Analysis
-
max time kernel
149s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
29/05/2024, 07:45
Static task
static1
Behavioral task
behavioral1
Sample
4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe
-
Size
2.7MB
-
MD5
4b49d88054efbff37b189fabd922ccb0
-
SHA1
397d0753f427f2936eb8b19c72de4c3c5976c2b4
-
SHA256
22de283c85e7024d2b7678710d4ac6d533e33cac1aaf896016ff421a0971c67c
-
SHA512
27d3ba61bc22db1830a4eb13273bf3b41c3ceeb8cac1505d1ac2638a2ecf065c89f8484aed4b4fcf8279704756e648b98e56ce959e2b0e7817ea1d625b89976b
-
SSDEEP
49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBp9w4Sx:+R0pI/IQlUoMPdmpSpV4
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4464 aoptiloc.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\AdobeAW\\aoptiloc.exe" 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\GalaxXY\\boddevsys.exe" 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4628 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe 4628 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe 4628 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe 4628 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe 4464 aoptiloc.exe 4464 aoptiloc.exe 4628 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe 4628 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe 4464 aoptiloc.exe 4464 aoptiloc.exe 4628 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe 4628 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe 4464 aoptiloc.exe 4464 aoptiloc.exe 4628 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe 4628 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe 4464 aoptiloc.exe 4464 aoptiloc.exe 4628 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe 4628 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe 4464 aoptiloc.exe 4464 aoptiloc.exe 4628 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe 4628 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe 4464 aoptiloc.exe 4464 aoptiloc.exe 4628 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe 4628 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe 4464 aoptiloc.exe 4464 aoptiloc.exe 4628 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe 4628 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe 4464 aoptiloc.exe 4464 aoptiloc.exe 4628 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe 4628 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe 4464 aoptiloc.exe 4464 aoptiloc.exe 4628 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe 4628 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe 4464 aoptiloc.exe 4464 aoptiloc.exe 4628 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe 4628 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe 4464 aoptiloc.exe 4464 aoptiloc.exe 4628 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe 4628 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe 4464 aoptiloc.exe 4464 aoptiloc.exe 4628 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe 4628 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe 4464 aoptiloc.exe 4464 aoptiloc.exe 4628 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe 4628 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe 4464 aoptiloc.exe 4464 aoptiloc.exe 4628 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe 4628 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe 4464 aoptiloc.exe 4464 aoptiloc.exe 4628 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe 4628 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4628 wrote to memory of 4464 4628 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe 96 PID 4628 wrote to memory of 4464 4628 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe 96 PID 4628 wrote to memory of 4464 4628 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\AdobeAW\aoptiloc.exeC:\AdobeAW\aoptiloc.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3852,i,1067197275908310731,12785105794523264014,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:81⤵PID:4788
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD58a507a88733ecf490507e6c802843ba5
SHA1c4150ddcea72eaab827f7dd94ac33f8199159788
SHA256636ce8987a9123f0a4380f81c815d38772da6b530198741bc3cb5e7e1ccd5747
SHA51283d873fa626f8fbeebcca87aa70723ce4cdd89a7236d78ba136b48468d9ef8ab0176d8e25efd7507be49168bc7005f3cf21c4e92fa8ade36af8fcffdeae1deb9
-
Filesize
12KB
MD5a24d07f66e772e6d4aabddbc12edaf22
SHA1b08151be2c76ec954a9705d8c983edfa28d20651
SHA256450f3553ef592c5332d0f992ffb02a92cd4c091b4ed4b5c61a6bcfb613b9a505
SHA5128a83008c9d13d536c9560b47cb28e3125001593f54a475bca7782c808b0966616f8dcae976c803e1197253a032ae01e962c53a973efa2e7e8054a26c5d66f3ce
-
Filesize
2.7MB
MD501359f4dc854a3ff30c67d76506b6e97
SHA109d9c2349d383cd9d68a1dc8057cbd2947a2fcca
SHA256742a81f22ec440d0ad92ac22a2e1cc354eb4c72c0da239a06506fd18bf314121
SHA512bb9466bd9a66c051aaac962d81f9703add2bbfdd8dcf8478e02cbb508c94dc577d93f81bce5c42485e1303d6ddcfc0ba9144448536bfad43cd2c411a96358d80
-
Filesize
204B
MD5a89683ecaa989b715b4e714b7636e5eb
SHA153bcc32b0abd37da1327e6a598f665d07de476bf
SHA256badf56ea55edf8b32f155317cf9e7eb6980722a5227147a8e78a491ce0f66818
SHA51279acf2c0bbd59002badfdeeb603d46f61c98f0950f9662a037b1600979d8a41d0646020b5530b07efe22b72cbee592629d2bbd7264b91ab3852a68422fb46ab2