Analysis

  • max time kernel
    136s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/05/2024, 11:44

General

  • Target

    d05c3fed6935d824e2f431b7a0287c60_NeikiAnalytics.exe

  • Size

    341KB

  • MD5

    d05c3fed6935d824e2f431b7a0287c60

  • SHA1

    5f8eedb46f86492181c0c388fd1445d10d82f27d

  • SHA256

    35d552cdd668999d6c36a29fac800769f58012f333d88017e9b967ee3ef79ed2

  • SHA512

    b1c2bbd497c0559ce6c532762641c5a798fc875c6b092207c7106f389a0dfeba77f3e0c1cf10e08083b95d22f726029a24c2a8f6905faba4fae72e2d6be44518

  • SSDEEP

    6144:LaVWdyzOxeA1DfdwX3MmIOUSyIB3HmuBEjzNl83oBedUdlK3npWPx:LMROxdDfOnMmXgk3HIcs/dg3nQx

Score
7/10

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 6 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d05c3fed6935d824e2f431b7a0287c60_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\d05c3fed6935d824e2f431b7a0287c60_NeikiAnalytics.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4948
    • C:\Users\Admin\AppData\Local\Temp\7zS453C3B47\setup-stub.exe
      .\setup-stub.exe
      2⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      PID:3520
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 2516
        3⤵
        • Program crash
        PID:4680
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3520 -ip 3520
    1⤵
      PID:1224

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\7zS453C3B47\setup-stub.exe

            Filesize

            550KB

            MD5

            4a8f61f7a57d35412e1432ecd3e17dfd

            SHA1

            470e537ee7b443437c70e3add089acb2ff17c379

            SHA256

            c21143d1784a88c88f66465e33d1ff0cb447b92511bf4109c5c4ead6e1e0b797

            SHA512

            4687820dc9ac6d6836efde9dbe4a0a61d8b4b059fdaabeda0aafced2273b2a278c9bde8154c68edc692c988f294d11ac12f9ee186d45fe80317971d0804841f8

          • C:\Users\Admin\AppData\Local\Temp\nsp78EA.tmp\CityHash.dll

            Filesize

            53KB

            MD5

            2021acc65fa998daa98131e20c4605be

            SHA1

            2e8407cfe3b1a9d839ea391cfc423e8df8d8a390

            SHA256

            c299a0a71bf57eb241868158b4fcfe839d15d5ba607e1bdc5499fdf67b334a14

            SHA512

            cb96d3547bab778cbe94076be6765ed2ae07e183e4888d6c380f240b8c6708662a3b2b6b2294e38c48bc91bf2cc5fc7cfcd3afe63775151ba2fe34b06ce38948

          • C:\Users\Admin\AppData\Local\Temp\nsp78EA.tmp\InetBgDL.dll

            Filesize

            17KB

            MD5

            97c607f5d0add72295f8d0f27b448037

            SHA1

            dfb9a1aa1d3b1f7821152afaac149cad38c8ce3c

            SHA256

            dc98ed352476af459c91100b8c29073988da19d3adc73e2c2086d25f238544a5

            SHA512

            ad759062152869089558389c741876029198c5b98fa725e2d2927866dc8b416ae2de871cb2479f614f6d29b6f646bf7191d02837c3cabc15b8185b563bc46268

          • C:\Users\Admin\AppData\Local\Temp\nsp78EA.tmp\System.dll

            Filesize

            22KB

            MD5

            b361682fa5e6a1906e754cfa08aa8d90

            SHA1

            c6701aee0c866565de1b7c1f81fd88da56b395d3

            SHA256

            b711c4f17690421c9dc8ddb9ed5a9ddc539b3a28f11e19c851e25dcfc7701c04

            SHA512

            2778f91c9bcf83277d26c71118a1ccb0fb3ce50e89729f14f4915bc65dd48503a77b1e5118ce774dea72f5ce3cc8681eb9ca3c55cf90e9f61a177101ba192ae9

          • C:\Users\Admin\AppData\Local\Temp\nsp78EA.tmp\UAC.dll

            Filesize

            28KB

            MD5

            d23b256e9c12fe37d984bae5017c5f8c

            SHA1

            fd698b58a563816b2260bbc50d7f864b33523121

            SHA256

            ec6a56d981892bf251df1439bea425a5f6c7e1c7312d44bedd5e2957f270338c

            SHA512

            13f284821324ffaeadafd3651f64d896186f47cf9a68735642cf37b37de777dba197067fbccd3a7411b5dc7976e510439253bd24c9be1d36c0a59d924c17ae8e

          • C:\Users\Admin\AppData\Local\Temp\nsp78EA.tmp\UserInfo.dll

            Filesize

            14KB

            MD5

            610ad03dec634768cd91c7ed79672d67

            SHA1

            dc8099d476e2b324c09db95059ec5fd3febe1e1e

            SHA256

            c6c413108539f141bea3f679e0e2ef705898c51ec7c2607f478a865fc5e2e2df

            SHA512

            18c3c92be81aadfa73884fe3bdf1fce96ccfbd35057600ef52788a871de293b64f677351ba2885c6e9ce5c3890c22471c92832ffc13ba544e9d0b347c5d33bfd

          • C:\Users\Admin\AppData\Local\Temp\nsp78EA.tmp\WebBrowser.dll

            Filesize

            103KB

            MD5

            b53cd4ad8562a11f3f7c7890a09df27a

            SHA1

            db66b94670d47c7ee436c2a5481110ed4f013a48

            SHA256

            281a0dc8b4f644334c2283897963b20df88fa9fd32acca98ed2856b23318e6ec

            SHA512

            bb45d93ed13df24a2056040c219cdf36ee44c8cddb7e178fdaabcec63ac965e07f679ca1fa42591bba571992af619aa1dc76e819a7901709df79598a2b0cef81

          • C:\Users\Admin\AppData\Local\Temp\nsp78EA.tmp\profile_cleanup.html

            Filesize

            1KB

            MD5

            1cb97b5f8c5f2728b26742d1d0669899

            SHA1

            bb5ab1b8c00810fcb18184a996573c5accdc72c3

            SHA256

            dec82e9caa154300e1aa44f550c16b455a2025be4fb1c3155cb75fe04a6b6611

            SHA512

            768ed2b070485f3bbcf457aefdc0ef8f1737ad8ac4a2703e2feaff424f9a2c69a2f5928a3be898932ef4976a44ea829a099d090bd9941a24d045d5c8ac8b7b43

          • C:\Users\Admin\AppData\Local\Temp\nsp78EA.tmp\profile_cleanup.js

            Filesize

            1KB

            MD5

            d845e8f4c0edb3cab17e6a30090ac5b8

            SHA1

            654f058570f0868f0acc5f0595147f3385a9c265

            SHA256

            1adcfdd9768242c6c639b10e4f0bcda24f6a957a169c1dede265e40336ecbd4f

            SHA512

            401d800c484b74401b90c3285d8b6cc0018baf4979d6ec7bb174f7810d3f60adfa6b4cebeafcee20d5a7c3597447f755af19c5fecf1863e2438fe427dbdf9fed

          • C:\Users\Admin\AppData\Local\Temp\nsp78EA.tmp\stub_common.js

            Filesize

            815B

            MD5

            efce3dce0165b3f6551db47e5c0ac8d6

            SHA1

            1e15f6bb688e3d645092c1aa5ee3136f8de65312

            SHA256

            dab39cbae31848cce0b5c43fddd2674fef4dea5b7a3dacdaabdc78a8a931817e

            SHA512

            cec12da07f52822aaed340b1b751153efa43e5c3d747fa39f03bb2800bf53e9416020d654a818a6088acb2cf5581714433d818537f04af150e6bfb6861c03988

          • memory/4948-2-0x0000000000400000-0x0000000000446000-memory.dmp

            Filesize

            280KB

          • memory/4948-75-0x0000000000400000-0x0000000000446000-memory.dmp

            Filesize

            280KB