Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-06-2024 03:49

General

  • Target

    5c0c2fc69656e74ab8edbe36b8e9ef20_NeikiAnalytics.exe

  • Size

    467KB

  • MD5

    5c0c2fc69656e74ab8edbe36b8e9ef20

  • SHA1

    7fce94f7f5babda85ad0aed3ddf179484f30f287

  • SHA256

    849f94425211387b7ee32ce2959c35102b76834cdc4a31f207f8b35b53fee6d0

  • SHA512

    999cd699dc13913c651a393446442db12287b1d8c6c40179aa77a694a482d0c3e87d0ade6776fbdec17c43a263a26f190071fb0fc6f7ee39c0aa89fca4188db1

  • SSDEEP

    6144:/rTfUHeeSKOS9ccFKk3Y9t9YZaCGUeKJCCrwqzOD:/n8yN0Mr8ZxvBMqzy

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 6 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5c0c2fc69656e74ab8edbe36b8e9ef20_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\5c0c2fc69656e74ab8edbe36b8e9ef20_NeikiAnalytics.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2448
    • C:\Users\Public\Microsoft Build\Isass.exe
      "C:\Users\Public\Microsoft Build\Isass.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:5044
    • C:\Users\Public\Microsoft Build\Isass.exe
      "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\5c0c2fc69656e74ab8edbe36b8e9ef20_NeikiAnalytics.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3008
      • C:\Users\Admin\AppData\Local\Temp\5c0c2fc69656e74ab8edbe36b8e9ef20_NeikiAnalytics.exe
        "C:\Users\Admin\AppData\Local\Temp\5c0c2fc69656e74ab8edbe36b8e9ef20_NeikiAnalytics.exe"
        3⤵
        • Checks computer location settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4084
        • C:\Users\Public\Microsoft Build\Isass.exe
          "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\5c0c2fc69656e74ab8edbe36b8e9ef20_NeikiAnalytics.exe
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:3500
          • C:\Users\Admin\AppData\Local\Temp\5c0c2fc69656e74ab8edbe36b8e9ef20_NeikiAnalytics.exe
            "C:\Users\Admin\AppData\Local\Temp\5c0c2fc69656e74ab8edbe36b8e9ef20_NeikiAnalytics.exe"
            5⤵
            • Checks computer location settings
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:1920
            • C:\Users\Public\Microsoft Build\Isass.exe
              "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\5c0c2fc69656e74ab8edbe36b8e9ef20_NeikiAnalytics.exe
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:1416
              • C:\Users\Admin\AppData\Local\Temp\5c0c2fc69656e74ab8edbe36b8e9ef20_NeikiAnalytics.exe
                "C:\Users\Admin\AppData\Local\Temp\5c0c2fc69656e74ab8edbe36b8e9ef20_NeikiAnalytics.exe"
                7⤵
                • Executes dropped EXE
                PID:4452

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe

    Filesize

    733KB

    MD5

    5efbd8bdc81de33d0a4e9596ba654bda

    SHA1

    475cee8443a7318c39fc8eb098a9bc2bcd174c33

    SHA256

    3dcc4585798885c22ecdad3fd2a82edae32ebee8adb496040f6553957fc17ea8

    SHA512

    08a23728f0e48d250bda2b8081b281b82f2bf86798888071276efa0d76977a189ce3d3c17bd5a7ecfdbff02298c3252ea41bf22e171ca00ab3ebedcfa5239568

  • C:\Users\Admin\AppData\Local\Temp\5c0c2fc69656e74ab8edbe36b8e9ef20_NeikiAnalytics.exe

    Filesize

    231KB

    MD5

    6f581a41167d2d484fcba20e6fc3c39a

    SHA1

    d48de48d24101b9baaa24f674066577e38e6b75c

    SHA256

    3eb8d53778eab9fb13b4c97aeab56e4bad2a6ea3748d342f22eaf4d7aa3185a7

    SHA512

    e1177b6cea89445d58307b3327c78909adff225497f9abb8de571cdd114b547a8f515ec3ab038b583bf752a085b231f6329d6ca82fbe6be8a58cd97a1dbaf0f6

  • C:\Users\Public\Microsoft Build\Isass.exe

    Filesize

    216KB

    MD5

    dd458aa6724576cbcdd78ff29139f11e

    SHA1

    94a239a6956865c6a60109b96970f3401e789377

    SHA256

    d4e7f06a9237ed9176b30869177426049bf265de65c7dc0f238cf4e6981af0a3

    SHA512

    f618878d58d29b9d23d05370a3ed1d3a9a2d96ed721589ab4a0f82665fcab0bec45e379b447c482c8394278d11a96800d47619d9981a8168e6a86ee1e4521ba4

  • memory/1416-29-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/1920-18-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2448-4-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2448-6-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/3008-9-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/3500-14-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/3500-16-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/4084-11-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/4084-13-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/5044-33-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/5044-47-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/5044-8-0x0000000001A10000-0x0000000001A11000-memory.dmp

    Filesize

    4KB

  • memory/5044-34-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/5044-7-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/5044-38-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/5044-39-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/5044-30-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/5044-48-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/5044-54-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/5044-55-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/5044-63-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/5044-67-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/5044-78-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/5044-79-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/5044-88-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB