Analysis

  • max time kernel
    149s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/05/2024, 22:23

General

  • Target

    0790af2d17e7a0ab3cd907154b995300_NeikiAnalytics.exe

  • Size

    2.6MB

  • MD5

    0790af2d17e7a0ab3cd907154b995300

  • SHA1

    0852e1736b22c30a419a264ddc0e2a42e2096be1

  • SHA256

    4519dcbdcb111511405abaf7d0b6bb7c12cbb865c02ddb2946304222f57717fe

  • SHA512

    b59d3104a3f31f79e67f2c99b0f4c7e16a8063ce744934a8614d9678ae565ca5148db69fdc2e124678122dedc53e1bbf0b0ff21f7d52986e4d410c237c6477dc

  • SSDEEP

    24576:ObCj2sObHtqQ4QEfCr7w7yvuqqNq8FroaSaPXRackmrM4Biq7MhLv9GImmVfq4ea:ObCjPKNqQEfsw43qtmVfq4L

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.mail.me.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    RICHARD205lord

Signatures

  • Executes dropped EXE 3 IoCs
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 26 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • NTFS ADS 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0790af2d17e7a0ab3cd907154b995300_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\0790af2d17e7a0ab3cd907154b995300_NeikiAnalytics.exe"
    1⤵
    • Adds Run key to start application
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1356
    • C:\ProgramData\jhdfkldfhndfkjdfnbfklfnf.exe
      C:\ProgramData\jhdfkldfhndfkjdfnbfklfnf.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • NTFS ADS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:712
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
        0
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4156
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
          C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe -f "C:\Users\Admin\AppData\Local\Temp\tmp9C5F.tmp"
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4008
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
          C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe -f "C:\Users\Admin\AppData\Local\Temp\tmp9F00.tmp"
          4⤵
          • Accesses Microsoft Outlook accounts
          • Suspicious use of AdjustPrivilegeToken
          PID:1896
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
          C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe -f "C:\Users\Admin\AppData\Local\Temp\tmp9F7E.tmp"
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1744
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
        3⤵
        • Creates scheduled task(s)
        PID:1620
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
        3⤵
        • Creates scheduled task(s)
        PID:1720
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
        3⤵
        • Creates scheduled task(s)
        PID:3752
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
        3⤵
        • Creates scheduled task(s)
        PID:1668
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
        3⤵
        • Creates scheduled task(s)
        PID:4020
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
        3⤵
        • Creates scheduled task(s)
        PID:2924
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
        3⤵
        • Creates scheduled task(s)
        PID:3872
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
        3⤵
        • Creates scheduled task(s)
        PID:2448
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
        3⤵
        • Creates scheduled task(s)
        PID:1912
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
        3⤵
        • Creates scheduled task(s)
        PID:1868
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
        3⤵
        • Creates scheduled task(s)
        PID:4852
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
        3⤵
        • Creates scheduled task(s)
        PID:1376
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
        3⤵
        • Creates scheduled task(s)
        PID:4236
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
        3⤵
        • Creates scheduled task(s)
        PID:3304
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
        3⤵
        • Creates scheduled task(s)
        PID:1288
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
        3⤵
        • Creates scheduled task(s)
        PID:1608
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
        3⤵
        • Creates scheduled task(s)
        PID:5056
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
        3⤵
        • Creates scheduled task(s)
        PID:628
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
        3⤵
        • Creates scheduled task(s)
        PID:3156
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
        3⤵
        • Creates scheduled task(s)
        PID:4764
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
        3⤵
        • Creates scheduled task(s)
        PID:4112
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
        3⤵
        • Creates scheduled task(s)
        PID:4424
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
        3⤵
        • Creates scheduled task(s)
        PID:1800
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
        3⤵
        • Creates scheduled task(s)
        PID:2056
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
        3⤵
        • Creates scheduled task(s)
        PID:2296
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
        3⤵
        • Creates scheduled task(s)
        PID:4528
  • C:\ProgramData\winmgr119.exe
    C:\ProgramData\winmgr119.exe
    1⤵
    • Executes dropped EXE
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    PID:3184
  • C:\ProgramData\winmgr119.exe
    C:\ProgramData\winmgr119.exe
    1⤵
    • Executes dropped EXE
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    PID:2444

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\jhdfkldfhndfkjdfnbfklfnf.exe

    Filesize

    2.6MB

    MD5

    64bfdbd592650c574706ed4b76a69bcb

    SHA1

    01e6ebb45208fdd4504a249f106b81becb338170

    SHA256

    6b0105e36378632134641fe79f86dc12f85982aa781215807be6997c3f49b6ed

    SHA512

    ebbd2a98d404827e5ea35274a4b56f86362de748360739986f2a742e23fc6610207f9b374deb608fc9aabd8bb7ebeb7d8d68bc8c4cc888a318687877fa4a4a61

  • C:\ProgramData\khaxFMfI\2c945db753d341ef9b0f02d75d493749

    Filesize

    8B

    MD5

    9328e7a9a275f19fc438054ff184a8f6

    SHA1

    de795634656fc0b28246146492ed3b386679aac8

    SHA256

    af09189b1169c85d3447445bebeb31c9377fcffc6d5d7be7467f429d0318cca4

    SHA512

    55697ae28580f2ddad8bfa24084662ce2943ae7e41f5ea1b1d1e07c445070f5ead7fe16977301448fdae02bc8b7236e6f03567100cf2d7fca17c0c708befeff9

  • C:\ProgramData\winmgr119.exe

    Filesize

    2.6MB

    MD5

    f202ab12fcca165ed4721e327fb76ba5

    SHA1

    a3586417a5f9b4f73de092aaeecc30aa89edbf74

    SHA256

    ba88c97c06e729f2221839d3009f3e42f2f21cbacb027c317b35b2f6b59b6419

    SHA512

    f93ad816fe1b93973bfadb23b5b60492f5034ba0b97265008286ef3e4fad8dc37e4a31646a5a3b23f83922bf999cb1e9178aa810563104f8c5b8777724b7a356

  • C:\Users\Admin\AppData\Local\Temp\tmp9C5F.tmp

    Filesize

    1KB

    MD5

    b0cc2e6f2d8036c9b5fef218736fa9c9

    SHA1

    64fd3017625979c95ba09d7cbea201010a82f73f

    SHA256

    997aceeb78143e057d4ea0ed699db3cc1c723f699b4532663b7b85c83baa5c50

    SHA512

    a1fe80b2971c4d1141a594f27eaea61500bf701cd1b8fbdb5ac2204a63c8ef862344f8c30f65ce769f0acf2b0718ed33a02744dd1a152c4a62a5318333d29b9b

  • C:\Users\Admin\AppData\Local\Temp\tmp9F00.tmp

    Filesize

    400B

    MD5

    de4e5ff058882957cf8a3b5f839a031f

    SHA1

    0b3d8279120fb5fa27efbd9eee89695aa040fc24

    SHA256

    ef54f46b9f1e342fc12e035ae94f57c61ea4e8be4e116f0a1c6f86310f400f49

    SHA512

    a6b0d557e9eec4e56630e5ba64495df318f4fd959fffbdcbf77831185b067906917c9117a0ecd6ac817c7860d5d831cce15820d715657d81e2d817d9fab9fb72

  • C:\Users\Admin\AppData\Local\Temp\tmp9F7E.tmp

    Filesize

    391B

    MD5

    3525ea58bba48993ea0d01b65ea71381

    SHA1

    1b917678fdd969e5ee5916e5899e7c75a979cf4d

    SHA256

    681bcee53cf679ac674e700136f9229b9184fe60ed6410dbd7a33d462ed13ae2

    SHA512

    5aad8dca43ec85882daf50c469bd04dcf0b62affc8bc605b3e289496a2679d4d548fea8bb0aea7080bbfbcdcab9d275fc6797b9c95b64f9f97ecf79583a83986

  • memory/1744-38-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

  • memory/1744-36-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

  • memory/1744-35-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

  • memory/1896-29-0x0000000000400000-0x0000000000491000-memory.dmp

    Filesize

    580KB

  • memory/1896-31-0x0000000000400000-0x0000000000491000-memory.dmp

    Filesize

    580KB

  • memory/1896-28-0x0000000000400000-0x0000000000491000-memory.dmp

    Filesize

    580KB

  • memory/1896-27-0x0000000000400000-0x0000000000491000-memory.dmp

    Filesize

    580KB

  • memory/4008-15-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/4008-17-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/4008-16-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/4008-24-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/4156-11-0x0000000073870000-0x0000000073E21000-memory.dmp

    Filesize

    5.7MB

  • memory/4156-10-0x0000000073870000-0x0000000073E21000-memory.dmp

    Filesize

    5.7MB

  • memory/4156-9-0x0000000073872000-0x0000000073873000-memory.dmp

    Filesize

    4KB

  • memory/4156-45-0x0000000073872000-0x0000000073873000-memory.dmp

    Filesize

    4KB

  • memory/4156-46-0x0000000073870000-0x0000000073E21000-memory.dmp

    Filesize

    5.7MB

  • memory/4156-47-0x0000000073870000-0x0000000073E21000-memory.dmp

    Filesize

    5.7MB

  • memory/4156-8-0x0000000001180000-0x000000000124A000-memory.dmp

    Filesize

    808KB