Analysis
-
max time kernel
150s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
11-05-2024 05:37
General
-
Target
8a16b59c8d096cdae5e2194c6c9ae4f0_NeikiAnalytics.exe
-
Size
5.8MB
-
MD5
8a16b59c8d096cdae5e2194c6c9ae4f0
-
SHA1
8c7705fc5108d0e968a566eaa4d7fbc8b4fe64ff
-
SHA256
ebe2b6cfbfaa64335b910bf45541863f490bfa72a2bfe87f1bd43bbf89def851
-
SHA512
f4c0b16fc368cac2f31ce38879566c4eec79c3532a28000f087eadd2525fd53048fc24d34df6f4d9fa27c8244bb2cf9e1bf310a0c093e5ae4023e573d1fdd6d1
-
SSDEEP
98304:WNDwSlUk9KPsUxfAdNmTVi+qkPZKOBuyaoY7cjG68:W1Uk9KmdNmTsOBuyaopjG68
Malware Config
Signatures
-
Executes dropped EXE 19 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 29 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 3 IoCs
-
Program crash 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 5 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 11 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\8a16b59c8d096cdae5e2194c6c9ae4f0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\8a16b59c8d096cdae5e2194c6c9ae4f0_NeikiAnalytics.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8a16b59c8d096cdae5e2194c6c9ae4f0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\8a16b59c8d096cdae5e2194c6c9ae4f0_NeikiAnalytics.exe" --type=collab-renderer --proc=41482⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 384 -s 11203⤵
- Program crash
-
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 384 -ip 3841⤵
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1416 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD5e651424ca2fbe28c6112e749e867c1f7
SHA109a6fd937d6d30afc6b4016ca6a72a5204fd168f
SHA256c0f1c18e2ba3ae89cb41c796de09346af655a4b5cb88bb7b2fac4f3afbe9fca8
SHA512fc07686e5134cd535d9b10ceb313abd39407288ce4e706f3cc2faa880dcc8e4ec903b157551008d2ac333b725056e8bd92e26a9071c76f488b48ecf9e0965b34
-
Filesize
1.6MB
MD53a21a1e6ba9e78d7342a6fb3fe6ccf73
SHA12e72abc5c430e4b67064e1d5636e6805f28262a0
SHA256264b6d8637d5f510cbde649986e358da0202017dce645b17340821a5706ded4f
SHA5129ebc20c36edc17fb7dbbc68a1e67c15c69847f64daffe90a96b0628ad3a9ba5ab3ee48c3a37b0373e4f287454cecdfc0bf92a295462ebb6d27ef2757f4af9ce4
-
Filesize
1.7MB
MD5e8c99d9b1bdc49fe4a1c5384321d55c6
SHA1542d21aa77e56883ca6f30babd6f01474398eebf
SHA2565fe4595a37904ea63fab29054a39abed37503f795a29034013b57731dcb7f766
SHA5125ce0f0045cf2cc1bdd32e19d254c876abe75b44508ee370f8f74542195e83aa6a2c8d1b43ba117d62464bb62ca51bce4a690db2451dd2c48d906c342549a92b0
-
Filesize
2.1MB
MD520ab271e552d44b1d2335e9e7fe58d86
SHA1be49e1001fc876abc64b27b651a799b8cc4fb902
SHA2569dc7b0d8b7b691b156254b297724b891c662611ccfb0316b57a93aad5b6366af
SHA51226c891907463efb21dc05645986d08db08d129a3cc4d992538ee33e33e18d6a638b1cf497bbba8ea7e49e250132cf642d5992e5e82b7366f7a90b50a1511617f
-
Filesize
1.4MB
MD575b43e4aca3cf2a378a68fd1209aa932
SHA1727bd39305b961ab1f0df3891d081c8db3aac52a
SHA256d53fc159ef90eebc73ede47ef028dd8479531c052f056412dab5d83f9e9f5644
SHA5129736efd6326d5473a88ed56ac0e133e819a2272dc1c79ea4dc02e03f29f5a2df54f8103e5061514b2c367f777b5354209975fef2595cc65543b7aa15b3acb1c2
-
Filesize
1.7MB
MD5c84756021082d5680d9eef8f9257bdf0
SHA1277f686d2694905f33289f61fb9bd41c30e3d4e1
SHA25680ea691d76dc7242335c20ce14b2cab281b199df766455d4e472409139b1141b
SHA512b980602fda6d99d8f2a640bee56f9f994b579b140532f964ed55a82eeec5816ff9f3ac5c7befcb811f84d65ff06c31752046e7e5469ddd416085f89b82fef809
-
Filesize
1.5MB
MD5a9010e7fcaf498e0bbc8ed18b4b71d99
SHA1f3c0270a98a266ed5c352bddf1519d4a33d787ce
SHA256f4fb9201688e1368737462af3f722b435f52dc385a2619aa3364653b3268197f
SHA512021c3863297677e5b28fdceef30e26a5120ab624a8140ad9c2ed61cba2298cb5e78ee543c129022b04485fbc7986988c36806b73224d415390fd1e69349affc5
-
Filesize
1.2MB
MD5b6031e636e35566d195a2d97cca78861
SHA1c78fa6b29a2710f1d6a2c1e32ba5626115a10468
SHA25671dfa6fab99cc6df27115493cd33016a7c3519645e83403cbd0d70654cf99721
SHA512f6975a630a400975e052aae7402fc9fe68fc03de2de698bc8bdfb68bc9b2e2f5d6f3bc70bb5e37b79871d785bc0943b659276ff41a89948f3cfe7bcfc6c2d5b4
-
Filesize
1.4MB
MD5c087c32e75ca7eda71d143d0ef14ac69
SHA10158b58991334a84725d738b31164bf6b1d8d7e2
SHA2561243cfb19ee5bf217c95cc60caa5c8a69614d319b0ac2f9101acdadbb32c6750
SHA5126c90b2352ca1500ca2e03bba6d032294a6c3de374e14c65234422412e48bb9b3c96b219844f1cbbe4a6994b96b1a3a4e3d069c5def4c56529096f34c110c5159
-
Filesize
1.8MB
MD5d47d5f5faba622ca14599b2f2788a75f
SHA1fb51e89e05a2cd071f76f42ff63ccf4d0afa5ad8
SHA256a7c44c6731a0015443c8d29bbbd05c67ee14d6c56d945c4b4ad218e3a68b81f1
SHA512e43303c729bec41136a9ee62eeee5ba9dfa84d35225e56174d1a2556b29c95a869116403f25792a310f90cc06a1a4333bdc49ee95b63c4881aecc4fb258f036b
-
Filesize
1.5MB
MD581d4bf961590f639bf38e2d6a429afa5
SHA115a08e7969232bf93544239ae0705118bf324b3f
SHA2565bc888f6a3fb914c7816b8f814edc35d53a903c15ac45a2514751f4ce1bf360c
SHA512fa2649de0f9bbbbe41f4d67e4142b068a5d51308d2b754ae77d0c9a6bceee106b49a8599a10c1da811288696ace7841d489e277ec55cf885a6d4f0193aa2d068
-
Filesize
1.8MB
MD5428503419c0b5ef8e709c79903b1d6c0
SHA19c2dceef3fc036135f87c6b2cece7f5fa1e1ca01
SHA25647d5f9c5199a87fe9c943955a3f54c3a73af0dc991b2f95449adca68238f14ac
SHA5124f23dfe7e00e83abeaa83fd64bb694ce73f28880f172370797db6e7d0340e7373be05c6b6e3811ed2f7faaea3e1467f433d5550cc88649597786ba13a9b993d5
-
Filesize
1.4MB
MD573a85eb164a347b3f3913267aa8e1348
SHA127e225c67a60522d0f94809cc8eccde236a90349
SHA256599c6dc336bce4c243a85c42125fc5a58914ab9ddc33ee8bd6b7a9373434ba22
SHA512a1ff230cd49ff4040102f7eebddbc7b27acbb91a56f457e17bd4b539a591e1e08385082277c4dcdb175c520ed7a62be1b76ce8419f0ef340d35e1ee9c2d2d40a
-
Filesize
1.7MB
MD54c386476f89d03a16ee0cd660233a302
SHA123492104b0d9e18462771738528016be80091869
SHA2566932a14b0d2340c6ef5bc19e223d29a7d9c16c4fef1a689e250d00bc886c4cbc
SHA5123963f9b81c240bfa83af7eb46ee6c7edc62c05bc4eedb16be9f1367bc7786b82241b2727d56f9e14a5ea26eaa6b90a9d079c97e509c91f53c62b0716a062cd1b
-
Filesize
2.0MB
MD5909c2771440ee8a302833dac51b0f4e4
SHA163040db4dab4693d133e8258fd9f320937ff569c
SHA25630cdcb20b46539ead275234628678377292ab4106808bcb97fc902ba5e3a54d4
SHA512f2876e3ec896eeac6f7e101d4190131357cd64f68da76f6e356cf106e6244f95da3a2ed82634cc6f2a7ed5f012f95bb8b48e250540c6a9a88c1fd969a04522b0
-
Filesize
1.5MB
MD5f150d46e76cbced1022978b064e50b01
SHA11cdf98a47aac48d0650f196e0afce7d9524235ee
SHA25665fa5eaac626d65bc8ef2a85f7777b0e9342dbc2410a54dcab2d73770bb26daa
SHA51215254550cac12a1e016ee3291620a2d302c747e3a721580a40d87e09d58251bfd746293898549a28a324f5b64035d90efa8e11c471ae7d6b36ea7176c7bb15e1
-
Filesize
1.6MB
MD5639f1e7531ef8cb062b86e8bbc9442d0
SHA1439e9f115834a5f762af87d1e0b8a8649136c1cc
SHA25659b34b1dee60c9e8f818c170c866d40540fb9b8a58d9a6b5303a7f5279866aa0
SHA51283cba17f0ea025886c849981e8181a796f37940623d5fe102437f53d48751fec95853d69eda692c7774d8f579393d46806729d6d2c4b2cf2033e8f65e5e8bcb6
-
Filesize
1.4MB
MD565fb6421a7e4916d6a6f351624bbaafe
SHA1439d8bde00421eb3747054e51fca3f792a78706d
SHA256d39686fc8ea2cb941d9de8c4e9bb3a4f055e5fcf350d1df5f6cfdfb11a5e7978
SHA51294b7ced0f176a505381b3d2a8ccee058f3fc4d9874589caa09a74a64104800ab4c34dbe6780f56e9f83ae71785fb5fbe19de15dd4211d581419856195034f2d4
-
Filesize
1.3MB
MD5ab1e4776c52cfb3f7bffafceca20954d
SHA12af833cac659231433ba1b863ce72ed3704315b7
SHA2565d91fa67914b8ef6b115da3cec1005c6f15d85af27ffc79cea5049b2b8c979a0
SHA512293bc96903896c1fa6001ade1d43eb48a0ec12e9b8ac5adb2794f8f29de039e830ea50bd66d1b5b6da6782dea63d8b25540258a1e3228b4990156c5a47662b8a
-
Filesize
1.3MB
MD530f5c1e538d74d9b2bc2a90f43dc45d0
SHA19e82da79284474d7b8c1706a500599095b70b812
SHA256f4b8b9a59091229c95b7e32e716136267975cb647f79a3252a672d2a50c2e549
SHA512c6196b265718247b63bebb5380089ed8d67fe136e7c10e29f53bfec6e25d6c34c06eaa1a01569ab811d96ed2eadba2aeab20bc298b3dc75937e2da0024aa5adc
-
Filesize
1.7MB
MD511994cf7d81ec0665b882e62a5b49e6f
SHA133e81d801ead13f71c7d5f56ede2a81e6f1aacc9
SHA256f7fe5573a1562a8562ef34357df6fb925ce4eee1cf60fe17525c08e2b2617720
SHA51281aafe25897c5b41854c8e5223aca76c7d9224364c3290bad6572119daf2c0b481f197767487ff3189c86e2ec23a909739d5451bd140785136d3d62063e8b335
-
Filesize
1.5MB
MD5a0dbc71bbb5bed8eb718e3576a70ac4e
SHA1aba29ddf724804afa612035660565960443e65e2
SHA2565f09ea3a43c0b678d0c267a2284f2e259fa661b1e8af0eb09b6fe726dbc626f1
SHA5129d342eaa6c8181af9b0f46a78a5cd244077c135f81708551d7ce008c99b99686a3479bf3bc3fd148a7bda9c063b1c0af7baa97dbf7c4051b29e514190d768cb1
-
Filesize
2.1MB
MD5904c4acbfcf95f616ec7c6aa15fab749
SHA105df498e5724aaecefc4b2159b247dc3cf2c996f
SHA2563cc06d0bdff360e0e603fab1813c064d18b61cffe53dbe0feaf70891136975dd
SHA5123c99e446d3b63d20fab6449a8b34d34e17f755eba22391d85a21cb7fb67ff59126cf5a06b5f6f2de89f7c88f5d992daf17a0d37ff2958ffd84472d7e33ab265a
-
Filesize
5.8MB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
5.8MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.3MB
-
Filesize
384KB
-
Filesize
2.3MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
5.8MB
-
Filesize
412KB
-
Filesize
5.8MB
-
Filesize
5.8MB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.4MB
-
Filesize
1.4MB