Analysis
-
max time kernel
94s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
14-06-2024 02:35
Static task
static1
Behavioral task
behavioral1
Sample
9ba42fd6e9a9e260d08d9f65570457d0_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
9ba42fd6e9a9e260d08d9f65570457d0_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
General
-
Target
9ba42fd6e9a9e260d08d9f65570457d0_NeikiAnalytics.exe
-
Size
76KB
-
MD5
9ba42fd6e9a9e260d08d9f65570457d0
-
SHA1
2ed1be424d9070d6f1159e597fc47f40885ac3d1
-
SHA256
044a4e369e3c2921a8d71af64de9c13962b33767095006557fd86e4dd4d1579d
-
SHA512
0b0f460755f4e9ea744496c94a407f9c2c790abb6b79e7e641d41266b7df33a78fc4f9edae7fc52f7e285a9c4453c4487fa70228df31336b5dbe9d7d31c35d15
-
SSDEEP
1536:ljj3x85+Ks2vOFECmwy/+gHO2Hdw1zMZGhy84LSX8IN79Dm:9jh85+KsiO9mnWK0uSyJLjY7Zm
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
AkvgfSlt85qi2qB.exesvhost.exepid process 4240 AkvgfSlt85qi2qB.exe 2140 svhost.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
9ba42fd6e9a9e260d08d9f65570457d0_NeikiAnalytics.exesvhost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Winhost = "C:\\Windows\\svhost.exe" 9ba42fd6e9a9e260d08d9f65570457d0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Winhost = "C:\\Windows\\svhost.exe" svhost.exe -
Drops file in Windows directory 2 IoCs
Processes:
9ba42fd6e9a9e260d08d9f65570457d0_NeikiAnalytics.exesvhost.exedescription ioc process File created C:\Windows\svhost.exe 9ba42fd6e9a9e260d08d9f65570457d0_NeikiAnalytics.exe File created C:\Windows\svhost.exe svhost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
9ba42fd6e9a9e260d08d9f65570457d0_NeikiAnalytics.exesvhost.exedescription pid process Token: SeDebugPrivilege 2692 9ba42fd6e9a9e260d08d9f65570457d0_NeikiAnalytics.exe Token: SeDebugPrivilege 2140 svhost.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
9ba42fd6e9a9e260d08d9f65570457d0_NeikiAnalytics.exedescription pid process target process PID 2692 wrote to memory of 4240 2692 9ba42fd6e9a9e260d08d9f65570457d0_NeikiAnalytics.exe AkvgfSlt85qi2qB.exe PID 2692 wrote to memory of 4240 2692 9ba42fd6e9a9e260d08d9f65570457d0_NeikiAnalytics.exe AkvgfSlt85qi2qB.exe PID 2692 wrote to memory of 4240 2692 9ba42fd6e9a9e260d08d9f65570457d0_NeikiAnalytics.exe AkvgfSlt85qi2qB.exe PID 2692 wrote to memory of 2140 2692 9ba42fd6e9a9e260d08d9f65570457d0_NeikiAnalytics.exe svhost.exe PID 2692 wrote to memory of 2140 2692 9ba42fd6e9a9e260d08d9f65570457d0_NeikiAnalytics.exe svhost.exe PID 2692 wrote to memory of 2140 2692 9ba42fd6e9a9e260d08d9f65570457d0_NeikiAnalytics.exe svhost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9ba42fd6e9a9e260d08d9f65570457d0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\9ba42fd6e9a9e260d08d9f65570457d0_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\AkvgfSlt85qi2qB.exeC:\Users\Admin\AppData\Local\Temp\AkvgfSlt85qi2qB.exe2⤵
- Executes dropped EXE
PID:4240 -
C:\Windows\svhost.exe"C:\Windows\svhost.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2140
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
338KB
MD5c950c68ff4f08ef6f87adb4da1803721
SHA13263573a7977b73b94beae67df924037cee9b760
SHA256b4806e516c701c906f0c7da0864a688e520179c6b4b744afb3072dab2f3a2fc4
SHA51212fa1184b21169f4906aa86218fd494920a9cb504e5700a03e42afc51717fd4275e1b6691ba4a15d4eed8b3a2ff3e5c0ee041faedb033ac1307b90aeeae6df30
-
Filesize
60KB
MD57b112b1fb864c90ec5b65eab21cb40b8
SHA1e7b73361f722fc7cbb93ef98a8d26e34f4d49767
SHA256751941b4e09898c31791efeb5f90fc7367c89831d4a98637ed505e40763e287b
SHA512bf9cdeff39cc4fa48457c55ad02e3856b5b27998535aed801a469252f01e7676462332fa3f93877753e963d037472f615c1fc5fc2e996316621b4e0a180cb5f5
-
Filesize
16KB
MD55e7c375139b7453abd0b91a8a220f8e5
SHA188a3d645fab0f4129c1e485c90b593ab60e469ae
SHA25636ec99991653fa54be6f638d0b95eeac3e3f5e3006e4320318c4aa6fc2e330a8
SHA5120805763fe788e0edeb69747d2f419842dc093c2d871d39f25afe2cd27867d54f90fa15892ff5e8c7148280c1ca9b90a0a375f56c277e5d442257c9e77295f1b2