249404caffd5c0bdd3fefb03e819408e60740d2d7208cd1b34dea971312565bc

Analysis

max time kernel
141s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30-06-2024 23:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

249404caffd5c0bdd3fefb03e819408e60740d2d7208cd1b34dea971312565bc_NeikiAnalytics.exe
Size

868KB
MD5

88c0db119b6f2ed00e82725bb6772bb0
SHA1

58b0cbc9172b2af373b4ddd959ac1ca89cb9a531
SHA256

249404caffd5c0bdd3fefb03e819408e60740d2d7208cd1b34dea971312565bc
SHA512

1073d3bd9bba23eb2e1fdebf4be8c8af55bac5f504fa42cf050921e7b8683f62856a8594b05d31c81a3a654c49d42e38615ed7ba85d1ab3db09ba201bd5c0222
SSDEEP

24576:0XdcgJxWfbEjkvnI1G5TjPQRa+sPpc0QvwJby:0X292kUG5TrYERMYJe

Score

7^/10

persistence spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 3 IoCs

Processes:

cVJt4XyENQ2EDQn.exeCTS.execVJt4XyENQ2EDQn.exe

pid process

1884 cVJt4XyENQ2EDQn.exe
3040 CTS.exe
2176 cVJt4XyENQ2EDQn.exe
Loads dropped DLL 3 IoCs

Processes:

249404caffd5c0bdd3fefb03e819408e60740d2d7208cd1b34dea971312565bc_NeikiAnalytics.execVJt4XyENQ2EDQn.execVJt4XyENQ2EDQn.exe

pid process

1404 249404caffd5c0bdd3fefb03e819408e60740d2d7208cd1b34dea971312565bc_NeikiAnalytics.exe
1884 cVJt4XyENQ2EDQn.exe
2176 cVJt4XyENQ2EDQn.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
1884	cVJt4XyENQ2EDQn.exe
3040	CTS.exe
2176	cVJt4XyENQ2EDQn.exe

pid	process
1404	249404caffd5c0bdd3fefb03e819408e60740d2d7208cd1b34dea971312565bc_NeikiAnalytics.exe
1884	cVJt4XyENQ2EDQn.exe
2176	cVJt4XyENQ2EDQn.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1404-0-0x0000000000060000-0x0000000000078000-memory.dmp	upx
C:\Windows\CTS.exe	upx
behavioral1/memory/3040-14-0x0000000000ED0000-0x0000000000EE8000-memory.dmp	upx
behavioral1/memory/1404-18-0x0000000000060000-0x0000000000078000-memory.dmp	upx
behavioral1/memory/3040-77-0x0000000000ED0000-0x0000000000EE8000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

249404caffd5c0bdd3fefb03e819408e60740d2d7208cd1b34dea971312565bc_NeikiAnalytics.exeCTS.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	249404caffd5c0bdd3fefb03e819408e60740d2d7208cd1b34dea971312565bc_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	CTS.exe

Drops file in Windows directory 2 IoCs

Processes:

249404caffd5c0bdd3fefb03e819408e60740d2d7208cd1b34dea971312565bc_NeikiAnalytics.exeCTS.exe

description ioc process

File created C:\Windows\CTS.exe 249404caffd5c0bdd3fefb03e819408e60740d2d7208cd1b34dea971312565bc_NeikiAnalytics.exe
File created C:\Windows\CTS.exe CTS.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

249404caffd5c0bdd3fefb03e819408e60740d2d7208cd1b34dea971312565bc_NeikiAnalytics.exeCTS.exe

description pid process

Token: SeDebugPrivilege 1404 249404caffd5c0bdd3fefb03e819408e60740d2d7208cd1b34dea971312565bc_NeikiAnalytics.exe
Token: SeDebugPrivilege 3040 CTS.exe

description	ioc	process
File created	C:\Windows\CTS.exe	249404caffd5c0bdd3fefb03e819408e60740d2d7208cd1b34dea971312565bc_NeikiAnalytics.exe
File created	C:\Windows\CTS.exe	CTS.exe

description	pid	process
Token: SeDebugPrivilege	1404	249404caffd5c0bdd3fefb03e819408e60740d2d7208cd1b34dea971312565bc_NeikiAnalytics.exe
Token: SeDebugPrivilege	3040	CTS.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

249404caffd5c0bdd3fefb03e819408e60740d2d7208cd1b34dea971312565bc_NeikiAnalytics.execVJt4XyENQ2EDQn.exe

description	pid	process	target process
PID 1404 wrote to memory of 1884	1404	249404caffd5c0bdd3fefb03e819408e60740d2d7208cd1b34dea971312565bc_NeikiAnalytics.exe	cVJt4XyENQ2EDQn.exe
PID 1404 wrote to memory of 1884	1404	249404caffd5c0bdd3fefb03e819408e60740d2d7208cd1b34dea971312565bc_NeikiAnalytics.exe	cVJt4XyENQ2EDQn.exe
PID 1404 wrote to memory of 1884	1404	249404caffd5c0bdd3fefb03e819408e60740d2d7208cd1b34dea971312565bc_NeikiAnalytics.exe	cVJt4XyENQ2EDQn.exe
PID 1404 wrote to memory of 1884	1404	249404caffd5c0bdd3fefb03e819408e60740d2d7208cd1b34dea971312565bc_NeikiAnalytics.exe	cVJt4XyENQ2EDQn.exe
PID 1404 wrote to memory of 1884	1404	249404caffd5c0bdd3fefb03e819408e60740d2d7208cd1b34dea971312565bc_NeikiAnalytics.exe	cVJt4XyENQ2EDQn.exe
PID 1404 wrote to memory of 1884	1404	249404caffd5c0bdd3fefb03e819408e60740d2d7208cd1b34dea971312565bc_NeikiAnalytics.exe	cVJt4XyENQ2EDQn.exe
PID 1404 wrote to memory of 1884	1404	249404caffd5c0bdd3fefb03e819408e60740d2d7208cd1b34dea971312565bc_NeikiAnalytics.exe	cVJt4XyENQ2EDQn.exe
PID 1404 wrote to memory of 3040	1404	249404caffd5c0bdd3fefb03e819408e60740d2d7208cd1b34dea971312565bc_NeikiAnalytics.exe	CTS.exe
PID 1404 wrote to memory of 3040	1404	249404caffd5c0bdd3fefb03e819408e60740d2d7208cd1b34dea971312565bc_NeikiAnalytics.exe	CTS.exe
PID 1404 wrote to memory of 3040	1404	249404caffd5c0bdd3fefb03e819408e60740d2d7208cd1b34dea971312565bc_NeikiAnalytics.exe	CTS.exe
PID 1404 wrote to memory of 3040	1404	249404caffd5c0bdd3fefb03e819408e60740d2d7208cd1b34dea971312565bc_NeikiAnalytics.exe	CTS.exe
PID 1884 wrote to memory of 2176	1884	cVJt4XyENQ2EDQn.exe	cVJt4XyENQ2EDQn.exe
PID 1884 wrote to memory of 2176	1884	cVJt4XyENQ2EDQn.exe	cVJt4XyENQ2EDQn.exe
PID 1884 wrote to memory of 2176	1884	cVJt4XyENQ2EDQn.exe	cVJt4XyENQ2EDQn.exe
PID 1884 wrote to memory of 2176	1884	cVJt4XyENQ2EDQn.exe	cVJt4XyENQ2EDQn.exe
PID 1884 wrote to memory of 2176	1884	cVJt4XyENQ2EDQn.exe	cVJt4XyENQ2EDQn.exe
PID 1884 wrote to memory of 2176	1884	cVJt4XyENQ2EDQn.exe	cVJt4XyENQ2EDQn.exe
PID 1884 wrote to memory of 2176	1884	cVJt4XyENQ2EDQn.exe	cVJt4XyENQ2EDQn.exe

C:\Users\Admin\AppData\Local\Temp\249404caffd5c0bdd3fefb03e819408e60740d2d7208cd1b34dea971312565bc_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\249404caffd5c0bdd3fefb03e819408e60740d2d7208cd1b34dea971312565bc_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1404

C:\Users\Admin\AppData\Local\Temp\cVJt4XyENQ2EDQn.exe
C:\Users\Admin\AppData\Local\Temp\cVJt4XyENQ2EDQn.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1884

C:\Windows\Temp\{203A7F1D-A191-4F7E-A861-0C6E355CF2FB}\.cr\cVJt4XyENQ2EDQn.exe
"C:\Windows\Temp\{203A7F1D-A191-4F7E-A861-0C6E355CF2FB}\.cr\cVJt4XyENQ2EDQn.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\cVJt4XyENQ2EDQn.exe" -burn.filehandle.attached=180 -burn.filehandle.self=188
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2176

C:\Windows\CTS.exe
"C:\Windows\CTS.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3040

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\CTS.exe
Filesize
27KB

MD5
a6749b968461644db5cc0ecceffb224a

SHA1
2795aa37b8586986a34437081351cdd791749a90

SHA256
720023737d7ff700818f55612ba069a609a5ddea646bb3509b615ee3523a4ca2

SHA512
2a276816290746ed914af9cf6427aef31ce9395b8e9937090e329a8f74fb84c62d15b196e13346caa086842b3f5f549b9eb20cbf422d18c9c1b63e6342ea90b4

Download Submit
C:\Windows\Temp\{BDCB994F-456F-428E-B5A1-B8AF94E80156}\.ba\SideBar.png
Filesize
56KB

MD5
ca62a92ad5b307faeac640cd5eb460ed

SHA1
5edf8b5fc931648f77a2a131e4c733f1d31b548e

SHA256
f3109977125d4a3a3ffa17462cfc31799589f466a51d226d1d1f87df2f267627

SHA512
f7b3001a957f393298b0ff2aa08b400f8639f2f0487a34ac2a0e8d9519765ac92249185ebe45f907bc9d2f8556fdd39095c52f890330a35edf71ae49df32e27a

Download Submit
\Users\Admin\AppData\Local\Temp\cVJt4XyENQ2EDQn.exe
Filesize
841KB

MD5
f33aac555c5e5a2c10d07e3bbf9a9e82

SHA1
75fa5322fdc00223246bc70fcb6772ae9f10e97c

SHA256
8977d454b74e2abbafc3be6a3b2e7946d1cde530d742235bc1e5cc229e231aa6

SHA512
a64d465c327cd3799044fa1e8786812e055b72aea7faeac66916c7cf1f762bb919d211060cc7944b84037c316babb796ef449d1049a162d8faa51b08d05cef34

Download Submit
\Windows\Temp\{BDCB994F-456F-428E-B5A1-B8AF94E80156}\.ba\PythonBA.dll
Filesize
600KB

MD5
910d34f4b8e8c40e2c7ea16335c7a27c

SHA1
d1ded5742bd647c688f2749cce0093b6a71b56f4

SHA256
c143b40448e90687587bb7ecb376e96db469f347c0921863af468181fab972e3

SHA512
be3ad1e5fbb4a3c65051b54c70d94f8e14edbbae69ff5670ce7d615171182da9aaeb2004c97c4c76689ce359e71a595cd5931f3500ef7fba001af8e68715084d

Download Submit
memory/1404-0-0x0000000000060000-0x0000000000078000-memory.dmp

Filesize
96KB

Download
memory/1404-12-0x0000000000200000-0x0000000000218000-memory.dmp

Filesize
96KB

Download
memory/1404-18-0x0000000000060000-0x0000000000078000-memory.dmp

Filesize
96KB

Download
memory/1404-11-0x0000000000200000-0x0000000000218000-memory.dmp

Filesize
96KB

Download
memory/3040-14-0x0000000000ED0000-0x0000000000EE8000-memory.dmp

Filesize
96KB

Download
memory/3040-77-0x0000000000ED0000-0x0000000000EE8000-memory.dmp

Filesize
96KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads