Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
23-05-2024 02:57
General
-
Target
7d2904bf315ecd17d3218f888b325d10_NeikiAnalytics.exe
-
Size
4.1MB
-
MD5
7d2904bf315ecd17d3218f888b325d10
-
SHA1
91abbc79d24b79bf11fd05f46bcf3c11beb803fe
-
SHA256
b8593c7ab9d69fa724ca0c6498ee8900a2e7f25430669a5c3194eadebe795b5c
-
SHA512
41b170252445eb597647fc0d2e60e95f1f59223de8152303666c817a048302f8951789d4eeb9eb9b0edfcf75b6f712bf85d5f4ac94380948817b5c89e7253ec2
-
SSDEEP
98304:+R0pI/IQlUoMPdmpSpv4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdm05n9klRKN41v
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 24 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7d2904bf315ecd17d3218f888b325d10_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\7d2904bf315ecd17d3218f888b325d10_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbecabod.exeC:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbecabod.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ipconfig > C:\Users\Admin\ipconfig.txt3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ipconfig.exeipconfig4⤵
- Gathers network information
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c netstat -a > C:\Users\Admin\netstat.txt3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\NETSTAT.EXEnetstat -a4⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c dir C:\*.txt /b /s >> C:\Users\Admin\grubb.list3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c dir C:\*.doc /b /s >> C:\Users\Admin\grubb.list3⤵
-
C:\SysDrvZE\xoptisys.exeC:\SysDrvZE\xoptisys.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.1MB
MD542a1fa032fd44ec2053092887d208b73
SHA1583bea1031d52c0b776443917a996ece8448bb64
SHA2561d9b85498c07114076c52e32c3110c1adee4bf90a629640e6816fc2429e02530
SHA5122a901fe7fb4a39ada5f59f81610e43e593acc1ea71ea184a2c6602eaca9f88b9beb6491018f644e248d0e4469b3cb4a6eb5682d42f75bac402120cdc46ef5462
-
Filesize
4.1MB
MD5bf91e87a1f63582f7ac1c1bf65795d2b
SHA1c55ea71821aea92aa2383c096ee8f5a3a9171952
SHA256cbff2300e025feb932c4f5a930ce7274a205d47ec584584b574e8dc9fbd37eb4
SHA51211ef57df9df66b41432ef19ea5690332420e3d9d09e32a6cc936db2576a2e81a2bac4b1d2ce2ab78e83fe3c698bee2ae821eea0ac99213cc93c36053eaf7621c
-
Filesize
4.1MB
MD5896ca15e9921fa1a871d969ba8f86cbc
SHA15ac1639ac8511b08e54018c535539996dde27823
SHA25642c0e458bc4413efff58f9999166ab165eec645720254c8a3e69bf1ed765ffb2
SHA51238cf37f1bf5638d8a1898eae93ec2005fc05e6c8c9957189583203b09f38cf56175c0146f9b14c412ce8c58ab842b942eca9ea9bea0320e18d1ae93cecc28060
-
Filesize
202B
MD57d254b318a234514d51e75ed3bfacf27
SHA171d44c0a7035c841854f1791e0562e1553bce34e
SHA256736cf6d2e624e752f024b94ff64e21fb75da98c3402809db8c3038f411298a43
SHA5124e3ae7c2e89cb8450817f5310222c9074c699b45a276239bba62632af8ac6d83a6152d4ade3ddcb14c2f6ed8cd4feca6725c58892425ad112ce9a31dd521f74c
-
Filesize
202B
MD518d30d3691d8708bb45ec264824c59af
SHA1909b83a8aee482c8893851e34b7f2253f8c1c26a
SHA25658268baca4816f94dc8c868f575678f4da3c499a6b4f6b65ae81ba766823b6b7
SHA512e327d5dbc92d66ad5b0672091b6f9affe36d8a882d259b65e6089b054dc9d8a43942dc78d172bccac729088cd01bfd95c65a2a00c0494fad08cd379a9090d88c
-
Filesize
40KB
MD5bf2650dd8e0e53a96c666056de207749
SHA1861b0e8048b592d15309fa4ad83908cd6b7f09c4
SHA256f8317d4fe1f340a0fa5c82da4f5dc877e0752792bede766da3d551dfa2d2bc89
SHA512bd6f8f36c141a0b8e4a0404b08fa64319c164ae352427701745e2822f73d90d3f0951cdbfbae299bda4a072114bdf95d0e130a7dc0d29597a0be89f3cdcb29c0
-
Filesize
4.1MB
MD5580c300fc1abd63630ae0ac8b6a5595a
SHA1c6c09bba865b13254def2d2ac4e5babfd4c08cae
SHA256d8b0bd062adb81c4377685bf4c55f23776d117447b35c4359b8b606c5cf2ff96
SHA51235c829485a23084426cba751007fb0f4db7128a605cc6c0689c9f0c290cca19b373179cd6b1a82c3fb8e9273982c5dd905041ab62d35092565fb8aeaaeecc9be