Analysis
- max time kernel
149s - max time network
127s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
28/05/2024, 05:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
33d0b4597988e10ff9110061e94cf4e0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
33d0b4597988e10ff9110061e94cf4e0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 33d0b4597988e10ff9110061e94cf4e0_NeikiAnalytics.exe
- Size 2.6MB
- Sample240528-fsdnbafe2y
- SHA256 6bd378cfb26ecefea7c0105155c87291471a0022ae2634bdff701c27bd116b7e
- MD5 33d0b4597988e10ff9110061e94cf4e0
- SHA1 89c2316e62e7bcf63a60d3a233c03584246d6c2f
- SHA512 e0980b8bc18c12c3f1021764e541398b1fa6a8b912d6aa6c52392d0785745085925346959fe40542d3fc142dc581ae8e74c2d5c0b293b82b45a19154908dbe21
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB/B/bS:sxX7QnxrloE5dpUpsb
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecaopti.exe 33d0b4597988e10ff9110061e94cf4e0_NeikiAnalytics.exe - Executes dropped EXE 2 IoCs
pid Process 3860 ecaopti.exe 3724 devoptiec.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\SysDrvXL\\devoptiec.exe" 33d0b4597988e10ff9110061e94cf4e0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\LabZ35\\bodxsys.exe" 33d0b4597988e10ff9110061e94cf4e0_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2908 33d0b4597988e10ff9110061e94cf4e0_NeikiAnalytics.exe 2908 33d0b4597988e10ff9110061e94cf4e0_NeikiAnalytics.exe 2908 33d0b4597988e10ff9110061e94cf4e0_NeikiAnalytics.exe 2908 33d0b4597988e10ff9110061e94cf4e0_NeikiAnalytics.exe 3860 ecaopti.exe 3860 ecaopti.exe 3724 devoptiec.exe 3724 devoptiec.exe 3860 ecaopti.exe 3860 ecaopti.exe 3724 devoptiec.exe 3724 devoptiec.exe 3860 ecaopti.exe 3860 ecaopti.exe 3724 devoptiec.exe 3724 devoptiec.exe 3860 ecaopti.exe 3860 ecaopti.exe 3724 devoptiec.exe 3724 devoptiec.exe 3860 ecaopti.exe 3860 ecaopti.exe 3724 devoptiec.exe 3724 devoptiec.exe 3860 ecaopti.exe 3860 ecaopti.exe 3724 devoptiec.exe 3724 devoptiec.exe 3860 ecaopti.exe 3860 ecaopti.exe 3724 devoptiec.exe 3724 devoptiec.exe 3860 ecaopti.exe 3860 ecaopti.exe 3724 devoptiec.exe 3724 devoptiec.exe 3860 ecaopti.exe 3860 ecaopti.exe 3724 devoptiec.exe 3724 devoptiec.exe 3860 ecaopti.exe 3860 ecaopti.exe 3724 devoptiec.exe 3724 devoptiec.exe 3860 ecaopti.exe 3860 ecaopti.exe 3724 devoptiec.exe 3724 devoptiec.exe 3860 ecaopti.exe 3860 ecaopti.exe 3724 devoptiec.exe 3724 devoptiec.exe 3860 ecaopti.exe 3860 ecaopti.exe 3724 devoptiec.exe 3724 devoptiec.exe 3860 ecaopti.exe 3860 ecaopti.exe 3724 devoptiec.exe 3724 devoptiec.exe 3860 ecaopti.exe 3860 ecaopti.exe 3724 devoptiec.exe 3724 devoptiec.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2908 wrote to memory of 3860 2908 33d0b4597988e10ff9110061e94cf4e0_NeikiAnalytics.exe 93 PID 2908 wrote to memory of 3860 2908 33d0b4597988e10ff9110061e94cf4e0_NeikiAnalytics.exe 93 PID 2908 wrote to memory of 3860 2908 33d0b4597988e10ff9110061e94cf4e0_NeikiAnalytics.exe 93 PID 2908 wrote to memory of 3724 2908 33d0b4597988e10ff9110061e94cf4e0_NeikiAnalytics.exe 94 PID 2908 wrote to memory of 3724 2908 33d0b4597988e10ff9110061e94cf4e0_NeikiAnalytics.exe 94 PID 2908 wrote to memory of 3724 2908 33d0b4597988e10ff9110061e94cf4e0_NeikiAnalytics.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\33d0b4597988e10ff9110061e94cf4e0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\33d0b4597988e10ff9110061e94cf4e0_NeikiAnalytics.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecaopti.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecaopti.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3860
-
-
C:\SysDrvXL\devoptiec.exeC:\SysDrvXL\devoptiec.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4488,i,13035806169561352434,1332896185314862791,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:81⤵PID:3920
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\LabZ35\bodxsys.exe
- Size 5KB
- SHA256 7d0f37cc24fb3edcb5ddc7ae98ede490bb599fb6b9e0bc5aa1719a4bab03ba04
- MD5 17b398df2ec540a4a99c651e6c79fb0c
- SHA1 e84844c0dbc3c2b504427b50b4e5bf0d1131f803
- SHA512 353e9bca38e949299279ac1474db632ae08da29f1cfe3e55ea9bcc08ecf7bc252c689454f4d3fe1c0d5920cc1f2700098bd783ad771c0579c1cce540c9d4172d
- SSDEEP 48:6BMk1Y8lp+j+nlXlnpVZlXHnznjLzrznzHTDzXT3jbU7LbL7:3k1Ycg+n1FZlXnzDnznTT3jkHn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\LabZ35\bodxsys.exe
- Size 2.6MB
- SHA256 0524c971cfbc4246be3f5c55f67810482d74b9eac4750f98fe9f44cfa7a4eccc
- MD5 62e7549d0cbc29fc438529bc3dc881bb
- SHA1 f3faea77b8bf7cd6020b30e955c832c5c05c661d
- SHA512 0533b2f2ca98cdbe9d47bf61055286466dfb118325499e81d8ed75d484e3ac03abfd8745c46419cc717197bce4206d2ddd59ed1d7c22a467eb37ce1ad5bbc4e2
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBLB/bS:sxX7QnxrloE5dpUpsb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\SysDrvXL\devoptiec.exe
- Size 616KB
- SHA256 6a61cd91bcdccfc6dc120955fc251485aab09fc16785c187de970def0bdf1562
- MD5 4252b30153372d0c2633ee83d4308a79
- SHA1 3ff6c690e30c5036e59b9263b34b81f9fe7fe54c
- SHA512 303c25d1123b9933f73d9e65a0f2773f8bac497486c21289f3b10877231fae00cd24dcbea59c714cbe3ff40a94edceab1f2167ca0376c9e754c486057a3a6ec2
- SSDEEP 12288:6ne3n0DmAm67YEjAyu6qJ/+WS5axBdSqpcVdSxL5XOEVpQEPcC3:6nxDZV7xMyu6qJ2WSYxBdSqpcVdm5XRp
- MD5 SHA1 SHA512 SSDEEP
- Path C:\SysDrvXL\devoptiec.exe
- Size 2.6MB
- SHA256 e938aaa80874ec2560e20f18fc728bf77e39e688862462e71ab6f06632b580eb
- MD5 11622930aa822da6222ac4bd45f0516c
- SHA1 73cf58b13ad6d05cf17c10fb96f1b420076fa6e5
- SHA512 bd93b0209d14b0f1a8398494bbb6c513f6dd00084742257ea8d30f41c0581bbca165fc73fc647ab8d6cce07136b586f1d8c50ca43f7931afe98cd1aa08821cfb
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBIB/bS:sxX7QnxrloE5dpUpvb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 203B
- SHA256 e3aa3cad2501f2f915b5ae6a117244a0fcf5419b2adbdf7da9c4efd0c0d4cc1d
- MD5 e4b0707c760c3404e215066fad1b60b1
- SHA1 1b44983a02207bad6d6e2ec046f739415a945f16
- SHA512 ebced5d762a0a6aa52fb1879de851ec93b82c70abb91f5571adf2bac877bc5e8d885c8e6714b5dbb2562a07d07b92752063796179bd136f7cca2f5fc3a25202d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 171B
- SHA256 18d6001e0589df77b4ab879b4118bdad90a01842cddf05f9470712466ed591a8
- MD5 6d52dc1acb0bf903a1d77cf87c4d7e9d
- SHA1 5a9ae5a6881f683945b133b420979dd160448119
- SHA512 39b54f703773e23d8a4243b312f6907dee8680ecaa66b27f82becccf5977b6600173434dae3d91de6a8abc4f857527951f52f6478b6ea31294627602c51e95ca
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecaopti.exe
- Size 2.6MB
- SHA256 00c8cc4464e671a55400e9207d80c99bd680891f1962598fca30860af64263a4
- MD5 40a1b7a45787023547e18e659540ec9b
- SHA1 fc3096ed2a3b8f4501f6663e3a0600c0abda4ff6
- SHA512 351dea41ae0aebce759e0cef0552d6874010b9b3a3f6229db0001212dd84cb1fd58af63a2810f41cb8f8e85824d86b64378a9e3de35e5f95bc898313aa9a12ed
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBPB/bS:sxX7QnxrloE5dpUpEb
- MD5 SHA1 SHA512 SSDEEP