Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
02/06/2024, 22:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
764b8d513005f5cee7df0d8b6b077ab0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
764b8d513005f5cee7df0d8b6b077ab0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 764b8d513005f5cee7df0d8b6b077ab0_NeikiAnalytics.exe
- Size 3.0MB
- Sample240602-2bzecaac74
- SHA256 15e8266bbe3e1cc7de6699ee13c9296615fccd6e0e4e82462b5525dd432c3571
- MD5 764b8d513005f5cee7df0d8b6b077ab0
- SHA1 56be18522723dd096c4548044ba5f378dc788099
- SHA512 19ccb64838a0c91b6abb3e450ea868bdd3e369b1d534f48ead0619b6f2f8c6c59b179bed24e94f55da278ee2f3add5e2bdefdb14047474a0fd122d92433ae06e
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBHB/bSqz8:sxX7QnxrloE5dpUpkbVz8
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysxdob.exe 764b8d513005f5cee7df0d8b6b077ab0_NeikiAnalytics.exe - Executes dropped EXE 2 IoCs
pid Process 1508 sysxdob.exe 4208 devoptiec.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\FilesGP\\devoptiec.exe" 764b8d513005f5cee7df0d8b6b077ab0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\KaVBHT\\boddevloc.exe" 764b8d513005f5cee7df0d8b6b077ab0_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3028 764b8d513005f5cee7df0d8b6b077ab0_NeikiAnalytics.exe 3028 764b8d513005f5cee7df0d8b6b077ab0_NeikiAnalytics.exe 3028 764b8d513005f5cee7df0d8b6b077ab0_NeikiAnalytics.exe 3028 764b8d513005f5cee7df0d8b6b077ab0_NeikiAnalytics.exe 1508 sysxdob.exe 1508 sysxdob.exe 4208 devoptiec.exe 4208 devoptiec.exe 1508 sysxdob.exe 1508 sysxdob.exe 4208 devoptiec.exe 4208 devoptiec.exe 1508 sysxdob.exe 1508 sysxdob.exe 4208 devoptiec.exe 4208 devoptiec.exe 1508 sysxdob.exe 1508 sysxdob.exe 4208 devoptiec.exe 4208 devoptiec.exe 1508 sysxdob.exe 1508 sysxdob.exe 4208 devoptiec.exe 4208 devoptiec.exe 1508 sysxdob.exe 1508 sysxdob.exe 4208 devoptiec.exe 4208 devoptiec.exe 1508 sysxdob.exe 1508 sysxdob.exe 4208 devoptiec.exe 4208 devoptiec.exe 1508 sysxdob.exe 1508 sysxdob.exe 4208 devoptiec.exe 4208 devoptiec.exe 1508 sysxdob.exe 1508 sysxdob.exe 4208 devoptiec.exe 4208 devoptiec.exe 1508 sysxdob.exe 1508 sysxdob.exe 4208 devoptiec.exe 4208 devoptiec.exe 1508 sysxdob.exe 1508 sysxdob.exe 4208 devoptiec.exe 4208 devoptiec.exe 1508 sysxdob.exe 1508 sysxdob.exe 4208 devoptiec.exe 4208 devoptiec.exe 1508 sysxdob.exe 1508 sysxdob.exe 4208 devoptiec.exe 4208 devoptiec.exe 1508 sysxdob.exe 1508 sysxdob.exe 4208 devoptiec.exe 4208 devoptiec.exe 1508 sysxdob.exe 1508 sysxdob.exe 4208 devoptiec.exe 4208 devoptiec.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3028 wrote to memory of 1508 3028 764b8d513005f5cee7df0d8b6b077ab0_NeikiAnalytics.exe 87 PID 3028 wrote to memory of 1508 3028 764b8d513005f5cee7df0d8b6b077ab0_NeikiAnalytics.exe 87 PID 3028 wrote to memory of 1508 3028 764b8d513005f5cee7df0d8b6b077ab0_NeikiAnalytics.exe 87 PID 3028 wrote to memory of 4208 3028 764b8d513005f5cee7df0d8b6b077ab0_NeikiAnalytics.exe 88 PID 3028 wrote to memory of 4208 3028 764b8d513005f5cee7df0d8b6b077ab0_NeikiAnalytics.exe 88 PID 3028 wrote to memory of 4208 3028 764b8d513005f5cee7df0d8b6b077ab0_NeikiAnalytics.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\764b8d513005f5cee7df0d8b6b077ab0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\764b8d513005f5cee7df0d8b6b077ab0_NeikiAnalytics.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysxdob.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysxdob.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1508
-
-
C:\FilesGP\devoptiec.exeC:\FilesGP\devoptiec.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4208
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\FilesGP\devoptiec.exe
- Size 3.0MB
- SHA256 81b626b188f760a4413bea0e3fd6628e48737ee033d20e432e771640a9fd338e
- MD5 e6defb6f76767f2388fc8b272c16ea87
- SHA1 74b56d92f7b81c012cf174f37eed7e1c45f42355
- SHA512 9408b6db88eb13dd460f1947f3481ecc5f07da61980a7d0cb96a96a4de43161c122b8d1e31f434071a2b98407fd4629e8076e14b4bcee80533de49ad2e5038fd
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBfB/bSqz8:sxX7QnxrloE5dpUpcbVz8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\KaVBHT\boddevloc.exe
- Size 303KB
- SHA256 a17c9d4589459028432b687ebaddf2538f65a939ec0f9c2c1b3506b41273efbc
- MD5 39baf1bd01bfc2eabebea56223e7f3e4
- SHA1 d7f8505ad4245753b9ce1fb673d4bf24fe478bc0
- SHA512 7d74fed9cc93c97460701b53edd28803726d38b9ef4c043796eba33ed5d394a80bd5025611256d930b894bbea91ce5ed4c85909569bb8f2836c60275f588d97b
- SSDEEP 6144:6nyJ3n0Dm7+zm6wr6YEjAumIann6qJ/mB9D+nnS5ax2SNm9WdF7Uqp5:6ne3n0DmAm67YEjAyu6qJ/+WS5axBdSa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\KaVBHT\boddevloc.exe
- Size 1.1MB
- SHA256 d7542ce7a81fab1a512357499bc1680f56a448f20bbeed35ca46ea805ef46af6
- MD5 a8157af914e90dbdae261ab977f632fe
- SHA1 a0424b0ce27cc20d0a3f1b846ad7dcb554461c3d
- SHA512 b296c7f83077e2b1d93a3c7435cb07c289ced381b9721a25ecbbea04e1947272c0d5038a4df7c2845e3f48f2b3aa45f551f58e838add4976ecf41aae3838c74c
- SSDEEP 24576:6nxDZV7xMyu6qJ2WSYxBdSqpcVdm5XRVpQO3chiIcr1RhSKntaxtooblD:sxX7665YxRVplZzSKntlGF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 204B
- SHA256 686a11a1233625cff23d6fb001937361a8a07de9f9a7ba0c39a5372321027c98
- MD5 eded7e0a4251054d8155757e508f4aac
- SHA1 c06ae7f87a019984ce03674928c9227211976384
- SHA512 4ec0b14e5bea7c095c4540bd802106c308d26cc3ddef80f385950d860c93d082cb4ffb85a106e4f26c0ad2c0c7854233e2bce84c1afd4499993aa495ab47118a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 172B
- SHA256 54ed2b5f8de91bdc97dcf1f8f9c47627d50fc20186b14a544d8f679b7d2096b2
- MD5 31b0adbdf8e4f6e2a1a19683138e7063
- SHA1 500f84766e6300a8ec0a07e3a518420fd9c81918
- SHA512 7dee29871e73608af38958ca609ae7702ad22900d1acb0bad64448342a07c0585ec49a3a798f0b9b2bc317f654baa5489fb0e0aae3def5deb9a4bb134dcff695
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysxdob.exe
- Size 3.0MB
- SHA256 e9746b887cfe9a6baced8e6f77a38c08740f9141907fd59a22f29a7d631147dc
- MD5 775406f4588816c411564bcb0c742604
- SHA1 5b05b303b07bda1cc219c58f00484a285b09d4bf
- SHA512 51555d33dc2df4a9dae12edff477e0076f05d7f945f18b71bbf9ca781f7e9e9c48b98247f6446890aa6b33bf5f895e5e41722c65ae01db9eba52cab085633750
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBTB/bSqz8:sxX7QnxrloE5dpUpsbVz8
- MD5 SHA1 SHA512 SSDEEP