57d35d41b7b5c4cc68a508ec0cddc3e596685f92951674ae80488eb2a4a87f31

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09/06/2024, 00:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

07d2186ae2aa19f7b0d0b6aa1e703720_NeikiAnalytics.exe
Size

104KB
MD5

07d2186ae2aa19f7b0d0b6aa1e703720
SHA1

81e26b71dd5edc843a5d0d90ee7f44f6aa4bcb46
SHA256

57d35d41b7b5c4cc68a508ec0cddc3e596685f92951674ae80488eb2a4a87f31
SHA512

96477196b7015c511fe4325698047404bcf8bd8d4f7357f2e16139a1c03acc82431a4f71719cdaeb7a35b17c432901dd824abc36a57c9bc08162df54a942b799
SSDEEP

3072:th85+Ksp8qtKQ7bCYUAVCBbaXGjdJgJNyyFJqnfa4hL:thw+7pDrbVCBbJj/Lg4nfaiL

Score

7^/10

persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4216	imNgDnIS36LgIYl.exe
892	svhost.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Winhost = "C:\\Windows\\svhost.exe"	07d2186ae2aa19f7b0d0b6aa1e703720_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Winhost = "C:\\Windows\\svhost.exe"	svhost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\svhost.exe	07d2186ae2aa19f7b0d0b6aa1e703720_NeikiAnalytics.exe
File created	C:\Windows\svhost.exe	svhost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2428	07d2186ae2aa19f7b0d0b6aa1e703720_NeikiAnalytics.exe
Token: SeDebugPrivilege	892	svhost.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 4216	2428	07d2186ae2aa19f7b0d0b6aa1e703720_NeikiAnalytics.exe	82
PID 2428 wrote to memory of 4216	2428	07d2186ae2aa19f7b0d0b6aa1e703720_NeikiAnalytics.exe	82
PID 2428 wrote to memory of 4216	2428	07d2186ae2aa19f7b0d0b6aa1e703720_NeikiAnalytics.exe	82
PID 2428 wrote to memory of 892	2428	07d2186ae2aa19f7b0d0b6aa1e703720_NeikiAnalytics.exe	83
PID 2428 wrote to memory of 892	2428	07d2186ae2aa19f7b0d0b6aa1e703720_NeikiAnalytics.exe	83
PID 2428 wrote to memory of 892	2428	07d2186ae2aa19f7b0d0b6aa1e703720_NeikiAnalytics.exe	83

C:\Users\Admin\AppData\Local\Temp\07d2186ae2aa19f7b0d0b6aa1e703720_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\07d2186ae2aa19f7b0d0b6aa1e703720_NeikiAnalytics.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Users\Admin\AppData\Local\Temp\imNgDnIS36LgIYl.exe
  C:\Users\Admin\AppData\Local\Temp\imNgDnIS36LgIYl.exe
  2⤵
  - Executes dropped EXE
  PID:4216
- C:\Windows\svhost.exe
  "C:\Windows\svhost.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml

Filesize
339KB

MD5
7cf73c801738d6f90269f064779037a5

SHA1
146f1c932823515abde289a56e6c0e6e7a00b04f

SHA256
d022f79c2d26c82414fa1bc3188161a5b057f059eeb3c08d67f27871e05e3f49

SHA512
c2c8dc29a671aeb36769a0fec05d0a18c630f14583ec6ccd7f39d2a0dffade5c08f5b83ccd551225d5396d87975bf637cca0e7b3c2498501e6593391abd32cd7

Download Submit
C:\Users\Admin\AppData\Local\Temp\imNgDnIS36LgIYl.exe

Filesize
88KB

MD5
4a895ec6c5a9df94820219ef525cf65a

SHA1
525dd15cdeec20966d61c5f0a81667cd931349cb

SHA256
949b6765d794c53656c9afc45b90d9a2cfcae6bb30444086b29225f19242217b

SHA512
a830996a8aae3d25bd21283f4f19ea295d6caa31ab98d14f5bacc15fee64264170348ca03c7bd390e6107274fb91923e24f4c6a6dca09a5354ae47d4109ed611

Download Submit
C:\Windows\svhost.exe

Filesize
16KB

MD5
76fd02b48297edb28940bdfa3fa1c48a

SHA1
bf5cae1057a0aca8bf3aab8b121fe77ebb0788ce

SHA256
07abd35f09b954eba7011ce18b225017c50168e039732680df58ae703324825c

SHA512
28c7bf4785547f6df9d678699a55cfb24c429a2bac5375733ff2f760c92933190517d8acd740bdf69c3ecc799635279af5d7ebd848c5b471318d1f330c441ff0

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads