Analysis
-
max time kernel
140s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 13:59
Behavioral task
behavioral1
Sample
9469a5c9059ad25aab75f6152dbe2ab0_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
9469a5c9059ad25aab75f6152dbe2ab0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
9469a5c9059ad25aab75f6152dbe2ab0_NeikiAnalytics.exe
-
Size
27KB
-
MD5
9469a5c9059ad25aab75f6152dbe2ab0
-
SHA1
16a537abab7d835d30da8f1c2be786b5ac0259cc
-
SHA256
d4970f21788c6e138c10e66c1a1411ad1ec8cc42c9e3b53ed9dae3637c1dbf24
-
SHA512
48c241ef1d3d8ae3d14a439c06868bf41de2a30195ae2ebb4f8f5f98b5ff8a4f228016bd7fcca04ab9f8465a866973c33656494ef67da42a02ef065f6195c1a6
-
SSDEEP
768:X9J/3FzjgfanEGx8V36unjv88tznuRU65Y4gpph1ePVCM4:N5VzcfA/6LrVpL74gfh16n4
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
CTS.exepid process 1176 CTS.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral2/memory/748-0-0x00000000004A0000-0x00000000004B8000-memory.dmp upx behavioral2/memory/748-8-0x00000000004A0000-0x00000000004B8000-memory.dmp upx C:\Windows\CTS.exe upx behavioral2/memory/1176-10-0x0000000000230000-0x0000000000248000-memory.dmp upx C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml upx C:\Users\Admin\AppData\Local\Temp\lpdAZXGc3dJ58SL.exe upx behavioral2/memory/1176-34-0x0000000000230000-0x0000000000248000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
9469a5c9059ad25aab75f6152dbe2ab0_NeikiAnalytics.exeCTS.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" 9469a5c9059ad25aab75f6152dbe2ab0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" CTS.exe -
Drops file in Windows directory 2 IoCs
Processes:
9469a5c9059ad25aab75f6152dbe2ab0_NeikiAnalytics.exeCTS.exedescription ioc process File created C:\Windows\CTS.exe 9469a5c9059ad25aab75f6152dbe2ab0_NeikiAnalytics.exe File created C:\Windows\CTS.exe CTS.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
9469a5c9059ad25aab75f6152dbe2ab0_NeikiAnalytics.exeCTS.exedescription pid process Token: SeDebugPrivilege 748 9469a5c9059ad25aab75f6152dbe2ab0_NeikiAnalytics.exe Token: SeDebugPrivilege 1176 CTS.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
9469a5c9059ad25aab75f6152dbe2ab0_NeikiAnalytics.exedescription pid process target process PID 748 wrote to memory of 1176 748 9469a5c9059ad25aab75f6152dbe2ab0_NeikiAnalytics.exe CTS.exe PID 748 wrote to memory of 1176 748 9469a5c9059ad25aab75f6152dbe2ab0_NeikiAnalytics.exe CTS.exe PID 748 wrote to memory of 1176 748 9469a5c9059ad25aab75f6152dbe2ab0_NeikiAnalytics.exe CTS.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9469a5c9059ad25aab75f6152dbe2ab0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\9469a5c9059ad25aab75f6152dbe2ab0_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\CTS.exe"C:\Windows\CTS.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xmlFilesize
351KB
MD580d7581a6ae6b176c0fb40770919f514
SHA1ce08c3ef38731919b9b881b5ec0172479bb2fa7c
SHA25679052be97d7ca2acdb0e5cbf7fb8b45c063aed1897f10f90a029105c6947c187
SHA512b6843cdd3b24d9cf19ba5bb24ec33a58ca7c39093fdaf7ee37a09bf1466efd148b15660914f27b08f171d852eaf2c1c2a84619d2e8246350a7809dba51953424
-
C:\Users\Admin\AppData\Local\Temp\lpdAZXGc3dJ58SL.exeFilesize
27KB
MD5d5e8ba1cd1776cec72c2976ba1a91b9c
SHA12820ed9f8ddbc53c20f7e60314d2fd141538313e
SHA2562b80940d99a6b37cef83cd9e4fc306a4085b626a7299be324f879943b80b4d17
SHA512fd68f60ec6e17e87222bc51285964100586cae2766c58b89484984cac7a995267f7d006791bc4bafc558bfbe91ee969a7c10313d290112a204307ca0fba91a47
-
C:\Windows\CTS.exeFilesize
27KB
MD5a6749b968461644db5cc0ecceffb224a
SHA12795aa37b8586986a34437081351cdd791749a90
SHA256720023737d7ff700818f55612ba069a609a5ddea646bb3509b615ee3523a4ca2
SHA5122a276816290746ed914af9cf6427aef31ce9395b8e9937090e329a8f74fb84c62d15b196e13346caa086842b3f5f549b9eb20cbf422d18c9c1b63e6342ea90b4
-
memory/748-0-0x00000000004A0000-0x00000000004B8000-memory.dmpFilesize
96KB
-
memory/748-8-0x00000000004A0000-0x00000000004B8000-memory.dmpFilesize
96KB
-
memory/1176-10-0x0000000000230000-0x0000000000248000-memory.dmpFilesize
96KB
-
memory/1176-34-0x0000000000230000-0x0000000000248000-memory.dmpFilesize
96KB