Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    14-06-2024 02:35

General

  • Target

    9ba42fd6e9a9e260d08d9f65570457d0_NeikiAnalytics.exe

  • Size

    76KB

  • MD5

    9ba42fd6e9a9e260d08d9f65570457d0

  • SHA1

    2ed1be424d9070d6f1159e597fc47f40885ac3d1

  • SHA256

    044a4e369e3c2921a8d71af64de9c13962b33767095006557fd86e4dd4d1579d

  • SHA512

    0b0f460755f4e9ea744496c94a407f9c2c790abb6b79e7e641d41266b7df33a78fc4f9edae7fc52f7e285a9c4453c4487fa70228df31336b5dbe9d7d31c35d15

  • SSDEEP

    1536:ljj3x85+Ks2vOFECmwy/+gHO2Hdw1zMZGhy84LSX8IN79Dm:9jh85+KsiO9mnWK0uSyJLjY7Zm

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9ba42fd6e9a9e260d08d9f65570457d0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\9ba42fd6e9a9e260d08d9f65570457d0_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1724
    • C:\Users\Admin\AppData\Local\Temp\6XuLVK9woDB8KNL.exe
      C:\Users\Admin\AppData\Local\Temp\6XuLVK9woDB8KNL.exe
      2⤵
      • Executes dropped EXE
      PID:1048
    • C:\Windows\svhost.exe
      "C:\Windows\svhost.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:2128

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\Downloads\ConnectSave.exe

    Filesize

    1.3MB

    MD5

    3129a237c5edfc930d0daae0df5d66cb

    SHA1

    950b80bdb88b814a119de0770679053ca4053f56

    SHA256

    eef85e67158729049ebc0854e8beff374d4dc827583c56a8915ec62e6cb2ca6a

    SHA512

    d619f59a33631d013318e92ef226895ec8149af729e6219c0827f421b1e12551cb4eae8bd2a56bd960358df205eaf89b381a37fb6e8a7956599145c345b86637

  • C:\Windows\svhost.exe

    Filesize

    16KB

    MD5

    5e7c375139b7453abd0b91a8a220f8e5

    SHA1

    88a3d645fab0f4129c1e485c90b593ab60e469ae

    SHA256

    36ec99991653fa54be6f638d0b95eeac3e3f5e3006e4320318c4aa6fc2e330a8

    SHA512

    0805763fe788e0edeb69747d2f419842dc093c2d871d39f25afe2cd27867d54f90fa15892ff5e8c7148280c1ca9b90a0a375f56c277e5d442257c9e77295f1b2

  • \Users\Admin\AppData\Local\Temp\6XuLVK9woDB8KNL.exe

    Filesize

    60KB

    MD5

    7b112b1fb864c90ec5b65eab21cb40b8

    SHA1

    e7b73361f722fc7cbb93ef98a8d26e34f4d49767

    SHA256

    751941b4e09898c31791efeb5f90fc7367c89831d4a98637ed505e40763e287b

    SHA512

    bf9cdeff39cc4fa48457c55ad02e3856b5b27998535aed801a469252f01e7676462332fa3f93877753e963d037472f615c1fc5fc2e996316621b4e0a180cb5f5