Analysis
-
max time kernel
140s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 10:36
Behavioral task
behavioral1
Sample
24a57fc5bbbec79ae816d25bca1f2ba0_NeikiAnalytics.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
24a57fc5bbbec79ae816d25bca1f2ba0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
24a57fc5bbbec79ae816d25bca1f2ba0_NeikiAnalytics.exe
-
Size
32KB
-
MD5
24a57fc5bbbec79ae816d25bca1f2ba0
-
SHA1
57246d6e988bb1638de7d9ea3991206ef569f602
-
SHA256
1bccadd6975310bd4f16a3b76700f6fbd28061a435a38fe0b194c3dec47298e8
-
SHA512
68f39038b82bca19cf44d87cd510c27e686afc3047b0bd6377424c95bc3a61f12985379fbb932c93ba1f6458586e94c5e74561170fe63e706585d61d2edcee20
-
SSDEEP
768:X9J/3FzjgfanEGx8V36unjv88tznuRU65Y4gpph1ePVCMILB86jlQF:N5VzcfA/6LrVpL74gfh16nIF86WF
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
CTS.exepid process 4780 CTS.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral2/memory/1988-0-0x0000000000610000-0x0000000000628000-memory.dmp upx C:\Windows\CTS.exe upx behavioral2/memory/1988-9-0x0000000000610000-0x0000000000628000-memory.dmp upx behavioral2/memory/4780-10-0x0000000000A30000-0x0000000000A48000-memory.dmp upx C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml upx C:\Users\Admin\AppData\Local\Temp\l0UqWsOIuaiEZ0b.exe upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
24a57fc5bbbec79ae816d25bca1f2ba0_NeikiAnalytics.exeCTS.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" 24a57fc5bbbec79ae816d25bca1f2ba0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" CTS.exe -
Drops file in Windows directory 2 IoCs
Processes:
CTS.exe24a57fc5bbbec79ae816d25bca1f2ba0_NeikiAnalytics.exedescription ioc process File created C:\Windows\CTS.exe CTS.exe File created C:\Windows\CTS.exe 24a57fc5bbbec79ae816d25bca1f2ba0_NeikiAnalytics.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
24a57fc5bbbec79ae816d25bca1f2ba0_NeikiAnalytics.exeCTS.exedescription pid process Token: SeDebugPrivilege 1988 24a57fc5bbbec79ae816d25bca1f2ba0_NeikiAnalytics.exe Token: SeDebugPrivilege 4780 CTS.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
24a57fc5bbbec79ae816d25bca1f2ba0_NeikiAnalytics.exedescription pid process target process PID 1988 wrote to memory of 4780 1988 24a57fc5bbbec79ae816d25bca1f2ba0_NeikiAnalytics.exe CTS.exe PID 1988 wrote to memory of 4780 1988 24a57fc5bbbec79ae816d25bca1f2ba0_NeikiAnalytics.exe CTS.exe PID 1988 wrote to memory of 4780 1988 24a57fc5bbbec79ae816d25bca1f2ba0_NeikiAnalytics.exe CTS.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\24a57fc5bbbec79ae816d25bca1f2ba0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\24a57fc5bbbec79ae816d25bca1f2ba0_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\CTS.exe"C:\Windows\CTS.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xmlFilesize
348KB
MD5ac456bc2c2de08084c11e259987cd59d
SHA1338868fb9623a274b261133163f4122a6f1f4986
SHA256efadba7817cbf3e1d4b0a027a6e6e21a66e40e929b570cfe757e90d162973f06
SHA512530ae247a9ede06d7e08f42c665874f7c50dbe902958f24e01fd71b5ed08bd9862c99b2ab1938543dea83fd4a1a8de2856637f0f06d02f9f2cb0201daade9bd4
-
C:\Users\Admin\AppData\Local\Temp\l0UqWsOIuaiEZ0b.exeFilesize
32KB
MD56c727b90c2263a1f976c22522dd79984
SHA16765ab821d45967773fa7bf19adb83c9bfb18ffb
SHA256342233652d117c6183be3d8b6f994dbadea535c4bd4864d7732f1237d5b2b8c3
SHA512b4b2e0bf22973251a6330f687076f0495ed981cf2475272fedc7dcaf7757141b11ca3f6fa36909ce7ee64285b28c8118b391fdbd6a01b71ea6e1a844e3fb4589
-
C:\Windows\CTS.exeFilesize
27KB
MD5a6749b968461644db5cc0ecceffb224a
SHA12795aa37b8586986a34437081351cdd791749a90
SHA256720023737d7ff700818f55612ba069a609a5ddea646bb3509b615ee3523a4ca2
SHA5122a276816290746ed914af9cf6427aef31ce9395b8e9937090e329a8f74fb84c62d15b196e13346caa086842b3f5f549b9eb20cbf422d18c9c1b63e6342ea90b4
-
memory/1988-0-0x0000000000610000-0x0000000000628000-memory.dmpFilesize
96KB
-
memory/1988-9-0x0000000000610000-0x0000000000628000-memory.dmpFilesize
96KB
-
memory/4780-10-0x0000000000A30000-0x0000000000A48000-memory.dmpFilesize
96KB