Overview

overview

8

Static

static

3

7949dcb1ee...cs.exe

windows7-x64

8

7949dcb1ee...cs.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    15/05/2024, 04:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    7949dcb1ee964a75238afc569b1be510_NeikiAnalytics.exe

  • Size

    127KB

  • MD5

    7949dcb1ee964a75238afc569b1be510

  • SHA1

    8aa5fc36518c57df59d61c60e30a09623b112d44

  • SHA256

    30a5ab4072bf794ef8215363fe75af22437d4a30f222f8f5d0f525c5f60e8481

  • SHA512

    14f9c9950216401fc0b7f546031db9657946481ca0d219fb89aad408b221848486048d4adc7a6257cb14bc8ee6714a42d11da14a470878528bf0cc7b45cd63e0

  • SSDEEP

    3072:OOjWuyt0ZHqsXOKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPPL:OIH9OKofHfHTXQLzgvnzHPowYbvrjD/O

Score
8/10
persistencespywarestealer

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 19 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry 3 TTPs 6 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Modifies registry class 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7949dcb1ee964a75238afc569b1be510_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\7949dcb1ee964a75238afc569b1be510_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Maps connected drives based on registry
    • Drops file in System32 directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1992
    • C:\Windows\SysWOW64\ctfmen.exe
      ctfmen.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2668
      • C:\Windows\SysWOW64\smnss.exe
        C:\Windows\system32\smnss.exe
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Enumerates connected drives
        • Maps connected drives based on registry
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:2560

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Windows\SysWOW64\satornas.dll
          Filesize

          183B

          MD5

          aec35b9f0e6dfb01969ed6372c405b61

          SHA1

          2b5543ff89f84d49fbc8c899520d84ec7484f7a4

          SHA256

          9bea0c9a23e147166288cb72533fccf752c4f61aa611bacb8f940768198efc75

          SHA512

          bb0988f646c8d44fd5983c7ebf539b75dda78d0396945d15a49fa962dddcd30e058e10b3d421959cec228489c7bf0cd57efc1f775b4ca0c2dfdf88c2b9f30475

          Download Submit

        • \Windows\SysWOW64\ctfmen.exe
          Filesize

          4KB

          MD5

          2ae2a3fd2a6258db896fa7f78236190a

          SHA1

          a986696792ba405b54d34791120c2040703fdf3d

          SHA256

          635505b25e70893810d2a6f9598a27bf7eb05900c243c93c2766be1ee7e01230

          SHA512

          b55552980eea68a5a89413a4d7835945bdf034de969eabb419c8cb1a7e932c2fc4dfdb9436932ad348f1dfadf4deea9804de9aea070888f286a7778c47daeff9

          Download Submit

        • \Windows\SysWOW64\shervans.dll
          Filesize

          8KB

          MD5

          05dc569f3f0eab402f6767c3efe4ae44

          SHA1

          9b408d571b51d2f1c48234afc047722451791fa2

          SHA256

          3fd2037fed8a54e873ed5f1472fa6e4d83c990b0bcc3deeb3e0840256aaca605

          SHA512

          d2cd6450e1831b376f01a3f1e984f26f798862f911bc7d9a76083cfac01cb4bcc8d37228f4a71cde7ba5f00d34438baf52e9287111634ed266d675f83c46d3e3

          Download Submit

        • \Windows\SysWOW64\smnss.exe
          Filesize

          127KB

          MD5

          3a2b1f761695ac732fd30bb214994642

          SHA1

          d89c2976f541448dcdd74309b12c309097dd5f50

          SHA256

          4def469b19ef208d18b65211aa73616cfc1750f29aa865f146366eb5c6add5df

          SHA512

          208c136c21b76f515a48c12ba74768fa08dbdf7e18cf7968fd788f681a4f2fe97a42ebd8250ce6912ef8c05ad519410a88bf255c937ef141c45729f5d2c6fb49

          Download Submit

        • memory/1992-12-0x0000000010000000-0x000000001000D000-memory.dmp

          Filesize

          52KB

          Download

        • memory/1992-19-0x0000000000340000-0x0000000000349000-memory.dmp

          Filesize

          36KB

          Download

        • memory/1992-0-0x0000000000400000-0x0000000000421000-memory.dmp

          Filesize

          132KB

          Download

        • memory/1992-28-0x0000000010000000-0x000000001000D000-memory.dmp

          Filesize

          52KB

          Download

        • memory/1992-27-0x0000000000400000-0x0000000000421000-memory.dmp

          Filesize

          132KB

          Download

        • memory/2560-34-0x0000000000400000-0x0000000000421000-memory.dmp

          Filesize

          132KB

          Download

        • memory/2560-41-0x0000000010000000-0x000000001000D000-memory.dmp

          Filesize

          52KB

          Download

        • memory/2560-44-0x0000000000400000-0x0000000000421000-memory.dmp

          Filesize

          132KB

          Download

        • memory/2668-32-0x0000000000400000-0x0000000000409000-memory.dmp

          Filesize

          36KB

          Download