4e715568a43db392a9573c842ec7ba867a3760cad001432453bdff884a3bbc00

General

Target
07c6e520741ad8168cb88a05e6f195c0_NeikiAnalytics.exe
Size 246KB
Sample240603-1sjjsabd49
SHA256 4e715568a43db392a9573c842ec7ba867a3760cad001432453bdff884a3bbc00
MD5 07c6e520741ad8168cb88a05e6f195c0
SHA1 5dedf8bd82e1dd85a9d074f098f8189f4f5ec884
SHA512 5865314c8bf442b9a5f64e0976256e75f46a870a57c5f2578d65755da7de821c3fe2ba8b5c771839b31c04b3c5042342b7f31a0877744fc429e9d6d5ad67e0ba
SSDEEP 6144:/MAoVNy4U+ANT755ERmciECErOxumcXG8VvmMbe+h8s1J3:0AeQJNGHizErO9cXfYme+h8I
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4560	UCJbOi7eUYd4vLI.exe
1080	CTS.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2364-0-0x0000000000590000-0x00000000005A8000-memory.dmp	upx
behavioral2/files/0x00070000000233cd-10.dat	upx
behavioral2/memory/2364-9-0x0000000000590000-0x00000000005A8000-memory.dmp	upx
behavioral2/files/0x000300000002295b-13.dat	upx
behavioral2/memory/1080-33-0x0000000000590000-0x00000000005A8000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	07c6e520741ad8168cb88a05e6f195c0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	CTS.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\CTS.exe	CTS.exe
File created	C:\Windows\CTS.exe	07c6e520741ad8168cb88a05e6f195c0_NeikiAnalytics.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2364	07c6e520741ad8168cb88a05e6f195c0_NeikiAnalytics.exe
Token: SeDebugPrivilege	1080	CTS.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 4560	2364	07c6e520741ad8168cb88a05e6f195c0_NeikiAnalytics.exe	84
PID 2364 wrote to memory of 4560	2364	07c6e520741ad8168cb88a05e6f195c0_NeikiAnalytics.exe	84
PID 2364 wrote to memory of 1080	2364	07c6e520741ad8168cb88a05e6f195c0_NeikiAnalytics.exe	85
PID 2364 wrote to memory of 1080	2364	07c6e520741ad8168cb88a05e6f195c0_NeikiAnalytics.exe	85
PID 2364 wrote to memory of 1080	2364	07c6e520741ad8168cb88a05e6f195c0_NeikiAnalytics.exe	85

C:\Users\Admin\AppData\Local\Temp\07c6e520741ad8168cb88a05e6f195c0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\07c6e520741ad8168cb88a05e6f195c0_NeikiAnalytics.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Users\Admin\AppData\Local\Temp\UCJbOi7eUYd4vLI.exe
  C:\Users\Admin\AppData\Local\Temp\UCJbOi7eUYd4vLI.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\CTS.exe
  "C:\Windows\CTS.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:1080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

excel.exe_Rules.xml

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml
Size 350KB
SHA256 9dcb762d427f917c18ce4f1b0b025e1747de37a2c6980c2a4c40a00ec4f894e2
MD5 9875adc88f0c72b5f4513b357803ee94
SHA1 9d2e887742b1fd2cae1a1421f47e68c610298538
SHA512 5be973e82af68f5a0502c8b0c00fb1d966f8238c63529a13bca5cb14bc1e6da4711824d77c73ff75cdb4d427dc32e23d2c0a93d3be45e8ef753ccb9652120de2
SSDEEP 6144:/MAoVNMxc5Z93yXkTnYQWSUabUFgnBzUfO5PgRRlSrgORoaBaMD2G:0ABan1y7pabUFgnefO5PgTlSEOr7D2G
MD5 SHA1 SHA512 SSDEEP

Submit Download

UCJbOi7eUYd4vLI.exe

Path C:\Users\Admin\AppData\Local\Temp\UCJbOi7eUYd4vLI.exe
Size 219KB
SHA256 84fe7824717bb55d7f32c7487e37012a1bc6cd4c8c0202be4bfb07e770f8dc51
MD5 e2312f199976d03a7cf41e453c5af246
SHA1 c723bf05f7132c9b66c4f91d6cc363d08b4ed622
SHA512 a5cad97d8bcf893b79eed436ae8df232d7e53df86a0ed38b381c128c5d8c76c0caad41407ed564f2ea2725236eb98ea6d29413886ea22371920bf2b498b49686
SSDEEP 6144:MjDWxgkiRaxBgV48MzA69VDEz5yTB5xAuFQfaT:MvWxjwOJ6z4Tfx9QfM
MD5 SHA1 SHA512 SSDEEP

Submit Download

CTS.exe

Path C:\Windows\CTS.exe
Size 27KB
SHA256 720023737d7ff700818f55612ba069a609a5ddea646bb3509b615ee3523a4ca2
MD5 a6749b968461644db5cc0ecceffb224a
SHA1 2795aa37b8586986a34437081351cdd791749a90
SHA512 2a276816290746ed914af9cf6427aef31ce9395b8e9937090e329a8f74fb84c62d15b196e13346caa086842b3f5f549b9eb20cbf422d18c9c1b63e6342ea90b4
SSDEEP 768:X9J/3FzjgfanEGx8V36unjv88tznuRU65Y4gpph1ePVCM:N5VzcfA/6LrVpL74gfh16n
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1080-33-0x0000000000590000-0x00000000005A8000-memory.dmp

Download

memory/2364-0-0x0000000000590000-0x00000000005A8000-memory.dmp

Download

memory/2364-9-0x0000000000590000-0x00000000005A8000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads