Analysis

  • max time kernel
    141s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-06-2024 21:45

General

  • Target

    0d6fbe1c955e373d4bd0d298c802bd32e14ed6f7acc1ed2b99745f297c1408ab_NeikiAnalytics.exe

  • Size

    520KB

  • MD5

    40251c4df0185c99e416d1d11e9d4000

  • SHA1

    5ba9b7295c9c2c51fbce86a12b2374563a046960

  • SHA256

    0d6fbe1c955e373d4bd0d298c802bd32e14ed6f7acc1ed2b99745f297c1408ab

  • SHA512

    a9195212deecca25bdb4a2ae41a91376ab7592e81e20fb97e90386516b6baa31ce7a9b57b027da95a313a5abc5642ba2cf0d1511da6f5eb89c48570ea870efd8

  • SSDEEP

    12288:YFnphE78AOz5tx6nde+8kWA0N1BJaEhQIBZ/:6nMgttxcIzkW31fvaY

Malware Config

Signatures

  • Detect Neshta payload 11 IoCs
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0d6fbe1c955e373d4bd0d298c802bd32e14ed6f7acc1ed2b99745f297c1408ab_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\0d6fbe1c955e373d4bd0d298c802bd32e14ed6f7acc1ed2b99745f297c1408ab_NeikiAnalytics.exe"
    1⤵
    • Checks computer location settings
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1972
    • C:\Users\Admin\AppData\Local\Temp\3582-490\0d6fbe1c955e373d4bd0d298c802bd32e14ed6f7acc1ed2b99745f297c1408ab_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\0d6fbe1c955e373d4bd0d298c802bd32e14ed6f7acc1ed2b99745f297c1408ab_NeikiAnalytics.exe"
      2⤵
      • Executes dropped EXE
      PID:3120
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1312 --field-trial-handle=2284,i,9807419199535700662,2319175108930815708,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:3348

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Persistence

    Event Triggered Execution

    1
    T1546

    Change Default File Association

    1
    T1546.001

    Privilege Escalation

    Event Triggered Execution

    1
    T1546

    Change Default File Association

    1
    T1546.001

    Defense Evasion

    Modify Registry

    1
    T1112

    Credential Access

    Unsecured Credentials

    1
    T1552

    Credentials In Files

    1
    T1552.001

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    2
    T1082

    Collection

    Data from Local System

    1
    T1005

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe
      Filesize

      2.4MB

      MD5

      8ffc3bdf4a1903d9e28b99d1643fc9c7

      SHA1

      919ba8594db0ae245a8abd80f9f3698826fc6fe5

      SHA256

      8268d3fefe8ca96a25a73690d14bacf644170ab5e9e70d2f8eeb350a4c83f9f6

      SHA512

      0b94ead97374d74eaee87e7614ddd3911d2cf66d4c49abbfd06b02c03e5dd56fd00993b4947e8a4bcd9d891fa39cab18cc6b61efc7d0812e91eb3aea9cd1a427

    • C:\Users\Admin\AppData\Local\Temp\3582-490\0d6fbe1c955e373d4bd0d298c802bd32e14ed6f7acc1ed2b99745f297c1408ab_NeikiAnalytics.exe
      Filesize

      480KB

      MD5

      28af1cb0821f3195e14803dbd65b7a8a

      SHA1

      c3c2e72e2ecd7b920585a0b0b532c4fe001cd016

      SHA256

      f011b2e075b42d34516dfe962124b5834aa28d80d65bdf07346081c12bed82f7

      SHA512

      809b4612eb101b63334736fa8533874b4e33d10a0f3e83d26b451a56fdb48131cd034ac36b8e5a58c60a1ec0e36f64489ea40f8692871790efc7ca8cb205b926

    • memory/1972-13-0x0000000000400000-0x000000000041B000-memory.dmp
      Filesize

      108KB

    • memory/1972-28-0x0000000000400000-0x000000000041B000-memory.dmp
      Filesize

      108KB

    • memory/1972-121-0x0000000000400000-0x000000000041B000-memory.dmp
      Filesize

      108KB

    • memory/1972-122-0x0000000000400000-0x000000000041B000-memory.dmp
      Filesize

      108KB

    • memory/1972-123-0x0000000000400000-0x000000000041B000-memory.dmp
      Filesize

      108KB

    • memory/1972-124-0x0000000000400000-0x000000000041B000-memory.dmp
      Filesize

      108KB

    • memory/1972-125-0x0000000000400000-0x000000000041B000-memory.dmp
      Filesize

      108KB

    • memory/1972-130-0x0000000000400000-0x000000000041B000-memory.dmp
      Filesize

      108KB

    • memory/1972-131-0x0000000000400000-0x000000000041B000-memory.dmp
      Filesize

      108KB

    • memory/1972-132-0x0000000000400000-0x000000000041B000-memory.dmp
      Filesize

      108KB