1c8399a59b5347641a665ed1744894ea9c513068740dc0f909ed6da7f6030e47

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 14:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe
Size

2.7MB
MD5

0863e1268bf146972594281dfea8c840
SHA1

162ae9c5144580aa6fb8911b0a418be6a4548c40
SHA256

1c8399a59b5347641a665ed1744894ea9c513068740dc0f909ed6da7f6030e47
SHA512

ef4c6cc62bf10a1e82b2867fb629dcbb44eef1f9f3dbaf8961921303f6bd6b7c07ad5796d2989bcd73d111748a7d83f0a95b444692956189506322b5e248d956
SSDEEP

49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBX9w4Sx:+R0pI/IQlUoMPdmpSpz4

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3844	aoptiec.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\FilesWQ\\aoptiec.exe"	0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\VidMP\\dobxloc.exe"	0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2848	0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe
2848	0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe
2848	0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe
2848	0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe
3844	aoptiec.exe
3844	aoptiec.exe
2848	0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe
2848	0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe
3844	aoptiec.exe
3844	aoptiec.exe
2848	0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe
2848	0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe
3844	aoptiec.exe
3844	aoptiec.exe
2848	0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe
2848	0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe
3844	aoptiec.exe
3844	aoptiec.exe
2848	0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe
2848	0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe
3844	aoptiec.exe
3844	aoptiec.exe
2848	0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe
2848	0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe
3844	aoptiec.exe
3844	aoptiec.exe
2848	0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe
2848	0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe
3844	aoptiec.exe
3844	aoptiec.exe
2848	0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe
2848	0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe
3844	aoptiec.exe
3844	aoptiec.exe
2848	0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe
2848	0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe
3844	aoptiec.exe
3844	aoptiec.exe
2848	0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe
2848	0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe
3844	aoptiec.exe
3844	aoptiec.exe
2848	0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe
2848	0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe
3844	aoptiec.exe
3844	aoptiec.exe
2848	0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe
2848	0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe
3844	aoptiec.exe
3844	aoptiec.exe
2848	0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe
2848	0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe
3844	aoptiec.exe
3844	aoptiec.exe
2848	0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe
2848	0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe
3844	aoptiec.exe
3844	aoptiec.exe
2848	0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe
2848	0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe
3844	aoptiec.exe
3844	aoptiec.exe
2848	0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe
2848	0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 3844	2848	0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe	88
PID 2848 wrote to memory of 3844	2848	0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe	88
PID 2848 wrote to memory of 3844	2848	0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe	88

C:\Users\Admin\AppData\Local\Temp\0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2848
- C:\FilesWQ\aoptiec.exe
  C:\FilesWQ\aoptiec.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:3844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\FilesWQ\aoptiec.exe

Filesize
2.7MB

MD5
77d20289378388b15ec3f677b15f9c70

SHA1
79ab69be24e2433fa300b33f2ad10f892c818349

SHA256
b38d91bffee348623d499d205d3d43620998bbaf4fdfec1ed1fa7a78eca0dd85

SHA512
f74e7b2a7d8cd2065a88c93f2231c12ab7aace55a2af3b6f02b708fc2482dc865c9fa64931b75e42f1507bec5bc29c7a0a004b9163ae05299a4ec23ecc040740

Download Submit
C:\Users\Admin\253086396416_10.0_Admin.ini

Filesize
199B

MD5
15e220d49e852cbaeeea571555cf3cff

SHA1
bb3b940c402e5302602a40a6fb763b8df8c30a51

SHA256
122167246cbd427b04d56e9ca13074b35e8e7b96bbc36ed3ef67133c42fbf581

SHA512
8e8b02419fdafa04d9bd61448c7607f5320dc96d5b86c987cd0db62db6eb2b9c0e9069121e1a71f34eda29d19aea7183274c7e077dd356c0511f3679344793f9

Download Submit
C:\VidMP\dobxloc.exe

Filesize
2.7MB

MD5
ee29fc485cc468409413281781b605f5

SHA1
efbc5987bcd4678816bbdd2b4e850bef804cd737

SHA256
97b286352a57e79ba9bbc574379301e256f6df69b54945e0227c01195cc89a64

SHA512
a82514634708d3d0b2568d80b50f82223fc091b3faf2c27dbd81b4fbf0bfa08b9ccd1884310dc8dfc7c6f43655e394f80842a0b9c52dd59993a1609cd00d8c12

Download Submit