Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/06/2024, 04:46

General

  • Target

    393251b82622d6df0c6a1e3676e546e0_NeikiAnalytics.exe

  • Size

    541KB

  • MD5

    393251b82622d6df0c6a1e3676e546e0

  • SHA1

    ea97ea7e3ef4aebd171dbcfb534e5a3700e7560b

  • SHA256

    ed00a2c8e8ddd01011351dfd1b5b2dd9c1a94e69849593e61ddcc69dbc2948de

  • SHA512

    369efb933336c91cf1ca114e02e26ab0e228df52f2e59e255de41cda8e54babecd084d8124353e75d2343ff1ca0df6bf7866565b5253c23efd6f1058a3b4dbe0

  • SSDEEP

    12288:WuDqZxApZDcf3xFs9MdQSLyq1gK0f4tc36AWWdlS7Jt:WlZw6fBFOMJLdySfMS7P

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\393251b82622d6df0c6a1e3676e546e0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\393251b82622d6df0c6a1e3676e546e0_NeikiAnalytics.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5116
    • C:\Users\Admin\AppData\Local\Temp\ugd44NbjXEa4Bnt.exe
      C:\Users\Admin\AppData\Local\Temp\ugd44NbjXEa4Bnt.exe
      2⤵
      • Executes dropped EXE
      PID:2100
    • C:\Windows\svhost.exe
      "C:\Windows\svhost.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:4600

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml

          Filesize

          339KB

          MD5

          f4909aae5cf905c0a6fa03e6f1583304

          SHA1

          0b95f24051fb2fd9705b05cb9a9dd8b69bf49464

          SHA256

          51d41be3f934d56643722b4b15a467e8c0366f6736e0733087a5779514c9d592

          SHA512

          8fa9001143218bc906e4e881733914aa0e831f92bd4c33ede03353217e09177b60c9e36880d2b1ecdf2faf4c3ddd24e1999fdd4d5c30b2a3591dcfb67fca7461

        • C:\Users\Admin\AppData\Local\Temp\ugd44NbjXEa4Bnt.exe

          Filesize

          541KB

          MD5

          94b31c7e1f400f0759de0e913d22d2fe

          SHA1

          7ea678934e6165e4df04b50964d61024d15daf6a

          SHA256

          fea34a6ccc40efb306d7813789adf98f0304d22d7971390f8ed5d3d04b246ba8

          SHA512

          7330cf53855bde5e597c99c01715d34a38b8e41d33ffce12a5d287ec42e6fa11fde554ee23a9ebdf81cfaf7927dfeac06ed35025f7ca4623914c151272369207

        • C:\Users\Admin\AppData\Local\Temp\ugd44NbjXEa4Bnt.exe

          Filesize

          524KB

          MD5

          645d5875c0ce2052d93943c62238a06e

          SHA1

          38c00dfaa6e0192e1157212d5baf42a8db869776

          SHA256

          66ef54018ef1207394bef76bcb0411f2fbbedd6230a812026bf8f1710218dbf9

          SHA512

          eb9654b527ddc15fae042ef6fa6b8a25f76c2fc21314abd1d629bac5066cfa11d9f3c1191150dc7784b20e5e47c4855ab97d34fadf904989a7a43ccd626949fe

        • C:\Windows\svhost.exe

          Filesize

          16KB

          MD5

          76fd02b48297edb28940bdfa3fa1c48a

          SHA1

          bf5cae1057a0aca8bf3aab8b121fe77ebb0788ce

          SHA256

          07abd35f09b954eba7011ce18b225017c50168e039732680df58ae703324825c

          SHA512

          28c7bf4785547f6df9d678699a55cfb24c429a2bac5375733ff2f760c92933190517d8acd740bdf69c3ecc799635279af5d7ebd848c5b471318d1f330c441ff0