Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 11:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a1186d3450e9002fe46f94a1404b4060_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
a1186d3450e9002fe46f94a1404b4060_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target a1186d3450e9002fe46f94a1404b4060_NeikiAnalytics.exe
- Size 2.7MB
- Sample240603-m58gsade82
- SHA256 1d2b505764d04746f9985edc97df183d5296843370c57b4ed5f51fd1fb965ad8
- MD5 a1186d3450e9002fe46f94a1404b4060
- SHA1 c3745de7c57f31a948048e501cc1084bd8132187
- SHA512 cbc5aaa0dd3cf57de0acb4fa928ecfc4e5fe9f4b9aacaf519d51edad035a388daf9112a423c1e02bd0c1098d618fa3f550e89b0e5c34519a387a099d22208b23
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBu9w4Sx:+R0pI/IQlUoMPdmpSp84
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4600 xoptiloc.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\Intelproc62\\xoptiloc.exe" a1186d3450e9002fe46f94a1404b4060_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\Mint5L\\bodxsys.exe" a1186d3450e9002fe46f94a1404b4060_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3648 a1186d3450e9002fe46f94a1404b4060_NeikiAnalytics.exe 3648 a1186d3450e9002fe46f94a1404b4060_NeikiAnalytics.exe 3648 a1186d3450e9002fe46f94a1404b4060_NeikiAnalytics.exe 3648 a1186d3450e9002fe46f94a1404b4060_NeikiAnalytics.exe 4600 xoptiloc.exe 4600 xoptiloc.exe 3648 a1186d3450e9002fe46f94a1404b4060_NeikiAnalytics.exe 3648 a1186d3450e9002fe46f94a1404b4060_NeikiAnalytics.exe 4600 xoptiloc.exe 4600 xoptiloc.exe 3648 a1186d3450e9002fe46f94a1404b4060_NeikiAnalytics.exe 3648 a1186d3450e9002fe46f94a1404b4060_NeikiAnalytics.exe 4600 xoptiloc.exe 4600 xoptiloc.exe 3648 a1186d3450e9002fe46f94a1404b4060_NeikiAnalytics.exe 3648 a1186d3450e9002fe46f94a1404b4060_NeikiAnalytics.exe 4600 xoptiloc.exe 4600 xoptiloc.exe 3648 a1186d3450e9002fe46f94a1404b4060_NeikiAnalytics.exe 3648 a1186d3450e9002fe46f94a1404b4060_NeikiAnalytics.exe 4600 xoptiloc.exe 4600 xoptiloc.exe 3648 a1186d3450e9002fe46f94a1404b4060_NeikiAnalytics.exe 3648 a1186d3450e9002fe46f94a1404b4060_NeikiAnalytics.exe 4600 xoptiloc.exe 4600 xoptiloc.exe 3648 a1186d3450e9002fe46f94a1404b4060_NeikiAnalytics.exe 3648 a1186d3450e9002fe46f94a1404b4060_NeikiAnalytics.exe 4600 xoptiloc.exe 4600 xoptiloc.exe 3648 a1186d3450e9002fe46f94a1404b4060_NeikiAnalytics.exe 3648 a1186d3450e9002fe46f94a1404b4060_NeikiAnalytics.exe 4600 xoptiloc.exe 4600 xoptiloc.exe 3648 a1186d3450e9002fe46f94a1404b4060_NeikiAnalytics.exe 3648 a1186d3450e9002fe46f94a1404b4060_NeikiAnalytics.exe 4600 xoptiloc.exe 4600 xoptiloc.exe 3648 a1186d3450e9002fe46f94a1404b4060_NeikiAnalytics.exe 3648 a1186d3450e9002fe46f94a1404b4060_NeikiAnalytics.exe 4600 xoptiloc.exe 4600 xoptiloc.exe 3648 a1186d3450e9002fe46f94a1404b4060_NeikiAnalytics.exe 3648 a1186d3450e9002fe46f94a1404b4060_NeikiAnalytics.exe 4600 xoptiloc.exe 4600 xoptiloc.exe 3648 a1186d3450e9002fe46f94a1404b4060_NeikiAnalytics.exe 3648 a1186d3450e9002fe46f94a1404b4060_NeikiAnalytics.exe 4600 xoptiloc.exe 4600 xoptiloc.exe 3648 a1186d3450e9002fe46f94a1404b4060_NeikiAnalytics.exe 3648 a1186d3450e9002fe46f94a1404b4060_NeikiAnalytics.exe 4600 xoptiloc.exe 4600 xoptiloc.exe 3648 a1186d3450e9002fe46f94a1404b4060_NeikiAnalytics.exe 3648 a1186d3450e9002fe46f94a1404b4060_NeikiAnalytics.exe 4600 xoptiloc.exe 4600 xoptiloc.exe 3648 a1186d3450e9002fe46f94a1404b4060_NeikiAnalytics.exe 3648 a1186d3450e9002fe46f94a1404b4060_NeikiAnalytics.exe 4600 xoptiloc.exe 4600 xoptiloc.exe 3648 a1186d3450e9002fe46f94a1404b4060_NeikiAnalytics.exe 3648 a1186d3450e9002fe46f94a1404b4060_NeikiAnalytics.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3648 wrote to memory of 4600 3648 a1186d3450e9002fe46f94a1404b4060_NeikiAnalytics.exe 92 PID 3648 wrote to memory of 4600 3648 a1186d3450e9002fe46f94a1404b4060_NeikiAnalytics.exe 92 PID 3648 wrote to memory of 4600 3648 a1186d3450e9002fe46f94a1404b4060_NeikiAnalytics.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\a1186d3450e9002fe46f94a1404b4060_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a1186d3450e9002fe46f94a1404b4060_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Intelproc62\xoptiloc.exeC:\Intelproc62\xoptiloc.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4600
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Intelproc62\xoptiloc.exe
- Size 2.7MB
- SHA256 c4e622dcb8d7ab34152c7cfe064db740c47ce1c604dc46e9c62a8b7ae2fa9ba9
- MD5 50fbd9c0a6287428c3d85a8821d65234
- SHA1 3ea68016e91d15c76ef6360047e0fa4eb8737fb5
- SHA512 d4197204345ffd3a5d2ff83b8332ac04567c1c8c63632e722192bac67520f999fcbc45ef12d9ed258ac31bb12820a315c031f30177acec78c985e4c33d3d44b4
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBI9w4Sx:+R0pI/IQlUoMPdmpSpu4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Mint5L\bodxsys.exe
- Size 1.4MB
- SHA256 841f9a10f483003ba4c8a3399873254ea6e90392cbaef986d1b520b414913de5
- MD5 b6da0da1217bc76416edfa8e002b6145
- SHA1 d8e6869a93b91d6aa59b5d2499fb943af48af80c
- SHA512 d60802bf9f5c289d03c8a42418f8cdb0cc14b67dd4151b8dc9533fe2f78e436b3667b02324ab12ef7b6dca90038d5445ee402c0de459a5aae1b7ac5a7ac326c9
- SSDEEP 24576:+RjQgSjgCf8xC78xmlVaXPATazr4eoDlqWtGNB6pel6Mf7nGry0QzMiITXyWFFno:+R0p8xHycIq+GI27nGroMPTJPerb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Mint5L\bodxsys.exe
- Size 2.7MB
- SHA256 07124e2feb366024cea9be58d1374ec83b1f64634571d7b73b66d30f55de8874
- MD5 cd7fd87011bf968f105e70e8db35da7f
- SHA1 7d2541d1f722a768211f5156417a2849eceae80e
- SHA512 3c9b82829bbf52280a9655563ad531ad9a8a5e181c118395618a23a4829d5e371d03e37798291ae1515b29ac946e1ff3851dfb70cb472bc8f1f42158ea2eb7ce
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBh9w4Sx:+R0pI/IQlUoMPdmpSph4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 206B
- SHA256 9f6eb03be62f1d8605c06665681fd0435d3f600db34a4248547d2c87a191f39a
- MD5 6262ba31a5b938127b4afaef430be55b
- SHA1 d3c84e7f3898dfdb6e1f4c246bbc77b61f0308e5
- SHA512 8c6b2bc33c15111e193d0c4bbf69fe5bc7105c3838c6261357610e0dca1a95b9b4d800976960e0e6988186cbc3b58f67f6c09f5ae2bf173efe77f236f10fb7ae
- MD5 SHA1 SHA512