aa8df7303f376659d0a3560cda232d724ea98eeb7fb653d0640be150a2cf1ea4

Analysis

max time kernel
149s
max time network
120s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
11-05-2024 05:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8a97a9c4b60eeeeea177fd9d18205a10_NeikiAnalytics.exe
Size

2.7MB
MD5

8a97a9c4b60eeeeea177fd9d18205a10
SHA1

30c69334764faa21b6295c66decaff1549bac127
SHA256

aa8df7303f376659d0a3560cda232d724ea98eeb7fb653d0640be150a2cf1ea4
SHA512

38fd7b199d00279f8b43f4a33e4f0000d56a0226c45ab9d4b5ecd39a80669c50be11ea3b061be68e7905eef3db55fc36ef85a813e157687326892ceb6024ac1b
SSDEEP

49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBF9w4Sx:+R0pI/IQlUoMPdmpSpR4

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1980	aoptisys.exe

Loads dropped DLL 1 IoCs

pid	Process
1660	8a97a9c4b60eeeeea177fd9d18205a10_NeikiAnalytics.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\FilesQ8\\aoptisys.exe"	8a97a9c4b60eeeeea177fd9d18205a10_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\GalaxZ1\\dobdevsys.exe"	8a97a9c4b60eeeeea177fd9d18205a10_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1660	8a97a9c4b60eeeeea177fd9d18205a10_NeikiAnalytics.exe
1660	8a97a9c4b60eeeeea177fd9d18205a10_NeikiAnalytics.exe
1980	aoptisys.exe
1660	8a97a9c4b60eeeeea177fd9d18205a10_NeikiAnalytics.exe
1980	aoptisys.exe
1660	8a97a9c4b60eeeeea177fd9d18205a10_NeikiAnalytics.exe
1980	aoptisys.exe
1660	8a97a9c4b60eeeeea177fd9d18205a10_NeikiAnalytics.exe
1980	aoptisys.exe
1660	8a97a9c4b60eeeeea177fd9d18205a10_NeikiAnalytics.exe
1980	aoptisys.exe
1660	8a97a9c4b60eeeeea177fd9d18205a10_NeikiAnalytics.exe
1980	aoptisys.exe
1660	8a97a9c4b60eeeeea177fd9d18205a10_NeikiAnalytics.exe
1980	aoptisys.exe
1660	8a97a9c4b60eeeeea177fd9d18205a10_NeikiAnalytics.exe
1980	aoptisys.exe
1660	8a97a9c4b60eeeeea177fd9d18205a10_NeikiAnalytics.exe
1980	aoptisys.exe
1660	8a97a9c4b60eeeeea177fd9d18205a10_NeikiAnalytics.exe
1980	aoptisys.exe
1660	8a97a9c4b60eeeeea177fd9d18205a10_NeikiAnalytics.exe
1980	aoptisys.exe
1660	8a97a9c4b60eeeeea177fd9d18205a10_NeikiAnalytics.exe
1980	aoptisys.exe
1660	8a97a9c4b60eeeeea177fd9d18205a10_NeikiAnalytics.exe
1980	aoptisys.exe
1660	8a97a9c4b60eeeeea177fd9d18205a10_NeikiAnalytics.exe
1980	aoptisys.exe
1660	8a97a9c4b60eeeeea177fd9d18205a10_NeikiAnalytics.exe
1980	aoptisys.exe
1660	8a97a9c4b60eeeeea177fd9d18205a10_NeikiAnalytics.exe
1980	aoptisys.exe
1660	8a97a9c4b60eeeeea177fd9d18205a10_NeikiAnalytics.exe
1980	aoptisys.exe
1660	8a97a9c4b60eeeeea177fd9d18205a10_NeikiAnalytics.exe
1980	aoptisys.exe
1660	8a97a9c4b60eeeeea177fd9d18205a10_NeikiAnalytics.exe
1980	aoptisys.exe
1660	8a97a9c4b60eeeeea177fd9d18205a10_NeikiAnalytics.exe
1980	aoptisys.exe
1660	8a97a9c4b60eeeeea177fd9d18205a10_NeikiAnalytics.exe
1980	aoptisys.exe
1660	8a97a9c4b60eeeeea177fd9d18205a10_NeikiAnalytics.exe
1980	aoptisys.exe
1660	8a97a9c4b60eeeeea177fd9d18205a10_NeikiAnalytics.exe
1980	aoptisys.exe
1660	8a97a9c4b60eeeeea177fd9d18205a10_NeikiAnalytics.exe
1980	aoptisys.exe
1660	8a97a9c4b60eeeeea177fd9d18205a10_NeikiAnalytics.exe
1980	aoptisys.exe
1660	8a97a9c4b60eeeeea177fd9d18205a10_NeikiAnalytics.exe
1980	aoptisys.exe
1660	8a97a9c4b60eeeeea177fd9d18205a10_NeikiAnalytics.exe
1980	aoptisys.exe
1660	8a97a9c4b60eeeeea177fd9d18205a10_NeikiAnalytics.exe
1980	aoptisys.exe
1660	8a97a9c4b60eeeeea177fd9d18205a10_NeikiAnalytics.exe
1980	aoptisys.exe
1660	8a97a9c4b60eeeeea177fd9d18205a10_NeikiAnalytics.exe
1980	aoptisys.exe
1660	8a97a9c4b60eeeeea177fd9d18205a10_NeikiAnalytics.exe
1980	aoptisys.exe
1660	8a97a9c4b60eeeeea177fd9d18205a10_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 1980	1660	8a97a9c4b60eeeeea177fd9d18205a10_NeikiAnalytics.exe	28
PID 1660 wrote to memory of 1980	1660	8a97a9c4b60eeeeea177fd9d18205a10_NeikiAnalytics.exe	28
PID 1660 wrote to memory of 1980	1660	8a97a9c4b60eeeeea177fd9d18205a10_NeikiAnalytics.exe	28
PID 1660 wrote to memory of 1980	1660	8a97a9c4b60eeeeea177fd9d18205a10_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\8a97a9c4b60eeeeea177fd9d18205a10_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\8a97a9c4b60eeeeea177fd9d18205a10_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1660
- C:\FilesQ8\aoptisys.exe
  C:\FilesQ8\aoptisys.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\GalaxZ1\dobdevsys.exe

Filesize
2.7MB

MD5
7b5a6651830bcb5082cc3af8fa3cdde1

SHA1
f53689264ab8c7cb0d36b80c4c77b22ae311b2e9

SHA256
d8c512d0c945baf6552105be05c10e47a4c157e6aea176d76c1aa9feae04bdfa

SHA512
b33507776553810c4ffe774dbb862b0069be47f816082adb53fa8c7a7bad4408be0dcf005614463bb312f10fa84bb19bff43a44843f3f336a454ca4c6d4bba90

Download Submit
C:\Users\Admin\253086396416_6.1_Admin.ini

Filesize
204B

MD5
e19be7b432e94d88ea14925cf52c34c8

SHA1
03c2afb3388450b919eb782a05dfc51c4257dfa6

SHA256
ec76416865552b748f14167981b39f7861ad6c3a43184991e6d97bd9455ef936

SHA512
602610a9925af2d707cb456738c3566c749e19f7f6c829115b398089749cab195d3ab87f229c7c6607c6869e6271847fbe6854d894341998bda2a29b859d41dd

Download Submit
\FilesQ8\aoptisys.exe

Filesize
2.7MB

MD5
bcfb0b5584c3cc6fb6f9b4c4fe195356

SHA1
8309ea48d4b0fdb45782dd28c99cda261f757895

SHA256
2acaea6593541b6ad54f754661d7fb76ba9d7aca2b43a8160577e95a7eacc97c

SHA512
b25db6bcbe2e3a338cb037c01bba9a42eebe80631b3e780c725143c81714c03639db83fba5b26502e017192cf985f80139709791f1728aa3376d01d42788a9cb

Download Submit