Analysis

  • max time kernel
    141s
  • max time network
    96s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-06-2024 03:57

General

  • Target

    5c8697b1ced337469351606365af65f0_NeikiAnalytics.exe

  • Size

    32KB

  • MD5

    5c8697b1ced337469351606365af65f0

  • SHA1

    56cb189c01e22bc64ce461e3a769212d83939dd2

  • SHA256

    550b1f2945443724adabc4ec789ea21f5647f3e13c3e3f9b397e7f584b49f053

  • SHA512

    d3018462a122151d0204b041efaa5d8538e3a2f3499f48efed0c84c2875fcb39f5037df3304bb95caa2c9416e0f1e7e414268908a907620e4dc0095aecd718d1

  • SSDEEP

    768:X9J/3FzjgfanEGx8V36unjv88tznuRU65Y4gpph1ePVCMkwF8OrXYV:N5VzcfA/6LrVpL74gfh16nkncQ

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5c8697b1ced337469351606365af65f0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\5c8697b1ced337469351606365af65f0_NeikiAnalytics.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2668
    • C:\Windows\CTS.exe
      "C:\Windows\CTS.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:4856

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml

    Filesize

    348KB

    MD5

    aa0f17913cad97dfc3eb38640c962e4d

    SHA1

    c5a8bd77ed1a6e3da83d0a09e1aea8b4b858cd3c

    SHA256

    f784d45846d98a36faafb9dc635aa1d2254adb1aa43ce10a49c452907f0c9fb9

    SHA512

    6b6b3437c2c398a3c3bd09e2fe16ba4daa2aa7cce1a83572aa8cbba74050fc76b9366d6546df5a5f31669bff4449bb5b737469828019f7eae1ff84c66f38754b

  • C:\Users\Admin\AppData\Local\Temp\B3tvKEG37x8aRZx.exe

    Filesize

    32KB

    MD5

    68975f5f209b828361637fe2fab978cb

    SHA1

    0b49dc05df956241476708f76f405e51610ab6ac

    SHA256

    b0a6e2b582f7cc5ad7358014c624a2763d2b2541fa030a2578260e54c36740f0

    SHA512

    a0b5102a449fa820e7af1d8455e1f5a09d4b87b630cdc808edaf1e07574035630976bcb1f94b49ae0dc56fb0aa41a17599e5f717b2a18000e0b983e8874b3f62

  • C:\Windows\CTS.exe

    Filesize

    27KB

    MD5

    a6749b968461644db5cc0ecceffb224a

    SHA1

    2795aa37b8586986a34437081351cdd791749a90

    SHA256

    720023737d7ff700818f55612ba069a609a5ddea646bb3509b615ee3523a4ca2

    SHA512

    2a276816290746ed914af9cf6427aef31ce9395b8e9937090e329a8f74fb84c62d15b196e13346caa086842b3f5f549b9eb20cbf422d18c9c1b63e6342ea90b4

  • memory/2668-0-0x0000000000820000-0x0000000000838000-memory.dmp

    Filesize

    96KB

  • memory/2668-8-0x0000000000820000-0x0000000000838000-memory.dmp

    Filesize

    96KB

  • memory/4856-10-0x0000000000260000-0x0000000000278000-memory.dmp

    Filesize

    96KB

  • memory/4856-34-0x0000000000260000-0x0000000000278000-memory.dmp

    Filesize

    96KB