Analysis
- max time kernel
150s - max time network
124s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
27/05/2024, 17:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
01e2941996de27f2a5e45d26bd3f6f60_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
01e2941996de27f2a5e45d26bd3f6f60_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 01e2941996de27f2a5e45d26bd3f6f60_NeikiAnalytics.exe
- Size 3.6MB
- Sample240527-vr7mbscc67
- SHA256 535b09bb200a2d6ec13152d0ac167c1f0d542e779995fe46c2dd5f93d4e93a92
- MD5 01e2941996de27f2a5e45d26bd3f6f60
- SHA1 bf94053aae4e432fcca2b1da72e2de28917d2a7a
- SHA512 e5767771a63273840b8377106cea953c7b03a4415df6be53a7c83d4c22681138c320d20b72a27057d75711c8fed9345ef43b15f1f16d285fa7afa7f7c67b0edf
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBLB/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUpUbVz8eLFcz
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysxdob.exe 01e2941996de27f2a5e45d26bd3f6f60_NeikiAnalytics.exe - Executes dropped EXE 2 IoCs
pid Process 4744 sysxdob.exe 3868 aoptiloc.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\AdobeHK\\aoptiloc.exe" 01e2941996de27f2a5e45d26bd3f6f60_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\KaVBUE\\bodaloc.exe" 01e2941996de27f2a5e45d26bd3f6f60_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1144 01e2941996de27f2a5e45d26bd3f6f60_NeikiAnalytics.exe 1144 01e2941996de27f2a5e45d26bd3f6f60_NeikiAnalytics.exe 1144 01e2941996de27f2a5e45d26bd3f6f60_NeikiAnalytics.exe 1144 01e2941996de27f2a5e45d26bd3f6f60_NeikiAnalytics.exe 4744 sysxdob.exe 4744 sysxdob.exe 3868 aoptiloc.exe 3868 aoptiloc.exe 4744 sysxdob.exe 4744 sysxdob.exe 3868 aoptiloc.exe 3868 aoptiloc.exe 4744 sysxdob.exe 4744 sysxdob.exe 3868 aoptiloc.exe 3868 aoptiloc.exe 4744 sysxdob.exe 4744 sysxdob.exe 3868 aoptiloc.exe 3868 aoptiloc.exe 4744 sysxdob.exe 4744 sysxdob.exe 3868 aoptiloc.exe 3868 aoptiloc.exe 4744 sysxdob.exe 4744 sysxdob.exe 3868 aoptiloc.exe 3868 aoptiloc.exe 4744 sysxdob.exe 4744 sysxdob.exe 3868 aoptiloc.exe 3868 aoptiloc.exe 4744 sysxdob.exe 4744 sysxdob.exe 3868 aoptiloc.exe 3868 aoptiloc.exe 4744 sysxdob.exe 4744 sysxdob.exe 3868 aoptiloc.exe 3868 aoptiloc.exe 4744 sysxdob.exe 4744 sysxdob.exe 3868 aoptiloc.exe 3868 aoptiloc.exe 4744 sysxdob.exe 4744 sysxdob.exe 3868 aoptiloc.exe 3868 aoptiloc.exe 4744 sysxdob.exe 4744 sysxdob.exe 3868 aoptiloc.exe 3868 aoptiloc.exe 4744 sysxdob.exe 4744 sysxdob.exe 3868 aoptiloc.exe 3868 aoptiloc.exe 4744 sysxdob.exe 4744 sysxdob.exe 3868 aoptiloc.exe 3868 aoptiloc.exe 4744 sysxdob.exe 4744 sysxdob.exe 3868 aoptiloc.exe 3868 aoptiloc.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1144 wrote to memory of 4744 1144 01e2941996de27f2a5e45d26bd3f6f60_NeikiAnalytics.exe 91 PID 1144 wrote to memory of 4744 1144 01e2941996de27f2a5e45d26bd3f6f60_NeikiAnalytics.exe 91 PID 1144 wrote to memory of 4744 1144 01e2941996de27f2a5e45d26bd3f6f60_NeikiAnalytics.exe 91 PID 1144 wrote to memory of 3868 1144 01e2941996de27f2a5e45d26bd3f6f60_NeikiAnalytics.exe 93 PID 1144 wrote to memory of 3868 1144 01e2941996de27f2a5e45d26bd3f6f60_NeikiAnalytics.exe 93 PID 1144 wrote to memory of 3868 1144 01e2941996de27f2a5e45d26bd3f6f60_NeikiAnalytics.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\01e2941996de27f2a5e45d26bd3f6f60_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\01e2941996de27f2a5e45d26bd3f6f60_NeikiAnalytics.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysxdob.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysxdob.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4744
-
-
C:\AdobeHK\aoptiloc.exeC:\AdobeHK\aoptiloc.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3868
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\AdobeHK\aoptiloc.exe
- Size 3.6MB
- SHA256 4d0f970d76e9382395f2b2eba79926b2eff409139bdda227802074c8abadde3b
- MD5 11056bdc73284ff0348ea7ae90ddd0e0
- SHA1 83118b6eadea3a1daebb6c599b557258169717ff
- SHA512 0cd09f9ab00b04d5f9ec499e49d902b9212b60718d74095aa3612aa6b118ec26ac2a12f8942d15f3583ded5fc6e34617c32208f31f49ab12bcd426bed82ef285
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBEB/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUpTbVz8eLFcz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\KaVBUE\bodaloc.exe
- Size 3.6MB
- SHA256 b8d830ead9e28d75ab470b80a8723d8c8748cc5972bba3b5b76f4abeafb6e6b1
- MD5 0f532eecb248976538a309d5ae45eaff
- SHA1 86e962b8ae6e9b9b01629d889f085ca9a8f74777
- SHA512 570e780a81d6bfc6267d153b54ff1951d936208867a09940e233f5de92a9d28bb10f9f0d00cd3d7d2ce3770063d8d52ac1fe077c77209fe72bb2f1b220fe859c
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBvB/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUpobVz8eLFcz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\KaVBUE\bodaloc.exe
- Size 3.6MB
- SHA256 1603041c1ee8943b6f2658c574028bad1b8e26fafe0874a92f4eefb82dceecea
- MD5 ba3feb2f21cdf934727b8756bf962053
- SHA1 c86b91de864212e3ead7cb3eb2aa212d062670ab
- SHA512 f1bac24aaf394003c668dc2dbc1c8fb5f422df86c8899995715fc7dc2a2e328f5ec91d089c40baa532987df845527b4b0fc1a7976a29754b7008364f74ed6fda
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBEB/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUpzbVz8eLFcz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 201B
- SHA256 8452a0db8e9aea92ddea497f2573ea40638dd9ca6834313b6c79685f837fc179
- MD5 6c4eeefa996c86058cea1481feb306b7
- SHA1 0b026d5254a027890c7838cf90ae36e4493f54f7
- SHA512 fd2a4879e0134d02219403025f1aa0059b82ea6bd888bfe1a871780e4dbc19e2fe0c2f5465218d2aa20382e4196cee31ad21503abaabe5b6cb283e775d97b82c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 169B
- SHA256 e1ffdb5cbd111aea904c3579041f37753a87fc568961cf9fb953604e0532fb25
- MD5 0a92fd62dd828f08e62856c5eb96614a
- SHA1 d3d4b6e2298b60d338ad5378fca851f2696f828c
- SHA512 88d68d2d387e67574a1613abb08746c3432c800eebe5f620ac47bbebfa53c6271a879de87f00c6415ed418542f618bb1e5b037971f056bbf60f8874fb3c6cf03
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysxdob.exe
- Size 3.6MB
- SHA256 d3b059a573e9bcd1371463a987546c192289ebded6a3cb5d56d8f9721eec30e4
- MD5 56d3e96534373423464bf7d5aaa4656d
- SHA1 03ea05262a8ba707ba175f4f39ae16d6f61c069a
- SHA512 a8e88d584c739e0738da428d454418fc17764d1ffcfb9ebbd09bded90d2593434243b416c303fdf69c420484eb2c504f649fa4d8b33dd5435337638ae6f9c58f
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBrB/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUpwbVz8eLFcz
- MD5 SHA1 SHA512 SSDEEP