5ba127a0_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLED.sho	3fff1866d3f49bd95562694a5ba127a0_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\GROOVEMN.sho	3fff1866d3f49bd95562694a5ba127a0_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\INFOPATH.sho	3fff1866d3f49bd95562694a5ba127a0_NeikiAnalytics.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\misc.exe	3fff1866d3f49bd95562694a5ba127a0_NeikiAnalytics.exe
File created	\??\c:\Program Files\Microsoft Games\Multiplayer\Spades\shvlzm.exe	3fff1866d3f49bd95562694a5ba127a0_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.sho	3fff1866d3f49bd95562694a5ba127a0_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Microsoft Games\Purble Place\PurblePlace.sho	3fff1866d3f49bd95562694a5ba127a0_NeikiAnalytics.exe
File created	\??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe	3fff1866d3f49bd95562694a5ba127a0_NeikiAnalytics.exe
File created	\??\c:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe	3fff1866d3f49bd95562694a5ba127a0_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\CLVIEW.sho	3fff1866d3f49bd95562694a5ba127a0_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\IEContentService.sho	3fff1866d3f49bd95562694a5ba127a0_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\chrome.sho	3fff1866d3f49bd95562694a5ba127a0_NeikiAnalytics.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\Wordconv.exe	3fff1866d3f49bd95562694a5ba127a0_NeikiAnalytics.exe
File created	\??\c:\Program Files\Microsoft Office\Office14\MSOHTMED.EXE	3fff1866d3f49bd95562694a5ba127a0_NeikiAnalytics.exe
File created	\??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe	3fff1866d3f49bd95562694a5ba127a0_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.sho	3fff1866d3f49bd95562694a5ba127a0_NeikiAnalytics.exe
File created	\??\c:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe	3fff1866d3f49bd95562694a5ba127a0_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\CNFNOT32.sho	3fff1866d3f49bd95562694a5ba127a0_NeikiAnalytics.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\MSTORDB.EXE	3fff1866d3f49bd95562694a5ba127a0_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\MSTORE.sho	3fff1866d3f49bd95562694a5ba127a0_NeikiAnalytics.exe
File created	\??\c:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe	3fff1866d3f49bd95562694a5ba127a0_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.sho	3fff1866d3f49bd95562694a5ba127a0_NeikiAnalytics.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\ONENOTE.EXE	3fff1866d3f49bd95562694a5ba127a0_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\BCSSync.sho	3fff1866d3f49bd95562694a5ba127a0_NeikiAnalytics.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1492	3fff1866d3f49bd95562694a5ba127a0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\3fff1866d3f49bd95562694a5ba127a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3fff1866d3f49bd95562694a5ba127a0_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: RenamesItself
PID:1492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe

Filesize
1.0MB

MD5
ff770d586e13c91bed490bccb6d32f44

SHA1
c1b717a80647fa60713c3abc2df863af9c7f332b

SHA256
8ca6788c055e9298de1c6225b1947876c0b67f6c5726b4b35d6d27fd1ae30e6c

SHA512
4e6413d9282936c66c2ef2b85c4d9326a357ff7882341fdca6bb63b029598f3f4a7777289c6a0fff8a0592b52140b6bac342e3ef77e1f19dcdae66476ca2cf4a

Download Submit
C:\Windows\SysWOW64\Shohdi.hdi

Filesize
90KB

MD5
3fff1866d3f49bd95562694a5ba127a0

SHA1
88f84a234894745e77138f5d20d4e4c787b0e8e6

SHA256
e94280d3a5e167b2afa0690358192bf50929ad9f8a51105f531abc63970fba3f

SHA512
ca4606f84cae896086d889473aa00ca5e4ecd8a60fe278342449849eeaf8af60ea1e8177a5c15f9785ab798445614046dc84e44d7e111fa389b3f7d9c613d303

Download Submit