Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 06:55
Behavioral task
behavioral1
Sample
66afbc31bf674b654e230610f0b380e0_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
66afbc31bf674b654e230610f0b380e0_NeikiAnalytics.exe
-
Size
231KB
-
MD5
66afbc31bf674b654e230610f0b380e0
-
SHA1
0765177dfb24e77aa6c246d9ea47d919fd073052
-
SHA256
2fbf9b1fa42bb67b2dae0ca1cf30d4d860041c2aa9109dc968df12a14686cd88
-
SHA512
2ef785884ed621f5c67a27f428b404c284575aaf7c77bf947925b173b6496dc2c7c0ffbd8b1f1796f0c286b89e1aeafe4d5ca4d608138286383eb46da4d46449
-
SSDEEP
6144:RloZMhrIkd8g+EtXHkv/iD4jOlqn9GuB70dP6aPLOb8e1m1/i:joZiL+EP8jOlqn9GuB70dP6aP+3
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1936-1-0x0000000000FB0000-0x0000000000FF0000-memory.dmp family_umbral -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Drops file in Drivers directory 1 IoCs
Processes:
66afbc31bf674b654e230610f0b380e0_NeikiAnalytics.exedescription ioc process File opened for modification C:\Windows\System32\drivers\etc\hosts 66afbc31bf674b654e230610f0b380e0_NeikiAnalytics.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 ip-api.com -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 2456 powershell.exe 2508 powershell.exe 2632 powershell.exe 3032 powershell.exe 1744 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
66afbc31bf674b654e230610f0b380e0_NeikiAnalytics.exepowershell.exepowershell.exepowershell.exepowershell.exewmic.exewmic.exedescription pid process Token: SeDebugPrivilege 1936 66afbc31bf674b654e230610f0b380e0_NeikiAnalytics.exe Token: SeDebugPrivilege 2456 powershell.exe Token: SeDebugPrivilege 2508 powershell.exe Token: SeDebugPrivilege 2632 powershell.exe Token: SeDebugPrivilege 3032 powershell.exe Token: SeIncreaseQuotaPrivilege 1568 wmic.exe Token: SeSecurityPrivilege 1568 wmic.exe Token: SeTakeOwnershipPrivilege 1568 wmic.exe Token: SeLoadDriverPrivilege 1568 wmic.exe Token: SeSystemProfilePrivilege 1568 wmic.exe Token: SeSystemtimePrivilege 1568 wmic.exe Token: SeProfSingleProcessPrivilege 1568 wmic.exe Token: SeIncBasePriorityPrivilege 1568 wmic.exe Token: SeCreatePagefilePrivilege 1568 wmic.exe Token: SeBackupPrivilege 1568 wmic.exe Token: SeRestorePrivilege 1568 wmic.exe Token: SeShutdownPrivilege 1568 wmic.exe Token: SeDebugPrivilege 1568 wmic.exe Token: SeSystemEnvironmentPrivilege 1568 wmic.exe Token: SeRemoteShutdownPrivilege 1568 wmic.exe Token: SeUndockPrivilege 1568 wmic.exe Token: SeManageVolumePrivilege 1568 wmic.exe Token: 33 1568 wmic.exe Token: 34 1568 wmic.exe Token: 35 1568 wmic.exe Token: SeIncreaseQuotaPrivilege 1568 wmic.exe Token: SeSecurityPrivilege 1568 wmic.exe Token: SeTakeOwnershipPrivilege 1568 wmic.exe Token: SeLoadDriverPrivilege 1568 wmic.exe Token: SeSystemProfilePrivilege 1568 wmic.exe Token: SeSystemtimePrivilege 1568 wmic.exe Token: SeProfSingleProcessPrivilege 1568 wmic.exe Token: SeIncBasePriorityPrivilege 1568 wmic.exe Token: SeCreatePagefilePrivilege 1568 wmic.exe Token: SeBackupPrivilege 1568 wmic.exe Token: SeRestorePrivilege 1568 wmic.exe Token: SeShutdownPrivilege 1568 wmic.exe Token: SeDebugPrivilege 1568 wmic.exe Token: SeSystemEnvironmentPrivilege 1568 wmic.exe Token: SeRemoteShutdownPrivilege 1568 wmic.exe Token: SeUndockPrivilege 1568 wmic.exe Token: SeManageVolumePrivilege 1568 wmic.exe Token: 33 1568 wmic.exe Token: 34 1568 wmic.exe Token: 35 1568 wmic.exe Token: SeIncreaseQuotaPrivilege 2256 wmic.exe Token: SeSecurityPrivilege 2256 wmic.exe Token: SeTakeOwnershipPrivilege 2256 wmic.exe Token: SeLoadDriverPrivilege 2256 wmic.exe Token: SeSystemProfilePrivilege 2256 wmic.exe Token: SeSystemtimePrivilege 2256 wmic.exe Token: SeProfSingleProcessPrivilege 2256 wmic.exe Token: SeIncBasePriorityPrivilege 2256 wmic.exe Token: SeCreatePagefilePrivilege 2256 wmic.exe Token: SeBackupPrivilege 2256 wmic.exe Token: SeRestorePrivilege 2256 wmic.exe Token: SeShutdownPrivilege 2256 wmic.exe Token: SeDebugPrivilege 2256 wmic.exe Token: SeSystemEnvironmentPrivilege 2256 wmic.exe Token: SeRemoteShutdownPrivilege 2256 wmic.exe Token: SeUndockPrivilege 2256 wmic.exe Token: SeManageVolumePrivilege 2256 wmic.exe Token: 33 2256 wmic.exe Token: 34 2256 wmic.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
66afbc31bf674b654e230610f0b380e0_NeikiAnalytics.exedescription pid process target process PID 1936 wrote to memory of 2456 1936 66afbc31bf674b654e230610f0b380e0_NeikiAnalytics.exe powershell.exe PID 1936 wrote to memory of 2456 1936 66afbc31bf674b654e230610f0b380e0_NeikiAnalytics.exe powershell.exe PID 1936 wrote to memory of 2456 1936 66afbc31bf674b654e230610f0b380e0_NeikiAnalytics.exe powershell.exe PID 1936 wrote to memory of 2508 1936 66afbc31bf674b654e230610f0b380e0_NeikiAnalytics.exe powershell.exe PID 1936 wrote to memory of 2508 1936 66afbc31bf674b654e230610f0b380e0_NeikiAnalytics.exe powershell.exe PID 1936 wrote to memory of 2508 1936 66afbc31bf674b654e230610f0b380e0_NeikiAnalytics.exe powershell.exe PID 1936 wrote to memory of 2632 1936 66afbc31bf674b654e230610f0b380e0_NeikiAnalytics.exe powershell.exe PID 1936 wrote to memory of 2632 1936 66afbc31bf674b654e230610f0b380e0_NeikiAnalytics.exe powershell.exe PID 1936 wrote to memory of 2632 1936 66afbc31bf674b654e230610f0b380e0_NeikiAnalytics.exe powershell.exe PID 1936 wrote to memory of 3032 1936 66afbc31bf674b654e230610f0b380e0_NeikiAnalytics.exe powershell.exe PID 1936 wrote to memory of 3032 1936 66afbc31bf674b654e230610f0b380e0_NeikiAnalytics.exe powershell.exe PID 1936 wrote to memory of 3032 1936 66afbc31bf674b654e230610f0b380e0_NeikiAnalytics.exe powershell.exe PID 1936 wrote to memory of 1568 1936 66afbc31bf674b654e230610f0b380e0_NeikiAnalytics.exe wmic.exe PID 1936 wrote to memory of 1568 1936 66afbc31bf674b654e230610f0b380e0_NeikiAnalytics.exe wmic.exe PID 1936 wrote to memory of 1568 1936 66afbc31bf674b654e230610f0b380e0_NeikiAnalytics.exe wmic.exe PID 1936 wrote to memory of 2256 1936 66afbc31bf674b654e230610f0b380e0_NeikiAnalytics.exe wmic.exe PID 1936 wrote to memory of 2256 1936 66afbc31bf674b654e230610f0b380e0_NeikiAnalytics.exe wmic.exe PID 1936 wrote to memory of 2256 1936 66afbc31bf674b654e230610f0b380e0_NeikiAnalytics.exe wmic.exe PID 1936 wrote to memory of 1548 1936 66afbc31bf674b654e230610f0b380e0_NeikiAnalytics.exe wmic.exe PID 1936 wrote to memory of 1548 1936 66afbc31bf674b654e230610f0b380e0_NeikiAnalytics.exe wmic.exe PID 1936 wrote to memory of 1548 1936 66afbc31bf674b654e230610f0b380e0_NeikiAnalytics.exe wmic.exe PID 1936 wrote to memory of 1744 1936 66afbc31bf674b654e230610f0b380e0_NeikiAnalytics.exe powershell.exe PID 1936 wrote to memory of 1744 1936 66afbc31bf674b654e230610f0b380e0_NeikiAnalytics.exe powershell.exe PID 1936 wrote to memory of 1744 1936 66afbc31bf674b654e230610f0b380e0_NeikiAnalytics.exe powershell.exe PID 1936 wrote to memory of 1660 1936 66afbc31bf674b654e230610f0b380e0_NeikiAnalytics.exe wmic.exe PID 1936 wrote to memory of 1660 1936 66afbc31bf674b654e230610f0b380e0_NeikiAnalytics.exe wmic.exe PID 1936 wrote to memory of 1660 1936 66afbc31bf674b654e230610f0b380e0_NeikiAnalytics.exe wmic.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\66afbc31bf674b654e230610f0b380e0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\66afbc31bf674b654e230610f0b380e0_NeikiAnalytics.exe"1⤵
- Drops file in Drivers directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\66afbc31bf674b654e230610f0b380e0_NeikiAnalytics.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 22⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name2⤵
- Detects videocard installed
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\WHL2HQNU12X4ICAQJQJL.tempFilesize
7KB
MD51c9a23bdb8cf9c801f2135f1f7e1594e
SHA1eedf146476a87c74cecfde6041d912e2511138b3
SHA256c41fc86dc10eb84ef29f59019c01425d52876ff23d7558ce5bf0cf578c5d12f9
SHA51275a1be1525cae6082db7c9024faa808a8a5ffcf32fef0713d3723b6ba004b32a4a3950fa146851b8d914a9ecdeffcfba916a790554f7129f0831ce26551dcb39
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/1744-48-0x00000000022C0000-0x00000000022C8000-memory.dmpFilesize
32KB
-
memory/1936-0-0x000007FEF5693000-0x000007FEF5694000-memory.dmpFilesize
4KB
-
memory/1936-1-0x0000000000FB0000-0x0000000000FF0000-memory.dmpFilesize
256KB
-
memory/1936-2-0x000007FEF5690000-0x000007FEF607C000-memory.dmpFilesize
9.9MB
-
memory/1936-52-0x000007FEF5690000-0x000007FEF607C000-memory.dmpFilesize
9.9MB
-
memory/2456-11-0x000007FEED980000-0x000007FEEE31D000-memory.dmpFilesize
9.6MB
-
memory/2456-12-0x000007FEED980000-0x000007FEEE31D000-memory.dmpFilesize
9.6MB
-
memory/2456-13-0x000007FEED980000-0x000007FEEE31D000-memory.dmpFilesize
9.6MB
-
memory/2456-10-0x000007FEED980000-0x000007FEEE31D000-memory.dmpFilesize
9.6MB
-
memory/2456-9-0x0000000001EF0000-0x0000000001EF8000-memory.dmpFilesize
32KB
-
memory/2456-8-0x000000001B680000-0x000000001B962000-memory.dmpFilesize
2.9MB
-
memory/2456-7-0x000007FEEDC3E000-0x000007FEEDC3F000-memory.dmpFilesize
4KB
-
memory/2508-19-0x000000001B880000-0x000000001BB62000-memory.dmpFilesize
2.9MB
-
memory/2508-20-0x0000000001F40000-0x0000000001F48000-memory.dmpFilesize
32KB