Overview

overview

7

Static

static

3

0a2e5fe0e9...cs.exe

windows7-x64

7

0a2e5fe0e9...cs.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    93s
  • max time network
    97s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/06/2024, 05:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    0a2e5fe0e91cbfcc30cae538374679d0_NeikiAnalytics.exe
  • Size 7.9MB
  • Sample240610-ftr74adb92
  • SHA256 a34aeea33347aa4f809c51dc6bff7076f6b5e0303dc877d5091962c554c253dc
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
spywarestealer

Malware Config

Signatures

  • Loads dropped DLL 18 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0a2e5fe0e91cbfcc30cae538374679d0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\0a2e5fe0e91cbfcc30cae538374679d0_NeikiAnalytics.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2596
    • C:\Users\Admin\AppData\Local\Temp\0a2e5fe0e91cbfcc30cae538374679d0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\0a2e5fe0e91cbfcc30cae538374679d0_NeikiAnalytics.exe"
      2⤵
      • Loads dropped DLL
      PID:4912

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI25962\VCRUNTIME140.dll
        • Size 93KB
        • SHA256 3242739842db5f32021de2ba87b4e5c884fcf47cb97b65fe38a4f8ad28722d98
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI25962\_bz2.pyd
        • Size 84KB
        • SHA256 3f2157d9b9845315f9af1ef1cbfbbf98cd86d05f8d1eb181e687e2903d8feb4b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI25962\_ctypes.pyd
        • Size 124KB
        • SHA256 07b3c95b8e23cad95af32121e9bfb690b4acfb366ecf8e0d7ef6142f5bf97eb4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI25962\_hashlib.pyd
        • Size 64KB
        • SHA256 a9375af5cbd417ae837bef6201a80991e06b795ec9e025da3bfe9dfa727cdfcb
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI25962\_lzma.pyd
        • Size 159KB
        • SHA256 2fa42a91817a646ed8fa600c1876b1c75be3a5a6f20003a19d893efbf29d3462
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI25962\_queue.pyd
        • Size 28KB
        • SHA256 534ccb3efdb812b1ae5f33d9dffdc6ab543ed6c066c59b680221194188257881
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI25962\_socket.pyd
        • Size 78KB
        • SHA256 79b20432ecea8ed73da88b0ef7f47b344bc59370411f7097704997dac8c801ae
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _sqlite3.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI25962\_sqlite3.pyd
        • Size 87KB
        • SHA256 7098c3741a62f79dd9046e60f9b5c8ba5f25dfa74829a17d555d9229c98eca43
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI25962\_ssl.pyd
        • Size 150KB
        • SHA256 2373bb3b41acfc3be03a220fd85a4dac876e956cf3e60873c8f85625cba41cb4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI25962\base_library.zip
        • Size 763KB
        • SHA256 1a1d48168bfe73b2db4a1002ae3995d014495ae467617f3537408d0514a55ae7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        cacert.pem
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI25962\certifi\cacert.pem
        • Size 257KB
        • SHA256 bb77f13d3fbec9e98bbf28ac95046b44196c7d8f55ab7720061e99991a829197
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        libcrypto-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI25962\libcrypto-1_1.dll
        • Size 3.3MB
        • SHA256 1511040c77e1124e93f910f6b84dd6f96500c66d99747426bdf2b323ee1e79fc
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        libffi-7.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI25962\libffi-7.dll
        • Size 32KB
        • SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        libssl-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI25962\libssl-1_1.dll
        • Size 678KB
        • SHA256 969e03fbceaab6388f695fac25ecfec878222f9a75c32ba6f0d7abdc4c77cea5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        python39.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI25962\python39.dll
        • Size 4.3MB
        • SHA256 db5b859cd14b39a6331b81d93ada8d044880fbd3d6b40add50dcc8e95bf53c95
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI25962\select.pyd
        • Size 28KB
        • SHA256 32f597df8e43aa7ac0469d7ee144fbad5b0c108ce8df38e5ea59a8a7335f95df
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        sqlite3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI25962\sqlite3.dll
        • Size 1.5MB
        • SHA256 8ce11c5374748144587148bc6bd7fc8981e4f8d89134515d4fa629e95ead5a8f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        tinyaes.cp39-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI25962\tinyaes.cp39-win_amd64.pyd
        • Size 39KB
        • SHA256 166c92d0374e2d2eccfd3feae6cb604e71cbd10392b98fadaec0789e096f36b9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI25962\unicodedata.pyd
        • Size 1.1MB
        • SHA256 507be7eb36b056a933951a5d79b5a898f841b9a72c2ce0430d76d611388762f7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download