Analysis

  • max time kernel
    150s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    26/05/2024, 03:16

General

  • Target

    5a23077e9e58a3b323a0e8b90632f9c0_NeikiAnalytics.exe

  • Size

    3.6MB

  • MD5

    5a23077e9e58a3b323a0e8b90632f9c0

  • SHA1

    4829630d1fdd1c7981a915c902eafa18aa4e3f20

  • SHA256

    60d45cf36c25afb59d0ebcf196c64fc5e96ed35c156f6dd3e4809d82c557f48b

  • SHA512

    f957a3bca3e3e542ed2b210bcf02a8f07b2547eecd21db1ebdda2581efcc7d8d53b10dbc87c038640a348cd13231c5171c858e2bad75d9e50e7f7df248343021

  • SSDEEP

    49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBUB/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUp3bVz8eLFcz

Malware Config

Signatures

  • Drops startup file 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5a23077e9e58a3b323a0e8b90632f9c0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\5a23077e9e58a3b323a0e8b90632f9c0_NeikiAnalytics.exe"
    1⤵
    • Drops startup file
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2276
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecabod.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecabod.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:2008
    • C:\FilesRA\abodsys.exe
      C:\FilesRA\abodsys.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:1980

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\FilesRA\abodsys.exe

          Filesize

          3.6MB

          MD5

          ec55c202d21f238a14572e7a890b631b

          SHA1

          c388f76fe316d70b37eaa499f1bb6b18cdfb6fb8

          SHA256

          730c45aa477597028916fa943dd2efc93aeac391ef76fdabd93bdde44991b995

          SHA512

          71cc167db8bd70b4d50c7ad5966981e8ac6fd98981ca973257702225806377dcd73b73b725dde85302996f630b4714bb78b885f8104d4f840e94435145bd56c5

        • C:\MintXE\optiasys.exe

          Filesize

          3.6MB

          MD5

          5aea361d614fc982dac8a3c1cf7b3de1

          SHA1

          ef4100fe78c487374af00a8b0b260dd6a64d8708

          SHA256

          d180fe16debb3c2ce2c7d5b4d7214a8b2f3646c68ec3537715f2ad8de3159441

          SHA512

          9539bf24d683331d2c6335e38c4ce277ec4162bfd397b4d7c55fce8dd80de8cb3d5f2f5c544dd319b6b99b43a3d95759a4b98d0368cecb17edd38f83ec7519e1

        • C:\Users\Admin\253086396416_6.1_Admin.ini

          Filesize

          168B

          MD5

          c706d8fc597fe10c890258aa03e4defb

          SHA1

          fe071da16802a145314d8e17651331a8c24db21c

          SHA256

          1e648df8b1c4135728772bffc527c659e3849989fd90dc4259744931cf284bee

          SHA512

          48afce71354f094729144ad638db74c318f314c08ed4425bc8e15e53ec2d4b47d9aa3798c7f860e63dd761a9c6ad9b732426b063c03a37a2b40a7ae3b8de1d38

        • C:\Users\Admin\253086396416_6.1_Admin.ini

          Filesize

          200B

          MD5

          837d8d406931c19607f7226e1718c8bc

          SHA1

          cc6aac10c1e74a6496c10f604569bea449ba7c58

          SHA256

          118994c2b7dbdab71413348bf940b25055092b9fe694ac8981706bae22e63db7

          SHA512

          b1e6a4371b68f472617b4f29e1cc58f007708f94dd331373b985fbcaec9cb09f13f177d01d8d1f5097d5ad6628f6b46f6326a49ffe41cec0a4863aa723dad1ad

        • \Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecabod.exe

          Filesize

          3.6MB

          MD5

          185562596455c1dbbdbed46f8dbbefb1

          SHA1

          ff7859ab6a1e81909c12cca63b575ff51ed3207f

          SHA256

          73dabac6fa44f4beb2a11b19c4f6cfae1c92bcd9a1d61ac88a3c174938d48a88

          SHA512

          28199014896332bfb774b97d98184a506541eab97c16aa1fff1beba0b53a625577a64ba8b8b35e3843e6cd5717d26532da3a0fd67b7e9e97d5abd661f2f5a3e3