Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
-
submitted
17-05-2024 01:08
General
-
Target
73958505ff0152f23a0cd73941c3e0d0_NeikiAnalytics.exe
-
Size
3.0MB
-
MD5
73958505ff0152f23a0cd73941c3e0d0
-
SHA1
abf7fa6de27db798cf54ef32625b51247de54cb0
-
SHA256
27ea63244f117e7f6c4154e4f5d594de4a11418af431158abc63fdf4f1637255
-
SHA512
3cfb8875855d779800f6544760e62ae77ca6dbba04d92c0134de49bda04562ff3268eff38fb8dfc3383aa85be0cc2eb6840c0acd801ba0ae564d011cca4c6c88
-
SSDEEP
49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBSB/bSqz8b6LNX:sxX7QnxrloE5dpUpFbVz8eLF
Malware Config
Signatures
-
Drops startup file 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\73958505ff0152f23a0cd73941c3e0d0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\73958505ff0152f23a0cd73941c3e0d0_NeikiAnalytics.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysaopti.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysaopti.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\FilesFM\xoptisys.exeC:\FilesFM\xoptisys.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.0MB
MD5230e381aeff4d21e9e21f1713cce7cb1
SHA1b69c59c6755d286a7f7ed75ba0a8e7d470ca241d
SHA256eaf4394f8b845a71a084059dc177d29f1c26812865e9284d2740dd83d0006390
SHA5123a579cc0384721e0e532107c01cc0cef2e97a323426084e6e438181bcefb9ed1fa94c40dcb49899083fc3fb384226ece13a64c39b4b9c89836152bc6fa9bbb74
-
Filesize
169B
MD5a19e12f415e3ac39ed80649c1134b78e
SHA17384f215aa9bc5c57317d0c3060d773c711c2ae0
SHA2564b0b1324b4480a04c959dce9e1df68086586e30895ba3a2b435bda57e0fe113e
SHA512eb67a6dc6430d62b6859e354d675992ddbd30798e38de671f19b673a192701a557abaa1a40007826032fa81bbf0a94f5c0c94225803c2153641a674d935db76f
-
Filesize
201B
MD502f21068bcb1bca318c0fb7c983d87ae
SHA1c123caf8cd8419f04107416e8bb5dc266aab77dd
SHA256e09a72c0dc587cd0fb597844b26eede2d9057c0a9f59a5a5448c1ce258a93317
SHA5124af37bc1c41f28ffcc4def3d71832ff9610727dd75f4b188477b6c8387a8bcff159506800f3b69fef18ea13537e14bf043ce043fb6b5f67efbef2c115021613d
-
Filesize
3.0MB
MD5e44010cab1f90d291ae92826a2675a5c
SHA15aec956d7ea738dce4800e933fb7fd1003db889f
SHA256f78e3318eb1cf22faae3ff444e67d9e62c8ce809942dd935c42a78227787250d
SHA5125b5d58770153999e28da5128ebeb6d9092237cfe45ed383db4732ef7b406de92fc24af8b1bf669f292b26a1a2085ce4a4bb03ef919cfd4b2025519722067184b
-
Filesize
3.0MB
MD559b42a16a835c897dc31603129e1f83f
SHA100d8acdf5fde70b3f7563f76a3b5c6f5fac1253e
SHA2566c0bea445020eddb53c4912d53569cf04a421702dfb4e24495e84328d8672602
SHA51247efc92fb102df12eb9ea4222c5f96eb897df7d064adaf7e60d37ced8c4454afb4fb108065b703761018d27ec266a1e47b84ebbf4368ddab17352c2b9893b99a
-
Filesize
3.0MB
MD5ab2a3e47d84dd5f6993a2fea700f02e5
SHA12c84a5b9cb79117535448544662cd26f80491604
SHA256f7b0667d7d6ac76caa51e8f69bf5bed53712a1f19e8975c23148ac2587d61086
SHA512c1b3cb0cb80e085893b5d560352abe24159f75c73cadcac4e621271030215ac6eb3b508e1581ad3581800129f1821c17ab228fdec14e98050e013e9c1676d7c1