Analysis
-
max time kernel
149s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
02/06/2024, 06:46
Static task
static1
Behavioral task
behavioral1
Sample
4a7cff2f45f93a211942065626689c60_NeikiAnalytics.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
4a7cff2f45f93a211942065626689c60_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
4a7cff2f45f93a211942065626689c60_NeikiAnalytics.exe
-
Size
4.1MB
-
MD5
4a7cff2f45f93a211942065626689c60
-
SHA1
65641656e56d4f8e67b5cfcfd0c0a132aa45503d
-
SHA256
a7c277acbfe7f94d457f365d6998fa23965ea5f71bab9c49d4e158293e36d1f0
-
SHA512
e8489a9565aab5c58ba01d7176f4fbf738f7444d80cd6d5de7d3a1c610bb078d4a861c5287752b945e89be896798c6e303c5f9028afff66a9b11cf10ce9502b0
-
SSDEEP
98304:+R0pI/IQlUoMPdmpSpy4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdm15n9klRKN41v
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3448 xoptisys.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\KaVBKC\\bodaloc.exe" 4a7cff2f45f93a211942065626689c60_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\SysDrvAY\\xoptisys.exe" 4a7cff2f45f93a211942065626689c60_NeikiAnalytics.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2976 4a7cff2f45f93a211942065626689c60_NeikiAnalytics.exe 2976 4a7cff2f45f93a211942065626689c60_NeikiAnalytics.exe 2976 4a7cff2f45f93a211942065626689c60_NeikiAnalytics.exe 2976 4a7cff2f45f93a211942065626689c60_NeikiAnalytics.exe 3448 xoptisys.exe 3448 xoptisys.exe 2976 4a7cff2f45f93a211942065626689c60_NeikiAnalytics.exe 2976 4a7cff2f45f93a211942065626689c60_NeikiAnalytics.exe 3448 xoptisys.exe 3448 xoptisys.exe 2976 4a7cff2f45f93a211942065626689c60_NeikiAnalytics.exe 2976 4a7cff2f45f93a211942065626689c60_NeikiAnalytics.exe 3448 xoptisys.exe 3448 xoptisys.exe 2976 4a7cff2f45f93a211942065626689c60_NeikiAnalytics.exe 2976 4a7cff2f45f93a211942065626689c60_NeikiAnalytics.exe 3448 xoptisys.exe 3448 xoptisys.exe 2976 4a7cff2f45f93a211942065626689c60_NeikiAnalytics.exe 2976 4a7cff2f45f93a211942065626689c60_NeikiAnalytics.exe 3448 xoptisys.exe 3448 xoptisys.exe 2976 4a7cff2f45f93a211942065626689c60_NeikiAnalytics.exe 2976 4a7cff2f45f93a211942065626689c60_NeikiAnalytics.exe 3448 xoptisys.exe 3448 xoptisys.exe 2976 4a7cff2f45f93a211942065626689c60_NeikiAnalytics.exe 2976 4a7cff2f45f93a211942065626689c60_NeikiAnalytics.exe 3448 xoptisys.exe 3448 xoptisys.exe 2976 4a7cff2f45f93a211942065626689c60_NeikiAnalytics.exe 2976 4a7cff2f45f93a211942065626689c60_NeikiAnalytics.exe 3448 xoptisys.exe 3448 xoptisys.exe 2976 4a7cff2f45f93a211942065626689c60_NeikiAnalytics.exe 2976 4a7cff2f45f93a211942065626689c60_NeikiAnalytics.exe 3448 xoptisys.exe 3448 xoptisys.exe 2976 4a7cff2f45f93a211942065626689c60_NeikiAnalytics.exe 2976 4a7cff2f45f93a211942065626689c60_NeikiAnalytics.exe 3448 xoptisys.exe 3448 xoptisys.exe 2976 4a7cff2f45f93a211942065626689c60_NeikiAnalytics.exe 2976 4a7cff2f45f93a211942065626689c60_NeikiAnalytics.exe 3448 xoptisys.exe 3448 xoptisys.exe 2976 4a7cff2f45f93a211942065626689c60_NeikiAnalytics.exe 2976 4a7cff2f45f93a211942065626689c60_NeikiAnalytics.exe 3448 xoptisys.exe 3448 xoptisys.exe 2976 4a7cff2f45f93a211942065626689c60_NeikiAnalytics.exe 2976 4a7cff2f45f93a211942065626689c60_NeikiAnalytics.exe 3448 xoptisys.exe 3448 xoptisys.exe 2976 4a7cff2f45f93a211942065626689c60_NeikiAnalytics.exe 2976 4a7cff2f45f93a211942065626689c60_NeikiAnalytics.exe 3448 xoptisys.exe 3448 xoptisys.exe 2976 4a7cff2f45f93a211942065626689c60_NeikiAnalytics.exe 2976 4a7cff2f45f93a211942065626689c60_NeikiAnalytics.exe 3448 xoptisys.exe 3448 xoptisys.exe 2976 4a7cff2f45f93a211942065626689c60_NeikiAnalytics.exe 2976 4a7cff2f45f93a211942065626689c60_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2976 wrote to memory of 3448 2976 4a7cff2f45f93a211942065626689c60_NeikiAnalytics.exe 87 PID 2976 wrote to memory of 3448 2976 4a7cff2f45f93a211942065626689c60_NeikiAnalytics.exe 87 PID 2976 wrote to memory of 3448 2976 4a7cff2f45f93a211942065626689c60_NeikiAnalytics.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a7cff2f45f93a211942065626689c60_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4a7cff2f45f93a211942065626689c60_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\SysDrvAY\xoptisys.exeC:\SysDrvAY\xoptisys.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3448
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5a1e5d914a4b78d0f377ebb20f4b1a72e
SHA17d7a4e76debe739781c2eeb132f7d7d7b86cba21
SHA256a33ace6a26353e6796f071da1660694215dc3a37cc03cdf3b25039861b3c578b
SHA512c89f69b89d2e89f5c8673313fde2e92e573748c6197d34a25ed35bfebcc4719a8db9152745b9c8b7812164ce0abca2c0d64ffd25354482eebde0f1f5108db328
-
Filesize
4.1MB
MD5caa63f1252beecf462d1241d0a1cc27a
SHA1866f8c11bacd7b9b2c9e2c7e1c970d2a3b1253a0
SHA2567db85114a5b9d20e3f32ed8e5b1d31a3d3e1033256dfe4835b3cca4a2e4cd6bc
SHA5127447af88a7d24b05914f395fd119ba9ace8c2e1ee4bab44bb2bca61687630e6b42d7847bd16adc8e32d119f96d14a15ee0a9ed90ff4003ffbc3aeec28e62cd75
-
Filesize
203B
MD52fc13b93feea1b33e198f15e22982219
SHA1f309c5111702e6608250940454ddf71b66f8b3ff
SHA2562139ecaabf965a5737dcad1b3cd0f02a0c10857b50a84f089f305d8b6467852b
SHA512d66db5839b4999929f9cd09c6c6dce7b90ae372b80257ca1dba593b35e51bbb39c45b1957833c97ff9e95c8cceda8c8af3464e729d41847d5a8e24a79bae45d9