Analysis
- max time kernel
149s - max time network
98s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 10:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a0f98f6f45786b67bc010fa895212480_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
a0f98f6f45786b67bc010fa895212480_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target a0f98f6f45786b67bc010fa895212480_NeikiAnalytics.exe
- Size 2.7MB
- Sample240603-m272vadd69
- SHA256 d2ab26b6eba2c7b0f259d29d65a7d6838a2b63398ee781288ca4fb3b125102bb
- MD5 a0f98f6f45786b67bc010fa895212480
- SHA1 4464bb33b8f77df9e0a44282c874ec976d6937c9
- SHA512 2b6335ffa984a0daa85e87be3e86164acb275e079bc2e30951957148910549d4398b7e79982ad14f0b3ed9832ac72d9985fca79e4299d65a38f2446b20c3b10c
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBj9w4Sx:+R0pI/IQlUoMPdmpSp/4
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3672 devoptiloc.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\SysDrvK4\\devoptiloc.exe" a0f98f6f45786b67bc010fa895212480_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\VidBP\\dobaloc.exe" a0f98f6f45786b67bc010fa895212480_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4436 a0f98f6f45786b67bc010fa895212480_NeikiAnalytics.exe 4436 a0f98f6f45786b67bc010fa895212480_NeikiAnalytics.exe 4436 a0f98f6f45786b67bc010fa895212480_NeikiAnalytics.exe 4436 a0f98f6f45786b67bc010fa895212480_NeikiAnalytics.exe 3672 devoptiloc.exe 3672 devoptiloc.exe 4436 a0f98f6f45786b67bc010fa895212480_NeikiAnalytics.exe 4436 a0f98f6f45786b67bc010fa895212480_NeikiAnalytics.exe 3672 devoptiloc.exe 3672 devoptiloc.exe 4436 a0f98f6f45786b67bc010fa895212480_NeikiAnalytics.exe 4436 a0f98f6f45786b67bc010fa895212480_NeikiAnalytics.exe 3672 devoptiloc.exe 3672 devoptiloc.exe 4436 a0f98f6f45786b67bc010fa895212480_NeikiAnalytics.exe 4436 a0f98f6f45786b67bc010fa895212480_NeikiAnalytics.exe 3672 devoptiloc.exe 3672 devoptiloc.exe 4436 a0f98f6f45786b67bc010fa895212480_NeikiAnalytics.exe 4436 a0f98f6f45786b67bc010fa895212480_NeikiAnalytics.exe 3672 devoptiloc.exe 3672 devoptiloc.exe 4436 a0f98f6f45786b67bc010fa895212480_NeikiAnalytics.exe 4436 a0f98f6f45786b67bc010fa895212480_NeikiAnalytics.exe 3672 devoptiloc.exe 3672 devoptiloc.exe 4436 a0f98f6f45786b67bc010fa895212480_NeikiAnalytics.exe 4436 a0f98f6f45786b67bc010fa895212480_NeikiAnalytics.exe 3672 devoptiloc.exe 3672 devoptiloc.exe 4436 a0f98f6f45786b67bc010fa895212480_NeikiAnalytics.exe 4436 a0f98f6f45786b67bc010fa895212480_NeikiAnalytics.exe 3672 devoptiloc.exe 3672 devoptiloc.exe 4436 a0f98f6f45786b67bc010fa895212480_NeikiAnalytics.exe 4436 a0f98f6f45786b67bc010fa895212480_NeikiAnalytics.exe 3672 devoptiloc.exe 3672 devoptiloc.exe 4436 a0f98f6f45786b67bc010fa895212480_NeikiAnalytics.exe 4436 a0f98f6f45786b67bc010fa895212480_NeikiAnalytics.exe 3672 devoptiloc.exe 3672 devoptiloc.exe 4436 a0f98f6f45786b67bc010fa895212480_NeikiAnalytics.exe 4436 a0f98f6f45786b67bc010fa895212480_NeikiAnalytics.exe 3672 devoptiloc.exe 3672 devoptiloc.exe 4436 a0f98f6f45786b67bc010fa895212480_NeikiAnalytics.exe 4436 a0f98f6f45786b67bc010fa895212480_NeikiAnalytics.exe 3672 devoptiloc.exe 3672 devoptiloc.exe 4436 a0f98f6f45786b67bc010fa895212480_NeikiAnalytics.exe 4436 a0f98f6f45786b67bc010fa895212480_NeikiAnalytics.exe 3672 devoptiloc.exe 3672 devoptiloc.exe 4436 a0f98f6f45786b67bc010fa895212480_NeikiAnalytics.exe 4436 a0f98f6f45786b67bc010fa895212480_NeikiAnalytics.exe 3672 devoptiloc.exe 3672 devoptiloc.exe 4436 a0f98f6f45786b67bc010fa895212480_NeikiAnalytics.exe 4436 a0f98f6f45786b67bc010fa895212480_NeikiAnalytics.exe 3672 devoptiloc.exe 3672 devoptiloc.exe 4436 a0f98f6f45786b67bc010fa895212480_NeikiAnalytics.exe 4436 a0f98f6f45786b67bc010fa895212480_NeikiAnalytics.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4436 wrote to memory of 3672 4436 a0f98f6f45786b67bc010fa895212480_NeikiAnalytics.exe 86 PID 4436 wrote to memory of 3672 4436 a0f98f6f45786b67bc010fa895212480_NeikiAnalytics.exe 86 PID 4436 wrote to memory of 3672 4436 a0f98f6f45786b67bc010fa895212480_NeikiAnalytics.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\a0f98f6f45786b67bc010fa895212480_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a0f98f6f45786b67bc010fa895212480_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\SysDrvK4\devoptiloc.exeC:\SysDrvK4\devoptiloc.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3672
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\SysDrvK4\devoptiloc.exe
- Size 2.7MB
- SHA256 3131ed54eeb5b58984815649a22ed768f11dc3cc36e55e80afaf02aa95cb3426
- MD5 5557b866729448dd6718e7c2bda86d52
- SHA1 d01f312ca1066cdfb11a2502fb8928d7aa229b02
- SHA512 865209497b8b87ad57b62d3beb59f6b4ff3864f1e6c419e8a6c251d73f67fa5baaee9554893f1d992dacc0007466225646d101f8ff578133944b180be2d69325
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBi9w4Sx:+R0pI/IQlUoMPdmpSps4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 203B
- SHA256 5cca654049d0717c3dc053c365ddc27ada9640772fbc7cbd7948bb300c73a874
- MD5 ec626dd83d2ffc7d8df4b4587faf78b0
- SHA1 5e578412495c87ff63d70f33619993fba92cd759
- SHA512 f6e982f09927235fa0c43025c7145fe2d238bc53d4e6513ba1ba82a111a90c0c1c63ad6b04954398b6ee5887894c5fe58f1e6723a69a53c2a8cf0999edb0d991
- MD5 SHA1 SHA512
- Path C:\VidBP\dobaloc.exe
- Size 2.7MB
- SHA256 9895bee2b08c6386070821d78ba20fbe0cca1f3ddd26ccc3190e3b7905cf1ae0
- MD5 0bed9d1c4c7f1336b615a66056ff534e
- SHA1 88219a23f7565fe8b8a3473259b514d4675eb991
- SHA512 5ddb97a1d32ec4c9d7aa24b00232080144d1c09c701441937c5209c9814b114a3c036c9de2320357c9c0aa6c3ee9532b8bef29bebba7a860860575851617a3f4
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBs9w4Sx:+R0pI/IQlUoMPdmpSpC4
- MD5 SHA1 SHA512 SSDEEP