c00235598c1bbcc6ecb41232054b388c611acc179c5d8a1f140541b3ed33682d

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 08:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6b5da0a45180be966bc4b325817e6860_NeikiAnalytics.exe
Size 18KB
Sample240613-jx4bbathnn
SHA256 c00235598c1bbcc6ecb41232054b388c611acc179c5d8a1f140541b3ed33682d
MD5 6b5da0a45180be966bc4b325817e6860
SHA1 f723771236c93069035285a50e07dc5b4b042005
SHA512 58aad3cd6c4b6aa41dfca59447953347d731ea409f0decd2ce331b5783f296f44c97625327a476a1a2237472d3903e0219f2b746fb10b93696d600615bb1c927
SSDEEP 384:x+uPfoQ+DfYMzKdPEsOuubuEG3KHM2/lI/Fu:IMAQ+BzWPEwnE+KHM2/Gu
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4768	svhost.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Winhost = "C:\\Windows\\svhost.exe"	6b5da0a45180be966bc4b325817e6860_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Winhost = "C:\\Windows\\svhost.exe"	svhost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\svhost.exe	6b5da0a45180be966bc4b325817e6860_NeikiAnalytics.exe
File created	C:\Windows\svhost.exe	svhost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1420	6b5da0a45180be966bc4b325817e6860_NeikiAnalytics.exe
Token: SeDebugPrivilege	4768	svhost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1420 wrote to memory of 4768	1420	6b5da0a45180be966bc4b325817e6860_NeikiAnalytics.exe	81
PID 1420 wrote to memory of 4768	1420	6b5da0a45180be966bc4b325817e6860_NeikiAnalytics.exe	81
PID 1420 wrote to memory of 4768	1420	6b5da0a45180be966bc4b325817e6860_NeikiAnalytics.exe	81

C:\Users\Admin\AppData\Local\Temp\6b5da0a45180be966bc4b325817e6860_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6b5da0a45180be966bc4b325817e6860_NeikiAnalytics.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1420
- C:\Windows\svhost.exe
  "C:\Windows\svhost.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:4768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

excel.exe_Rules.xml

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml
Size 338KB
SHA256 ca5d82c49c78013ab929fd81ae94008e7864fa6b5945e40434fbc0a94a451218
MD5 363c00ad17115b4391d5735472acd0ba
SHA1 7292f5f3f89b71e7db01ca019f6c070f3c3e1441
SHA512 79cb5130d75abe80ef367dab2c7f8614c6488ea2a6e3487fff7bfeb3dd944aaad2f4c5e08c03a64370ef46e2641f65f4fd6d647fca9ec5f3cba87778135d47e7
SSDEEP 6144:thw+7qsilWK+A2GyJaYfAt0KfkCSbZ/h0HIC2q7+n2VqYjz7pfM7auHtTOoKsv:+ZXr2VJxAyKfkCSbZ5YIC2qScj/pM7YU
MD5 SHA1 SHA512 SSDEEP

Submit Download

oenBwEHGrTto7zd.exe

Path C:\Users\Admin\AppData\Local\Temp\oenBwEHGrTto7zd.exe
Size 18KB
SHA256 dd725f2d24d7f0915bc089938e2273a511d8c9298b966e086a82896ddd08e416
MD5 57dd80876ec9bc47e2039046a6344008
SHA1 26e45300e5277189a44948059475321fc81dff7b
SHA512 7128add4942c339a42d8e106cb754ad019d7cd19ed77e0bbae2531f4dc43d3a156d22fc7b7b6ce9ee741c7882c3ec5ed1efefc1ea7dad6a98b2aa83860c294c9
SSDEEP 384:x+uPfoQ+DfYMzKdPEsOuubuEG3KHM2/HodRlh:IMAQ+BzWPEwnE+KHM2/IZh
MD5 SHA1 SHA512 SSDEEP

Submit Download

svhost.exe

Path C:\Windows\svhost.exe
Size 16KB
SHA256 07abd35f09b954eba7011ce18b225017c50168e039732680df58ae703324825c
MD5 76fd02b48297edb28940bdfa3fa1c48a
SHA1 bf5cae1057a0aca8bf3aab8b121fe77ebb0788ce
SHA512 28c7bf4785547f6df9d678699a55cfb24c429a2bac5375733ff2f760c92933190517d8acd740bdf69c3ecc799635279af5d7ebd848c5b471318d1f330c441ff0
SSDEEP 192:nx+uPBkqyIfgm64++u6gzYMzZ0dqsEq65+O0I5L0pJ/WDvd0EtITbKH62RTs2/fX:x+uPfoQ+DfYMzKdPEsOuubuEG3KHM2/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads