Overview

overview

8

Static

static

3

0c011951cd...cs.exe

windows7-x64

8

0c011951cd...cs.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    146s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    12/05/2024, 12:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    0c011951cd513bc8832f21dc3f0d3de0_NeikiAnalytics.exe

  • Size

    56KB

  • MD5

    0c011951cd513bc8832f21dc3f0d3de0

  • SHA1

    3158d0ee9669ab4fc2a572a88ecd535c3cfdd990

  • SHA256

    8a85d8932ea4882636c50ea74dee4f6c71355d0df0244f3c8222fdd5cd76c324

  • SHA512

    94563a0811079a7c4aad54cbf8da836b763d81c5c3716d77e55e01c05dd548a89b4fb1e97c977a3fe1b5a56e7ec77e05f88b3fe6bfb697a9d2254fc023499cf7

  • SSDEEP

    1536:Eq5VwWDjDkdTRqHFOn8tIbbeYiuZIFS9b1YTjg:Eq5ud9qHFO8Kf3rIIb1Yvg

Score
8/10
persistencespywarestealer

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 19 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry 3 TTPs 6 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Modifies registry class 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0c011951cd513bc8832f21dc3f0d3de0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\0c011951cd513bc8832f21dc3f0d3de0_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Maps connected drives based on registry
    • Drops file in System32 directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2740
    • C:\Windows\SysWOW64\ctfmen.exe
      ctfmen.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2592
      • C:\Windows\SysWOW64\smnss.exe
        C:\Windows\system32\smnss.exe
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Enumerates connected drives
        • Maps connected drives based on registry
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:2652

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Windows\SysWOW64\satornas.dll
          Filesize

          183B

          MD5

          5d714ac1540a09a881266f8d60803a9a

          SHA1

          0138062a3ad85c7fdfe9505c1260d9d64b597eff

          SHA256

          0781160c001d74354ad9bbdba115e082a96f1dc982cc06fc710916adfb2e0c57

          SHA512

          6757974403f491e1bb0b9fc4446450fc5ba24e744ff5a0b2985d5ab21405de54aff2c5188affd90bab01a80b3de161b6482df09c1e2a976a17a3e9f8ec9a469b

          Download Submit

        • C:\Windows\SysWOW64\smnss.exe
          Filesize

          56KB

          MD5

          8ed9e98e4748666ca089690cd7f89013

          SHA1

          391d6fa0dab2f056c6de96fef2b03b8a9113494c

          SHA256

          20b5357a8179afa3a2a08f29b301ab771c2684f07f22db0da804ff3db85faac8

          SHA512

          72f6eee0d25b7e88ebe63dd796ec7e6c8cca89412a47e850105fe6e88621c69fe6d59c57ff42313f1976f4068de53c57c11ad5cad639bc9d9cb9bbb6690e0d67

          Download Submit

        • \Windows\SysWOW64\ctfmen.exe
          Filesize

          4KB

          MD5

          8e689e3e10df26e79f535597d2fec50c

          SHA1

          a19abca9d2205c8668c58e7f528bc47678985aee

          SHA256

          5cf1b161fafbfe3845de76cc4c81764e8b9391d48339b278933724007a864a43

          SHA512

          d4ecfbbe1f22c8603694fdef5180c01157121a94fd08ff541fb9cf05545676dcedd45bc593c8c929641e30585ad27ca70f13ffb45a32a6ff367d4f9ed4a18377

          Download Submit

        • \Windows\SysWOW64\shervans.dll
          Filesize

          8KB

          MD5

          4db779fcabe2955121112ca5d4cc6709

          SHA1

          7337feaf9a085ef20a1107f13a92ad31e6af85a4

          SHA256

          f8b966794579a4c064a9c80c5b5d5ed01aaa17daf50e682cdf04a0c8ea3a8997

          SHA512

          087c99dc87e4561b23f97223056c7779ffc3e77b966493c54ec3ca3efa7912e5e065b5bf7bdf3bd114205ccc0529870f8192aff3ae513f0fa7b597a5f96b4cb7

          Download Submit

        • memory/2592-33-0x0000000000400000-0x0000000000409000-memory.dmp

          Filesize

          36KB

          Download

        • memory/2652-35-0x0000000000400000-0x000000000041F000-memory.dmp

          Filesize

          124KB

          Download

        • memory/2652-42-0x0000000010000000-0x000000001000D000-memory.dmp

          Filesize

          52KB

          Download

        • memory/2652-43-0x0000000000400000-0x000000000041F000-memory.dmp

          Filesize

          124KB

          Download

        • memory/2652-47-0x0000000000400000-0x000000000041F000-memory.dmp

          Filesize

          124KB

          Download

        • memory/2652-49-0x0000000000400000-0x000000000041F000-memory.dmp

          Filesize

          124KB

          Download

        • memory/2740-27-0x0000000000400000-0x000000000041F000-memory.dmp

          Filesize

          124KB

          Download

        • memory/2740-28-0x0000000010000000-0x000000001000D000-memory.dmp

          Filesize

          52KB

          Download

        • memory/2740-18-0x0000000000340000-0x0000000000349000-memory.dmp

          Filesize

          36KB

          Download

        • memory/2740-0-0x0000000000400000-0x000000000041F000-memory.dmp

          Filesize

          124KB

          Download

        • memory/2740-16-0x0000000010000000-0x000000001000D000-memory.dmp

          Filesize

          52KB

          Download