Overview

overview

8

Static

static

3

778daa43bf...cs.exe

windows7-x64

8

778daa43bf...cs.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    156s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    14-05-2024 04:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    778daa43bfe924ff8231b87c133a3f40_NeikiAnalytics.exe

  • Size

    352KB

  • MD5

    778daa43bfe924ff8231b87c133a3f40

  • SHA1

    d8e7d428f8c68c6e19e54875883197843e4f5853

  • SHA256

    02ada37b24aa81c8f6af56a6ac490ad2f3acad1372fefac7d5c4094a73cb9018

  • SHA512

    0c1518cc2cc0c08bd95599947efc5628a1f07326e3b0a7f3d28d4c6a3a15a8e15423a40c73d8b966f3d6ede8046a8d9e60318c3c40ad1680bd43d2240b3fa344

  • SSDEEP

    6144:6Is9OKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPFsEPAsKCe8i:3KofHfHTXQLzgvnzHPowYbvrjD/L7QPs

Score
8/10
persistencespywarestealer

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 19 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry 3 TTPs 6 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Modifies registry class 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\778daa43bfe924ff8231b87c133a3f40_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\778daa43bfe924ff8231b87c133a3f40_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Maps connected drives based on registry
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2244
    • C:\Windows\SysWOW64\ctfmen.exe
      ctfmen.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2524
      • C:\Windows\SysWOW64\smnss.exe
        C:\Windows\system32\smnss.exe
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Enumerates connected drives
        • Maps connected drives based on registry
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:2548

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\satornas.dll
    Filesize

    183B

    MD5

    b24697e3dbbba827e883abff107ff1ca

    SHA1

    270798e0b47ab6f238d2bc8257b304623f38b352

    SHA256

    8304c74f3410d03521624f04ed47b27cc278382b86fa2250ef3e1c7194b4950f

    SHA512

    44a63db1e2c1db58ec9532550b714f4792da81c420a890a88b2791a03078e9ab551a554c00045a0ac29e3d0afff259a1999a37c86e3f7dce286587b00bef0d55

    Download Submit

  • \Windows\SysWOW64\ctfmen.exe
    Filesize

    4KB

    MD5

    7d90feb3802ffaa3dd14360e2473ee44

    SHA1

    d69871f3c1da0b3b607a2f1e29a4f59f4c158d4a

    SHA256

    a10798c3f1a492434241f663c28b13ca77df2f15adfbf084f80ef721e4a9e506

    SHA512

    9f5f3d0ea28c05a836ca2a11feb68bbf82bbfc7f885fc654873b1480952868eddc90f1bf394cf761764bbae48d2e51cd5f32fb931292d535014bd078c0e80f79

    Download Submit

  • \Windows\SysWOW64\shervans.dll
    Filesize

    8KB

    MD5

    af8050f88b8cb159ce53d56b4299ab55

    SHA1

    7cb8a007ec501c318027f287cd266f10e948152b

    SHA256

    9a6e1574da6742e10292cc585a155fbba0a02935fadc5421e9c69db68096e80b

    SHA512

    94979bb38b300e0962a2af2fcd0d02753791cb8b9ce9f27ba668790d95d557e35ce5d3b6f50f52f0198229b37d8671b0119cc0f03feaba07e2b5dda195e13056

    Download Submit

  • \Windows\SysWOW64\smnss.exe
    Filesize

    352KB

    MD5

    012f544ab2a78f9bcccd66deed30eda5

    SHA1

    48290bc6c0005970f8ed56899bdce948c57df021

    SHA256

    7847ce8bbebb647ea6afe331683e1077a63f4298996c89294f20c9753298ebf5

    SHA512

    b3146208b101c8ec92ba7a58d2a7e98b318a27c59bbba5659c998fc2695418b105f8c650f99aa90e10f4013867b2aa50debf685c95dfcbcf2d2ebebd0362d73b

    Download Submit

  • memory/2244-25-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

    Download

  • memory/2244-26-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2244-0-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

    Download

  • memory/2244-18-0x0000000000340000-0x0000000000349000-memory.dmp

    Filesize

    36KB

    Download

  • memory/2244-12-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2524-29-0x0000000000320000-0x0000000000380000-memory.dmp

    Filesize

    384KB

    Download

  • memory/2524-34-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

    Download

  • memory/2548-35-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

    Download

  • memory/2548-41-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2548-43-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2548-45-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

    Download