Overview

overview

8

Static

static

3

982e584932...cs.exe

windows7-x64

8

982e584932...cs.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    147s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    17/05/2024, 03:23

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    982e5849326f458dfba4435c9c1ae0a0_NeikiAnalytics.exe

  • Size

    118KB

  • MD5

    982e5849326f458dfba4435c9c1ae0a0

  • SHA1

    2520efd4d86be4ff41f0fce19a0c27f69df6b9c7

  • SHA256

    d4e24a99909fe2f294339a252a84c6fb62c0f5ade41e7ddf9b45f405e7dbcb6a

  • SHA512

    6e50ecc9fa6d96a86613515aa477993f9d3734020428e61bb17f121100b38fea1e0bb32aa6fd8dc819444b05eb048a4dc7ae21e8548e4c92ad79bf0a6b870278

  • SSDEEP

    3072:NOjWuyt0ZsqsXOKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPPP:NIs9OKofHfHTXQLzgvnzHPowYbvrjD/i

Score
8/10
persistencespywarestealer

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 19 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry 3 TTPs 6 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Modifies registry class 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\982e5849326f458dfba4435c9c1ae0a0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\982e5849326f458dfba4435c9c1ae0a0_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Maps connected drives based on registry
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1132
    • C:\Windows\SysWOW64\ctfmen.exe
      ctfmen.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:3068
      • C:\Windows\SysWOW64\smnss.exe
        C:\Windows\system32\smnss.exe
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Enumerates connected drives
        • Maps connected drives based on registry
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:2816

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Windows\SysWOW64\satornas.dll
          Filesize

          183B

          MD5

          ce36473e090908a717485527c209c4c6

          SHA1

          29399c4e85c72a5c2310076909a4a6731c0eb792

          SHA256

          5a495cf9e44a7da4a7ddcad2668123ca7e8a2834f391b53b5a471f34afd0a63d

          SHA512

          6c0cd197116d504ee41d53191c4bb9f951715b2b4b11a5c4d57df7abb248489232a29fcc8c760669359bbdf704c45e5852d3d84df4bb0635e2adedc0378548c2

          Download Submit

        • C:\Windows\SysWOW64\smnss.exe
          Filesize

          118KB

          MD5

          d1e6a491c028caadd855ae1efe409cb1

          SHA1

          afbd12eca074c05f870df8e89c468b59a271ee56

          SHA256

          410df94bc3408f8a3bc902619351da857c24c7eaee35fea58613007d6c1eaa5f

          SHA512

          833d3005e3bf6c4b81f52ea3a758ae9653b73afbc47e19abde550f33933b8ce222c506c55c45ba55216b149835e1801f8eec5c6a5bf4b06f1d5a64e76632986b

          Download Submit

        • \Windows\SysWOW64\ctfmen.exe
          Filesize

          4KB

          MD5

          ff0707235a9e519fe9e2e0ac2d16fa9c

          SHA1

          45f1de4215d151769b699f270666d1311031abdd

          SHA256

          60dfc6807d9084a46f6561c2fbeed5b941aadf612790f5a99254221d34b39bc5

          SHA512

          6eeec84008596cb702374905a651f319442e6ea1edb1783d9ec6aa4b594e4a80f99015df8ff1ea2709c5acd01f889733c12e7edf58d09047f2fa4768d8f06408

          Download Submit

        • \Windows\SysWOW64\shervans.dll
          Filesize

          8KB

          MD5

          2b7dd47a3e7784784f659ef4ecb2f7b3

          SHA1

          51a15b308664335c54cea9f3949eac99d4f5bf4e

          SHA256

          85948e71bd41f7aa6450531b9b8d2404ab1ed8464bf9a54913ba24b329367411

          SHA512

          e03a871fc703399eb8795d19ccb54f1fb7f6b564a965b60cbdb6839968eceb2316bb2bc810f6331166a8849cafaf4ae2ed07a68c188c147ccd9769c3502eabb5

          Download Submit

        • memory/1132-1-0x0000000000400000-0x000000000041F000-memory.dmp

          Filesize

          124KB

          Download

        • memory/1132-18-0x0000000000420000-0x0000000000429000-memory.dmp

          Filesize

          36KB

          Download

        • memory/1132-26-0x0000000010000000-0x000000001000D000-memory.dmp

          Filesize

          52KB

          Download

        • memory/1132-16-0x0000000010000000-0x000000001000D000-memory.dmp

          Filesize

          52KB

          Download

        • memory/2816-38-0x0000000000400000-0x000000000041F000-memory.dmp

          Filesize

          124KB

          Download

        • memory/2816-41-0x0000000010000000-0x000000001000D000-memory.dmp

          Filesize

          52KB

          Download

        • memory/2816-44-0x0000000000400000-0x000000000041F000-memory.dmp

          Filesize

          124KB

          Download

        • memory/3068-30-0x0000000000400000-0x0000000000409000-memory.dmp

          Filesize

          36KB

          Download

        • memory/3068-29-0x0000000000320000-0x000000000033F000-memory.dmp

          Filesize

          124KB

          Download