Analysis
-
max time kernel
15s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
10-06-2024 03:06
Static task
static1
Behavioral task
behavioral1
Sample
0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe
-
Size
635KB
-
MD5
0801012a2c93ecb8a6e359244cac8cd0
-
SHA1
cf346c3816aa4487163df89f4f949a664a3f2023
-
SHA256
8cba27793eb477e7eb12574f1a529c2dce2c4eb9a17a3cbb513f9505bfe32cae
-
SHA512
16c266eea2da408ef54bb845d1dad7f88b91af9d001119d09dbb37b21b183ff4d9d1cbf0be8a7cf21a9c0a54defb3fbb932e893062cc510f2ceece77a6953420
-
SSDEEP
12288:lXATRthqXdwQ5nlxA2C20WtIaVkG2cCzKPZIwygfIh5Xgu7X9xlJX30qjqyJMY:l6RWNwQC2/VpCGBdyRXgu77/nYO
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.destinationtoplan.com - Port:
587 - Username:
[email protected] - Password:
Alora..101 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 api.ipify.org 5 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exedescription pid Process procid_target PID 2196 set thread context of 2624 2196 0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe 31 -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exepid Process 2196 0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe 2196 0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe 2196 0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe 2196 0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe 2196 0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe 2624 0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe 2624 0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exedescription pid Process Token: SeDebugPrivilege 2196 0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe Token: SeDebugPrivilege 2624 0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exedescription pid Process procid_target PID 2196 wrote to memory of 2696 2196 0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe 28 PID 2196 wrote to memory of 2696 2196 0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe 28 PID 2196 wrote to memory of 2696 2196 0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe 28 PID 2196 wrote to memory of 2696 2196 0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe 28 PID 2196 wrote to memory of 2712 2196 0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe 29 PID 2196 wrote to memory of 2712 2196 0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe 29 PID 2196 wrote to memory of 2712 2196 0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe 29 PID 2196 wrote to memory of 2712 2196 0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe 29 PID 2196 wrote to memory of 2856 2196 0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe 30 PID 2196 wrote to memory of 2856 2196 0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe 30 PID 2196 wrote to memory of 2856 2196 0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe 30 PID 2196 wrote to memory of 2856 2196 0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe 30 PID 2196 wrote to memory of 2624 2196 0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe 31 PID 2196 wrote to memory of 2624 2196 0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe 31 PID 2196 wrote to memory of 2624 2196 0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe 31 PID 2196 wrote to memory of 2624 2196 0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe 31 PID 2196 wrote to memory of 2624 2196 0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe 31 PID 2196 wrote to memory of 2624 2196 0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe 31 PID 2196 wrote to memory of 2624 2196 0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe 31 PID 2196 wrote to memory of 2624 2196 0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe 31 PID 2196 wrote to memory of 2624 2196 0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe"2⤵PID:2696
-
-
C:\Users\Admin\AppData\Local\Temp\0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe"2⤵PID:2712
-
-
C:\Users\Admin\AppData\Local\Temp\0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe"2⤵PID:2856
-
-
C:\Users\Admin\AppData\Local\Temp\0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2624
-