4e715568a43db392a9573c842ec7ba867a3760cad001432453bdff884a3bbc00

General

Target
07c6e520741ad8168cb88a05e6f195c0_NeikiAnalytics.exe
Size 246KB
Sample240603-1sjjsabd49
SHA256 4e715568a43db392a9573c842ec7ba867a3760cad001432453bdff884a3bbc00
MD5 07c6e520741ad8168cb88a05e6f195c0
SHA1 5dedf8bd82e1dd85a9d074f098f8189f4f5ec884
SHA512 5865314c8bf442b9a5f64e0976256e75f46a870a57c5f2578d65755da7de821c3fe2ba8b5c771839b31c04b3c5042342b7f31a0877744fc429e9d6d5ad67e0ba
SSDEEP 6144:/MAoVNy4U+ANT755ERmciECErOxumcXG8VvmMbe+h8s1J3:0AeQJNGHizErO9cXfYme+h8I
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
3036	CTS.exe
1704	AsHcWW83n94J4tk.exe
1188	Process not Found

Loads dropped DLL 1 IoCs

pid	Process
2848	07c6e520741ad8168cb88a05e6f195c0_NeikiAnalytics.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2848-0-0x00000000003A0000-0x00000000003B8000-memory.dmp	upx
behavioral1/files/0x0038000000014415-11.dat	upx
behavioral1/memory/3036-15-0x0000000000300000-0x0000000000318000-memory.dmp	upx
behavioral1/memory/2848-10-0x00000000003A0000-0x00000000003B8000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	07c6e520741ad8168cb88a05e6f195c0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	CTS.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\CTS.exe	07c6e520741ad8168cb88a05e6f195c0_NeikiAnalytics.exe
File created	C:\Windows\CTS.exe	CTS.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2848	07c6e520741ad8168cb88a05e6f195c0_NeikiAnalytics.exe
Token: SeDebugPrivilege	3036	CTS.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 1704	2848	07c6e520741ad8168cb88a05e6f195c0_NeikiAnalytics.exe	28
PID 2848 wrote to memory of 1704	2848	07c6e520741ad8168cb88a05e6f195c0_NeikiAnalytics.exe	28
PID 2848 wrote to memory of 1704	2848	07c6e520741ad8168cb88a05e6f195c0_NeikiAnalytics.exe	28
PID 2848 wrote to memory of 1704	2848	07c6e520741ad8168cb88a05e6f195c0_NeikiAnalytics.exe	28
PID 2848 wrote to memory of 3036	2848	07c6e520741ad8168cb88a05e6f195c0_NeikiAnalytics.exe	29
PID 2848 wrote to memory of 3036	2848	07c6e520741ad8168cb88a05e6f195c0_NeikiAnalytics.exe	29
PID 2848 wrote to memory of 3036	2848	07c6e520741ad8168cb88a05e6f195c0_NeikiAnalytics.exe	29
PID 2848 wrote to memory of 3036	2848	07c6e520741ad8168cb88a05e6f195c0_NeikiAnalytics.exe	29

C:\Users\Admin\AppData\Local\Temp\07c6e520741ad8168cb88a05e6f195c0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\07c6e520741ad8168cb88a05e6f195c0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Users\Admin\AppData\Local\Temp\AsHcWW83n94J4tk.exe
  C:\Users\Admin\AppData\Local\Temp\AsHcWW83n94J4tk.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\CTS.exe
  "C:\Windows\CTS.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:3036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CTS.exe

Path C:\Windows\CTS.exe
Size 27KB
SHA256 720023737d7ff700818f55612ba069a609a5ddea646bb3509b615ee3523a4ca2
MD5 a6749b968461644db5cc0ecceffb224a
SHA1 2795aa37b8586986a34437081351cdd791749a90
SHA512 2a276816290746ed914af9cf6427aef31ce9395b8e9937090e329a8f74fb84c62d15b196e13346caa086842b3f5f549b9eb20cbf422d18c9c1b63e6342ea90b4
SSDEEP 768:X9J/3FzjgfanEGx8V36unjv88tznuRU65Y4gpph1ePVCM:N5VzcfA/6LrVpL74gfh16n
MD5 SHA1 SHA512 SSDEEP

Submit Download

AsHcWW83n94J4tk.exe

Path \Users\Admin\AppData\Local\Temp\AsHcWW83n94J4tk.exe
Size 219KB
SHA256 84fe7824717bb55d7f32c7487e37012a1bc6cd4c8c0202be4bfb07e770f8dc51
MD5 e2312f199976d03a7cf41e453c5af246
SHA1 c723bf05f7132c9b66c4f91d6cc363d08b4ed622
SHA512 a5cad97d8bcf893b79eed436ae8df232d7e53df86a0ed38b381c128c5d8c76c0caad41407ed564f2ea2725236eb98ea6d29413886ea22371920bf2b498b49686
SSDEEP 6144:MjDWxgkiRaxBgV48MzA69VDEz5yTB5xAuFQfaT:MvWxjwOJ6z4Tfx9QfM
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2848-0-0x00000000003A0000-0x00000000003B8000-memory.dmp

Download

memory/2848-10-0x00000000003A0000-0x00000000003B8000-memory.dmp

Download

memory/3036-15-0x0000000000300000-0x0000000000318000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads