Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 11:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a23facb6e0fe3838a988b4319f709120_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
a23facb6e0fe3838a988b4319f709120_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target a23facb6e0fe3838a988b4319f709120_NeikiAnalytics.exe
- Size 3.9MB
- Sample240603-nv3dfsdc6w
- SHA256 ed0ba55806066c38b3b099e614015f287209ec8353c785085d993c86eb3e7ff7
- MD5 a23facb6e0fe3838a988b4319f709120
- SHA1 0990a9b34fe1ac64e0bb502a388800af6678789b
- SHA512 b9d7b1c75553c9680ffdf2e73aba1deb1bc0ddfc4d1a4794c3ff46e5cc694adc51bbe007cd8bc7045f3bb3b0ed0db0f364b46f7ee658f9204924678ecb3f9c71
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBoB/bSqz8:sxX7QnxrloE5dpUp/bVz8
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysxopti.exe a23facb6e0fe3838a988b4319f709120_NeikiAnalytics.exe - Executes dropped EXE 2 IoCs
pid Process 1172 sysxopti.exe 2340 devdobloc.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\FilesQF\\devdobloc.exe" a23facb6e0fe3838a988b4319f709120_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\VidN2\\bodxloc.exe" a23facb6e0fe3838a988b4319f709120_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2180 a23facb6e0fe3838a988b4319f709120_NeikiAnalytics.exe 2180 a23facb6e0fe3838a988b4319f709120_NeikiAnalytics.exe 2180 a23facb6e0fe3838a988b4319f709120_NeikiAnalytics.exe 2180 a23facb6e0fe3838a988b4319f709120_NeikiAnalytics.exe 1172 sysxopti.exe 1172 sysxopti.exe 2340 devdobloc.exe 2340 devdobloc.exe 1172 sysxopti.exe 1172 sysxopti.exe 2340 devdobloc.exe 2340 devdobloc.exe 1172 sysxopti.exe 1172 sysxopti.exe 2340 devdobloc.exe 2340 devdobloc.exe 1172 sysxopti.exe 1172 sysxopti.exe 2340 devdobloc.exe 2340 devdobloc.exe 1172 sysxopti.exe 1172 sysxopti.exe 2340 devdobloc.exe 2340 devdobloc.exe 1172 sysxopti.exe 1172 sysxopti.exe 2340 devdobloc.exe 2340 devdobloc.exe 1172 sysxopti.exe 1172 sysxopti.exe 2340 devdobloc.exe 2340 devdobloc.exe 1172 sysxopti.exe 1172 sysxopti.exe 2340 devdobloc.exe 2340 devdobloc.exe 1172 sysxopti.exe 1172 sysxopti.exe 2340 devdobloc.exe 2340 devdobloc.exe 1172 sysxopti.exe 1172 sysxopti.exe 2340 devdobloc.exe 2340 devdobloc.exe 1172 sysxopti.exe 1172 sysxopti.exe 2340 devdobloc.exe 2340 devdobloc.exe 1172 sysxopti.exe 1172 sysxopti.exe 2340 devdobloc.exe 2340 devdobloc.exe 1172 sysxopti.exe 1172 sysxopti.exe 2340 devdobloc.exe 2340 devdobloc.exe 1172 sysxopti.exe 1172 sysxopti.exe 2340 devdobloc.exe 2340 devdobloc.exe 1172 sysxopti.exe 1172 sysxopti.exe 2340 devdobloc.exe 2340 devdobloc.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2180 wrote to memory of 1172 2180 a23facb6e0fe3838a988b4319f709120_NeikiAnalytics.exe 87 PID 2180 wrote to memory of 1172 2180 a23facb6e0fe3838a988b4319f709120_NeikiAnalytics.exe 87 PID 2180 wrote to memory of 1172 2180 a23facb6e0fe3838a988b4319f709120_NeikiAnalytics.exe 87 PID 2180 wrote to memory of 2340 2180 a23facb6e0fe3838a988b4319f709120_NeikiAnalytics.exe 90 PID 2180 wrote to memory of 2340 2180 a23facb6e0fe3838a988b4319f709120_NeikiAnalytics.exe 90 PID 2180 wrote to memory of 2340 2180 a23facb6e0fe3838a988b4319f709120_NeikiAnalytics.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\a23facb6e0fe3838a988b4319f709120_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a23facb6e0fe3838a988b4319f709120_NeikiAnalytics.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysxopti.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysxopti.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1172
-
-
C:\FilesQF\devdobloc.exeC:\FilesQF\devdobloc.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2340
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\FilesQF\devdobloc.exe
- Size 3.9MB
- SHA256 c7e4acdb3f268fa949311f2fd7c2b641006ba4e93e774c50056478ad29275e8e
- MD5 a02ec09ef801a97c8fba97b600bee1de
- SHA1 7bb9a6bd2b394abe6b13f41c631a0d91e947f95c
- SHA512 f166ce9a2bd485223823909cabc1a367885342d9f3b262b56cdc8880e6b4820e69a9483f7f0ae57fc83560acec56c6cfd0b0744991ef8a6eaa8d71961f5f2779
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBjB/bSqz8:sxX7QnxrloE5dpUpYbVz8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 202B
- SHA256 76c28f040d4bfc0f61f605d9713c1be4a8c1b794d3e74324c8825b310f29b12b
- MD5 ee43af2ed1e650ade25082d54304481e
- SHA1 0bdaec59726357875570c29e3a352756d9418f1c
- SHA512 a20f835df8fa16d13d8514b4e9f002017bd3a7c735f69751bf9a2c3ff0123398350f38b4437271f6b32631d84ab41123df4dd4f8811024d960b0b70df4d4456a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 170B
- SHA256 93e07aa3e827faea5277068e5284b69585787b96a50819ba17dde18c4d300d29
- MD5 986d514b27c14219013fdb4ee917b97e
- SHA1 b2c5de21f4c49a710a9834df60e0ebae75416ee7
- SHA512 dd0802423eee32693433abbf86d6be629c0491fb8b10807e6ef65e0816286400c4df0abb46895cff6c0df537d12fd19b6eb53ab86a0b3ba4334e4e362972f420
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysxopti.exe
- Size 3.9MB
- SHA256 7b23019e0b74dea43ce615789f04e2783edd0018e7efd795b3f06efa40d2e77e
- MD5 529d1920b872a1f604ab58b9c507d27e
- SHA1 e4f9cee05f8cf930ed26c4e982f6567d6de50534
- SHA512 31ab0e6c1bf469677df0660627d3a354ede1ac24c475763df361d084881697eca9ee91abfc49e8faa1b93ff1bd58bc5a3699d6f257c2008c21ed41e8a5716690
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBXB/bSqz8:sxX7QnxrloE5dpUpUbVz8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\VidN2\bodxloc.exe
- Size 930KB
- SHA256 7617e253090dfb1ab5444519409839dc12b684a3d76eeefe70c58e29257eb8b4
- MD5 e859ce3d8a532c55c33af574574674a0
- SHA1 22370058974ed3cd9db6af6fe4f2ba6e5ba52d71
- SHA512 b7687339e91818947a37782331d7cea65953808805c94cd8ad5e88440f4368e93c9f1b33dc1153698141f8f4a23d5f2564f6080ffe69fa75695c331a3f2ebb17
- SSDEEP 24576:6nxDZV7xMyu6qJ2WSYxBdSqpcVdm5XRVpQO3chiIcr1RhSKnta:sxX7665YxRVplZzSKnt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\VidN2\bodxloc.exe
- Size 94KB
- SHA256 3ba0b0a635dae31e8b1f0f805555ebcf1881055bbe80ff6fa76b1029e3c9cee7
- MD5 7b545eae8d65009e7452c5b19a78c0a5
- SHA1 6a982f1c987d0c6cb3719a48a75437324dafebc4
- SHA512 8d5f6811f25f8b15e5bfad2afd24e9bc969571426cfb0aaa2ae6eda4b06a4fd0faa4755010b9b1a956761c73cb759f8f006ddf64981d97cd2905e15c3c44b00c
- SSDEEP 1536:ABalOBo1TKFO3n0KkZHqX7+g2lWXQmMc0pgUXwiyx66tv/Ejd:6uOByTKI3n0dZHm7+zsMcSgUXwr6a/EB
- MD5 SHA1 SHA512 SSDEEP