Analysis
- max time kernel
149s - max time network
96s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 11:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a10ac087ba650466c6a9594fe5eb19a0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
a10ac087ba650466c6a9594fe5eb19a0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target a10ac087ba650466c6a9594fe5eb19a0_NeikiAnalytics.exe
- Size 2.7MB
- Sample240603-m4r4eade45
- SHA256 34558f7c517342b512a7f5067ad3ee8f84aef9d984f848618948a73017099d96
- MD5 a10ac087ba650466c6a9594fe5eb19a0
- SHA1 557ae8efa96ef41def4c068713645a5a3a03de6e
- SHA512 00a5c784567180c5a0258b1585de0523005f6f293201dae90ae8147f0433be126b4175307494a477a75009cf18a3f066f52b3086d8582c8a9630b203d25eaaae
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LB29w4Sx:+R0pI/IQlUoMPdmpSpE4
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1640 aoptiec.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\FilesF0\\aoptiec.exe" a10ac087ba650466c6a9594fe5eb19a0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\KaVB3B\\optixloc.exe" a10ac087ba650466c6a9594fe5eb19a0_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2188 a10ac087ba650466c6a9594fe5eb19a0_NeikiAnalytics.exe 2188 a10ac087ba650466c6a9594fe5eb19a0_NeikiAnalytics.exe 2188 a10ac087ba650466c6a9594fe5eb19a0_NeikiAnalytics.exe 2188 a10ac087ba650466c6a9594fe5eb19a0_NeikiAnalytics.exe 1640 aoptiec.exe 1640 aoptiec.exe 2188 a10ac087ba650466c6a9594fe5eb19a0_NeikiAnalytics.exe 2188 a10ac087ba650466c6a9594fe5eb19a0_NeikiAnalytics.exe 1640 aoptiec.exe 1640 aoptiec.exe 2188 a10ac087ba650466c6a9594fe5eb19a0_NeikiAnalytics.exe 2188 a10ac087ba650466c6a9594fe5eb19a0_NeikiAnalytics.exe 1640 aoptiec.exe 1640 aoptiec.exe 2188 a10ac087ba650466c6a9594fe5eb19a0_NeikiAnalytics.exe 2188 a10ac087ba650466c6a9594fe5eb19a0_NeikiAnalytics.exe 1640 aoptiec.exe 1640 aoptiec.exe 2188 a10ac087ba650466c6a9594fe5eb19a0_NeikiAnalytics.exe 2188 a10ac087ba650466c6a9594fe5eb19a0_NeikiAnalytics.exe 1640 aoptiec.exe 1640 aoptiec.exe 2188 a10ac087ba650466c6a9594fe5eb19a0_NeikiAnalytics.exe 2188 a10ac087ba650466c6a9594fe5eb19a0_NeikiAnalytics.exe 1640 aoptiec.exe 1640 aoptiec.exe 2188 a10ac087ba650466c6a9594fe5eb19a0_NeikiAnalytics.exe 2188 a10ac087ba650466c6a9594fe5eb19a0_NeikiAnalytics.exe 1640 aoptiec.exe 1640 aoptiec.exe 2188 a10ac087ba650466c6a9594fe5eb19a0_NeikiAnalytics.exe 2188 a10ac087ba650466c6a9594fe5eb19a0_NeikiAnalytics.exe 1640 aoptiec.exe 1640 aoptiec.exe 2188 a10ac087ba650466c6a9594fe5eb19a0_NeikiAnalytics.exe 2188 a10ac087ba650466c6a9594fe5eb19a0_NeikiAnalytics.exe 1640 aoptiec.exe 1640 aoptiec.exe 2188 a10ac087ba650466c6a9594fe5eb19a0_NeikiAnalytics.exe 2188 a10ac087ba650466c6a9594fe5eb19a0_NeikiAnalytics.exe 1640 aoptiec.exe 1640 aoptiec.exe 2188 a10ac087ba650466c6a9594fe5eb19a0_NeikiAnalytics.exe 2188 a10ac087ba650466c6a9594fe5eb19a0_NeikiAnalytics.exe 1640 aoptiec.exe 1640 aoptiec.exe 2188 a10ac087ba650466c6a9594fe5eb19a0_NeikiAnalytics.exe 2188 a10ac087ba650466c6a9594fe5eb19a0_NeikiAnalytics.exe 1640 aoptiec.exe 1640 aoptiec.exe 2188 a10ac087ba650466c6a9594fe5eb19a0_NeikiAnalytics.exe 2188 a10ac087ba650466c6a9594fe5eb19a0_NeikiAnalytics.exe 1640 aoptiec.exe 1640 aoptiec.exe 2188 a10ac087ba650466c6a9594fe5eb19a0_NeikiAnalytics.exe 2188 a10ac087ba650466c6a9594fe5eb19a0_NeikiAnalytics.exe 1640 aoptiec.exe 1640 aoptiec.exe 2188 a10ac087ba650466c6a9594fe5eb19a0_NeikiAnalytics.exe 2188 a10ac087ba650466c6a9594fe5eb19a0_NeikiAnalytics.exe 1640 aoptiec.exe 1640 aoptiec.exe 2188 a10ac087ba650466c6a9594fe5eb19a0_NeikiAnalytics.exe 2188 a10ac087ba650466c6a9594fe5eb19a0_NeikiAnalytics.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2188 wrote to memory of 1640 2188 a10ac087ba650466c6a9594fe5eb19a0_NeikiAnalytics.exe 86 PID 2188 wrote to memory of 1640 2188 a10ac087ba650466c6a9594fe5eb19a0_NeikiAnalytics.exe 86 PID 2188 wrote to memory of 1640 2188 a10ac087ba650466c6a9594fe5eb19a0_NeikiAnalytics.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\a10ac087ba650466c6a9594fe5eb19a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a10ac087ba650466c6a9594fe5eb19a0_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\FilesF0\aoptiec.exeC:\FilesF0\aoptiec.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1640
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\FilesF0\aoptiec.exe
- Size 2.7MB
- SHA256 90745f9329ce5267a7c2732eea36a0195c02a25ec2ba3e6c8c6d55eeb7ac20e2
- MD5 63ef0c7f3aa3008c65e80f0fbe7ac230
- SHA1 dd9e6e20dac45f95bade1aaea1262aa495ad7385
- SHA512 3cef4bb7dd5e81513706ebc5477467ce4446c28ef57ecf4431745076bf9391dd7d45332e62581c3f3f1ece01717fbcd808fe103daea7cf544dc8659e24441edd
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBRC9w4Sx:+R0pI/IQlUoMPdmpSpe4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\KaVB3B\optixloc.exe
- Size 2.7MB
- SHA256 1784c3cbbb82ab02a949500eaf9b8226a9623a4043ec7a75d1a8d15121e35619
- MD5 4b09db4d9efe7f826a2bfc9cd3f4ede4
- SHA1 be6d4598ea8c5c1b26e5bb1f8e0839b59b78b095
- SHA512 b5cf204a9f756dd167a3c6108450b4e197e86c0b8797109676c84416b6a1afa1e843aa4089795c27dd9f46424e7c8bcdddaf2521bd99ac88b3fc562aa51f842b
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBR9w4Sx:+R0pI/IQlUoMPdmpSpd4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 202B
- SHA256 679e4ab6cff4d32ef32b43e940bbf7b7eb3d57a282b223dec3dd5730d74558fb
- MD5 2d52a031dd46ca65670bddf34c1c978a
- SHA1 1c5a05cb53fae3915f8ae1d8589c27b0ef7d2fd8
- SHA512 cbf818bbe1ba5f89b3adb391109fd98b44b2bf867ea347a54e82c5abe01559149c4c05c314427bcb6518b0e44ee1020a8aaf89916b19376a78e00ad30ce4d77f
- MD5 SHA1 SHA512