844167d57b507f3144e594dec81f124320792c381a2c3d805964bc37af24b3cf

General

Target

34d287f31b87286d6ce3121b80a5cef0_NeikiAnalytics.exe
Size

2.7MB
MD5

34d287f31b87286d6ce3121b80a5cef0
SHA1

03a64af9f39c7989a8fd800ad0229688ea531e85
SHA256

844167d57b507f3144e594dec81f124320792c381a2c3d805964bc37af24b3cf
SHA512

ed710668cad07edbed3c706a256b2fed40eac69b3ec990b68bdbbbe67d109cf1851d6f8fd7f97f83ad0791814ccb7c68c9defc6d3a1372e56db73cb4d9e76298
SSDEEP

49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBz9w4Sx:+R0pI/IQlUoMPdmpSpT4

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

aoptiec.exe

pid process

2264 aoptiec.exe
Loads dropped DLL 1 IoCs

Processes:

34d287f31b87286d6ce3121b80a5cef0_NeikiAnalytics.exe

pid process

1520 34d287f31b87286d6ce3121b80a5cef0_NeikiAnalytics.exe

pid	process
2264	aoptiec.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

34d287f31b87286d6ce3121b80a5cef0_NeikiAnalytics.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\Files9L\\aoptiec.exe"	34d287f31b87286d6ce3121b80a5cef0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\KaVBRL\\boddevsys.exe"	34d287f31b87286d6ce3121b80a5cef0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

34d287f31b87286d6ce3121b80a5cef0_NeikiAnalytics.exeaoptiec.exe

pid	process
1520	34d287f31b87286d6ce3121b80a5cef0_NeikiAnalytics.exe
1520	34d287f31b87286d6ce3121b80a5cef0_NeikiAnalytics.exe
2264	aoptiec.exe
1520	34d287f31b87286d6ce3121b80a5cef0_NeikiAnalytics.exe
2264	aoptiec.exe
1520	34d287f31b87286d6ce3121b80a5cef0_NeikiAnalytics.exe
2264	aoptiec.exe
1520	34d287f31b87286d6ce3121b80a5cef0_NeikiAnalytics.exe
2264	aoptiec.exe
1520	34d287f31b87286d6ce3121b80a5cef0_NeikiAnalytics.exe
2264	aoptiec.exe
1520	34d287f31b87286d6ce3121b80a5cef0_NeikiAnalytics.exe
2264	aoptiec.exe
1520	34d287f31b87286d6ce3121b80a5cef0_NeikiAnalytics.exe
2264	aoptiec.exe
1520	34d287f31b87286d6ce3121b80a5cef0_NeikiAnalytics.exe
2264	aoptiec.exe
1520	34d287f31b87286d6ce3121b80a5cef0_NeikiAnalytics.exe
2264	aoptiec.exe
1520	34d287f31b87286d6ce3121b80a5cef0_NeikiAnalytics.exe
2264	aoptiec.exe
1520	34d287f31b87286d6ce3121b80a5cef0_NeikiAnalytics.exe
2264	aoptiec.exe
1520	34d287f31b87286d6ce3121b80a5cef0_NeikiAnalytics.exe
2264	aoptiec.exe
1520	34d287f31b87286d6ce3121b80a5cef0_NeikiAnalytics.exe
2264	aoptiec.exe
1520	34d287f31b87286d6ce3121b80a5cef0_NeikiAnalytics.exe
2264	aoptiec.exe
1520	34d287f31b87286d6ce3121b80a5cef0_NeikiAnalytics.exe
2264	aoptiec.exe
1520	34d287f31b87286d6ce3121b80a5cef0_NeikiAnalytics.exe
2264	aoptiec.exe
1520	34d287f31b87286d6ce3121b80a5cef0_NeikiAnalytics.exe
2264	aoptiec.exe
1520	34d287f31b87286d6ce3121b80a5cef0_NeikiAnalytics.exe
2264	aoptiec.exe
1520	34d287f31b87286d6ce3121b80a5cef0_NeikiAnalytics.exe
2264	aoptiec.exe
1520	34d287f31b87286d6ce3121b80a5cef0_NeikiAnalytics.exe
2264	aoptiec.exe
1520	34d287f31b87286d6ce3121b80a5cef0_NeikiAnalytics.exe
2264	aoptiec.exe
1520	34d287f31b87286d6ce3121b80a5cef0_NeikiAnalytics.exe
2264	aoptiec.exe
1520	34d287f31b87286d6ce3121b80a5cef0_NeikiAnalytics.exe
2264	aoptiec.exe
1520	34d287f31b87286d6ce3121b80a5cef0_NeikiAnalytics.exe
2264	aoptiec.exe
1520	34d287f31b87286d6ce3121b80a5cef0_NeikiAnalytics.exe
2264	aoptiec.exe
1520	34d287f31b87286d6ce3121b80a5cef0_NeikiAnalytics.exe
2264	aoptiec.exe
1520	34d287f31b87286d6ce3121b80a5cef0_NeikiAnalytics.exe
2264	aoptiec.exe
1520	34d287f31b87286d6ce3121b80a5cef0_NeikiAnalytics.exe
2264	aoptiec.exe
1520	34d287f31b87286d6ce3121b80a5cef0_NeikiAnalytics.exe
2264	aoptiec.exe
1520	34d287f31b87286d6ce3121b80a5cef0_NeikiAnalytics.exe
2264	aoptiec.exe
1520	34d287f31b87286d6ce3121b80a5cef0_NeikiAnalytics.exe
2264	aoptiec.exe
1520	34d287f31b87286d6ce3121b80a5cef0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

34d287f31b87286d6ce3121b80a5cef0_NeikiAnalytics.exe

description	pid	process	target process
PID 1520 wrote to memory of 2264	1520	34d287f31b87286d6ce3121b80a5cef0_NeikiAnalytics.exe	aoptiec.exe
PID 1520 wrote to memory of 2264	1520	34d287f31b87286d6ce3121b80a5cef0_NeikiAnalytics.exe	aoptiec.exe
PID 1520 wrote to memory of 2264	1520	34d287f31b87286d6ce3121b80a5cef0_NeikiAnalytics.exe	aoptiec.exe
PID 1520 wrote to memory of 2264	1520	34d287f31b87286d6ce3121b80a5cef0_NeikiAnalytics.exe	aoptiec.exe

C:\Users\Admin\AppData\Local\Temp\34d287f31b87286d6ce3121b80a5cef0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\34d287f31b87286d6ce3121b80a5cef0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1520

C:\Files9L\aoptiec.exe
C:\Files9L\aoptiec.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\KaVBRL\boddevsys.exe

Filesize
12KB

MD5
d5a7d525dbe308b8a427c14d39f93449

SHA1
be921176bd559fb31ca16ffa3f7b1138564947f3

SHA256
8989c30319b39766d8386754527ee98423aa21136d1918453163df7dc04c58fa

SHA512
87796e55cee373ea3be465a18afcec7543ea327cc6f5a289619a90950d3b9b16cf510f7ec55871ee8f7a27fc7bcc672ae59cb2a6862aadb1004c706de3925521

Download Submit
C:\Users\Admin\253086396416_6.1_Admin.ini

Filesize
202B

MD5
7039996cc8584225bf5f4dc17225652f

SHA1
0804a859ab6bba3044e224f0077f1ba4811a83c4

SHA256
cd5fd1401fb66a1ecfef02f3c50d2e159d7f1e55befdf78cec2c969fc37adbd0

SHA512
faa90db8b46fdbbb044eb3c18fc2e0b39cb7804c6e518f51817339028b2774a51658c0ece4cb34be24b69fe6abede7542b681e95301e07d3c911c5bad1381f74

Download Submit
\Files9L\aoptiec.exe

Filesize
2.7MB

MD5
a731397e8d55fbab05f6fee58c7205ff

SHA1
98586cae1aa626fda999f68a49237d6bcc7bf7ab

SHA256
ac624670826e2a41babf15bdfdf1dce4bcec63f3dc872091152358bc03fee8d1

SHA512
ac16f9c6fc68af827ed00357993e0ff137019e68a0085f805276fdff8724fd0b3765277010ffe7b522d9d36d2b2c9b3104a42a63a9a5793235888edb7386d765

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads