Analysis

  • max time kernel
    140s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    13-06-2024 03:49

General

  • Target

    5c0c2fc69656e74ab8edbe36b8e9ef20_NeikiAnalytics.exe

  • Size

    467KB

  • MD5

    5c0c2fc69656e74ab8edbe36b8e9ef20

  • SHA1

    7fce94f7f5babda85ad0aed3ddf179484f30f287

  • SHA256

    849f94425211387b7ee32ce2959c35102b76834cdc4a31f207f8b35b53fee6d0

  • SHA512

    999cd699dc13913c651a393446442db12287b1d8c6c40179aa77a694a482d0c3e87d0ade6776fbdec17c43a263a26f190071fb0fc6f7ee39c0aa89fca4188db1

  • SSDEEP

    6144:/rTfUHeeSKOS9ccFKk3Y9t9YZaCGUeKJCCrwqzOD:/n8yN0Mr8ZxvBMqzy

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5c0c2fc69656e74ab8edbe36b8e9ef20_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\5c0c2fc69656e74ab8edbe36b8e9ef20_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2240
    • C:\Users\Public\Microsoft Build\Isass.exe
      "C:\Users\Public\Microsoft Build\Isass.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      PID:2304
    • C:\Users\Public\Microsoft Build\Isass.exe
      "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\5c0c2fc69656e74ab8edbe36b8e9ef20_NeikiAnalytics.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2980
      • C:\Users\Admin\AppData\Local\Temp\5c0c2fc69656e74ab8edbe36b8e9ef20_NeikiAnalytics.exe
        "C:\Users\Admin\AppData\Local\Temp\5c0c2fc69656e74ab8edbe36b8e9ef20_NeikiAnalytics.exe"
        3⤵
        • Executes dropped EXE
        PID:2532

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Public\Microsoft Build\Isass.exe

    Filesize

    216KB

    MD5

    dd458aa6724576cbcdd78ff29139f11e

    SHA1

    94a239a6956865c6a60109b96970f3401e789377

    SHA256

    d4e7f06a9237ed9176b30869177426049bf265de65c7dc0f238cf4e6981af0a3

    SHA512

    f618878d58d29b9d23d05370a3ed1d3a9a2d96ed721589ab4a0f82665fcab0bec45e379b447c482c8394278d11a96800d47619d9981a8168e6a86ee1e4521ba4

  • \Users\Admin\AppData\Local\Temp\5c0c2fc69656e74ab8edbe36b8e9ef20_NeikiAnalytics.exe

    Filesize

    231KB

    MD5

    6f581a41167d2d484fcba20e6fc3c39a

    SHA1

    d48de48d24101b9baaa24f674066577e38e6b75c

    SHA256

    3eb8d53778eab9fb13b4c97aeab56e4bad2a6ea3748d342f22eaf4d7aa3185a7

    SHA512

    e1177b6cea89445d58307b3327c78909adff225497f9abb8de571cdd114b547a8f515ec3ab038b583bf752a085b231f6329d6ca82fbe6be8a58cd97a1dbaf0f6

  • memory/2240-13-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2240-11-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2304-28-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2304-44-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2304-86-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2304-23-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2304-24-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2304-27-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2304-14-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2304-35-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2304-36-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2304-15-0x00000000003B0000-0x00000000003B1000-memory.dmp

    Filesize

    4KB

  • memory/2304-45-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2304-51-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2304-52-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2304-64-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2304-65-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2304-73-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2304-74-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2980-21-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB