Analysis

  • max time kernel
    94s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-06-2024 02:35

General

  • Target

    9ba42fd6e9a9e260d08d9f65570457d0_NeikiAnalytics.exe

  • Size

    76KB

  • MD5

    9ba42fd6e9a9e260d08d9f65570457d0

  • SHA1

    2ed1be424d9070d6f1159e597fc47f40885ac3d1

  • SHA256

    044a4e369e3c2921a8d71af64de9c13962b33767095006557fd86e4dd4d1579d

  • SHA512

    0b0f460755f4e9ea744496c94a407f9c2c790abb6b79e7e641d41266b7df33a78fc4f9edae7fc52f7e285a9c4453c4487fa70228df31336b5dbe9d7d31c35d15

  • SSDEEP

    1536:ljj3x85+Ks2vOFECmwy/+gHO2Hdw1zMZGhy84LSX8IN79Dm:9jh85+KsiO9mnWK0uSyJLjY7Zm

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9ba42fd6e9a9e260d08d9f65570457d0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\9ba42fd6e9a9e260d08d9f65570457d0_NeikiAnalytics.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2692
    • C:\Users\Admin\AppData\Local\Temp\AkvgfSlt85qi2qB.exe
      C:\Users\Admin\AppData\Local\Temp\AkvgfSlt85qi2qB.exe
      2⤵
      • Executes dropped EXE
      PID:4240
    • C:\Windows\svhost.exe
      "C:\Windows\svhost.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:2140

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml

    Filesize

    338KB

    MD5

    c950c68ff4f08ef6f87adb4da1803721

    SHA1

    3263573a7977b73b94beae67df924037cee9b760

    SHA256

    b4806e516c701c906f0c7da0864a688e520179c6b4b744afb3072dab2f3a2fc4

    SHA512

    12fa1184b21169f4906aa86218fd494920a9cb504e5700a03e42afc51717fd4275e1b6691ba4a15d4eed8b3a2ff3e5c0ee041faedb033ac1307b90aeeae6df30

  • C:\Users\Admin\AppData\Local\Temp\AkvgfSlt85qi2qB.exe

    Filesize

    60KB

    MD5

    7b112b1fb864c90ec5b65eab21cb40b8

    SHA1

    e7b73361f722fc7cbb93ef98a8d26e34f4d49767

    SHA256

    751941b4e09898c31791efeb5f90fc7367c89831d4a98637ed505e40763e287b

    SHA512

    bf9cdeff39cc4fa48457c55ad02e3856b5b27998535aed801a469252f01e7676462332fa3f93877753e963d037472f615c1fc5fc2e996316621b4e0a180cb5f5

  • C:\Windows\svhost.exe

    Filesize

    16KB

    MD5

    5e7c375139b7453abd0b91a8a220f8e5

    SHA1

    88a3d645fab0f4129c1e485c90b593ab60e469ae

    SHA256

    36ec99991653fa54be6f638d0b95eeac3e3f5e3006e4320318c4aa6fc2e330a8

    SHA512

    0805763fe788e0edeb69747d2f419842dc093c2d871d39f25afe2cd27867d54f90fa15892ff5e8c7148280c1ca9b90a0a375f56c277e5d442257c9e77295f1b2