Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
02/06/2024, 01:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
200364cefb6a0cb69c4da6e4927d66c0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
200364cefb6a0cb69c4da6e4927d66c0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 200364cefb6a0cb69c4da6e4927d66c0_NeikiAnalytics.exe
- Size 2.7MB
- Sample240602-caqclseh2z
- SHA256 595fb35d32027a0183888697a5d5cfd0d3fa810125b23ed2d16c5d47b60f0d3a
- MD5 200364cefb6a0cb69c4da6e4927d66c0
- SHA1 26210e17d61ea37fe1bf11cecc6918dfba233f80
- SHA512 edc96b4e1b58092ba754a11ef091ae7c965cebc00f10d004a17e6b412a839d630285cad3e033cd50121c472c228603fc18dc0d6723fd796306a8b0cb878cb3e8
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBV9w4Sx:+R0pI/IQlUoMPdmpSph4
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1760 xoptiec.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\Intelproc7J\\xoptiec.exe" 200364cefb6a0cb69c4da6e4927d66c0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\VidJM\\dobasys.exe" 200364cefb6a0cb69c4da6e4927d66c0_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 380 200364cefb6a0cb69c4da6e4927d66c0_NeikiAnalytics.exe 380 200364cefb6a0cb69c4da6e4927d66c0_NeikiAnalytics.exe 380 200364cefb6a0cb69c4da6e4927d66c0_NeikiAnalytics.exe 380 200364cefb6a0cb69c4da6e4927d66c0_NeikiAnalytics.exe 1760 xoptiec.exe 1760 xoptiec.exe 380 200364cefb6a0cb69c4da6e4927d66c0_NeikiAnalytics.exe 380 200364cefb6a0cb69c4da6e4927d66c0_NeikiAnalytics.exe 1760 xoptiec.exe 1760 xoptiec.exe 380 200364cefb6a0cb69c4da6e4927d66c0_NeikiAnalytics.exe 380 200364cefb6a0cb69c4da6e4927d66c0_NeikiAnalytics.exe 1760 xoptiec.exe 1760 xoptiec.exe 380 200364cefb6a0cb69c4da6e4927d66c0_NeikiAnalytics.exe 380 200364cefb6a0cb69c4da6e4927d66c0_NeikiAnalytics.exe 1760 xoptiec.exe 1760 xoptiec.exe 380 200364cefb6a0cb69c4da6e4927d66c0_NeikiAnalytics.exe 380 200364cefb6a0cb69c4da6e4927d66c0_NeikiAnalytics.exe 1760 xoptiec.exe 1760 xoptiec.exe 380 200364cefb6a0cb69c4da6e4927d66c0_NeikiAnalytics.exe 380 200364cefb6a0cb69c4da6e4927d66c0_NeikiAnalytics.exe 1760 xoptiec.exe 1760 xoptiec.exe 380 200364cefb6a0cb69c4da6e4927d66c0_NeikiAnalytics.exe 380 200364cefb6a0cb69c4da6e4927d66c0_NeikiAnalytics.exe 1760 xoptiec.exe 1760 xoptiec.exe 380 200364cefb6a0cb69c4da6e4927d66c0_NeikiAnalytics.exe 380 200364cefb6a0cb69c4da6e4927d66c0_NeikiAnalytics.exe 1760 xoptiec.exe 1760 xoptiec.exe 380 200364cefb6a0cb69c4da6e4927d66c0_NeikiAnalytics.exe 380 200364cefb6a0cb69c4da6e4927d66c0_NeikiAnalytics.exe 1760 xoptiec.exe 1760 xoptiec.exe 380 200364cefb6a0cb69c4da6e4927d66c0_NeikiAnalytics.exe 380 200364cefb6a0cb69c4da6e4927d66c0_NeikiAnalytics.exe 1760 xoptiec.exe 1760 xoptiec.exe 380 200364cefb6a0cb69c4da6e4927d66c0_NeikiAnalytics.exe 380 200364cefb6a0cb69c4da6e4927d66c0_NeikiAnalytics.exe 1760 xoptiec.exe 1760 xoptiec.exe 380 200364cefb6a0cb69c4da6e4927d66c0_NeikiAnalytics.exe 380 200364cefb6a0cb69c4da6e4927d66c0_NeikiAnalytics.exe 1760 xoptiec.exe 1760 xoptiec.exe 380 200364cefb6a0cb69c4da6e4927d66c0_NeikiAnalytics.exe 380 200364cefb6a0cb69c4da6e4927d66c0_NeikiAnalytics.exe 1760 xoptiec.exe 1760 xoptiec.exe 380 200364cefb6a0cb69c4da6e4927d66c0_NeikiAnalytics.exe 380 200364cefb6a0cb69c4da6e4927d66c0_NeikiAnalytics.exe 1760 xoptiec.exe 1760 xoptiec.exe 380 200364cefb6a0cb69c4da6e4927d66c0_NeikiAnalytics.exe 380 200364cefb6a0cb69c4da6e4927d66c0_NeikiAnalytics.exe 1760 xoptiec.exe 1760 xoptiec.exe 380 200364cefb6a0cb69c4da6e4927d66c0_NeikiAnalytics.exe 380 200364cefb6a0cb69c4da6e4927d66c0_NeikiAnalytics.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 380 wrote to memory of 1760 380 200364cefb6a0cb69c4da6e4927d66c0_NeikiAnalytics.exe 87 PID 380 wrote to memory of 1760 380 200364cefb6a0cb69c4da6e4927d66c0_NeikiAnalytics.exe 87 PID 380 wrote to memory of 1760 380 200364cefb6a0cb69c4da6e4927d66c0_NeikiAnalytics.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\200364cefb6a0cb69c4da6e4927d66c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\200364cefb6a0cb69c4da6e4927d66c0_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:380 -
C:\Intelproc7J\xoptiec.exeC:\Intelproc7J\xoptiec.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1760
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Intelproc7J\xoptiec.exe
- Size 2.7MB
- SHA256 0954b2b29a9fd68062e29da533f2396c22486025203e667618c4d1dd8a628df6
- MD5 c4511849de3d70d962aeefc4f1f56569
- SHA1 606db41448f06ab5cbebc2f9b68fc29a7e8ff75b
- SHA512 95fe6ab6a6b1e3bc4af87159ce229e9bfa4e30909ecf1c61f6a712cef7380b0f09ba9ffb14ef94b9285c686ef85de9e6e1f77dcd179fadcd8a6d8c6573149a89
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBf9w4Sx:+R0pI/IQlUoMPdmpSpD4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 203B
- SHA256 130c91f13500e199ec822de7d6d39e1207e11ca8dcb9456b5468a80d0c95ffee
- MD5 d5f360e7e93128392ae18a6490e79492
- SHA1 19899b3f312ccbaa648440ec9fc48920e2872b70
- SHA512 a7f6f1de33e1403c3e84768d46430c0dbf29e1a78ec148b1529828e616c277ec36a2ee1f464d5c13085391466623ed0b29826f28a64658487e318276865f6fcd
- MD5 SHA1 SHA512
- Path C:\VidJM\dobasys.exe
- Size 19KB
- SHA256 76b2bf6f278b163f901e420fba2d31579ed4d8835d1ed69615b424a57916f09f
- MD5 fd27c80c1b6c1d24a41756d5ed82c72f
- SHA1 ed2d4631dbd5f75933b0c67fa8437eb21a261e63
- SHA512 934188d48dbe921497e532a7738e85e6e08e0f8ecaf93829f5f5bfe3c5eda73f44ef8c7d7fce0c7c46c0e5cdebd344e4c8bdbfe06adf3b276706182f91810d9e
- SSDEEP 384:PLT5lDnYcy/ES70S7Tq6xRVtLiD1APk/f:PLT5ZRHUj7TRxRVED1bH
- MD5 SHA1 SHA512 SSDEEP