Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
08/05/2024, 01:38
Static task
static1
Behavioral task
behavioral1
Sample
96a36cc0875fcd74c888ea78a9a591c0_NEIKI.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
96a36cc0875fcd74c888ea78a9a591c0_NEIKI.exe
Resource
win10v2004-20240419-en
General
-
Target
96a36cc0875fcd74c888ea78a9a591c0_NEIKI.exe
-
Size
2.7MB
-
MD5
96a36cc0875fcd74c888ea78a9a591c0
-
SHA1
545b3ee9c269d4b05a575c0304c0ebd4a29a9b16
-
SHA256
82c17157a26f02b8007afb7f8f85f9bd461b919653adb199cbe08dcac454a758
-
SHA512
47cdc4389c523ffa1c76998108800c5f18da32275c961abefefc80306946994ac0032611c2fc28924a63766044cc39572d56e535209adad663499b6e1ebec347
-
SSDEEP
49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBQ9w4Sx:+R0pI/IQlUoMPdmpSpK4
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2880 aoptiec.exe -
Loads dropped DLL 1 IoCs
pid Process 2188 96a36cc0875fcd74c888ea78a9a591c0_NEIKI.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\Vid5B\\optiasys.exe" 96a36cc0875fcd74c888ea78a9a591c0_NEIKI.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\AdobeR0\\aoptiec.exe" 96a36cc0875fcd74c888ea78a9a591c0_NEIKI.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2188 96a36cc0875fcd74c888ea78a9a591c0_NEIKI.exe 2188 96a36cc0875fcd74c888ea78a9a591c0_NEIKI.exe 2880 aoptiec.exe 2188 96a36cc0875fcd74c888ea78a9a591c0_NEIKI.exe 2880 aoptiec.exe 2188 96a36cc0875fcd74c888ea78a9a591c0_NEIKI.exe 2880 aoptiec.exe 2188 96a36cc0875fcd74c888ea78a9a591c0_NEIKI.exe 2880 aoptiec.exe 2188 96a36cc0875fcd74c888ea78a9a591c0_NEIKI.exe 2880 aoptiec.exe 2188 96a36cc0875fcd74c888ea78a9a591c0_NEIKI.exe 2880 aoptiec.exe 2188 96a36cc0875fcd74c888ea78a9a591c0_NEIKI.exe 2880 aoptiec.exe 2188 96a36cc0875fcd74c888ea78a9a591c0_NEIKI.exe 2880 aoptiec.exe 2188 96a36cc0875fcd74c888ea78a9a591c0_NEIKI.exe 2880 aoptiec.exe 2188 96a36cc0875fcd74c888ea78a9a591c0_NEIKI.exe 2880 aoptiec.exe 2188 96a36cc0875fcd74c888ea78a9a591c0_NEIKI.exe 2880 aoptiec.exe 2188 96a36cc0875fcd74c888ea78a9a591c0_NEIKI.exe 2880 aoptiec.exe 2188 96a36cc0875fcd74c888ea78a9a591c0_NEIKI.exe 2880 aoptiec.exe 2188 96a36cc0875fcd74c888ea78a9a591c0_NEIKI.exe 2880 aoptiec.exe 2188 96a36cc0875fcd74c888ea78a9a591c0_NEIKI.exe 2880 aoptiec.exe 2188 96a36cc0875fcd74c888ea78a9a591c0_NEIKI.exe 2880 aoptiec.exe 2188 96a36cc0875fcd74c888ea78a9a591c0_NEIKI.exe 2880 aoptiec.exe 2188 96a36cc0875fcd74c888ea78a9a591c0_NEIKI.exe 2880 aoptiec.exe 2188 96a36cc0875fcd74c888ea78a9a591c0_NEIKI.exe 2880 aoptiec.exe 2188 96a36cc0875fcd74c888ea78a9a591c0_NEIKI.exe 2880 aoptiec.exe 2188 96a36cc0875fcd74c888ea78a9a591c0_NEIKI.exe 2880 aoptiec.exe 2188 96a36cc0875fcd74c888ea78a9a591c0_NEIKI.exe 2880 aoptiec.exe 2188 96a36cc0875fcd74c888ea78a9a591c0_NEIKI.exe 2880 aoptiec.exe 2188 96a36cc0875fcd74c888ea78a9a591c0_NEIKI.exe 2880 aoptiec.exe 2188 96a36cc0875fcd74c888ea78a9a591c0_NEIKI.exe 2880 aoptiec.exe 2188 96a36cc0875fcd74c888ea78a9a591c0_NEIKI.exe 2880 aoptiec.exe 2188 96a36cc0875fcd74c888ea78a9a591c0_NEIKI.exe 2880 aoptiec.exe 2188 96a36cc0875fcd74c888ea78a9a591c0_NEIKI.exe 2880 aoptiec.exe 2188 96a36cc0875fcd74c888ea78a9a591c0_NEIKI.exe 2880 aoptiec.exe 2188 96a36cc0875fcd74c888ea78a9a591c0_NEIKI.exe 2880 aoptiec.exe 2188 96a36cc0875fcd74c888ea78a9a591c0_NEIKI.exe 2880 aoptiec.exe 2188 96a36cc0875fcd74c888ea78a9a591c0_NEIKI.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2188 wrote to memory of 2880 2188 96a36cc0875fcd74c888ea78a9a591c0_NEIKI.exe 28 PID 2188 wrote to memory of 2880 2188 96a36cc0875fcd74c888ea78a9a591c0_NEIKI.exe 28 PID 2188 wrote to memory of 2880 2188 96a36cc0875fcd74c888ea78a9a591c0_NEIKI.exe 28 PID 2188 wrote to memory of 2880 2188 96a36cc0875fcd74c888ea78a9a591c0_NEIKI.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\96a36cc0875fcd74c888ea78a9a591c0_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\96a36cc0875fcd74c888ea78a9a591c0_NEIKI.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\AdobeR0\aoptiec.exeC:\AdobeR0\aoptiec.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2880
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
201B
MD525c6d49cb3e6a4c070eb5bd0bad7c4e6
SHA1632d4eb82953fb544c86444a9ca611c40235b525
SHA2562bdfddbb29d109bcbeb1d65f0235742709168684ce21571f4d7ffef393136a9c
SHA5123e0c7955a5931cd083cde299e37dc9974d744e146bc7434127ef97bf49207c6012f105ed1974b95d6e59d8b904669b92796e65c82b54cc1c5f4adeb541c7f09b
-
Filesize
2.7MB
MD59582695cb88706881514bcca9f893ed6
SHA1ef166f4241f1550ef71d6b9afae0efce25321fb9
SHA256191c547d059ac6f0be643e0a3ec005de99aec002c1e312de206870bdfcf78668
SHA5129412d54bf64aba6ae5e805fa4a0168e951e6286f1cb4ad2342c2a54e01c8d43d3b29617b2095845ba9dfbde9ab8fac35fe8b6b5559c326f21752eef3fcd6bf95
-
Filesize
2.7MB
MD55fc1bbb98110faa32d26d539dff5a641
SHA12fce0a72eb9dc1b32725c893c68b25b844358a36
SHA25688dc504f43f14e2bfea5180e53a9b92fc991ab7c30f9529c0613b3a414ab1794
SHA5122a018fcc44fa2aebfd4accf93ea104e69d6895e6374063b25030e4d91413e4c59c0868af0960308c6db5259090ef9d98f1ed2b630ec77c7ba6bfa64fdac3c26f