Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
02/06/2024, 04:46
Static task
static1
Behavioral task
behavioral1
Sample
393251b82622d6df0c6a1e3676e546e0_NeikiAnalytics.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
393251b82622d6df0c6a1e3676e546e0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
393251b82622d6df0c6a1e3676e546e0_NeikiAnalytics.exe
-
Size
541KB
-
MD5
393251b82622d6df0c6a1e3676e546e0
-
SHA1
ea97ea7e3ef4aebd171dbcfb534e5a3700e7560b
-
SHA256
ed00a2c8e8ddd01011351dfd1b5b2dd9c1a94e69849593e61ddcc69dbc2948de
-
SHA512
369efb933336c91cf1ca114e02e26ab0e228df52f2e59e255de41cda8e54babecd084d8124353e75d2343ff1ca0df6bf7866565b5253c23efd6f1058a3b4dbe0
-
SSDEEP
12288:WuDqZxApZDcf3xFs9MdQSLyq1gK0f4tc36AWWdlS7Jt:WlZw6fBFOMJLdySfMS7P
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2100 ugd44NbjXEa4Bnt.exe 4600 svhost.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Winhost = "C:\\Windows\\svhost.exe" 393251b82622d6df0c6a1e3676e546e0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Winhost = "C:\\Windows\\svhost.exe" svhost.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\svhost.exe 393251b82622d6df0c6a1e3676e546e0_NeikiAnalytics.exe File created C:\Windows\svhost.exe svhost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 5116 393251b82622d6df0c6a1e3676e546e0_NeikiAnalytics.exe Token: SeDebugPrivilege 4600 svhost.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 5116 wrote to memory of 2100 5116 393251b82622d6df0c6a1e3676e546e0_NeikiAnalytics.exe 81 PID 5116 wrote to memory of 2100 5116 393251b82622d6df0c6a1e3676e546e0_NeikiAnalytics.exe 81 PID 5116 wrote to memory of 4600 5116 393251b82622d6df0c6a1e3676e546e0_NeikiAnalytics.exe 83 PID 5116 wrote to memory of 4600 5116 393251b82622d6df0c6a1e3676e546e0_NeikiAnalytics.exe 83 PID 5116 wrote to memory of 4600 5116 393251b82622d6df0c6a1e3676e546e0_NeikiAnalytics.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\393251b82622d6df0c6a1e3676e546e0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\393251b82622d6df0c6a1e3676e546e0_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\ugd44NbjXEa4Bnt.exeC:\Users\Admin\AppData\Local\Temp\ugd44NbjXEa4Bnt.exe2⤵
- Executes dropped EXE
PID:2100
-
-
C:\Windows\svhost.exe"C:\Windows\svhost.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4600
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
339KB
MD5f4909aae5cf905c0a6fa03e6f1583304
SHA10b95f24051fb2fd9705b05cb9a9dd8b69bf49464
SHA25651d41be3f934d56643722b4b15a467e8c0366f6736e0733087a5779514c9d592
SHA5128fa9001143218bc906e4e881733914aa0e831f92bd4c33ede03353217e09177b60c9e36880d2b1ecdf2faf4c3ddd24e1999fdd4d5c30b2a3591dcfb67fca7461
-
Filesize
541KB
MD594b31c7e1f400f0759de0e913d22d2fe
SHA17ea678934e6165e4df04b50964d61024d15daf6a
SHA256fea34a6ccc40efb306d7813789adf98f0304d22d7971390f8ed5d3d04b246ba8
SHA5127330cf53855bde5e597c99c01715d34a38b8e41d33ffce12a5d287ec42e6fa11fde554ee23a9ebdf81cfaf7927dfeac06ed35025f7ca4623914c151272369207
-
Filesize
524KB
MD5645d5875c0ce2052d93943c62238a06e
SHA138c00dfaa6e0192e1157212d5baf42a8db869776
SHA25666ef54018ef1207394bef76bcb0411f2fbbedd6230a812026bf8f1710218dbf9
SHA512eb9654b527ddc15fae042ef6fa6b8a25f76c2fc21314abd1d629bac5066cfa11d9f3c1191150dc7784b20e5e47c4855ab97d34fadf904989a7a43ccd626949fe
-
Filesize
16KB
MD576fd02b48297edb28940bdfa3fa1c48a
SHA1bf5cae1057a0aca8bf3aab8b121fe77ebb0788ce
SHA25607abd35f09b954eba7011ce18b225017c50168e039732680df58ae703324825c
SHA51228c7bf4785547f6df9d678699a55cfb24c429a2bac5375733ff2f760c92933190517d8acd740bdf69c3ecc799635279af5d7ebd848c5b471318d1f330c441ff0