Analysis
-
max time kernel
153s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
10/05/2024, 20:53
General
-
Target
00cc3d2a446330f64c2f00c81c3f7ea0_NeikiAnalytics.exe
-
Size
622KB
-
MD5
00cc3d2a446330f64c2f00c81c3f7ea0
-
SHA1
b75cfbcbb77d898af5730a3697237481e747551e
-
SHA256
e48d108728cf9d8cab46b083bcd261d6c5a15b34a8150ad6ee4bff6feb12049f
-
SHA512
d6c58fdd544343af2815097ad59b2e97491c9c758ce66287775b06c264b918fd6f672bdeb87b5a0e2b35b3f937a4ee90fc13f77891ec956a42d2233bf9a2cd2a
-
SSDEEP
12288:Wu2yndwCg6/xjPHFFBwpRDftD7IBUgbScDQCSkb6wjfRMVviOvf7sibN3A1G31f9:Wu2e1g6p7HF/w/ftDsBUiScD7WGfWVbF
Malware Config
Signatures
-
Executes dropped EXE 22 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 24 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 35 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 42 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\00cc3d2a446330f64c2f00c81c3f7ea0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\00cc3d2a446330f64c2f00c81c3f7ea0_NeikiAnalytics.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 804 808 816 8192 812 7842⤵
- Modifies data under HKEY_USERS
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4252 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD517205fc45a4a4273801df7df2a978527
SHA1ef1bb31bbb1ebfb7c67dd630a578081d10cb3a17
SHA256bfd785e9136783572a58f9a721bdaa8aa164fe63e13f86e1a6781da800a475e0
SHA5120432a1702be26571a8a71e6b69d39adbd0398bca0936746340b6f618e1a3867d54bb3b50f0e7e491ccadf29eee13df7cc878d2c86e793ac1745e703a44fc6037
-
Filesize
781KB
MD5cf56fb2b46f33360f40fcadc112ec758
SHA1964a168e38b54374c52928b8afec625f6f968781
SHA256cae2fb694c89e7709d8232fbd3c3f03ab72d41027a277bd529d53a1fee2f63ab
SHA512f08aa306472dad8f85ecd73eca5c7a1f0b5e8530f71beb90ca63f64090f5d9cbe935b6b0f20e1e5891473a5176aba8f05537bea1a2a9170c117469e63caad5f0
-
Filesize
805KB
MD5b644c7dc302524360d72e4e3651c4967
SHA125557dcaef4ad46e0ae170880a061ac1eb8454bb
SHA2567aeefa697ecf0ad703d65cdf16d3e07ae0123055d8a7ebb8c3f926269646b01c
SHA512049d167895482410a1a289050fbd14d95bd3ea3316a7440ccea4e6f1c2964f1f7e8c6449a9b9ca38e96bd284c26549da42199df19645ce38c977c577eb74b79a
-
Filesize
2.1MB
MD53e50b843e7638e22c3c1dc8ab1373efd
SHA101b9ca0e16c9e6ba90805a444343401f3033d170
SHA2561ac1a1e77c1836efb8cc80df9bea2ca4ed05e6968f37993bdd3db1faa3f92958
SHA512ead771947ca11533f91680019c3cd09d5fc9f9e108e7608f7080b426c5184acd968cf452ebe61c3fc01ad9fcebacbd0fda338a30918d39685a9809ac1e5208c3
-
Filesize
588KB
MD5b563ed9e2a2046d42e6aa57d136f2ad2
SHA17c71a3c771c5fea50f373fb862ff254b2b013136
SHA2567d8cfed0e3c3eded894a614f628477aa5fc9fb0afb269303f95631f1fa91fc43
SHA5129819ffc9687aa9e5521731e870ff2d723720fe0e2c9f90303c97df66a7f495075f53ef66b698b7c433ba072322e9cbf3f73709f36f290f2fad1cfb734741c02f
-
Filesize
1.7MB
MD5e1e4e0344cb24cd00732c7d76af20d47
SHA15c7ef56cdf7c61e131805f96cbde90d9a801b66e
SHA256a7899e9087347614dc74092f1c3c5a430738c771395801cd0e8895e8666680b0
SHA512f84f11b4c5bdb2ba15dc917c3df198dbc79e4261c051a0019509e35b765c78390d9d406787d362fa3277bdfe8574f6ecbb6568588efac495aef5c33be633fa27
-
Filesize
659KB
MD51e37575726dcce24493ad5eeace80629
SHA17ab24f0770f51abf3efbf981f7f7e41a861cdee5
SHA25635b53fbaba92c6854637d49164130f03b824807f31092f8b1d83e3a733e21460
SHA512274be70185ddb57e9f52a486d7d6a55ae8dbf608c02d1faabfa3a0081ca75374dd4aee21e55687dec938ea3263f56a0988c72589016b9f29467032c32a00352a
-
Filesize
1.2MB
MD576fe98e00da7a345974d79869bd23c3e
SHA1299fadfc1decfb9e93fe87780359d38e53a62d19
SHA2565e959b12d7685e776ea18c0fdb871a3b73545e03263a10ca7a4652656fb4fea0
SHA51262d4e1c575f5daed4db63bdb52e38a8ca10a1e966a7117a90a58ee3261668c57739c947b5bf7968e9f48010b4c403cf9056b1974ebe8a90c62086c97e2d71c91
-
Filesize
578KB
MD5bc95031dbfff63e016f07e34649b957b
SHA1d24a1559261317ddd35ac81ae0807f04deb65cee
SHA256061e729fde6f42a2f931fd27b18e33a75fa10979bd709799dae10c1ca2a641ff
SHA51299825884d838055904de0a0db9fd7ad8c2955e21d0c56d693682248ce9fc321d0cb463ac020ddb566e20edfa87339683ac008125e0becbb27523431060f06465
-
Filesize
940KB
MD50017c0d83baf2ccab6cb92c30f13a1fb
SHA1229f68eb204238f6b64d3366254784394d29432d
SHA25652b5c3d6de1070821eceaf00f9ec5abe319db12ed88d6e860a8d35044a7a2aa4
SHA5126bb10d56bd7409b453f4e7bf2a0d6a921a43db06e589a61145dd582d287dd1fd0a46e186a7750363757d0f34a0794c6f59dbbc61c48b1129dc082fd459b76bb7
-
Filesize
671KB
MD597f6123999c20d7ac97beb7dade80dc4
SHA1b0568aeee389392dc2ebcce80dcdb0453fadc40b
SHA256895cdd128918063104587617d2d024cf5a5decc52cd9eeae8ff7f9ba8ff1cb4b
SHA512e17d3e096295aa6bea95f5154052fa6df0f9e882e630d4c9202d79c6026faecdbaad1806d6cbf130dea020fc7b633669afd4b2f65255b8951e26d6a89aaba113
-
Filesize
1.4MB
MD5003c11f91bd1a15f417906d12e87d880
SHA11777fb420f0dd39617a71c3716a66f76871cb6c5
SHA256dc40f2a0e31fda8418f37ffc37ef6d53116b6c9c3fb48fda3017aff708a588d1
SHA5127c4f20a8bb7beda27f3fdcbee472818d7a960532f70fed63303c872a505c0cd91f52d16e68435da75a7a3191a68d05f7b6bfb0ebdcad865c3249aacc145c3b78
-
Filesize
1.8MB
MD584de04a33492866bc6b41fe0992c76c6
SHA1794560cf5df41a119dcba703c7cc2b006bafe930
SHA2568651982c20015048356ecc01202d2b4b539fefe6586c7841b5a5b67c5dc276b9
SHA512107dbbd66ed54ebc85d89a12dab5fe20600897a8622a9fa6c3fc9dc932b0f93ff4dd1c1a5313009023d35432a22055cdedd6bee23ce28aa1018f7bc8caf75614
-
Filesize
1.4MB
MD5779fb5de4f16db64063aa2320770c956
SHA1dc016946ce975abadb4ed93e049e8894e7e35b05
SHA25604c2f8f81daa2204f7ccb8c3e6ad2cf4078893889ee10dcd29648896e8e9d7e7
SHA512f55cefea7d500e7da99eb86a3b1084f647fa6ba123bc0e9cfc5045a1d5ba6ffa7628b7e4046be8c58e917c2f364387c55d1aed09c4fefac6f5efd61773c9fddc
-
Filesize
885KB
MD56c3e396f7920e860c3c3544f37a99d4d
SHA1038c74fe485b2f2b102e870acaac944efe91f489
SHA25641b23c5daf2b4239918a3cb79ff2601f1b3e5427dd0a84c5f1d91638b0ca6896
SHA512ec3dd8b78184d693a3ad326f89af922e1251f0deed1d70e03f17f46b659cbdc1ff8cdc51394d738ed4eb799b41407672fc98e80ff635f1be2179d5f199af9374
-
Filesize
2.0MB
MD53ecbea05ea2665dba732d53be7737a81
SHA10ca677a96d63e1ea6238d804f9deffbba1941f27
SHA256405dc10aab48535a984105a83eb060983b9f42dd1bb7c2151158da8b2857227c
SHA512f5a0b05a48170d774d3c78f26c25fc75c5eb3b6bb831a06fe8febbbb23bb33a0b1da6064f737e47b9fb0bdbd6d144915132908868c495e7fc2c23bfc5fe4ded1
-
Filesize
661KB
MD50fde7d66eb9030ec76b90d145a9d5b49
SHA1fec624c1add81a6e53a0a36a7821d550c405f2bf
SHA256528aa1e14b878e6a9c53097dd95ceb679392a05a10f41786faa04db41bea462f
SHA512af90602a1a115924de44865c3b9db7573a7eb5b28eb83f92ccbb1f71e454953ef306f0686091c270df7e75ec85faff40cf095eb8d32fbbc0c7649f0b80b19421
-
Filesize
712KB
MD5fd0de7a0f9833b5efecc67ca1c5bc481
SHA1bff146ed364307f735a8c54d29d5231ea5f11cf9
SHA2568f65f0e2f86f0a1999c5722311b271476b37825c6d6cc0f43a28ce950b82accd
SHA5127d88262dabc047280c1f14934addcd9b0467f04dd56e8f55d7294d690bdcc83d99f9cc98b16e20520a3512c3f4200953f8b74bfc6461b5deed74ae180b0386d2
-
Filesize
584KB
MD5a182a8622a696888ca55f9f05e7f67c6
SHA12c035855a5e824475c457bf23659669fda198b87
SHA2560ff0e1f3712e74c6d8537c9075738d060a123eefe181f2ef37712e415c8cc122
SHA512a5cc95739a2a6c92da290ad74669390a5b80cb236af890982ba964e50fbaa39d27024b936593d4fb502fbcb3c95bf97b363fb12b3b480460883d8ac86c1c7507
-
Filesize
1.3MB
MD5acbb06e08e2a2b11adf6d08d02f76634
SHA15b346a4806e85bcab557b3ce9d3dded550b9d1c7
SHA256a6b830b9a42f043b37360ecf180985b99a2aa261c2fdebc56d2ebbe22d8c751a
SHA5125203288f32a3067bd021b8f867b76e2e3487511599bf7a50fb386300e7b5dcd9a9b79b0a45d82f826be27013e66f78f3bd8e38179032c9105f85243948e3832b
-
Filesize
772KB
MD54addd60e1d3c49b71b3bc9e0bb0c5c4f
SHA190b46dc1ebce136c6744c47e12edc4ee0d1e7f99
SHA256952d528d16603cd81affac3ef6632758522364d76f166388e8509bceb2530d3f
SHA51211bad99fe1cd22e20386df4acaf9a00c021f81cccd0450799f2e24f1583c755ad7a388e65320bed3f5d40f6b9f9cebd27c3aedc55374224804d9dcb160e81249
-
Filesize
2.1MB
MD53d2a9540386cf1bb9b126ca299af9698
SHA196428365d6cd46255947de92c395831dc9abc479
SHA2563a40d12a5d752da94d9e1b4230e1ddf1df42f11b5b2996b4f6bc758a68344587
SHA512a81f9078d56f098935b05e33118ac9d283a477068de9c3c7284096fa3fcb31732b90b289a681bacd3fdbcbd36fd710556386f3bad10073235900a504907da48f
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
792KB
-
Filesize
792KB
-
Filesize
384KB
-
Filesize
2.3MB
-
Filesize
384KB
-
Filesize
2.3MB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
676KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
676KB
-
Filesize
808KB
-
Filesize
384KB
-
Filesize
808KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
632KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
632KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
600KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
604KB
-
Filesize
604KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
684KB
-
Filesize
684KB