Overview

overview

8

Static

static

3

25479f2eda...cs.exe

windows7-x64

8

25479f2eda...cs.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    22/05/2024, 08:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    25479f2edaf76b28ea5b55de764ff2a0_NeikiAnalytics.exe

  • Size

    224KB

  • MD5

    25479f2edaf76b28ea5b55de764ff2a0

  • SHA1

    1ef545dd5319e06d10d07e7dd24af4b2d3fa75b2

  • SHA256

    3fd14ec8d4d1781442e189c8cf3000d818dbb5a93121ca171b34d4e0b47f1928

  • SHA512

    00bc74f3bd9b291ea3d4663e98b8c387cfc6d118a3eee87caecbe1c13e90c591aa167a869854dcd843a848680971ee15648111a8732a112981eb27bf8429eba3

  • SSDEEP

    6144:eIs9OKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPFsEPAsKCtZy:DKofHfHTXQLzgvnzHPowYbvrjD/L7QPo

Score
8/10
persistencespywarestealer

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 19 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry 3 TTPs 6 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Modifies registry class 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\25479f2edaf76b28ea5b55de764ff2a0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\25479f2edaf76b28ea5b55de764ff2a0_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Maps connected drives based on registry
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2320
    • C:\Windows\SysWOW64\ctfmen.exe
      ctfmen.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2280
      • C:\Windows\SysWOW64\smnss.exe
        C:\Windows\system32\smnss.exe
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Enumerates connected drives
        • Maps connected drives based on registry
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:2692

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\satornas.dll
    Filesize

    183B

    MD5

    684be97642611293b1dbb68c9226eaf7

    SHA1

    5626b1c46108667d09a7eb2211e9c993e10ce3b5

    SHA256

    8e981b2e747fe5107956f9a4fe63473621c4ee655ee463ba0b592660239b77f3

    SHA512

    c67bb49f4e59060a483dabe1108e73d545b1657b151182f79258e67775b2352758ac37b5105fc341e3199a5b3b978e43241438fc3ad812e2836e605378813778

    Download Submit

  • \Windows\SysWOW64\ctfmen.exe
    Filesize

    4KB

    MD5

    c3cd388f0706879343631717c08be621

    SHA1

    e827937b147a12543d306b6a8e67e0f84df7f089

    SHA256

    cf8a5235cc1a458aa72dccd5464aa7d2fe587382f9dd5c3b7ddd2e74d7cba256

    SHA512

    38e158210a271f880637e02492985927f0fafe7a93b9b1539341ea5ca160d9feb254fb45fc400729b3ef0a81fe49dcb0276beba98b8d9dbed11f03b2bfe85be5

    Download Submit

  • \Windows\SysWOW64\shervans.dll
    Filesize

    8KB

    MD5

    3d527beecc8f115a4a6f2c5e9bd05db8

    SHA1

    f89748d1aa1539645a6b74b62ed1b8ca6c089f8c

    SHA256

    cba2bf456189bdcc027d40a9f1ffaf4e51baae2dcab8e48f457a9ffaf7e574a3

    SHA512

    a28069b2c54a6438d56a13cc77ecbe8cbb8b5ef33c6f1e8d900eac1b46b110f586c89146ae4d2594568dde7098af6ff7b19e8159b821d813b55f6889185226c4

    Download Submit

  • \Windows\SysWOW64\smnss.exe
    Filesize

    224KB

    MD5

    73b461a0428c1259a76593c8e4e89407

    SHA1

    77819ee47f6112b437d15aebddf4967ad79f7cf3

    SHA256

    e1197634f7cf054a04add6f50d8e2b02dc2e884cf46025405ada966b5bc4308e

    SHA512

    73a80984634ff7b6686f621191e5e5804ff149b351a5478a2bc1f91324e7e4b8cb3217591961ae04f437d5fde89efd4954567cb315cc53ac0a3e58321cdf3255

    Download Submit

  • memory/2280-31-0x00000000003B0000-0x00000000003E2000-memory.dmp

    Filesize

    200KB

    Download

  • memory/2280-28-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

    Download

  • memory/2280-35-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

    Download

  • memory/2320-25-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB

    Download

  • memory/2320-26-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2320-18-0x0000000000340000-0x0000000000349000-memory.dmp

    Filesize

    36KB

    Download

  • memory/2320-0-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB

    Download

  • memory/2320-16-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2692-37-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB

    Download

  • memory/2692-43-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2692-46-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB

    Download