Analysis
-
max time kernel
140s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
13-06-2024 03:57
Behavioral task
behavioral1
Sample
5c8697b1ced337469351606365af65f0_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
5c8697b1ced337469351606365af65f0_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
General
-
Target
5c8697b1ced337469351606365af65f0_NeikiAnalytics.exe
-
Size
32KB
-
MD5
5c8697b1ced337469351606365af65f0
-
SHA1
56cb189c01e22bc64ce461e3a769212d83939dd2
-
SHA256
550b1f2945443724adabc4ec789ea21f5647f3e13c3e3f9b397e7f584b49f053
-
SHA512
d3018462a122151d0204b041efaa5d8538e3a2f3499f48efed0c84c2875fcb39f5037df3304bb95caa2c9416e0f1e7e414268908a907620e4dc0095aecd718d1
-
SSDEEP
768:X9J/3FzjgfanEGx8V36unjv88tznuRU65Y4gpph1ePVCMkwF8OrXYV:N5VzcfA/6LrVpL74gfh16nkncQ
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
CTS.exepid process 1592 CTS.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral1/memory/2964-0-0x0000000001290000-0x00000000012A8000-memory.dmp upx C:\Windows\CTS.exe upx behavioral1/memory/2964-12-0x0000000001290000-0x00000000012A8000-memory.dmp upx behavioral1/memory/1592-14-0x0000000000EE0000-0x0000000000EF8000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\bqE522VfA6SUHrO.exe upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
5c8697b1ced337469351606365af65f0_NeikiAnalytics.exeCTS.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" 5c8697b1ced337469351606365af65f0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" CTS.exe -
Drops file in Windows directory 2 IoCs
Processes:
CTS.exe5c8697b1ced337469351606365af65f0_NeikiAnalytics.exedescription ioc process File created C:\Windows\CTS.exe CTS.exe File created C:\Windows\CTS.exe 5c8697b1ced337469351606365af65f0_NeikiAnalytics.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
5c8697b1ced337469351606365af65f0_NeikiAnalytics.exeCTS.exedescription pid process Token: SeDebugPrivilege 2964 5c8697b1ced337469351606365af65f0_NeikiAnalytics.exe Token: SeDebugPrivilege 1592 CTS.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
5c8697b1ced337469351606365af65f0_NeikiAnalytics.exedescription pid process target process PID 2964 wrote to memory of 1592 2964 5c8697b1ced337469351606365af65f0_NeikiAnalytics.exe CTS.exe PID 2964 wrote to memory of 1592 2964 5c8697b1ced337469351606365af65f0_NeikiAnalytics.exe CTS.exe PID 2964 wrote to memory of 1592 2964 5c8697b1ced337469351606365af65f0_NeikiAnalytics.exe CTS.exe PID 2964 wrote to memory of 1592 2964 5c8697b1ced337469351606365af65f0_NeikiAnalytics.exe CTS.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5c8697b1ced337469351606365af65f0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5c8697b1ced337469351606365af65f0_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Windows\CTS.exe"C:\Windows\CTS.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1592
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
32KB
MD5883962fe8aa5028dc10dfd0a874c5aba
SHA180e9d57951532ef16db00a47556f4710c7cfb5bf
SHA256ad1615c0dd90d7b40260e5d29d471783da57487925cf29439e96feebc022f06d
SHA512337bf96abaaa3499773b0f5034ffa46e8e2abd2ea7b81f4901ff35d88e7e4de8ad94e6d87ca12d301528ba4287597e02a3ab9ce74cba4e89d4f61c0d698d384d
-
Filesize
27KB
MD5a6749b968461644db5cc0ecceffb224a
SHA12795aa37b8586986a34437081351cdd791749a90
SHA256720023737d7ff700818f55612ba069a609a5ddea646bb3509b615ee3523a4ca2
SHA5122a276816290746ed914af9cf6427aef31ce9395b8e9937090e329a8f74fb84c62d15b196e13346caa086842b3f5f549b9eb20cbf422d18c9c1b63e6342ea90b4