51e84de7e30a7f4ddec6c1c5199166fbfb66e285341a1a5932e48ea96081da3a

Analysis

max time kernel
142s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29-05-2024 09:35

Target

4f65432d8ea5fff59aa20716035fc410_NeikiAnalytics.exe
Size

8.2MB
MD5

4f65432d8ea5fff59aa20716035fc410
SHA1

d206ac93fc10e4d4ca9538ca3d124986a9a9b520
SHA256

51e84de7e30a7f4ddec6c1c5199166fbfb66e285341a1a5932e48ea96081da3a
SHA512

96cc7160008f277c0cf8778942db84f26b7148d51d1b3502e89f20d0a362c169f4704f5c6df40ee2d1b351e971bbe6e9bd056fe505d917181dfaec0c9d69bb57
SSDEEP

98304:vKncL2GG3m1+T3UEDjCD57275SmXQdfOsHvZev1a75Kt:bL1G3m1KtDMC7U7sOZD7A

Score

7^/10

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Antivirus Updater 0000 = "C:\\Users\\Admin\\AppData\\Roaming\\DenyGrant.pot\\Antivirus Update eqJxq.exe"	4f65432d8ea5fff59aa20716035fc410_NeikiAnalytics.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
5	ip-api.com

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	6	Go-http-client/1.1

C:\Users\Admin\AppData\Local\Temp\4f65432d8ea5fff59aa20716035fc410_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4f65432d8ea5fff59aa20716035fc410_NeikiAnalytics.exe"
1⤵
- Adds Run key to start application
PID:2748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4256 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8
1⤵
PID:4560