Analysis

  • max time kernel
    149s
  • max time network
    102s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/06/2024, 06:46

General

  • Target

    4a7cff2f45f93a211942065626689c60_NeikiAnalytics.exe

  • Size

    4.1MB

  • MD5

    4a7cff2f45f93a211942065626689c60

  • SHA1

    65641656e56d4f8e67b5cfcfd0c0a132aa45503d

  • SHA256

    a7c277acbfe7f94d457f365d6998fa23965ea5f71bab9c49d4e158293e36d1f0

  • SHA512

    e8489a9565aab5c58ba01d7176f4fbf738f7444d80cd6d5de7d3a1c610bb078d4a861c5287752b945e89be896798c6e303c5f9028afff66a9b11cf10ce9502b0

  • SSDEEP

    98304:+R0pI/IQlUoMPdmpSpy4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdm15n9klRKN41v

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4a7cff2f45f93a211942065626689c60_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\4a7cff2f45f93a211942065626689c60_NeikiAnalytics.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2976
    • C:\SysDrvAY\xoptisys.exe
      C:\SysDrvAY\xoptisys.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:3448

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\KaVBKC\bodaloc.exe

    Filesize

    3KB

    MD5

    a1e5d914a4b78d0f377ebb20f4b1a72e

    SHA1

    7d7a4e76debe739781c2eeb132f7d7d7b86cba21

    SHA256

    a33ace6a26353e6796f071da1660694215dc3a37cc03cdf3b25039861b3c578b

    SHA512

    c89f69b89d2e89f5c8673313fde2e92e573748c6197d34a25ed35bfebcc4719a8db9152745b9c8b7812164ce0abca2c0d64ffd25354482eebde0f1f5108db328

  • C:\SysDrvAY\xoptisys.exe

    Filesize

    4.1MB

    MD5

    caa63f1252beecf462d1241d0a1cc27a

    SHA1

    866f8c11bacd7b9b2c9e2c7e1c970d2a3b1253a0

    SHA256

    7db85114a5b9d20e3f32ed8e5b1d31a3d3e1033256dfe4835b3cca4a2e4cd6bc

    SHA512

    7447af88a7d24b05914f395fd119ba9ace8c2e1ee4bab44bb2bca61687630e6b42d7847bd16adc8e32d119f96d14a15ee0a9ed90ff4003ffbc3aeec28e62cd75

  • C:\Users\Admin\253086396416_10.0_Admin.ini

    Filesize

    203B

    MD5

    2fc13b93feea1b33e198f15e22982219

    SHA1

    f309c5111702e6608250940454ddf71b66f8b3ff

    SHA256

    2139ecaabf965a5737dcad1b3cd0f02a0c10857b50a84f089f305d8b6467852b

    SHA512

    d66db5839b4999929f9cd09c6c6dce7b90ae372b80257ca1dba593b35e51bbb39c45b1957833c97ff9e95c8cceda8c8af3464e729d41847d5a8e24a79bae45d9