Analysis

  • max time kernel
    129s
  • max time network
    99s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/05/2024, 10:54

General

  • Target

    cb912c476204e3ef21c9eda2fc6214a0_NeikiAnalytics.exe

  • Size

    71KB

  • MD5

    cb912c476204e3ef21c9eda2fc6214a0

  • SHA1

    32f39ba431bd871cb734d1b02aa31320de2eb4b4

  • SHA256

    56d4ccb45b58f1842ce637557ff5723fde96f45969074250c201a2d14dcbe604

  • SHA512

    748f5bee65bdf49a35c0d940d7668867e78944925c391d22b9ad052e4e180458aad1d1f4802037e5fe0360dc04a8c0620e0d7fa0464ed4fcb9f57358c75d654b

  • SSDEEP

    1536:Fc8N7UsWjcd9w+AyabjDbxE+MwmvlzuazTv:ZRpAyazIliazTv

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cb912c476204e3ef21c9eda2fc6214a0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\cb912c476204e3ef21c9eda2fc6214a0_NeikiAnalytics.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3800
    • C:\Windows\CTS.exe
      "C:\Windows\CTS.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:1516

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml

          Filesize

          392KB

          MD5

          71661453465c3cc82cfb0ad163dd48e3

          SHA1

          401329f442a1a73a805a00b037cede67baf3c228

          SHA256

          acfabbea2ad41a4decf2172ed2e2543f84485ea9fb8979997d553153c78927ff

          SHA512

          be190f0f85aa36102f9cea00e9707e60e8569b4b35b6c0b07fc7d2cddd7383ea9e63263c547c3bdf77c01ab080dafe6354200ae9b817519176dd25e9e961c1e0

        • C:\Users\Admin\AppData\Local\Temp\ON4tOM5KkFgvRNj.exe

          Filesize

          71KB

          MD5

          3f6d9b9f549dea6f9a81acff6a27d7f7

          SHA1

          8ac7059d8219531d6ba350d71ea4b368c80fbcba

          SHA256

          4ab0e0c80a92ac0b4fb3c79b8c91d427166750c657f9d7680b967e9ce1f8b80b

          SHA512

          068da945041ff399a2a7e8adeaff405e2ecc5fa5a52a0eb369d6bfb901414c02752a1f5c198d2b3c372803fb26ee5d9cf0a8fc7cbea8d18382f89c7929713589

        • C:\Windows\CTS.exe

          Filesize

          71KB

          MD5

          f9d4ab0a726adc9b5e4b7d7b724912f1

          SHA1

          3d42ca2098475924f70ee4a831c4f003b4682328

          SHA256

          b43be87e8586ca5e995979883468f3b3d9dc5212fbfd0b5f3341a5b7c56e0fbc

          SHA512

          22a5f0e4b2716244e978ee50771823926f86baf0382ece48fd049f039cf77b5eb0691d83c61148903cff081fdbea969f47b8ed521647717f42bbed5c64552432