Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    15/05/2024, 10:54

General

  • Target

    cb912c476204e3ef21c9eda2fc6214a0_NeikiAnalytics.exe

  • Size

    71KB

  • MD5

    cb912c476204e3ef21c9eda2fc6214a0

  • SHA1

    32f39ba431bd871cb734d1b02aa31320de2eb4b4

  • SHA256

    56d4ccb45b58f1842ce637557ff5723fde96f45969074250c201a2d14dcbe604

  • SHA512

    748f5bee65bdf49a35c0d940d7668867e78944925c391d22b9ad052e4e180458aad1d1f4802037e5fe0360dc04a8c0620e0d7fa0464ed4fcb9f57358c75d654b

  • SSDEEP

    1536:Fc8N7UsWjcd9w+AyabjDbxE+MwmvlzuazTv:ZRpAyazIliazTv

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cb912c476204e3ef21c9eda2fc6214a0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\cb912c476204e3ef21c9eda2fc6214a0_NeikiAnalytics.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2400
    • C:\Windows\CTS.exe
      "C:\Windows\CTS.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:2208

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\U9Mre5fmBYcLICU.exe

          Filesize

          71KB

          MD5

          f91ab761a32e45af84a2c64eca960c86

          SHA1

          d1dae13766a32f5b5aee96fe7893120f5c215cb6

          SHA256

          f00e32dfde2a3ccac244fbfd1b48790e7bda2a9f8d86497688a10e7f6dea153a

          SHA512

          feb60cc6252859e01c4ab3c7b95feaa21eeb6a9ce24a536ca7d1f3b409021fcf874f872a077e09c452d90ba0a0f2306f74aea505bba9b77d98922e0f5156a3bf

        • C:\Windows\CTS.exe

          Filesize

          71KB

          MD5

          f9d4ab0a726adc9b5e4b7d7b724912f1

          SHA1

          3d42ca2098475924f70ee4a831c4f003b4682328

          SHA256

          b43be87e8586ca5e995979883468f3b3d9dc5212fbfd0b5f3341a5b7c56e0fbc

          SHA512

          22a5f0e4b2716244e978ee50771823926f86baf0382ece48fd049f039cf77b5eb0691d83c61148903cff081fdbea969f47b8ed521647717f42bbed5c64552432