Analysis

  • max time kernel
    148s
  • max time network
    141s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    05-06-2024 10:47

General

  • Target

    50f6e215f2e575c658c0d5f6b30c0920_NeikiAnalytics.exe

  • Size

    2.6MB

  • MD5

    50f6e215f2e575c658c0d5f6b30c0920

  • SHA1

    4854e9f40453c9ac5b24bfafebec97ffb4ff6993

  • SHA256

    e11b94a331595019fca9839630dcd03ebc49e44fd78117b6c4b2744e211c9f54

  • SHA512

    7c8e034b6c51d17a53ab5986d91c1e466406f09ef716231dfe43b5d8408fe2ae54dc0ddff82ddd44070ecea98a91497020dc3ed0a78e091a6fa8a1da91f2a3c8

  • SSDEEP

    24576:ObCj2sObHtqQ4QEfCr7w7yvuqqNq8FroaSaPXRackmrM4Biq7MhLv9GImmVfq4eR:ObCjPKNqQEfsw43qtmVfq4w

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.mail.me.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    RICHARD205lord

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 24 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies system certificate store 2 TTPs 4 IoCs
  • NTFS ADS 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\50f6e215f2e575c658c0d5f6b30c0920_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\50f6e215f2e575c658c0d5f6b30c0920_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2504
    • C:\ProgramData\jhdfkldfhndfkjdfnbfklfnf.exe
      C:\ProgramData\jhdfkldfhndfkjdfnbfklfnf.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • NTFS ADS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2900
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
        0
        3⤵
        • Suspicious use of SetThreadContext
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2620
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
          C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe -f "C:\Users\Admin\AppData\Local\Temp\tmp2166.tmp"
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:968
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
          C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe -f "C:\Users\Admin\AppData\Local\Temp\tmp23C7.tmp"
          4⤵
          • Accesses Microsoft Outlook accounts
          • Suspicious use of AdjustPrivilegeToken
          PID:2872
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
          C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe -f "C:\Users\Admin\AppData\Local\Temp\tmp38B7.tmp"
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:3032
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
        3⤵
        • Creates scheduled task(s)
        PID:2592
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
        3⤵
        • Creates scheduled task(s)
        PID:2492
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
        3⤵
        • Creates scheduled task(s)
        PID:1628
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
        3⤵
        • Creates scheduled task(s)
        PID:388
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
        3⤵
        • Creates scheduled task(s)
        PID:2796
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
        3⤵
        • Creates scheduled task(s)
        PID:2608
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
        3⤵
        • Creates scheduled task(s)
        PID:2944
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
        3⤵
        • Creates scheduled task(s)
        PID:836
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
        3⤵
        • Creates scheduled task(s)
        PID:796
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
        3⤵
        • Creates scheduled task(s)
        PID:624
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
        3⤵
        • Creates scheduled task(s)
        PID:1568
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
        3⤵
        • Creates scheduled task(s)
        PID:1780
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
        3⤵
        • Creates scheduled task(s)
        PID:2204
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
        3⤵
        • Creates scheduled task(s)
        PID:880
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
        3⤵
        • Creates scheduled task(s)
        PID:1752
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
        3⤵
        • Creates scheduled task(s)
        PID:1228
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
        3⤵
        • Creates scheduled task(s)
        PID:2884
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
        3⤵
        • Creates scheduled task(s)
        PID:2684
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
        3⤵
        • Creates scheduled task(s)
        PID:2632
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
        3⤵
        • Creates scheduled task(s)
        PID:2464
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
        3⤵
        • Creates scheduled task(s)
        PID:2716
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
        3⤵
        • Creates scheduled task(s)
        PID:2120
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
        3⤵
        • Creates scheduled task(s)
        PID:944
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
        3⤵
        • Creates scheduled task(s)
        PID:2692
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {3F76BB83-854B-4485-804C-C86889BC547B} S-1-5-21-330940541-141609230-1670313778-1000:KXIPPCKF\Admin:Interactive:[1]
    1⤵
      PID:1064
      • C:\ProgramData\winmgr119.exe
        C:\ProgramData\winmgr119.exe
        2⤵
        • Executes dropped EXE
        • NTFS ADS
        • Suspicious behavior: EnumeratesProcesses
        PID:972
      • C:\ProgramData\winmgr119.exe
        C:\ProgramData\winmgr119.exe
        2⤵
        • Executes dropped EXE
        • NTFS ADS
        • Suspicious behavior: EnumeratesProcesses
        PID:2552

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\khaxFMfI\6ec746e680934bcbbb1e77361f007ffd

      Filesize

      8B

      MD5

      dd8eba16ac1e3cabecc740db73b90377

      SHA1

      b52960116e3ea5250ac56191ef994efa761ce312

      SHA256

      c0fd592fcec1997702a4af8594e0892fe1bc52f3b128349f67ceb33bee0e5e0c

      SHA512

      e56cd6918371614db2cb7455cbcafc4620b5a575bd5d97fcb06e71238d97494953430315086039a5765ca3c3041c9a4cdc5535559e4313455fd23008cf275c31

    • C:\ProgramData\winmgr119.exe

      Filesize

      2.6MB

      MD5

      11005cc6d92b7a59c1a06be594cdba74

      SHA1

      4f93f11228ef94aba91836772b3463fa40816885

      SHA256

      154b0d5dfc1908a30908ba8c45f2a12c8cde9a2e65fe1551a782a94f637f664e

      SHA512

      e40cd64928ce72b86b10ca323935943bdc4da48568aee2d0c9306813f15421bf203647716e6d84e9a9f03d9e16261d3b6faf0689b9abd1f5be7dd9442f1061b3

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

      Filesize

      70KB

      MD5

      49aebf8cbd62d92ac215b2923fb1b9f5

      SHA1

      1723be06719828dda65ad804298d0431f6aff976

      SHA256

      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

      SHA512

      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    • C:\Users\Admin\AppData\Local\Temp\Tar2F44.tmp

      Filesize

      181KB

      MD5

      4ea6026cf93ec6338144661bf1202cd1

      SHA1

      a1dec9044f750ad887935a01430bf49322fbdcb7

      SHA256

      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

      SHA512

      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    • C:\Users\Admin\AppData\Local\Temp\tmp2166.tmp

      Filesize

      399B

      MD5

      e4bf4f7accc657622fe419c0d62419ab

      SHA1

      c2856936dd3de05bad0da5ca94d6b521e40ab5a2

      SHA256

      b32fa68b79c5a7ceaa89e8e537efe33a963c499666202611329944bd2c09318e

      SHA512

      85dc223e39a16ddeba53a4b3d6c9eff14d30ec67dfda1e650da2c9057f640edd033a31868915a31caac0d325d240a7f634f62cd52fbd2adc68bd1d9cb6281431

    • C:\Users\Admin\AppData\Local\Temp\tmp23C7.tmp

      Filesize

      400B

      MD5

      de4e5ff058882957cf8a3b5f839a031f

      SHA1

      0b3d8279120fb5fa27efbd9eee89695aa040fc24

      SHA256

      ef54f46b9f1e342fc12e035ae94f57c61ea4e8be4e116f0a1c6f86310f400f49

      SHA512

      a6b0d557e9eec4e56630e5ba64495df318f4fd959fffbdcbf77831185b067906917c9117a0ecd6ac817c7860d5d831cce15820d715657d81e2d817d9fab9fb72

    • C:\Users\Admin\AppData\Local\Temp\tmp38B7.tmp

      Filesize

      391B

      MD5

      3525ea58bba48993ea0d01b65ea71381

      SHA1

      1b917678fdd969e5ee5916e5899e7c75a979cf4d

      SHA256

      681bcee53cf679ac674e700136f9229b9184fe60ed6410dbd7a33d462ed13ae2

      SHA512

      5aad8dca43ec85882daf50c469bd04dcf0b62affc8bc605b3e289496a2679d4d548fea8bb0aea7080bbfbcdcab9d275fc6797b9c95b64f9f97ecf79583a83986

    • \ProgramData\jhdfkldfhndfkjdfnbfklfnf.exe

      Filesize

      2.6MB

      MD5

      dfc2d4d8c59d83cfd4132ad9edf23810

      SHA1

      c4e7d486c353fe8ec5db2da5acebab5f84615f78

      SHA256

      c25cfbac4e3c8cbd0f11d2656f468a874a1ec3959d5bef96a762b646b2bcdef0

      SHA512

      b9eb75cec8aea78ad8f1144b27da010a61c269a10a32138f6b6f763b3cb132f96e7900d2e8efacd136d73d1ebf7e9b971fc5533c35d8ea3341dc21ac6e3764b3

    • memory/968-23-0x0000000000400000-0x000000000048E000-memory.dmp

      Filesize

      568KB

    • memory/968-25-0x0000000000400000-0x000000000048E000-memory.dmp

      Filesize

      568KB

    • memory/968-24-0x0000000000400000-0x000000000048E000-memory.dmp

      Filesize

      568KB

    • memory/968-30-0x0000000000400000-0x000000000048E000-memory.dmp

      Filesize

      568KB

    • memory/1752-93-0x0000000076AE0000-0x0000000076BFF000-memory.dmp

      Filesize

      1.1MB

    • memory/1752-94-0x0000000076C00000-0x0000000076CFA000-memory.dmp

      Filesize

      1000KB

    • memory/2620-18-0x0000000073A82000-0x0000000073A84000-memory.dmp

      Filesize

      8KB

    • memory/2620-15-0x00000000001D0000-0x000000000029A000-memory.dmp

      Filesize

      808KB

    • memory/2620-17-0x00000000001D0000-0x000000000029A000-memory.dmp

      Filesize

      808KB

    • memory/2620-11-0x00000000001D0000-0x000000000029A000-memory.dmp

      Filesize

      808KB

    • memory/2620-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2620-13-0x00000000001D0000-0x000000000029A000-memory.dmp

      Filesize

      808KB

    • memory/2620-87-0x0000000073A82000-0x0000000073A84000-memory.dmp

      Filesize

      8KB

    • memory/2872-35-0x0000000000400000-0x0000000000491000-memory.dmp

      Filesize

      580KB

    • memory/2872-77-0x0000000000400000-0x0000000000491000-memory.dmp

      Filesize

      580KB

    • memory/2872-36-0x0000000000400000-0x0000000000491000-memory.dmp

      Filesize

      580KB

    • memory/2872-34-0x0000000000400000-0x0000000000491000-memory.dmp

      Filesize

      580KB

    • memory/3032-83-0x0000000000400000-0x000000000043C000-memory.dmp

      Filesize

      240KB

    • memory/3032-81-0x0000000000400000-0x000000000043C000-memory.dmp

      Filesize

      240KB

    • memory/3032-80-0x0000000000400000-0x000000000043C000-memory.dmp

      Filesize

      240KB