Analysis
- max time kernel
149s - max time network
126s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 10:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a03991f5d90825bb10677db574fc6840_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
a03991f5d90825bb10677db574fc6840_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target a03991f5d90825bb10677db574fc6840_NeikiAnalytics.exe
- Size 3.2MB
- Sample240603-mltvaabd8t
- SHA256 5605f1eba9c117f2786470960be7ee89de6f02c51bfafb8bac496e13feee1f56
- MD5 a03991f5d90825bb10677db574fc6840
- SHA1 8a8234951ae4f72f90865223ccfd7d2d13b814ed
- SHA512 b02126cf12b11173c8942af7cf6c641aa5623f2107a423c2fee1e405aab49861bad5bb75123a2440c3cee7edba8d70851a60d8f7b5db4766b3455d2f632dc971
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBOB/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUp1bVz8eLFcz
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecaopti.exe a03991f5d90825bb10677db574fc6840_NeikiAnalytics.exe - Executes dropped EXE 2 IoCs
pid Process 3128 ecaopti.exe 4656 devoptiec.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\LabZ35\\bodxsys.exe" a03991f5d90825bb10677db574fc6840_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\SysDrvXL\\devoptiec.exe" a03991f5d90825bb10677db574fc6840_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4576 a03991f5d90825bb10677db574fc6840_NeikiAnalytics.exe 4576 a03991f5d90825bb10677db574fc6840_NeikiAnalytics.exe 4576 a03991f5d90825bb10677db574fc6840_NeikiAnalytics.exe 4576 a03991f5d90825bb10677db574fc6840_NeikiAnalytics.exe 3128 ecaopti.exe 3128 ecaopti.exe 4656 devoptiec.exe 4656 devoptiec.exe 3128 ecaopti.exe 3128 ecaopti.exe 4656 devoptiec.exe 4656 devoptiec.exe 3128 ecaopti.exe 3128 ecaopti.exe 4656 devoptiec.exe 4656 devoptiec.exe 3128 ecaopti.exe 3128 ecaopti.exe 4656 devoptiec.exe 4656 devoptiec.exe 3128 ecaopti.exe 3128 ecaopti.exe 4656 devoptiec.exe 4656 devoptiec.exe 3128 ecaopti.exe 3128 ecaopti.exe 4656 devoptiec.exe 4656 devoptiec.exe 3128 ecaopti.exe 3128 ecaopti.exe 4656 devoptiec.exe 4656 devoptiec.exe 3128 ecaopti.exe 3128 ecaopti.exe 4656 devoptiec.exe 4656 devoptiec.exe 3128 ecaopti.exe 3128 ecaopti.exe 4656 devoptiec.exe 4656 devoptiec.exe 3128 ecaopti.exe 3128 ecaopti.exe 4656 devoptiec.exe 4656 devoptiec.exe 3128 ecaopti.exe 3128 ecaopti.exe 4656 devoptiec.exe 4656 devoptiec.exe 3128 ecaopti.exe 3128 ecaopti.exe 4656 devoptiec.exe 4656 devoptiec.exe 3128 ecaopti.exe 3128 ecaopti.exe 4656 devoptiec.exe 4656 devoptiec.exe 3128 ecaopti.exe 3128 ecaopti.exe 4656 devoptiec.exe 4656 devoptiec.exe 3128 ecaopti.exe 3128 ecaopti.exe 4656 devoptiec.exe 4656 devoptiec.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4576 wrote to memory of 3128 4576 a03991f5d90825bb10677db574fc6840_NeikiAnalytics.exe 95 PID 4576 wrote to memory of 3128 4576 a03991f5d90825bb10677db574fc6840_NeikiAnalytics.exe 95 PID 4576 wrote to memory of 3128 4576 a03991f5d90825bb10677db574fc6840_NeikiAnalytics.exe 95 PID 4576 wrote to memory of 4656 4576 a03991f5d90825bb10677db574fc6840_NeikiAnalytics.exe 97 PID 4576 wrote to memory of 4656 4576 a03991f5d90825bb10677db574fc6840_NeikiAnalytics.exe 97 PID 4576 wrote to memory of 4656 4576 a03991f5d90825bb10677db574fc6840_NeikiAnalytics.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\a03991f5d90825bb10677db574fc6840_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a03991f5d90825bb10677db574fc6840_NeikiAnalytics.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecaopti.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecaopti.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3128
-
-
C:\SysDrvXL\devoptiec.exeC:\SysDrvXL\devoptiec.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4656
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3148,i,1697479186275492802,18058102846092193784,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:81⤵PID:2320
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\LabZ35\bodxsys.exe
- Size 3.2MB
- SHA256 d92d21ea6131a4b3ddad60d341d1401122b19e1a238407afdd45dd29804e3eaa
- MD5 919736c0d47049696db7c7e31b6f1759
- SHA1 9555ccf5517dd218dbfc593f46c660a2562b3053
- SHA512 46bd6709e3e1fe009b62554daa28cc5c23856b30a31caf29ab1303066ff2313e858750a07d3167071e1184918f3bfa03ef6e0d3089c8820573b1ab9fbd04c0ed
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBXB/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUpcbVz8eLFcz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\LabZ35\bodxsys.exe
- Size 25KB
- SHA256 69cb4117ddfca25bce5b0a6d385228b75974a2bc05ed3dfc8c3302b019f99453
- MD5 f2e229245e4c656c5fd3b227b0bfc75c
- SHA1 f6805256a0f1bc53d43ba845f91405bc25f841f7
- SHA512 e86ac1cfd40b9aeb7971305e7777138aa70671e9fd8c058133f4f94709efa9d2a14827feae7bee15228b6b27551eb720f659d1be01a518b402fa16fd3162aaa6
- SSDEEP 384:04ezXTIk/IxT/ES70S7TqOODVtLiD1APE/7TJRKahcO8oRZV:xezkk/DUj7TlODVED17nKFO3J
- MD5 SHA1 SHA512 SSDEEP
- Path C:\SysDrvXL\devoptiec.exe
- Size 305KB
- SHA256 c73cb17336a5c904d22a5a7d4eb2f29717d7b6bf9adb8552f625115b33ef0bdd
- MD5 6008937fdeb369a3793022d43d26220e
- SHA1 df1dc0bc8ca8e987b5708631f473f6c1d149c0dc
- SHA512 fe981c4f45ab36fe9479f2e1ee44fd58a2ef721ac1161bf57db96c13835bb0ee1ed01023be86e3dd7af07ca3245a0e144c0f4affa638d8871112b6b7e74ccec5
- SSDEEP 6144:6nyJ3n0Dm7+zm6wr6YEjAumIann6qJ/mB9D+nnS5ax2SNm9WdF7UqpI:6ne3n0DmAm67YEjAyu6qJ/+WS5axBdSf
- MD5 SHA1 SHA512 SSDEEP
- Path C:\SysDrvXL\devoptiec.exe
- Size 3.2MB
- SHA256 f0bbf115e38b448060f1568590313516e9deb23bc6e93e56c1eb90af06661a89
- MD5 37c7e1cdad92aac714430dfdd54a0f03
- SHA1 8bd68d26fa9783240e0fae5a9dd80d6ed141b600
- SHA512 c20f127160f74660e988c3bdd6d9e810f347b00bd02d6cb7c9ad91a6611062d5b82f7536151065cb7b530953eeeca598e885c3b2b6946f2f4fa4d8a12927cd52
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBLB/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUpkbVz8eLFcz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 203B
- SHA256 e3aa3cad2501f2f915b5ae6a117244a0fcf5419b2adbdf7da9c4efd0c0d4cc1d
- MD5 e4b0707c760c3404e215066fad1b60b1
- SHA1 1b44983a02207bad6d6e2ec046f739415a945f16
- SHA512 ebced5d762a0a6aa52fb1879de851ec93b82c70abb91f5571adf2bac877bc5e8d885c8e6714b5dbb2562a07d07b92752063796179bd136f7cca2f5fc3a25202d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 171B
- SHA256 18d6001e0589df77b4ab879b4118bdad90a01842cddf05f9470712466ed591a8
- MD5 6d52dc1acb0bf903a1d77cf87c4d7e9d
- SHA1 5a9ae5a6881f683945b133b420979dd160448119
- SHA512 39b54f703773e23d8a4243b312f6907dee8680ecaa66b27f82becccf5977b6600173434dae3d91de6a8abc4f857527951f52f6478b6ea31294627602c51e95ca
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecaopti.exe
- Size 3.2MB
- SHA256 76e2e9d1ec97916bb561c6b26971e787ec6f553aec1ffbd2d285be00562f81ce
- MD5 f1803f316c4e6333895bf05f8bb926e9
- SHA1 de330fe7c8e8e1a9ac71b3ff460916ce4801d296
- SHA512 b91ff5edaaf5dbc560c6b333e709ff905437bf2e65005041ab6bc735eeb3254283c31fa562aad9ed757e801b85a00bf0d70966189bcb4f4bb7263dbace072869
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBPB/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUpEbVz8eLFcz
- MD5 SHA1 SHA512 SSDEEP