90e82a0243361e09344500cdd09f5538a5a59e3661e9c5b37e7eda4454888078

Analysis

max time kernel
149s
max time network
121s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 09:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c0bf732dcf2720b82d7b96a9033b7fb0_NeikiAnalytics.exe
Size

2.7MB
MD5

c0bf732dcf2720b82d7b96a9033b7fb0
SHA1

fa5c7127a2db863de943919f3da0084519d82be9
SHA256

90e82a0243361e09344500cdd09f5538a5a59e3661e9c5b37e7eda4454888078
SHA512

cece647b1a426b8ff309e6ca172e7844cf881d3894fde24b5fb7f07a8d7866a50c33868fb1c0fd3b659cca504ad24ff697fd53692ae13da4657b69b0d541f1d3
SSDEEP

49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LB29w4Sx:+R0pI/IQlUoMPdmpSpE4

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1940	aoptiloc.exe

Loads dropped DLL 1 IoCs

pid	Process
2076	c0bf732dcf2720b82d7b96a9033b7fb0_NeikiAnalytics.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\UserDotRR\\aoptiloc.exe"	c0bf732dcf2720b82d7b96a9033b7fb0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\MintUW\\optialoc.exe"	c0bf732dcf2720b82d7b96a9033b7fb0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2076	c0bf732dcf2720b82d7b96a9033b7fb0_NeikiAnalytics.exe
2076	c0bf732dcf2720b82d7b96a9033b7fb0_NeikiAnalytics.exe
1940	aoptiloc.exe
2076	c0bf732dcf2720b82d7b96a9033b7fb0_NeikiAnalytics.exe
1940	aoptiloc.exe
2076	c0bf732dcf2720b82d7b96a9033b7fb0_NeikiAnalytics.exe
1940	aoptiloc.exe
2076	c0bf732dcf2720b82d7b96a9033b7fb0_NeikiAnalytics.exe
1940	aoptiloc.exe
2076	c0bf732dcf2720b82d7b96a9033b7fb0_NeikiAnalytics.exe
1940	aoptiloc.exe
2076	c0bf732dcf2720b82d7b96a9033b7fb0_NeikiAnalytics.exe
1940	aoptiloc.exe
2076	c0bf732dcf2720b82d7b96a9033b7fb0_NeikiAnalytics.exe
1940	aoptiloc.exe
2076	c0bf732dcf2720b82d7b96a9033b7fb0_NeikiAnalytics.exe
1940	aoptiloc.exe
2076	c0bf732dcf2720b82d7b96a9033b7fb0_NeikiAnalytics.exe
1940	aoptiloc.exe
2076	c0bf732dcf2720b82d7b96a9033b7fb0_NeikiAnalytics.exe
1940	aoptiloc.exe
2076	c0bf732dcf2720b82d7b96a9033b7fb0_NeikiAnalytics.exe
1940	aoptiloc.exe
2076	c0bf732dcf2720b82d7b96a9033b7fb0_NeikiAnalytics.exe
1940	aoptiloc.exe
2076	c0bf732dcf2720b82d7b96a9033b7fb0_NeikiAnalytics.exe
1940	aoptiloc.exe
2076	c0bf732dcf2720b82d7b96a9033b7fb0_NeikiAnalytics.exe
1940	aoptiloc.exe
2076	c0bf732dcf2720b82d7b96a9033b7fb0_NeikiAnalytics.exe
1940	aoptiloc.exe
2076	c0bf732dcf2720b82d7b96a9033b7fb0_NeikiAnalytics.exe
1940	aoptiloc.exe
2076	c0bf732dcf2720b82d7b96a9033b7fb0_NeikiAnalytics.exe
1940	aoptiloc.exe
2076	c0bf732dcf2720b82d7b96a9033b7fb0_NeikiAnalytics.exe
1940	aoptiloc.exe
2076	c0bf732dcf2720b82d7b96a9033b7fb0_NeikiAnalytics.exe
1940	aoptiloc.exe
2076	c0bf732dcf2720b82d7b96a9033b7fb0_NeikiAnalytics.exe
1940	aoptiloc.exe
2076	c0bf732dcf2720b82d7b96a9033b7fb0_NeikiAnalytics.exe
1940	aoptiloc.exe
2076	c0bf732dcf2720b82d7b96a9033b7fb0_NeikiAnalytics.exe
1940	aoptiloc.exe
2076	c0bf732dcf2720b82d7b96a9033b7fb0_NeikiAnalytics.exe
1940	aoptiloc.exe
2076	c0bf732dcf2720b82d7b96a9033b7fb0_NeikiAnalytics.exe
1940	aoptiloc.exe
2076	c0bf732dcf2720b82d7b96a9033b7fb0_NeikiAnalytics.exe
1940	aoptiloc.exe
2076	c0bf732dcf2720b82d7b96a9033b7fb0_NeikiAnalytics.exe
1940	aoptiloc.exe
2076	c0bf732dcf2720b82d7b96a9033b7fb0_NeikiAnalytics.exe
1940	aoptiloc.exe
2076	c0bf732dcf2720b82d7b96a9033b7fb0_NeikiAnalytics.exe
1940	aoptiloc.exe
2076	c0bf732dcf2720b82d7b96a9033b7fb0_NeikiAnalytics.exe
1940	aoptiloc.exe
2076	c0bf732dcf2720b82d7b96a9033b7fb0_NeikiAnalytics.exe
1940	aoptiloc.exe
2076	c0bf732dcf2720b82d7b96a9033b7fb0_NeikiAnalytics.exe
1940	aoptiloc.exe
2076	c0bf732dcf2720b82d7b96a9033b7fb0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 1940	2076	c0bf732dcf2720b82d7b96a9033b7fb0_NeikiAnalytics.exe	28
PID 2076 wrote to memory of 1940	2076	c0bf732dcf2720b82d7b96a9033b7fb0_NeikiAnalytics.exe	28
PID 2076 wrote to memory of 1940	2076	c0bf732dcf2720b82d7b96a9033b7fb0_NeikiAnalytics.exe	28
PID 2076 wrote to memory of 1940	2076	c0bf732dcf2720b82d7b96a9033b7fb0_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\c0bf732dcf2720b82d7b96a9033b7fb0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\c0bf732dcf2720b82d7b96a9033b7fb0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2076
- C:\UserDotRR\aoptiloc.exe
  C:\UserDotRR\aoptiloc.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MintUW\optialoc.exe

Filesize
2.7MB

MD5
b7f164321a394f9697f3decc9163e8de

SHA1
30afe2fff7dcdb0298dd06d658d8b14e09e7e539

SHA256
7d96bbbd8c883634a70fd173e75eb2fb8d5297d7d4c943b2d0125ad15f8a3d5b

SHA512
109a58567b35d7dd8c323776a0e6f1ab61c1d0158d86519d65e072397f471ef59ce2e917ab0acd1c60f680a88e940a37fb0114abe369673f360b4272d72c2d8b

Download Submit
C:\Users\Admin\253086396416_6.1_Admin.ini

Filesize
205B

MD5
29c48787dd86bc1d9f18d44419a323e1

SHA1
5217cf790013e98767999b4a56b74d7d828985fc

SHA256
1f5cbd3a16c48ed7998eb365b582f2321c1fcb3e40413f431b7e83b569c179fb

SHA512
36a12869c865b59f6b785ee52d0e46a411a9c5388fb0c419a6ce9284aed258239d56b170ddfeac3f8c56919b33bdf30246eca5423158598228661e8b8970cba8

Download Submit
\UserDotRR\aoptiloc.exe

Filesize
2.7MB

MD5
433819ed004ab1290366419af8464636

SHA1
589d89490dab5cfd1350becd62bcd4f7cc348b35

SHA256
026f0c28e4fc99aba25a80257b9d08f1be25e514a71f579f5a83eb9c127fb7b6

SHA512
40b93f57bf7b51652dcf51931d584734b52b872394db13ee8e93311212dc2e02484ee41efd58f87f4691471b749f9ab3ff228d34f17ba97c5c0cce3799d3fd20

Download Submit