Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 00:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
886e3c63e7453a3cf7b9e02f0e4b2f30_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
886e3c63e7453a3cf7b9e02f0e4b2f30_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 886e3c63e7453a3cf7b9e02f0e4b2f30_NeikiAnalytics.exe
- Size 4.1MB
- Sample240603-adr99sca7z
- SHA256 14d0de4f3bd7475880893680507841da1d25f8fc451ebe0c0489e7001a866800
- MD5 886e3c63e7453a3cf7b9e02f0e4b2f30
- SHA1 888094c1237d12ee2902316344492644d2eee319
- SHA512 c55bff32b502b08584002d086b8ee6d378b3ccf786389dcb0942b4627859e7c3f0804de400249caad683c12510bfb2f66140c42e902dae8599fae475f4411425
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBSB/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUpRbVz8eLFcz
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysxbod.exe 886e3c63e7453a3cf7b9e02f0e4b2f30_NeikiAnalytics.exe - Executes dropped EXE 2 IoCs
pid Process 3716 sysxbod.exe 4340 xoptiloc.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\UserDot3F\\xoptiloc.exe" 886e3c63e7453a3cf7b9e02f0e4b2f30_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\Galax9A\\optialoc.exe" 886e3c63e7453a3cf7b9e02f0e4b2f30_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4764 886e3c63e7453a3cf7b9e02f0e4b2f30_NeikiAnalytics.exe 4764 886e3c63e7453a3cf7b9e02f0e4b2f30_NeikiAnalytics.exe 4764 886e3c63e7453a3cf7b9e02f0e4b2f30_NeikiAnalytics.exe 4764 886e3c63e7453a3cf7b9e02f0e4b2f30_NeikiAnalytics.exe 3716 sysxbod.exe 3716 sysxbod.exe 4340 xoptiloc.exe 4340 xoptiloc.exe 3716 sysxbod.exe 3716 sysxbod.exe 4340 xoptiloc.exe 4340 xoptiloc.exe 3716 sysxbod.exe 3716 sysxbod.exe 4340 xoptiloc.exe 4340 xoptiloc.exe 3716 sysxbod.exe 3716 sysxbod.exe 4340 xoptiloc.exe 4340 xoptiloc.exe 3716 sysxbod.exe 3716 sysxbod.exe 4340 xoptiloc.exe 4340 xoptiloc.exe 3716 sysxbod.exe 3716 sysxbod.exe 4340 xoptiloc.exe 4340 xoptiloc.exe 3716 sysxbod.exe 3716 sysxbod.exe 4340 xoptiloc.exe 4340 xoptiloc.exe 3716 sysxbod.exe 3716 sysxbod.exe 4340 xoptiloc.exe 4340 xoptiloc.exe 3716 sysxbod.exe 3716 sysxbod.exe 4340 xoptiloc.exe 4340 xoptiloc.exe 3716 sysxbod.exe 3716 sysxbod.exe 4340 xoptiloc.exe 4340 xoptiloc.exe 3716 sysxbod.exe 3716 sysxbod.exe 4340 xoptiloc.exe 4340 xoptiloc.exe 3716 sysxbod.exe 3716 sysxbod.exe 4340 xoptiloc.exe 4340 xoptiloc.exe 3716 sysxbod.exe 3716 sysxbod.exe 4340 xoptiloc.exe 4340 xoptiloc.exe 3716 sysxbod.exe 3716 sysxbod.exe 4340 xoptiloc.exe 4340 xoptiloc.exe 3716 sysxbod.exe 3716 sysxbod.exe 4340 xoptiloc.exe 4340 xoptiloc.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4764 wrote to memory of 3716 4764 886e3c63e7453a3cf7b9e02f0e4b2f30_NeikiAnalytics.exe 89 PID 4764 wrote to memory of 3716 4764 886e3c63e7453a3cf7b9e02f0e4b2f30_NeikiAnalytics.exe 89 PID 4764 wrote to memory of 3716 4764 886e3c63e7453a3cf7b9e02f0e4b2f30_NeikiAnalytics.exe 89 PID 4764 wrote to memory of 4340 4764 886e3c63e7453a3cf7b9e02f0e4b2f30_NeikiAnalytics.exe 91 PID 4764 wrote to memory of 4340 4764 886e3c63e7453a3cf7b9e02f0e4b2f30_NeikiAnalytics.exe 91 PID 4764 wrote to memory of 4340 4764 886e3c63e7453a3cf7b9e02f0e4b2f30_NeikiAnalytics.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\886e3c63e7453a3cf7b9e02f0e4b2f30_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\886e3c63e7453a3cf7b9e02f0e4b2f30_NeikiAnalytics.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysxbod.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysxbod.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3716
-
-
C:\UserDot3F\xoptiloc.exeC:\UserDot3F\xoptiloc.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4340
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Galax9A\optialoc.exe
- Size 287KB
- SHA256 9b16b1e801685cf9e5336997661c79310d8a2ae94c51a7cd0569cb288d13e8ed
- MD5 242c8dad2306d53c6b1522ab817d23f9
- SHA1 b28e46550e49ec5a46dbf72442ce63c219bd9107
- SHA512 cb5045ac76ccb50adca545529ad70b835f56f46c0a004ea5d82d138b0ed0bc6c048400a6c250c9574ef92f56b29d480a7259444fcf74d286faee4068f20b0847
- SSDEEP 6144:6nyJ3n0Dm7+zm6wr6YEjAumIann6qJ/mB9D+nnS5ax2SNmh:6ne3n0DmAm67YEjAyu6qJ/+WS5axBO
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Galax9A\optialoc.exe
- Size 4.1MB
- SHA256 f2f6f16d72d7f8674f5d9bc7650edc1b6ceb827a8d86d007554240f2d0a59eeb
- MD5 5926dc05c902accb612bab8513178267
- SHA1 91c17f52413d657311d6bc394a9e64e9fa4950f7
- SHA512 959bf8352c3268e36541a8c53ab01785cfa9f0a18ea09893e38677ad2d85b5cd206c136c7814b0ce55dbd4ceb4dbf1fda0c5352e99c0da6137205d5ae975f8fb
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBCB/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUphbVz8eLFcz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\UserDot3F\xoptiloc.exe
- Size 4.1MB
- SHA256 8ca42fc100bfea123893b92e2e14569cfccc56a8985d923051c367191a0b9e59
- MD5 312e5d049cdcf9b96056af2c5555d44e
- SHA1 cd11cb23c04db766514afdda546b4de7d2cf4680
- SHA512 7219d3b39cb771a54540a36d87d766eddc7e63017881eec07c8af2e120d4065038c79eca7d509da01c9e452b0b2dcd45d6ee34067b3edfb272a439d775d8ff03
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB1B/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUpqbVz8eLFcz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 205B
- SHA256 78288138942bb6884bad1b237f4bb16cc4b74edf62f23ba8e2e50b934695e3dd
- MD5 cc33662f28e0084b6300ed76a5c75486
- SHA1 a84346de14bde723aa253b62d46641ba13f807fe
- SHA512 9df00bbd2f083dc03aac403ed1617dd832a233f5e87f990908c3ae78cf618a04f3d5c0a4aac5c39721b1c906f093c21d64f18c2f5b8cc67ee09acdb2648bed1d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 173B
- SHA256 5b2dbe730491da0d1f09807622737db2a7a34255df28e94731b26bfd81d0e083
- MD5 efbb4f0696cbd7d7fa39b3a55fbe7dd4
- SHA1 6b510c06fb8b2408b8234f18b27b70b96cf53a6f
- SHA512 ef63e1a85394fd08e4c24f5f1a323bd367114a0cfb0ae05783cb943c7a2c8b88fcc4c81b25415d4987a676804039f4a3b195bedc65876ec21fa3e76140514029
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysxbod.exe
- Size 4.1MB
- SHA256 2bc47f58dfe8c71537ae76d9f98310826a866b3ed866aef72f8e408d8913e9f9
- MD5 6b4f904ec9db4c99a7f72786784c6081
- SHA1 b67aa757f35b98132606717f27236ed3bd800842
- SHA512 54ffa8ba99d5772d94aac1e24e47a28c18c476ed503cfc792948c54b307d2ceb67473546352ff0ca079394a46307013423f50cb306c6262ac3c57003ef931e6e
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBHB/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUpQbVz8eLFcz
- MD5 SHA1 SHA512 SSDEEP