Analysis
- max time kernel
149s - max time network
95s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
27/05/2024, 17:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
06048d94bc8dbacf6a46b33434f1f0f0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
06048d94bc8dbacf6a46b33434f1f0f0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 06048d94bc8dbacf6a46b33434f1f0f0_NeikiAnalytics.exe
- Size 3.1MB
- Sample240527-wdsfxsdb52
- SHA256 533cc05ff87834a04e044a57c68ae3077214194d3d0becdd334482b215ecbb07
- MD5 06048d94bc8dbacf6a46b33434f1f0f0
- SHA1 5887039c9d158c3801be3196d0ec24e2739429ec
- SHA512 243077e04d9883e128bfdc0c6ec602e20e137ea5b76b8047f3d616242c201e9038c1fa51d6aac8e356d101309139a1d1d4fc2d9d8b8582528989d478b24911e8
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBwB/bSqz8b6LNXJqI:sxX7QnxrloE5dpUp3bVz8eLFc
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevopti.exe 06048d94bc8dbacf6a46b33434f1f0f0_NeikiAnalytics.exe - Executes dropped EXE 2 IoCs
pid Process 3136 locdevopti.exe 1296 devbodsys.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\SysDrv71\\devbodsys.exe" 06048d94bc8dbacf6a46b33434f1f0f0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\GalaxKB\\optiasys.exe" 06048d94bc8dbacf6a46b33434f1f0f0_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1824 06048d94bc8dbacf6a46b33434f1f0f0_NeikiAnalytics.exe 1824 06048d94bc8dbacf6a46b33434f1f0f0_NeikiAnalytics.exe 1824 06048d94bc8dbacf6a46b33434f1f0f0_NeikiAnalytics.exe 1824 06048d94bc8dbacf6a46b33434f1f0f0_NeikiAnalytics.exe 3136 locdevopti.exe 3136 locdevopti.exe 1296 devbodsys.exe 1296 devbodsys.exe 3136 locdevopti.exe 3136 locdevopti.exe 1296 devbodsys.exe 1296 devbodsys.exe 3136 locdevopti.exe 3136 locdevopti.exe 1296 devbodsys.exe 1296 devbodsys.exe 3136 locdevopti.exe 3136 locdevopti.exe 1296 devbodsys.exe 1296 devbodsys.exe 3136 locdevopti.exe 3136 locdevopti.exe 1296 devbodsys.exe 1296 devbodsys.exe 3136 locdevopti.exe 3136 locdevopti.exe 1296 devbodsys.exe 1296 devbodsys.exe 3136 locdevopti.exe 3136 locdevopti.exe 1296 devbodsys.exe 1296 devbodsys.exe 3136 locdevopti.exe 3136 locdevopti.exe 1296 devbodsys.exe 1296 devbodsys.exe 3136 locdevopti.exe 3136 locdevopti.exe 1296 devbodsys.exe 1296 devbodsys.exe 3136 locdevopti.exe 3136 locdevopti.exe 1296 devbodsys.exe 1296 devbodsys.exe 3136 locdevopti.exe 3136 locdevopti.exe 1296 devbodsys.exe 1296 devbodsys.exe 3136 locdevopti.exe 3136 locdevopti.exe 1296 devbodsys.exe 1296 devbodsys.exe 3136 locdevopti.exe 3136 locdevopti.exe 1296 devbodsys.exe 1296 devbodsys.exe 3136 locdevopti.exe 3136 locdevopti.exe 1296 devbodsys.exe 1296 devbodsys.exe 3136 locdevopti.exe 3136 locdevopti.exe 1296 devbodsys.exe 1296 devbodsys.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1824 wrote to memory of 3136 1824 06048d94bc8dbacf6a46b33434f1f0f0_NeikiAnalytics.exe 85 PID 1824 wrote to memory of 3136 1824 06048d94bc8dbacf6a46b33434f1f0f0_NeikiAnalytics.exe 85 PID 1824 wrote to memory of 3136 1824 06048d94bc8dbacf6a46b33434f1f0f0_NeikiAnalytics.exe 85 PID 1824 wrote to memory of 1296 1824 06048d94bc8dbacf6a46b33434f1f0f0_NeikiAnalytics.exe 86 PID 1824 wrote to memory of 1296 1824 06048d94bc8dbacf6a46b33434f1f0f0_NeikiAnalytics.exe 86 PID 1824 wrote to memory of 1296 1824 06048d94bc8dbacf6a46b33434f1f0f0_NeikiAnalytics.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\06048d94bc8dbacf6a46b33434f1f0f0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\06048d94bc8dbacf6a46b33434f1f0f0_NeikiAnalytics.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevopti.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevopti.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3136
-
-
C:\SysDrv71\devbodsys.exeC:\SysDrv71\devbodsys.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1296
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\GalaxKB\optiasys.exe
- Size 3.1MB
- SHA256 93916f570efe5f06b569a841f9bc521ae23162bcddf1638ca8ab8f220425bc5d
- MD5 288f17804d1667399937fc339881d060
- SHA1 fe8c8f1a4aa801d2efd23fab9e4b97fd46e5d6f4
- SHA512 f0e06de97ad8038f5ec439cea628b727d56b36e586f308057184f401af11a396c8a64d1caf1d384c433bff534fc4692162fb50be8c1cac9b094a3edb28d50107
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB5B/bSqz8b6LNXJqI:sxX7QnxrloE5dpUpWbVz8eLFc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\GalaxKB\optiasys.exe
- Size 3.1MB
- SHA256 91a76bd2bdadc7e661747016d076bb1e2176ebecf4e0536cf953cd31fd89a16e
- MD5 6c56fc4e9871f2396db618113a43c848
- SHA1 5068688c30eefaf0b723821d6e372c1f56dfe59f
- SHA512 f09ec9e7f208c5586d1cb018f3485d321286b97da83acc093e77f52876d18c0fe165c39ae800dbc9c6708a1870a1bc494398bcb1fa6234c9267a09abbbd6af15
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBfB/bSqz8b6LNXJqI:sxX7QnxrloE5dpUpYbVz8eLFc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\SysDrv71\devbodsys.exe
- Size 3.1MB
- SHA256 f56d3085795dcabff23fd4bc368193f6d35e47bf7d6b8adfd33999c7816dc595
- MD5 c5711ee669347d491ceb1b1217c73757
- SHA1 8648cfb912b323d11651604cfdd8aac96a4c15f2
- SHA512 ec9a7001ebb2e4df840ddfb207ece171243c5a85bc30461321da92c63a53cc314ef1be71a9d00afa657c77ad850a952fd549b74af0f976688cd1545c439c0c38
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBVB/bSqz8b6LNXJqI:sxX7QnxrloE5dpUpCbVz8eLFc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 208B
- SHA256 4d55ac6ae3a60efe56d35818fb7635728867996bead743d26050f1dde433cc6a
- MD5 4ab878bce14a4a2691b1b841883241ef
- SHA1 1b76005670fac1763580160a468ca70cdb399f5d
- SHA512 c5a0fe760195d2b480da8dc6dcc46239405a79ee52bd014c9a89a01292b849527eba9e36603b1d4a42aec5b5c92eb79d7ec4661d3ce3d7079386c86d70f713b9
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 176B
- SHA256 666e4d574ee19e2f928fb3aa520fdda25620c80414b41ad8a61860707eaf3299
- MD5 b4d4d7530cc980aebc4cd35589cfc9cf
- SHA1 ea88e3b94d483dc7ca03bf41ba2cf4e8542ed517
- SHA512 9b9c410dcd4db05c733d9171a9317803ed26c263b54fea0dd59132983f37e3e6b13a9486e0548d6ece1337afe4dd2484ed9d6d8f3a2e3e3e5fe6a3eb1578d634
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevopti.exe
- Size 3.1MB
- SHA256 5728a93486347d6cb9ba4612d30812f06bf5f29c7ad4e9e7e126922e77b087e3
- MD5 03882d5397d066b3cb125013ada3e0f0
- SHA1 0f57b1be1890104a70d92799221142b636651c28
- SHA512 aca756ea2d9a14e893caf703edd51edb90c1fc15887984fac0fe1cb4b572006006cf5b46498eb39c6eeaaf40dd67ec92084781e3bb1a522ac4ba8100cafb40b7
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBSB/bSqz8b6LNXJqI:sxX7QnxrloE5dpUp9bVz8eLFc
- MD5 SHA1 SHA512 SSDEEP