Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    02/06/2024, 04:46

General

  • Target

    393251b82622d6df0c6a1e3676e546e0_NeikiAnalytics.exe

  • Size

    541KB

  • MD5

    393251b82622d6df0c6a1e3676e546e0

  • SHA1

    ea97ea7e3ef4aebd171dbcfb534e5a3700e7560b

  • SHA256

    ed00a2c8e8ddd01011351dfd1b5b2dd9c1a94e69849593e61ddcc69dbc2948de

  • SHA512

    369efb933336c91cf1ca114e02e26ab0e228df52f2e59e255de41cda8e54babecd084d8124353e75d2343ff1ca0df6bf7866565b5253c23efd6f1058a3b4dbe0

  • SSDEEP

    12288:WuDqZxApZDcf3xFs9MdQSLyq1gK0f4tc36AWWdlS7Jt:WlZw6fBFOMJLdySfMS7P

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\393251b82622d6df0c6a1e3676e546e0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\393251b82622d6df0c6a1e3676e546e0_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2364
    • C:\Users\Admin\AppData\Local\Temp\bklLuxtwASWp7kS.exe
      C:\Users\Admin\AppData\Local\Temp\bklLuxtwASWp7kS.exe
      2⤵
      • Executes dropped EXE
      PID:2328
    • C:\Windows\svhost.exe
      "C:\Windows\svhost.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:1244

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\bklLuxtwASWp7kS.exe

          Filesize

          541KB

          MD5

          416206cafd3291f763e968affa433be4

          SHA1

          bc58c75562b2c749579e4c7a70b076cc36fa01c2

          SHA256

          ceaa6a886095dd409b3de2bc03f44a642c85012037acb6bbb1db361a5093410b

          SHA512

          6687dd0eb797d6498557e244db806e2b90c48b0cfc4a0f77648e4ecd997580dd3ce9d715b08c6d78df6e08c8afa536a3af40b6a34ac40af0bacfa0d664b928a8

        • C:\Users\Admin\AppData\Local\Temp\bklLuxtwASWp7kS.exe

          Filesize

          524KB

          MD5

          645d5875c0ce2052d93943c62238a06e

          SHA1

          38c00dfaa6e0192e1157212d5baf42a8db869776

          SHA256

          66ef54018ef1207394bef76bcb0411f2fbbedd6230a812026bf8f1710218dbf9

          SHA512

          eb9654b527ddc15fae042ef6fa6b8a25f76c2fc21314abd1d629bac5066cfa11d9f3c1191150dc7784b20e5e47c4855ab97d34fadf904989a7a43ccd626949fe

        • C:\Windows\svhost.exe

          Filesize

          16KB

          MD5

          76fd02b48297edb28940bdfa3fa1c48a

          SHA1

          bf5cae1057a0aca8bf3aab8b121fe77ebb0788ce

          SHA256

          07abd35f09b954eba7011ce18b225017c50168e039732680df58ae703324825c

          SHA512

          28c7bf4785547f6df9d678699a55cfb24c429a2bac5375733ff2f760c92933190517d8acd740bdf69c3ecc799635279af5d7ebd848c5b471318d1f330c441ff0