75173bab8fb15d74f91116a64626113a34af841c5d24a46ee523177e925da1d5

Analysis

max time kernel
150s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01/06/2024, 10:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

428243aa08704d9c8b526686cf95cff0_NeikiAnalytics.exe
Size

2.7MB
MD5

428243aa08704d9c8b526686cf95cff0
SHA1

471b56b81e6b0bc1e8ffe398f59b92b6d1d1911c
SHA256

75173bab8fb15d74f91116a64626113a34af841c5d24a46ee523177e925da1d5
SHA512

0274f363fb3d06c83368d635df055373ad7271d93c3b5114fa5cc2cd371b61ee3cf2751a9cc86cf6bb45ce401321cbd920a7ac4fc95510fa818ca7467355b1b2
SSDEEP

49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBb9w4Sx:+R0pI/IQlUoMPdmpSpj4

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1876	xoptiloc.exe

Loads dropped DLL 1 IoCs

pid	Process
2248	428243aa08704d9c8b526686cf95cff0_NeikiAnalytics.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\Adobe5V\\xoptiloc.exe"	428243aa08704d9c8b526686cf95cff0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\Mint7M\\bodxec.exe"	428243aa08704d9c8b526686cf95cff0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2248	428243aa08704d9c8b526686cf95cff0_NeikiAnalytics.exe
2248	428243aa08704d9c8b526686cf95cff0_NeikiAnalytics.exe
1876	xoptiloc.exe
2248	428243aa08704d9c8b526686cf95cff0_NeikiAnalytics.exe
1876	xoptiloc.exe
2248	428243aa08704d9c8b526686cf95cff0_NeikiAnalytics.exe
1876	xoptiloc.exe
2248	428243aa08704d9c8b526686cf95cff0_NeikiAnalytics.exe
1876	xoptiloc.exe
2248	428243aa08704d9c8b526686cf95cff0_NeikiAnalytics.exe
1876	xoptiloc.exe
2248	428243aa08704d9c8b526686cf95cff0_NeikiAnalytics.exe
1876	xoptiloc.exe
2248	428243aa08704d9c8b526686cf95cff0_NeikiAnalytics.exe
1876	xoptiloc.exe
2248	428243aa08704d9c8b526686cf95cff0_NeikiAnalytics.exe
1876	xoptiloc.exe
2248	428243aa08704d9c8b526686cf95cff0_NeikiAnalytics.exe
1876	xoptiloc.exe
2248	428243aa08704d9c8b526686cf95cff0_NeikiAnalytics.exe
1876	xoptiloc.exe
2248	428243aa08704d9c8b526686cf95cff0_NeikiAnalytics.exe
1876	xoptiloc.exe
2248	428243aa08704d9c8b526686cf95cff0_NeikiAnalytics.exe
1876	xoptiloc.exe
2248	428243aa08704d9c8b526686cf95cff0_NeikiAnalytics.exe
1876	xoptiloc.exe
2248	428243aa08704d9c8b526686cf95cff0_NeikiAnalytics.exe
1876	xoptiloc.exe
2248	428243aa08704d9c8b526686cf95cff0_NeikiAnalytics.exe
1876	xoptiloc.exe
2248	428243aa08704d9c8b526686cf95cff0_NeikiAnalytics.exe
1876	xoptiloc.exe
2248	428243aa08704d9c8b526686cf95cff0_NeikiAnalytics.exe
1876	xoptiloc.exe
2248	428243aa08704d9c8b526686cf95cff0_NeikiAnalytics.exe
1876	xoptiloc.exe
2248	428243aa08704d9c8b526686cf95cff0_NeikiAnalytics.exe
1876	xoptiloc.exe
2248	428243aa08704d9c8b526686cf95cff0_NeikiAnalytics.exe
1876	xoptiloc.exe
2248	428243aa08704d9c8b526686cf95cff0_NeikiAnalytics.exe
1876	xoptiloc.exe
2248	428243aa08704d9c8b526686cf95cff0_NeikiAnalytics.exe
1876	xoptiloc.exe
2248	428243aa08704d9c8b526686cf95cff0_NeikiAnalytics.exe
1876	xoptiloc.exe
2248	428243aa08704d9c8b526686cf95cff0_NeikiAnalytics.exe
1876	xoptiloc.exe
2248	428243aa08704d9c8b526686cf95cff0_NeikiAnalytics.exe
1876	xoptiloc.exe
2248	428243aa08704d9c8b526686cf95cff0_NeikiAnalytics.exe
1876	xoptiloc.exe
2248	428243aa08704d9c8b526686cf95cff0_NeikiAnalytics.exe
1876	xoptiloc.exe
2248	428243aa08704d9c8b526686cf95cff0_NeikiAnalytics.exe
1876	xoptiloc.exe
2248	428243aa08704d9c8b526686cf95cff0_NeikiAnalytics.exe
1876	xoptiloc.exe
2248	428243aa08704d9c8b526686cf95cff0_NeikiAnalytics.exe
1876	xoptiloc.exe
2248	428243aa08704d9c8b526686cf95cff0_NeikiAnalytics.exe
1876	xoptiloc.exe
2248	428243aa08704d9c8b526686cf95cff0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 1876	2248	428243aa08704d9c8b526686cf95cff0_NeikiAnalytics.exe	28
PID 2248 wrote to memory of 1876	2248	428243aa08704d9c8b526686cf95cff0_NeikiAnalytics.exe	28
PID 2248 wrote to memory of 1876	2248	428243aa08704d9c8b526686cf95cff0_NeikiAnalytics.exe	28
PID 2248 wrote to memory of 1876	2248	428243aa08704d9c8b526686cf95cff0_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\428243aa08704d9c8b526686cf95cff0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\428243aa08704d9c8b526686cf95cff0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Adobe5V\xoptiloc.exe
  C:\Adobe5V\xoptiloc.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Mint7M\bodxec.exe

Filesize
2.7MB

MD5
0d7b8adc18cf562a793ea367a06eee28

SHA1
54293288b95a73961f0324ac6355a9995a076170

SHA256
231624a6dfede122337d29d9f20b45bc7abc6ebd6975dcaaf8ed43b41416fbc0

SHA512
4e23444658785894e1b1cce2d2819b1457f758d89e5e082794fea7596acbadbafc4fab5c88b285cdc719ab728724ef9279806334a687931a9b9ef968b43f4405

Download Submit
C:\Users\Admin\253086396416_6.1_Admin.ini

Filesize
201B

MD5
380a874c0e63c6f3237427bc754a9585

SHA1
5f3eecdba28c964ab0e205bbd1fae89aa92e2edb

SHA256
ae96208d2cb6c89705665f2517dbe0a283b3eabf4cfa686715a9e801777136f6

SHA512
44909bd8bf309666b96a6f432c4ed0a9f2fd4361011b086a5a6af8a29b4f7441c5f5535ac4cb7ab7e915818104697b693956a7f96282a3a3288675bd6a88de2a

Download Submit
\Adobe5V\xoptiloc.exe

Filesize
2.7MB

MD5
1ab98624d341d265da2f20286e6de172

SHA1
26613a30dc9c941306bd1346b952fcc060fdd3e0

SHA256
cc7f8d6e06147001b022a15c82836ee1f2cd6fb22fb51515aa88e22c02b73679

SHA512
ebab00d3ffddb0bc8eebf30d936fe2088180af3a5e78b9454d4890ecfa42563fe3c9d564975d1e2617e478683636ce6b2bc70018eb54552bbf01ab3509242d37

Download Submit