Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
14-06-2024 02:35
Static task
static1
Behavioral task
behavioral1
Sample
9ba42fd6e9a9e260d08d9f65570457d0_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
9ba42fd6e9a9e260d08d9f65570457d0_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
General
-
Target
9ba42fd6e9a9e260d08d9f65570457d0_NeikiAnalytics.exe
-
Size
76KB
-
MD5
9ba42fd6e9a9e260d08d9f65570457d0
-
SHA1
2ed1be424d9070d6f1159e597fc47f40885ac3d1
-
SHA256
044a4e369e3c2921a8d71af64de9c13962b33767095006557fd86e4dd4d1579d
-
SHA512
0b0f460755f4e9ea744496c94a407f9c2c790abb6b79e7e641d41266b7df33a78fc4f9edae7fc52f7e285a9c4453c4487fa70228df31336b5dbe9d7d31c35d15
-
SSDEEP
1536:ljj3x85+Ks2vOFECmwy/+gHO2Hdw1zMZGhy84LSX8IN79Dm:9jh85+KsiO9mnWK0uSyJLjY7Zm
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
6XuLVK9woDB8KNL.exesvhost.exepid process 1048 6XuLVK9woDB8KNL.exe 2128 svhost.exe -
Loads dropped DLL 2 IoCs
Processes:
9ba42fd6e9a9e260d08d9f65570457d0_NeikiAnalytics.exepid process 1724 9ba42fd6e9a9e260d08d9f65570457d0_NeikiAnalytics.exe 1724 9ba42fd6e9a9e260d08d9f65570457d0_NeikiAnalytics.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
9ba42fd6e9a9e260d08d9f65570457d0_NeikiAnalytics.exesvhost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Winhost = "C:\\Windows\\svhost.exe" 9ba42fd6e9a9e260d08d9f65570457d0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Winhost = "C:\\Windows\\svhost.exe" svhost.exe -
Drops file in Windows directory 2 IoCs
Processes:
9ba42fd6e9a9e260d08d9f65570457d0_NeikiAnalytics.exesvhost.exedescription ioc process File created C:\Windows\svhost.exe 9ba42fd6e9a9e260d08d9f65570457d0_NeikiAnalytics.exe File created C:\Windows\svhost.exe svhost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
9ba42fd6e9a9e260d08d9f65570457d0_NeikiAnalytics.exesvhost.exedescription pid process Token: SeDebugPrivilege 1724 9ba42fd6e9a9e260d08d9f65570457d0_NeikiAnalytics.exe Token: SeDebugPrivilege 2128 svhost.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
9ba42fd6e9a9e260d08d9f65570457d0_NeikiAnalytics.exedescription pid process target process PID 1724 wrote to memory of 1048 1724 9ba42fd6e9a9e260d08d9f65570457d0_NeikiAnalytics.exe 6XuLVK9woDB8KNL.exe PID 1724 wrote to memory of 1048 1724 9ba42fd6e9a9e260d08d9f65570457d0_NeikiAnalytics.exe 6XuLVK9woDB8KNL.exe PID 1724 wrote to memory of 1048 1724 9ba42fd6e9a9e260d08d9f65570457d0_NeikiAnalytics.exe 6XuLVK9woDB8KNL.exe PID 1724 wrote to memory of 1048 1724 9ba42fd6e9a9e260d08d9f65570457d0_NeikiAnalytics.exe 6XuLVK9woDB8KNL.exe PID 1724 wrote to memory of 2128 1724 9ba42fd6e9a9e260d08d9f65570457d0_NeikiAnalytics.exe svhost.exe PID 1724 wrote to memory of 2128 1724 9ba42fd6e9a9e260d08d9f65570457d0_NeikiAnalytics.exe svhost.exe PID 1724 wrote to memory of 2128 1724 9ba42fd6e9a9e260d08d9f65570457d0_NeikiAnalytics.exe svhost.exe PID 1724 wrote to memory of 2128 1724 9ba42fd6e9a9e260d08d9f65570457d0_NeikiAnalytics.exe svhost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9ba42fd6e9a9e260d08d9f65570457d0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\9ba42fd6e9a9e260d08d9f65570457d0_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\6XuLVK9woDB8KNL.exeC:\Users\Admin\AppData\Local\Temp\6XuLVK9woDB8KNL.exe2⤵
- Executes dropped EXE
PID:1048 -
C:\Windows\svhost.exe"C:\Windows\svhost.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2128
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD53129a237c5edfc930d0daae0df5d66cb
SHA1950b80bdb88b814a119de0770679053ca4053f56
SHA256eef85e67158729049ebc0854e8beff374d4dc827583c56a8915ec62e6cb2ca6a
SHA512d619f59a33631d013318e92ef226895ec8149af729e6219c0827f421b1e12551cb4eae8bd2a56bd960358df205eaf89b381a37fb6e8a7956599145c345b86637
-
Filesize
16KB
MD55e7c375139b7453abd0b91a8a220f8e5
SHA188a3d645fab0f4129c1e485c90b593ab60e469ae
SHA25636ec99991653fa54be6f638d0b95eeac3e3f5e3006e4320318c4aa6fc2e330a8
SHA5120805763fe788e0edeb69747d2f419842dc093c2d871d39f25afe2cd27867d54f90fa15892ff5e8c7148280c1ca9b90a0a375f56c277e5d442257c9e77295f1b2
-
Filesize
60KB
MD57b112b1fb864c90ec5b65eab21cb40b8
SHA1e7b73361f722fc7cbb93ef98a8d26e34f4d49767
SHA256751941b4e09898c31791efeb5f90fc7367c89831d4a98637ed505e40763e287b
SHA512bf9cdeff39cc4fa48457c55ad02e3856b5b27998535aed801a469252f01e7676462332fa3f93877753e963d037472f615c1fc5fc2e996316621b4e0a180cb5f5