Analysis
-
max time kernel
140s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 03:46
Behavioral task
behavioral1
Sample
1679ea6a5d0372bbc71fc3f9bc7cbda0_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
1679ea6a5d0372bbc71fc3f9bc7cbda0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
1679ea6a5d0372bbc71fc3f9bc7cbda0_NeikiAnalytics.exe
-
Size
27KB
-
MD5
1679ea6a5d0372bbc71fc3f9bc7cbda0
-
SHA1
c413cafa8f99382d82622777cfdabe36002003a6
-
SHA256
2aa2977f302467d912db19494621929c23b30bb5b8d17b7fc95ee3f7ac18a042
-
SHA512
832f97e6569c421a9b8532a91d3cc0566d4487124b19c4831aacf15e7ba0ab5615d95f5bd170bfc3734e0fe47edd22e5c25e2126fc5ba9a8a39a62efb804355e
-
SSDEEP
768:X9J/3FzjgfanEGx8V36unjv88tznuRU65Y4gpph1ePVCMg:N5VzcfA/6LrVpL74gfh16ng
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
CTS.exepid process 2000 CTS.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral1/memory/1936-0-0x00000000003D0000-0x00000000003E8000-memory.dmp upx behavioral1/memory/1936-10-0x00000000003D0000-0x00000000003E8000-memory.dmp upx C:\Windows\CTS.exe upx behavioral1/memory/2000-11-0x0000000000EF0000-0x0000000000F08000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\dPgrx0oWhWxFPqf.exe upx behavioral1/memory/2000-17-0x0000000000EF0000-0x0000000000F08000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
CTS.exe1679ea6a5d0372bbc71fc3f9bc7cbda0_NeikiAnalytics.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" CTS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" 1679ea6a5d0372bbc71fc3f9bc7cbda0_NeikiAnalytics.exe -
Drops file in Windows directory 2 IoCs
Processes:
1679ea6a5d0372bbc71fc3f9bc7cbda0_NeikiAnalytics.exeCTS.exedescription ioc process File created C:\Windows\CTS.exe 1679ea6a5d0372bbc71fc3f9bc7cbda0_NeikiAnalytics.exe File created C:\Windows\CTS.exe CTS.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
1679ea6a5d0372bbc71fc3f9bc7cbda0_NeikiAnalytics.exeCTS.exedescription pid process Token: SeDebugPrivilege 1936 1679ea6a5d0372bbc71fc3f9bc7cbda0_NeikiAnalytics.exe Token: SeDebugPrivilege 2000 CTS.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
1679ea6a5d0372bbc71fc3f9bc7cbda0_NeikiAnalytics.exedescription pid process target process PID 1936 wrote to memory of 2000 1936 1679ea6a5d0372bbc71fc3f9bc7cbda0_NeikiAnalytics.exe CTS.exe PID 1936 wrote to memory of 2000 1936 1679ea6a5d0372bbc71fc3f9bc7cbda0_NeikiAnalytics.exe CTS.exe PID 1936 wrote to memory of 2000 1936 1679ea6a5d0372bbc71fc3f9bc7cbda0_NeikiAnalytics.exe CTS.exe PID 1936 wrote to memory of 2000 1936 1679ea6a5d0372bbc71fc3f9bc7cbda0_NeikiAnalytics.exe CTS.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1679ea6a5d0372bbc71fc3f9bc7cbda0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1679ea6a5d0372bbc71fc3f9bc7cbda0_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\CTS.exe"C:\Windows\CTS.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\dPgrx0oWhWxFPqf.exeFilesize
27KB
MD5d39a78bbc7f66c6eee164974009c214b
SHA1108dbe4940048eb8f85829c077ed326445d455cf
SHA256bed491a5d339949eef4e99591071fcfee33350cc1dfc078e66100cbe5586a015
SHA5125d81388f6fa09ba4dc1fe7f358e66fe12ab3cf3a6288124504306fc1809a8cb3fc0816c452622f153481625966735889c40827a244b031720727f87cda14b78e
-
C:\Windows\CTS.exeFilesize
27KB
MD5a6749b968461644db5cc0ecceffb224a
SHA12795aa37b8586986a34437081351cdd791749a90
SHA256720023737d7ff700818f55612ba069a609a5ddea646bb3509b615ee3523a4ca2
SHA5122a276816290746ed914af9cf6427aef31ce9395b8e9937090e329a8f74fb84c62d15b196e13346caa086842b3f5f549b9eb20cbf422d18c9c1b63e6342ea90b4
-
memory/1936-0-0x00000000003D0000-0x00000000003E8000-memory.dmpFilesize
96KB
-
memory/1936-10-0x00000000003D0000-0x00000000003E8000-memory.dmpFilesize
96KB
-
memory/2000-11-0x0000000000EF0000-0x0000000000F08000-memory.dmpFilesize
96KB
-
memory/2000-17-0x0000000000EF0000-0x0000000000F08000-memory.dmpFilesize
96KB