Analysis
- max time kernel
150s - max time network
96s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
02/06/2024, 22:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
76b992ed6ff26c7e5b6423d833ecaeb0_NeikiAnalytics.exe
Resource
win7-20240215-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
76b992ed6ff26c7e5b6423d833ecaeb0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 76b992ed6ff26c7e5b6423d833ecaeb0_NeikiAnalytics.exe
- Size 4.1MB
- Sample240602-2dkc7sad59
- SHA256 c2b56352cbcd9ce1364ad0d8408bb4effda958980577d803843490b7942f7a32
- MD5 76b992ed6ff26c7e5b6423d833ecaeb0
- SHA1 731b36a7f6e32e78ce978be74c40c25e94a7bb7f
- SHA512 47c185f3fe17430244dc04e73b75aa36ce09efbefec25345747ea8188a5a4d6b3fa703c09ddd7300bb1cf4b26edc4769004fcb8bf5cf8b9667d986329b5b57e5
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBBB/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUpebVz8eLFcz
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecdevdob.exe 76b992ed6ff26c7e5b6423d833ecaeb0_NeikiAnalytics.exe - Executes dropped EXE 2 IoCs
pid Process 4132 ecdevdob.exe 4492 adobsys.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\UserDotHK\\adobsys.exe" 76b992ed6ff26c7e5b6423d833ecaeb0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\Galax44\\optidevec.exe" 76b992ed6ff26c7e5b6423d833ecaeb0_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3880 76b992ed6ff26c7e5b6423d833ecaeb0_NeikiAnalytics.exe 3880 76b992ed6ff26c7e5b6423d833ecaeb0_NeikiAnalytics.exe 3880 76b992ed6ff26c7e5b6423d833ecaeb0_NeikiAnalytics.exe 3880 76b992ed6ff26c7e5b6423d833ecaeb0_NeikiAnalytics.exe 4132 ecdevdob.exe 4132 ecdevdob.exe 4492 adobsys.exe 4492 adobsys.exe 4132 ecdevdob.exe 4132 ecdevdob.exe 4492 adobsys.exe 4492 adobsys.exe 4132 ecdevdob.exe 4132 ecdevdob.exe 4492 adobsys.exe 4492 adobsys.exe 4132 ecdevdob.exe 4132 ecdevdob.exe 4492 adobsys.exe 4492 adobsys.exe 4132 ecdevdob.exe 4132 ecdevdob.exe 4492 adobsys.exe 4492 adobsys.exe 4132 ecdevdob.exe 4132 ecdevdob.exe 4492 adobsys.exe 4492 adobsys.exe 4132 ecdevdob.exe 4132 ecdevdob.exe 4492 adobsys.exe 4492 adobsys.exe 4132 ecdevdob.exe 4132 ecdevdob.exe 4492 adobsys.exe 4492 adobsys.exe 4132 ecdevdob.exe 4132 ecdevdob.exe 4492 adobsys.exe 4492 adobsys.exe 4132 ecdevdob.exe 4132 ecdevdob.exe 4492 adobsys.exe 4492 adobsys.exe 4132 ecdevdob.exe 4132 ecdevdob.exe 4492 adobsys.exe 4492 adobsys.exe 4132 ecdevdob.exe 4132 ecdevdob.exe 4492 adobsys.exe 4492 adobsys.exe 4132 ecdevdob.exe 4132 ecdevdob.exe 4492 adobsys.exe 4492 adobsys.exe 4132 ecdevdob.exe 4132 ecdevdob.exe 4492 adobsys.exe 4492 adobsys.exe 4132 ecdevdob.exe 4132 ecdevdob.exe 4492 adobsys.exe 4492 adobsys.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3880 wrote to memory of 4132 3880 76b992ed6ff26c7e5b6423d833ecaeb0_NeikiAnalytics.exe 82 PID 3880 wrote to memory of 4132 3880 76b992ed6ff26c7e5b6423d833ecaeb0_NeikiAnalytics.exe 82 PID 3880 wrote to memory of 4132 3880 76b992ed6ff26c7e5b6423d833ecaeb0_NeikiAnalytics.exe 82 PID 3880 wrote to memory of 4492 3880 76b992ed6ff26c7e5b6423d833ecaeb0_NeikiAnalytics.exe 85 PID 3880 wrote to memory of 4492 3880 76b992ed6ff26c7e5b6423d833ecaeb0_NeikiAnalytics.exe 85 PID 3880 wrote to memory of 4492 3880 76b992ed6ff26c7e5b6423d833ecaeb0_NeikiAnalytics.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\76b992ed6ff26c7e5b6423d833ecaeb0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\76b992ed6ff26c7e5b6423d833ecaeb0_NeikiAnalytics.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecdevdob.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecdevdob.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4132
-
-
C:\UserDotHK\adobsys.exeC:\UserDotHK\adobsys.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4492
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Galax44\optidevec.exe
- Size 4.1MB
- SHA256 4ed37af8e20c2526b0a224856922a8dd93dc5c0faf629d822caf7fa7e6df445b
- MD5 765ad52138705c79cdfd9e55f9716e3a
- SHA1 ca6dee97001e733ec37c15ce033012ed6b0cb79b
- SHA512 9b319477f31dca0cb7e150e09126868e87b2140bea7e64eee98bfb3913ca3a5385fed0ff28ddc40467333b3528cbdccb35e2379c2bc30813e24d33138aba2bb8
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBgB/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUp3bVz8eLFcz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Galax44\optidevec.exe
- Size 112KB
- SHA256 e8c2004b2c0cc275ce5481860f748bc51c82b3475f708c72876da5e04b12dd99
- MD5 3bdbcccbb8535670ce407d2cce9e560b
- SHA1 b614f77a380a651c2e92690c297a6392c73d1679
- SHA512 7f0bed1afe54b80d78b59fb5b0ce63d916a6319ed6b653265db03c1c6419f5f50171b5aca83d93fa50935be41a2ce844140117317739bcd9735ad602ff252a93
- SSDEEP 3072:6uOByTKI3n0dZHm7+zsMcSgUXwr6a/Ej2vfj:6nyJ3n0Dm7+zm6wr6YEjAb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\UserDotHK\adobsys.exe
- Size 4.1MB
- SHA256 d3f96342acca0a7fa5e198e5381c1415fd1be9501e42dc484c4ecccc6180f212
- MD5 868c414c846f1cd79744ef8fa7c2c871
- SHA1 3a7937b94d6fead37183075014e5d84bde8837b8
- SHA512 ce09ac47e58f59e76a4ce0bdfbd293174b39c2868597341a3565ff2a94f2f2370f4c7468503504c4728622331530f03955dc2600556561399a38814ccd345e3a
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBJB/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUpCbVz8eLFcz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 206B
- SHA256 2420438017e55dbfe949a5a253c5a68b665d0f5fb5dbbaf4268cd2bf4a5d8e4d
- MD5 f07d8b7d571724211032132387681787
- SHA1 7c4093350e70b6231f7e1e04d5c0b974e068ddcc
- SHA512 634f8d602106194c5ebad6f52dfb0f769f24abfe87901c5b17444102fe0097ad3670567eed6892b9eab0d0661cf89c5eb1080456524af1520f9afd9ef8317793
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 174B
- SHA256 cde605fee211ef0b9d88ab943d9336b1f09b61681a19f70659fd50f74f5dd1a6
- MD5 c97e392c4e756f9e6d37a0999e627534
- SHA1 e5927216a452d0ed7d5798e52ce99450d7b99b5d
- SHA512 9b21307058eddb2e479dab0d044574a39ecd50607054fdfbe5e6db305bffe421adeda395fff10df121569e46c922f971bd71ed3045c837a8ed1bddeda7e7784b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecdevdob.exe
- Size 4.1MB
- SHA256 71e8d15feaf48a92c427c7039378eeda2e1570dd79ec83b62a2114c0bf74064d
- MD5 6fae2bfa5827bb2e6cbdda9d1d1f93da
- SHA1 8648eceb2452ca49f1b43d64b57e238becc6f9e2
- SHA512 005765c03c196087943b124dea4ab891d74fbafa212935737dc7e16959c8c8084d648a0259736790127d726d11ef16c33b5601e701cacced11488bf77292412f
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBlB/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUpubVz8eLFcz
- MD5 SHA1 SHA512 SSDEEP