23e9b4d3f00064c3535949879d33813b6ee0974098d3a5c5619c88528aa82361

Analysis

max time kernel
92s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 01:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5f7d94aa72ff212dcf0079037787cca0_NeikiAnalytics.exe
Size 341KB
Sample240530-ccfaesbd37
SHA256 23e9b4d3f00064c3535949879d33813b6ee0974098d3a5c5619c88528aa82361
MD5 5f7d94aa72ff212dcf0079037787cca0
SHA1 67b6105f7e7b5583ba2a68be14ee8a77237d14c2
SHA512 98ce03c087c42a06a563d7e82a6fe0731a79225f8a7de7aac2dc3f4c12e214d9e4f801fbf715da659f34fa8256795b8f258239c18797e7b6f6f5ac65b22e55a5
SSDEEP 6144:IaVWdyzOxeA1DfdwX3MmIOLziJeKBcNo0GiP1TP34ybs0Qq0kjCy:IMROxdDfOnMmXiUict9Thbs0Qq0kjCy
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer upx

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3704-0-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral2/memory/3704-74-0x0000000000400000-0x0000000000446000-memory.dmp	upx

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\nsx4D48.tmp	setup-stub.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nsx4D47.tmp\	setup-stub.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nsx4D49.tmp	setup-stub.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nsx4D4A.tmp	setup-stub.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nsx4D49.tmp\	setup-stub.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nsx4D47.tmp	setup-stub.exe

Executes dropped EXE 1 IoCs

pid	Process
2504	setup-stub.exe

Loads dropped DLL 7 IoCs

pid	Process
2504	setup-stub.exe
2504	setup-stub.exe
2504	setup-stub.exe
2504	setup-stub.exe
2504	setup-stub.exe
2504	setup-stub.exe
2504	setup-stub.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3976	2504	WerFault.exe	81

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2504	setup-stub.exe
2504	setup-stub.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3704 wrote to memory of 2504	3704	5f7d94aa72ff212dcf0079037787cca0_NeikiAnalytics.exe	81
PID 3704 wrote to memory of 2504	3704	5f7d94aa72ff212dcf0079037787cca0_NeikiAnalytics.exe	81
PID 3704 wrote to memory of 2504	3704	5f7d94aa72ff212dcf0079037787cca0_NeikiAnalytics.exe	81

C:\Users\Admin\AppData\Local\Temp\5f7d94aa72ff212dcf0079037787cca0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5f7d94aa72ff212dcf0079037787cca0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3704
- C:\Users\Admin\AppData\Local\Temp\7zS87EF0107\setup-stub.exe
  .\setup-stub.exe
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2504
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 2256
    3⤵
    - Program crash
    PID:3976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2504 -ip 2504
1⤵
PID:4980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setup-stub.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS87EF0107\setup-stub.exe
Size 550KB
SHA256 81647a4e05096a3d9437d8f808d5076f7d0b903f2b3d857823950e3a1d294cde
MD5 f0be457d57df0c534f5cd06f6d514bed
SHA1 850d2c5e3af4dc205d3b4502084da9269c25f347
SHA512 d3a20509fed88e524433bd094c738a1a313211084341702e05b41633089a9a729784e93a786c47f39c4cf68c3be1244b388c9e91a2821d627e08805650978126
SSDEEP 6144:BT4Dt7zUuRDWp9es0mitrE7xPCtkPOz3U6uW/ns1VId4dZY:BTcUj9euYrE/OzhuW/sTIdUY
MD5 SHA1 SHA512 SSDEEP

Submit Download

CityHash.dll

Path C:\Users\Admin\AppData\Local\Temp\nss4D27.tmp\CityHash.dll
Size 53KB
SHA256 c299a0a71bf57eb241868158b4fcfe839d15d5ba607e1bdc5499fdf67b334a14
MD5 2021acc65fa998daa98131e20c4605be
SHA1 2e8407cfe3b1a9d839ea391cfc423e8df8d8a390
SHA512 cb96d3547bab778cbe94076be6765ed2ae07e183e4888d6c380f240b8c6708662a3b2b6b2294e38c48bc91bf2cc5fc7cfcd3afe63775151ba2fe34b06ce38948
SSDEEP 768:jfXngOuwVTROMOZbPg9ao/wxsfJM3JuNUgo3BDGFo+EA3:j/hPVTRBO9NJYMMnomoy3
MD5 SHA1 SHA512 SSDEEP

Submit Download

InetBgDL.dll

Path C:\Users\Admin\AppData\Local\Temp\nss4D27.tmp\InetBgDL.dll
Size 17KB
SHA256 dc98ed352476af459c91100b8c29073988da19d3adc73e2c2086d25f238544a5
MD5 97c607f5d0add72295f8d0f27b448037
SHA1 dfb9a1aa1d3b1f7821152afaac149cad38c8ce3c
SHA512 ad759062152869089558389c741876029198c5b98fa725e2d2927866dc8b416ae2de871cb2479f614f6d29b6f646bf7191d02837c3cabc15b8185b563bc46268
SSDEEP 384:Pbp9amRB1QxIsjvDGFtart8E9VFK4iwgEQsJE:f3DqDGFo+EAOY
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nss4D27.tmp\System.dll
Size 22KB
SHA256 b711c4f17690421c9dc8ddb9ed5a9ddc539b3a28f11e19c851e25dcfc7701c04
MD5 b361682fa5e6a1906e754cfa08aa8d90
SHA1 c6701aee0c866565de1b7c1f81fd88da56b395d3
SHA512 2778f91c9bcf83277d26c71118a1ccb0fb3ce50e89729f14f4915bc65dd48503a77b1e5118ce774dea72f5ce3cc8681eb9ca3c55cf90e9f61a177101ba192ae9
SSDEEP 384:78+Qlt70Fj/lQRY/9VjjgLZvDGFtart8E9VFK4ietffvtlh:7SqFjm6YL1DGFo+EA6tlh
MD5 SHA1 SHA512 SSDEEP

Submit Download

UAC.dll

Path C:\Users\Admin\AppData\Local\Temp\nss4D27.tmp\UAC.dll
Size 28KB
SHA256 ec6a56d981892bf251df1439bea425a5f6c7e1c7312d44bedd5e2957f270338c
MD5 d23b256e9c12fe37d984bae5017c5f8c
SHA1 fd698b58a563816b2260bbc50d7f864b33523121
SHA512 13f284821324ffaeadafd3651f64d896186f47cf9a68735642cf37b37de777dba197067fbccd3a7411b5dc7976e510439253bd24c9be1d36c0a59d924c17ae8e
SSDEEP 384:2lqVibvTh4qnFP+OPEzinclP++vDGFtart8E9VFK4iBSaXrwz1k:EqVavVfPkzhlmIDGFo+EAzrn
MD5 SHA1 SHA512 SSDEEP

Submit Download

UserInfo.dll

Path C:\Users\Admin\AppData\Local\Temp\nss4D27.tmp\UserInfo.dll
Size 14KB
SHA256 c6c413108539f141bea3f679e0e2ef705898c51ec7c2607f478a865fc5e2e2df
MD5 610ad03dec634768cd91c7ed79672d67
SHA1 dc8099d476e2b324c09db95059ec5fd3febe1e1e
SHA512 18c3c92be81aadfa73884fe3bdf1fce96ccfbd35057600ef52788a871de293b64f677351ba2885c6e9ce5c3890c22471c92832ffc13ba544e9d0b347c5d33bfd
SSDEEP 192:PmTH+kPMC7x0KDWpHFtH6cAAANa3Gy2sE9jBFKWJfsHRGz6ot87n5/:PWH+SvDGFtart8E9VFK4iczNwn5
MD5 SHA1 SHA512 SSDEEP

Submit Download

WebBrowser.dll

Path C:\Users\Admin\AppData\Local\Temp\nss4D27.tmp\WebBrowser.dll
Size 103KB
SHA256 281a0dc8b4f644334c2283897963b20df88fa9fd32acca98ed2856b23318e6ec
MD5 b53cd4ad8562a11f3f7c7890a09df27a
SHA1 db66b94670d47c7ee436c2a5481110ed4f013a48
SHA512 bb45d93ed13df24a2056040c219cdf36ee44c8cddb7e178fdaabcec63ac965e07f679ca1fa42591bba571992af619aa1dc76e819a7901709df79598a2b0cef81
SSDEEP 3072:XfSOjAHW06ovW1UOBnuW/0L8ieV1QWZxs1VIdfyb:KOz3U6uW/ns1VIdY
MD5 SHA1 SHA512 SSDEEP

Submit Download

profile_cleanup.html

Path C:\Users\Admin\AppData\Local\Temp\nss4D27.tmp\profile_cleanup.html
Size 1KB
SHA256 dec82e9caa154300e1aa44f550c16b455a2025be4fb1c3155cb75fe04a6b6611
MD5 1cb97b5f8c5f2728b26742d1d0669899
SHA1 bb5ab1b8c00810fcb18184a996573c5accdc72c3
SHA512 768ed2b070485f3bbcf457aefdc0ef8f1737ad8ac4a2703e2feaff424f9a2c69a2f5928a3be898932ef4976a44ea829a099d090bd9941a24d045d5c8ac8b7b43
MD5 SHA1 SHA512

Submit Download

profile_cleanup.js

Path C:\Users\Admin\AppData\Local\Temp\nss4D27.tmp\profile_cleanup.js
Size 1KB
SHA256 1adcfdd9768242c6c639b10e4f0bcda24f6a957a169c1dede265e40336ecbd4f
MD5 d845e8f4c0edb3cab17e6a30090ac5b8
SHA1 654f058570f0868f0acc5f0595147f3385a9c265
SHA512 401d800c484b74401b90c3285d8b6cc0018baf4979d6ec7bb174f7810d3f60adfa6b4cebeafcee20d5a7c3597447f755af19c5fecf1863e2438fe427dbdf9fed
MD5 SHA1 SHA512

Submit Download

stub_common.js

Path C:\Users\Admin\AppData\Local\Temp\nss4D27.tmp\stub_common.js
Size 815B
SHA256 dab39cbae31848cce0b5c43fddd2674fef4dea5b7a3dacdaabdc78a8a931817e
MD5 efce3dce0165b3f6551db47e5c0ac8d6
SHA1 1e15f6bb688e3d645092c1aa5ee3136f8de65312
SHA512 cec12da07f52822aaed340b1b751153efa43e5c3d747fa39f03bb2800bf53e9416020d654a818a6088acb2cf5581714433d818537f04af150e6bfb6861c03988
MD5 SHA1 SHA512

Submit Download

memory/3704-0-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/3704-74-0x0000000000400000-0x0000000000446000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads