Analysis

  • max time kernel
    147s
  • max time network
    133s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    15/05/2024, 11:14

General

  • Target

    cf280305bfeb9c9d4c0d6f479ad12840_NeikiAnalytics.exe

  • Size

    2.6MB

  • MD5

    cf280305bfeb9c9d4c0d6f479ad12840

  • SHA1

    7b6b2ae638196065cf6bf87ab59710ef9ade42f5

  • SHA256

    d7d771d27ed3aeeced41548568292535d6c9d06fb1ce557fcbea21233880a653

  • SHA512

    65edeca3f63b6d40ee1eae8728809a557580e0b57463bf15f824e4bb7ef121d74b4e2a975e6f555cd6e55925d2b03fed75ce6a1639fbc035e931bbcd90d73cec

  • SSDEEP

    24576:ObCj2sObHtqQ4QEfCr7w7yvuqqNq8FroaSaPXRackmrM4Biq7MhLv9GImmVfq4e7:ObCjPKNqQEfsw43qtmVfq40

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.mail.me.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    RICHARD205lord

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 24 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies system certificate store 2 TTPs 4 IoCs
  • NTFS ADS 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cf280305bfeb9c9d4c0d6f479ad12840_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\cf280305bfeb9c9d4c0d6f479ad12840_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1212
    • C:\ProgramData\jhdfkldfhndfkjdfnbfklfnf.exe
      C:\ProgramData\jhdfkldfhndfkjdfnbfklfnf.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • NTFS ADS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2780
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
        0
        3⤵
        • Suspicious use of SetThreadContext
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2708
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
          C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe -f "C:\Users\Admin\AppData\Local\Temp\tmp9157.tmp"
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2508
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
          C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe -f "C:\Users\Admin\AppData\Local\Temp\tmp9223.tmp"
          4⤵
          • Accesses Microsoft Outlook accounts
          • Suspicious use of AdjustPrivilegeToken
          PID:2804
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
          C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe -f "C:\Users\Admin\AppData\Local\Temp\tmpA667.tmp"
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2980
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
        3⤵
        • Creates scheduled task(s)
        PID:2764
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
        3⤵
        • Creates scheduled task(s)
        PID:2044
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
        3⤵
        • Creates scheduled task(s)
        PID:792
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
        3⤵
        • Creates scheduled task(s)
        PID:1232
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
        3⤵
        • Creates scheduled task(s)
        PID:496
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
        3⤵
        • Creates scheduled task(s)
        PID:1792
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
        3⤵
        • Creates scheduled task(s)
        PID:448
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
        3⤵
        • Creates scheduled task(s)
        PID:1740
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
        3⤵
        • Creates scheduled task(s)
        PID:1644
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
        3⤵
        • Creates scheduled task(s)
        PID:2964
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
        3⤵
        • Creates scheduled task(s)
        PID:900
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
        3⤵
        • Creates scheduled task(s)
        PID:2944
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
        3⤵
        • Creates scheduled task(s)
        PID:1416
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
        3⤵
        • Creates scheduled task(s)
        PID:2388
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
        3⤵
        • Creates scheduled task(s)
        PID:1672
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
        3⤵
        • Creates scheduled task(s)
        PID:1576
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
        3⤵
        • Creates scheduled task(s)
        PID:2408
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
        3⤵
        • Creates scheduled task(s)
        PID:2180
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
        3⤵
        • Creates scheduled task(s)
        PID:2616
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
        3⤵
        • Creates scheduled task(s)
        PID:2668
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
        3⤵
        • Creates scheduled task(s)
        PID:2516
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
        3⤵
        • Creates scheduled task(s)
        PID:2796
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
        3⤵
        • Creates scheduled task(s)
        PID:2544
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
        3⤵
        • Creates scheduled task(s)
        PID:2852
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {861DCD1A-8777-4CE5-8607-66F370BAE38F} S-1-5-21-268080393-3149932598-1824759070-1000:UHRQKJCP\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2016
    • C:\ProgramData\winmgr119.exe
      C:\ProgramData\winmgr119.exe
      2⤵
      • Executes dropped EXE
      • NTFS ADS
      • Suspicious behavior: EnumeratesProcesses
      PID:332
    • C:\ProgramData\winmgr119.exe
      C:\ProgramData\winmgr119.exe
      2⤵
      • Executes dropped EXE
      • NTFS ADS
      • Suspicious behavior: EnumeratesProcesses
      PID:1628

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\ProgramData\khaxFMfI\2c945db753d341ef9b0f02d75d493749

          Filesize

          8B

          MD5

          ed0124f2edabcd6ff87b61312dee9b47

          SHA1

          627deb090d4de5985e5e76b84cec23facdb846ba

          SHA256

          21f2bb3e0ff41148a8708299d8dc5d6bdf6f6f7326de2ab725a2ab323aecd20c

          SHA512

          1dd511bbe99a930cc7f7a4262d17e1de773f7f5a7d0d6579574f0df3c817c6ea0474c6db91bb672fdb7f760d6976ba4430f4ca0c471432432302ec6f0d84fb4e

        • C:\ProgramData\winmgr119.exe

          Filesize

          2.6MB

          MD5

          6249a5425d4d3baa42295bc774182561

          SHA1

          28f644257326cd6a5617662b73af17e7ee1fcf6e

          SHA256

          725df0b2314d9dfea223c5b3044017992e90d10d608b1471074b730abdf4fd8f

          SHA512

          13d83599407eccbfbc72176118f51cc0464cc4c68f27ed320a3af6ec9fc3fc27d6d8399a33a5244c109eef043f08c515d3bd3841040d2e09635a5a6dc6e47558

        • C:\Users\Admin\AppData\Local\Temp\CabA1EE.tmp

          Filesize

          68KB

          MD5

          29f65ba8e88c063813cc50a4ea544e93

          SHA1

          05a7040d5c127e68c25d81cc51271ffb8bef3568

          SHA256

          1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

          SHA512

          e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

        • C:\Users\Admin\AppData\Local\Temp\TarA201.tmp

          Filesize

          177KB

          MD5

          435a9ac180383f9fa094131b173a2f7b

          SHA1

          76944ea657a9db94f9a4bef38f88c46ed4166983

          SHA256

          67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

          SHA512

          1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

        • C:\Users\Admin\AppData\Local\Temp\tmp9157.tmp

          Filesize

          399B

          MD5

          e4bf4f7accc657622fe419c0d62419ab

          SHA1

          c2856936dd3de05bad0da5ca94d6b521e40ab5a2

          SHA256

          b32fa68b79c5a7ceaa89e8e537efe33a963c499666202611329944bd2c09318e

          SHA512

          85dc223e39a16ddeba53a4b3d6c9eff14d30ec67dfda1e650da2c9057f640edd033a31868915a31caac0d325d240a7f634f62cd52fbd2adc68bd1d9cb6281431

        • C:\Users\Admin\AppData\Local\Temp\tmp9223.tmp

          Filesize

          400B

          MD5

          de4e5ff058882957cf8a3b5f839a031f

          SHA1

          0b3d8279120fb5fa27efbd9eee89695aa040fc24

          SHA256

          ef54f46b9f1e342fc12e035ae94f57c61ea4e8be4e116f0a1c6f86310f400f49

          SHA512

          a6b0d557e9eec4e56630e5ba64495df318f4fd959fffbdcbf77831185b067906917c9117a0ecd6ac817c7860d5d831cce15820d715657d81e2d817d9fab9fb72

        • C:\Users\Admin\AppData\Local\Temp\tmpA667.tmp

          Filesize

          391B

          MD5

          3525ea58bba48993ea0d01b65ea71381

          SHA1

          1b917678fdd969e5ee5916e5899e7c75a979cf4d

          SHA256

          681bcee53cf679ac674e700136f9229b9184fe60ed6410dbd7a33d462ed13ae2

          SHA512

          5aad8dca43ec85882daf50c469bd04dcf0b62affc8bc605b3e289496a2679d4d548fea8bb0aea7080bbfbcdcab9d275fc6797b9c95b64f9f97ecf79583a83986

        • \ProgramData\jhdfkldfhndfkjdfnbfklfnf.exe

          Filesize

          2.6MB

          MD5

          e6e76737fc9f0394c7afde7f06d6ff60

          SHA1

          d36336f4f9f71775325a43c55e6010ad480c4fdc

          SHA256

          83c2da139c89e89bdea5db45c6b92f7588dda711a5de200361a44ba982451c99

          SHA512

          f06d40e867b9c187e43f2f97966799b415798165e9203cdfe013fc0470424ad46d0b87eeed974e5a0aed987f5be71431097764e0ddbcc2d831b98741912def49

        • memory/2508-23-0x0000000000400000-0x000000000048E000-memory.dmp

          Filesize

          568KB

        • memory/2508-24-0x0000000000400000-0x000000000048E000-memory.dmp

          Filesize

          568KB

        • memory/2508-25-0x0000000000400000-0x000000000048E000-memory.dmp

          Filesize

          568KB

        • memory/2508-30-0x0000000000400000-0x000000000048E000-memory.dmp

          Filesize

          568KB

        • memory/2708-15-0x00000000001D0000-0x000000000029A000-memory.dmp

          Filesize

          808KB

        • memory/2708-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

          Filesize

          4KB

        • memory/2708-10-0x00000000001D0000-0x000000000029A000-memory.dmp

          Filesize

          808KB

        • memory/2708-86-0x0000000074632000-0x0000000074634000-memory.dmp

          Filesize

          8KB

        • memory/2708-18-0x0000000074632000-0x0000000074634000-memory.dmp

          Filesize

          8KB

        • memory/2708-17-0x00000000001D0000-0x000000000029A000-memory.dmp

          Filesize

          808KB

        • memory/2708-13-0x00000000001D0000-0x000000000029A000-memory.dmp

          Filesize

          808KB

        • memory/2804-34-0x0000000000400000-0x0000000000491000-memory.dmp

          Filesize

          580KB

        • memory/2804-74-0x0000000000400000-0x0000000000491000-memory.dmp

          Filesize

          580KB

        • memory/2804-36-0x0000000000400000-0x0000000000491000-memory.dmp

          Filesize

          580KB

        • memory/2804-35-0x0000000000400000-0x0000000000491000-memory.dmp

          Filesize

          580KB

        • memory/2980-77-0x0000000000400000-0x000000000043C000-memory.dmp

          Filesize

          240KB

        • memory/2980-78-0x0000000000400000-0x000000000043C000-memory.dmp

          Filesize

          240KB

        • memory/2980-80-0x0000000000400000-0x000000000043C000-memory.dmp

          Filesize

          240KB