a857667fe80dec03895bfecf0aa1186802a6cf45c9a1a3e0a104578ea77699f0

Analysis

max time kernel
144s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 21:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

993c01226bbb74701aa5bc789a9294e0_NeikiAnalytics.exe
Size

41KB
MD5

993c01226bbb74701aa5bc789a9294e0
SHA1

eed8ef7d9344e4cb6b0d6db86121ce9803fc896e
SHA256

a857667fe80dec03895bfecf0aa1186802a6cf45c9a1a3e0a104578ea77699f0
SHA512

c363da7b3346234b2583ead64edc5f998f25b91c364aac0aa417575303f1120245c85d4376c55389f45c706a789fa3d111998a6ebeebea6d1fca9a54e1aeac58
SSDEEP

768:IMAQ+BzWPEwnE+KHM2/fWsaoOD/hosxp0TlZUAr33U/hKsoJUrA7xaEqzA4:t3x85+Ks2zaoODdp0RZUzhgOpz/

Score

7^/10

persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

mB99r71kGPyxagg.exesvhost.exe

pid process

4808 mB99r71kGPyxagg.exe
2916 svhost.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
4808	mB99r71kGPyxagg.exe
2916	svhost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

993c01226bbb74701aa5bc789a9294e0_NeikiAnalytics.exesvhost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Winhost = "C:\\Windows\\svhost.exe"	993c01226bbb74701aa5bc789a9294e0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Winhost = "C:\\Windows\\svhost.exe"	svhost.exe

Drops file in Windows directory 2 IoCs

Processes:

993c01226bbb74701aa5bc789a9294e0_NeikiAnalytics.exesvhost.exe

description ioc process

File created C:\Windows\svhost.exe 993c01226bbb74701aa5bc789a9294e0_NeikiAnalytics.exe
File created C:\Windows\svhost.exe svhost.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

993c01226bbb74701aa5bc789a9294e0_NeikiAnalytics.exesvhost.exe

description pid process

Token: SeDebugPrivilege 1380 993c01226bbb74701aa5bc789a9294e0_NeikiAnalytics.exe
Token: SeDebugPrivilege 2916 svhost.exe

description	ioc	process
File created	C:\Windows\svhost.exe	993c01226bbb74701aa5bc789a9294e0_NeikiAnalytics.exe
File created	C:\Windows\svhost.exe	svhost.exe

description	pid	process
Token: SeDebugPrivilege	1380	993c01226bbb74701aa5bc789a9294e0_NeikiAnalytics.exe
Token: SeDebugPrivilege	2916	svhost.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

993c01226bbb74701aa5bc789a9294e0_NeikiAnalytics.exe

description	pid	process	target process
PID 1380 wrote to memory of 4808	1380	993c01226bbb74701aa5bc789a9294e0_NeikiAnalytics.exe	mB99r71kGPyxagg.exe
PID 1380 wrote to memory of 4808	1380	993c01226bbb74701aa5bc789a9294e0_NeikiAnalytics.exe	mB99r71kGPyxagg.exe
PID 1380 wrote to memory of 2916	1380	993c01226bbb74701aa5bc789a9294e0_NeikiAnalytics.exe	svhost.exe
PID 1380 wrote to memory of 2916	1380	993c01226bbb74701aa5bc789a9294e0_NeikiAnalytics.exe	svhost.exe
PID 1380 wrote to memory of 2916	1380	993c01226bbb74701aa5bc789a9294e0_NeikiAnalytics.exe	svhost.exe

C:\Users\Admin\AppData\Local\Temp\993c01226bbb74701aa5bc789a9294e0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\993c01226bbb74701aa5bc789a9294e0_NeikiAnalytics.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1380

C:\Users\Admin\AppData\Local\Temp\mB99r71kGPyxagg.exe
C:\Users\Admin\AppData\Local\Temp\mB99r71kGPyxagg.exe
2⤵
- Executes dropped EXE
PID:4808

C:\Windows\svhost.exe
"C:\Windows\svhost.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1400 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:8
1⤵
PID:3996

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml
Filesize
734KB

MD5
6285cc36afabf33497d3d4f00ed180be

SHA1
342bbd33df58b0451ea2869d30974d03ea162beb

SHA256
f4328cf817a0d4b829d1729461f317ba569f58d64af00c1049d9351697e8f262

SHA512
2a22ee1748e033ce5a9e4e6ebb0b97da1f6ee5cd771dbcafeb3c59658ec870c7b6faab9b557f308bf99aec844dac725df8f765fb504e1fd051138d2b0bed92d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\mB99r71kGPyxagg.exe
Filesize
25KB

MD5
abbd49c180a2f8703f6306d6fa731fdc

SHA1
d63f4bfe7f74936b2fbace803e3da6103fbf6586

SHA256
5f411c0bd9ed9a42b0f07ed568c7d0cf358a83063b225a1f8f7da3296dde90f1

SHA512
290dd984acc451b778f3db8c510bae7aec1d9547c3ad0a1829df731c136e4ecc9a37dc6a786cf8f1ecc4d14339aed1288af25055f450f6f953138c8d4d5c36e9

Download Submit
C:\Windows\svhost.exe
Filesize
16KB

MD5
76fd02b48297edb28940bdfa3fa1c48a

SHA1
bf5cae1057a0aca8bf3aab8b121fe77ebb0788ce

SHA256
07abd35f09b954eba7011ce18b225017c50168e039732680df58ae703324825c

SHA512
28c7bf4785547f6df9d678699a55cfb24c429a2bac5375733ff2f760c92933190517d8acd740bdf69c3ecc799635279af5d7ebd848c5b471318d1f330c441ff0

Download Submit
memory/4808-7-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download