Analysis
- max time kernel
151s - max time network
158s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
25/05/2024, 03:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
45c3aa4aa5c1d0268122fcb87f754f60_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
45c3aa4aa5c1d0268122fcb87f754f60_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 45c3aa4aa5c1d0268122fcb87f754f60_NeikiAnalytics.exe
- Size 2.7MB
- Sample240525-drlanace91
- SHA256 dca1e793247a51122452a5c0c3af4a5cbe96691a7969682e104517a39dd5dd8f
- MD5 45c3aa4aa5c1d0268122fcb87f754f60
- SHA1 620439b7fe3d8c380675210175798f40bba2058b
- SHA512 0d05802180ff97508ef7d84e5a82b331707c519e3da41e13478fbb797e69f0b632392589825967101ebaf15185f3494dbe2393c976ced383d8bfb66104000a5e
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBJ9w4Sx:+R0pI/IQlUoMPdmpSpR4
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3744 xdobloc.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\UserDotF2\\xdobloc.exe" 45c3aa4aa5c1d0268122fcb87f754f60_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\MintI3\\optixsys.exe" 45c3aa4aa5c1d0268122fcb87f754f60_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3292 45c3aa4aa5c1d0268122fcb87f754f60_NeikiAnalytics.exe 3292 45c3aa4aa5c1d0268122fcb87f754f60_NeikiAnalytics.exe 3292 45c3aa4aa5c1d0268122fcb87f754f60_NeikiAnalytics.exe 3292 45c3aa4aa5c1d0268122fcb87f754f60_NeikiAnalytics.exe 3744 xdobloc.exe 3744 xdobloc.exe 3292 45c3aa4aa5c1d0268122fcb87f754f60_NeikiAnalytics.exe 3292 45c3aa4aa5c1d0268122fcb87f754f60_NeikiAnalytics.exe 3744 xdobloc.exe 3744 xdobloc.exe 3292 45c3aa4aa5c1d0268122fcb87f754f60_NeikiAnalytics.exe 3292 45c3aa4aa5c1d0268122fcb87f754f60_NeikiAnalytics.exe 3744 xdobloc.exe 3744 xdobloc.exe 3292 45c3aa4aa5c1d0268122fcb87f754f60_NeikiAnalytics.exe 3292 45c3aa4aa5c1d0268122fcb87f754f60_NeikiAnalytics.exe 3744 xdobloc.exe 3744 xdobloc.exe 3292 45c3aa4aa5c1d0268122fcb87f754f60_NeikiAnalytics.exe 3292 45c3aa4aa5c1d0268122fcb87f754f60_NeikiAnalytics.exe 3744 xdobloc.exe 3744 xdobloc.exe 3292 45c3aa4aa5c1d0268122fcb87f754f60_NeikiAnalytics.exe 3292 45c3aa4aa5c1d0268122fcb87f754f60_NeikiAnalytics.exe 3744 xdobloc.exe 3744 xdobloc.exe 3292 45c3aa4aa5c1d0268122fcb87f754f60_NeikiAnalytics.exe 3292 45c3aa4aa5c1d0268122fcb87f754f60_NeikiAnalytics.exe 3744 xdobloc.exe 3744 xdobloc.exe 3292 45c3aa4aa5c1d0268122fcb87f754f60_NeikiAnalytics.exe 3292 45c3aa4aa5c1d0268122fcb87f754f60_NeikiAnalytics.exe 3744 xdobloc.exe 3744 xdobloc.exe 3292 45c3aa4aa5c1d0268122fcb87f754f60_NeikiAnalytics.exe 3292 45c3aa4aa5c1d0268122fcb87f754f60_NeikiAnalytics.exe 3744 xdobloc.exe 3744 xdobloc.exe 3292 45c3aa4aa5c1d0268122fcb87f754f60_NeikiAnalytics.exe 3292 45c3aa4aa5c1d0268122fcb87f754f60_NeikiAnalytics.exe 3744 xdobloc.exe 3744 xdobloc.exe 3292 45c3aa4aa5c1d0268122fcb87f754f60_NeikiAnalytics.exe 3292 45c3aa4aa5c1d0268122fcb87f754f60_NeikiAnalytics.exe 3744 xdobloc.exe 3744 xdobloc.exe 3292 45c3aa4aa5c1d0268122fcb87f754f60_NeikiAnalytics.exe 3292 45c3aa4aa5c1d0268122fcb87f754f60_NeikiAnalytics.exe 3744 xdobloc.exe 3744 xdobloc.exe 3292 45c3aa4aa5c1d0268122fcb87f754f60_NeikiAnalytics.exe 3292 45c3aa4aa5c1d0268122fcb87f754f60_NeikiAnalytics.exe 3744 xdobloc.exe 3744 xdobloc.exe 3292 45c3aa4aa5c1d0268122fcb87f754f60_NeikiAnalytics.exe 3292 45c3aa4aa5c1d0268122fcb87f754f60_NeikiAnalytics.exe 3744 xdobloc.exe 3744 xdobloc.exe 3292 45c3aa4aa5c1d0268122fcb87f754f60_NeikiAnalytics.exe 3292 45c3aa4aa5c1d0268122fcb87f754f60_NeikiAnalytics.exe 3744 xdobloc.exe 3744 xdobloc.exe 3292 45c3aa4aa5c1d0268122fcb87f754f60_NeikiAnalytics.exe 3292 45c3aa4aa5c1d0268122fcb87f754f60_NeikiAnalytics.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3292 wrote to memory of 3744 3292 45c3aa4aa5c1d0268122fcb87f754f60_NeikiAnalytics.exe 92 PID 3292 wrote to memory of 3744 3292 45c3aa4aa5c1d0268122fcb87f754f60_NeikiAnalytics.exe 92 PID 3292 wrote to memory of 3744 3292 45c3aa4aa5c1d0268122fcb87f754f60_NeikiAnalytics.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\45c3aa4aa5c1d0268122fcb87f754f60_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\45c3aa4aa5c1d0268122fcb87f754f60_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\UserDotF2\xdobloc.exeC:\UserDotF2\xdobloc.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4080 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:81⤵PID:1124
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\MintI3\optixsys.exe
- Size 12KB
- SHA256 8989c30319b39766d8386754527ee98423aa21136d1918453163df7dc04c58fa
- MD5 d5a7d525dbe308b8a427c14d39f93449
- SHA1 be921176bd559fb31ca16ffa3f7b1138564947f3
- SHA512 87796e55cee373ea3be465a18afcec7543ea327cc6f5a289619a90950d3b9b16cf510f7ec55871ee8f7a27fc7bcc672ae59cb2a6862aadb1004c706de3925521
- SSDEEP 192:lNLT5nl3TzTH4HKnxRuq0dn8E/ES76xS7BzFq:PLT5lDnYcy/ES70S7Tq
- MD5 SHA1 SHA512 SSDEEP
- Path C:\UserDotF2\xdobloc.exe
- Size 2.7MB
- SHA256 c087417c39c32a8a16f4508207291e1f10170bfe795f77bfb0b5cfffbdfc1023
- MD5 89367ae625427df151d6fea2590647fc
- SHA1 3e7616d0aa63d3a0b71826f4ea96fe6c339fc986
- SHA512 c9b57bff61cf0306970187fe4cb4796578b88c478cbe9cc9038287e12be595b81c064382d4c20b802a55888dfa7b82592ba2bf12ff077427048dd2ad6e10650f
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBQ9w4Sx:+R0pI/IQlUoMPdmpSpO4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 204B
- SHA256 4a57dc29299cb9f7436f89f0be3c3dafee68ba463a72946a52b6e44d2cc69987
- MD5 922b0f57421769a625d912ad618be5f8
- SHA1 972d1dc59ccb52b8022e578c8b29c618611d46af
- SHA512 f5c8761ed0049014fae4dc81f5b17d9e16b096af366d29676140e280037678b44153c5342a6a852f7b6e0c820a5ad3141b6fe0bbe2db023e03bf3da5ba3dfd58
- MD5 SHA1 SHA512