Analysis
- max time kernel
149s - max time network
124s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
27/05/2024, 16:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
004218a027f6b0cfc564f4124a1d9620_NeikiAnalytics.exe
Resource
win7-20240215-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
004218a027f6b0cfc564f4124a1d9620_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 004218a027f6b0cfc564f4124a1d9620_NeikiAnalytics.exe
- Size 3.1MB
- Sample240527-vglbcabh66
- SHA256 5f8d4ca837def9700d72fa81ce71f131d97d70956b91570fad5422254b3089e2
- MD5 004218a027f6b0cfc564f4124a1d9620
- SHA1 458a6afd4cffd35af6f2b0c9c023c86cc6359dc8
- SHA512 e35b28c1a7b540e6343a1199187a2f374ae51fd209fc8e1104988a0a87326cf17bc94b6ab7b6e3cfa119fe54bfbc61ae57bff36907da36e95818d8ce799c2d09
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBeB/bSqz8:sxX7QnxrloE5dpUp1bVz8
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevopti.exe 004218a027f6b0cfc564f4124a1d9620_NeikiAnalytics.exe - Executes dropped EXE 2 IoCs
pid Process 4728 locdevopti.exe 1960 aoptiloc.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\AdobeYY\\aoptiloc.exe" 004218a027f6b0cfc564f4124a1d9620_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\GalaxSJ\\dobdevec.exe" 004218a027f6b0cfc564f4124a1d9620_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3188 004218a027f6b0cfc564f4124a1d9620_NeikiAnalytics.exe 3188 004218a027f6b0cfc564f4124a1d9620_NeikiAnalytics.exe 3188 004218a027f6b0cfc564f4124a1d9620_NeikiAnalytics.exe 3188 004218a027f6b0cfc564f4124a1d9620_NeikiAnalytics.exe 4728 locdevopti.exe 4728 locdevopti.exe 1960 aoptiloc.exe 1960 aoptiloc.exe 4728 locdevopti.exe 4728 locdevopti.exe 1960 aoptiloc.exe 1960 aoptiloc.exe 4728 locdevopti.exe 4728 locdevopti.exe 1960 aoptiloc.exe 1960 aoptiloc.exe 4728 locdevopti.exe 4728 locdevopti.exe 1960 aoptiloc.exe 1960 aoptiloc.exe 4728 locdevopti.exe 4728 locdevopti.exe 1960 aoptiloc.exe 1960 aoptiloc.exe 4728 locdevopti.exe 4728 locdevopti.exe 1960 aoptiloc.exe 1960 aoptiloc.exe 4728 locdevopti.exe 4728 locdevopti.exe 1960 aoptiloc.exe 1960 aoptiloc.exe 4728 locdevopti.exe 4728 locdevopti.exe 1960 aoptiloc.exe 1960 aoptiloc.exe 4728 locdevopti.exe 4728 locdevopti.exe 1960 aoptiloc.exe 1960 aoptiloc.exe 4728 locdevopti.exe 4728 locdevopti.exe 1960 aoptiloc.exe 1960 aoptiloc.exe 4728 locdevopti.exe 4728 locdevopti.exe 1960 aoptiloc.exe 1960 aoptiloc.exe 4728 locdevopti.exe 4728 locdevopti.exe 1960 aoptiloc.exe 1960 aoptiloc.exe 4728 locdevopti.exe 4728 locdevopti.exe 1960 aoptiloc.exe 1960 aoptiloc.exe 4728 locdevopti.exe 4728 locdevopti.exe 1960 aoptiloc.exe 1960 aoptiloc.exe 4728 locdevopti.exe 4728 locdevopti.exe 1960 aoptiloc.exe 1960 aoptiloc.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3188 wrote to memory of 4728 3188 004218a027f6b0cfc564f4124a1d9620_NeikiAnalytics.exe 89 PID 3188 wrote to memory of 4728 3188 004218a027f6b0cfc564f4124a1d9620_NeikiAnalytics.exe 89 PID 3188 wrote to memory of 4728 3188 004218a027f6b0cfc564f4124a1d9620_NeikiAnalytics.exe 89 PID 3188 wrote to memory of 1960 3188 004218a027f6b0cfc564f4124a1d9620_NeikiAnalytics.exe 90 PID 3188 wrote to memory of 1960 3188 004218a027f6b0cfc564f4124a1d9620_NeikiAnalytics.exe 90 PID 3188 wrote to memory of 1960 3188 004218a027f6b0cfc564f4124a1d9620_NeikiAnalytics.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\004218a027f6b0cfc564f4124a1d9620_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\004218a027f6b0cfc564f4124a1d9620_NeikiAnalytics.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevopti.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevopti.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4728
-
-
C:\AdobeYY\aoptiloc.exeC:\AdobeYY\aoptiloc.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1960
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\AdobeYY\aoptiloc.exe
- Size 153KB
- SHA256 23fc58c6b88bcfb5485832369cf879e16f5026e0fe1b28a44e0a6413ed9ecac1
- MD5 fec022addfefde6c5ff2b1e776bb2c0f
- SHA1 0fc39e5400a241218f0fd4c10ce0b417b2f3d513
- SHA512 7f2214e320cfb4aa2d0c6cd88b973819086e9ab6bc15b7cfe23860db1fcd2b122a67c5d49240e8726a22e3ad6f2ebb67bec93e6bc230bb7f5ce4e3735cda3df4
- SSDEEP 3072:6uOByTKI3n0dZHm7+zsMcSgUXwr6a/Ej2vfGm+7s+ndOm:6nyJ3n0Dm7+zm6wr6YEjAumi
- MD5 SHA1 SHA512 SSDEEP
- Path C:\AdobeYY\aoptiloc.exe
- Size 3.1MB
- SHA256 407c097e9eb7aab030a2eaad54204098b4cdc618e55a66163e4e3c552d20cf41
- MD5 f1078181b829abc29460be8d14ab14d7
- SHA1 fa7f09185a113f2208653155008023b7cb815082
- SHA512 f342f0ea319c519d1a3708c616a5fed8df72c6087c1684bd4fa9f07cc2d403f1fb593e85dc412f14297f4c7e31e57eeffc42479d6ade259452a36af95be2f2f9
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBrB/bSqz8:sxX7QnxrloE5dpUp4bVz8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\GalaxSJ\dobdevec.exe
- Size 1.6MB
- SHA256 b9bfc5aff47ba09f5d5b3a75d069150a512be69ff6274ac8d2900f0ca80470e2
- MD5 bb46cfa5f6aebf37731b0bc6d94167d1
- SHA1 f7f95eba6c32a5747578c8f034833208c93c449c
- SHA512 56d6180c28ca19468fbcb78b78371be3b3f47965c2d5858519174dba3a80230fa2d0c2b8ddc291cf86a78f8e1f8d110327905c6a9cf395d72930a51062bf1baf
- SSDEEP 24576:6nxDZV7xMyu6qJ2WSYxBdSqpcVdm5XRVpQO3chiIcr1RhSKntaxtooblyiuafDD9:sxX7665YxRVplZzSKntlGIiT+HvRdpcv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\GalaxSJ\dobdevec.exe
- Size 3.1MB
- SHA256 7f07e3ad1d4c1999bd2f3bccafdb8a63cc28b27cd6a6d960da6a7c52e18de6b2
- MD5 5776f795f2924cd9ecdaf5c1f8c4373e
- SHA1 d56c58cac8c3b6a6858fb78f6ab270c610df3ab5
- SHA512 687c99167f50b0c127a9429aa8a1a01fa7242c13eb996c4b4576f440ae86184788c02d1cfd4bb521877342f23bee9d680ee4dad36f6f486d899445784621ca95
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBtB/bSqz8:sxX7QnxrloE5dpUpSbVz8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 206B
- SHA256 4d5aa0840ed0a733ceb454b5caf34754df8d3a2982a946637d82ca7029f752c5
- MD5 b3ce201c6634bf192299ce62f20b7d72
- SHA1 eef33704dce98ccdf683ca08c9c0410fd289f039
- SHA512 86f7152a3feb9bf03d1c9ab000ceefda572e3b8f727cad0cecdb3e7cde0cdfc50cea4135f810862e95f56aeb96ae5519eaf109c941c0f7968d1668cdc09c73a5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 174B
- SHA256 ba86cab3131e877438b48dbac1c2d1884b2ab8ec4726d9a9ab496e7a8acdee5b
- MD5 2380fbe8a144950f51fda49dbcd0f072
- SHA1 1616daa330ef2c8e8ab7435a40059d8eeeff1f48
- SHA512 e73b46dc1bebf287ecc1ae9cd5aa9e7d754482a7a4837a72335ac8b3fc45451585db56ecab592cf0fd542e817c98bda8ce97ce63fc9245ba1104f7d49c2932f3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevopti.exe
- Size 3.1MB
- SHA256 b2b6189c4ef6d95ba4f9b6794b16d39a99e42229b0a9ebaedd1f29d36a18973b
- MD5 72cd4101aa79f0e316e011d4810ad09c
- SHA1 3e98b29470f4763d2ea32d1677f998fad647a6bd
- SHA512 3d84383b20c645c036518a044ad292b23e83018e9752b407da6246ae433e3b74080cbe1afeab63f999da11d94eac58216dd0c9a42fa2a97c3672593043ee0cbd
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBZB/bSqz8:sxX7QnxrloE5dpUpqbVz8
- MD5 SHA1 SHA512 SSDEEP