Analysis
- max time kernel
150s - max time network
107s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 12:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a38750969e769ebfbd1071d4c97a5cb0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
a38750969e769ebfbd1071d4c97a5cb0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target a38750969e769ebfbd1071d4c97a5cb0_NeikiAnalytics.exe
- Size 3.1MB
- Sample240603-ppe7eaed8y
- SHA256 577e12075638a9894cc9babf68f47545001e3cdd905f40184eeabf97125da253
- MD5 a38750969e769ebfbd1071d4c97a5cb0
- SHA1 9e36b0fa2cf26cf45358d335e1869ad3d1751d14
- SHA512 2a3814892397d204a7e8c599dd24251b44c6ce582e8b65df6a5e7278550cc62f1d91ab16916b9be17e17dbc3ce0051f3f463de3f3c8c292c7c2e399806b14ec3
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB/B/bSqz8:sxX7QnxrloE5dpUpsbVz8
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecabod.exe a38750969e769ebfbd1071d4c97a5cb0_NeikiAnalytics.exe - Executes dropped EXE 2 IoCs
pid Process 2276 ecabod.exe 1404 devoptisys.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\UserDot1V\\devoptisys.exe" a38750969e769ebfbd1071d4c97a5cb0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\LabZET\\dobaloc.exe" a38750969e769ebfbd1071d4c97a5cb0_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2008 a38750969e769ebfbd1071d4c97a5cb0_NeikiAnalytics.exe 2008 a38750969e769ebfbd1071d4c97a5cb0_NeikiAnalytics.exe 2008 a38750969e769ebfbd1071d4c97a5cb0_NeikiAnalytics.exe 2008 a38750969e769ebfbd1071d4c97a5cb0_NeikiAnalytics.exe 2276 ecabod.exe 2276 ecabod.exe 1404 devoptisys.exe 1404 devoptisys.exe 2276 ecabod.exe 2276 ecabod.exe 1404 devoptisys.exe 1404 devoptisys.exe 2276 ecabod.exe 2276 ecabod.exe 1404 devoptisys.exe 1404 devoptisys.exe 2276 ecabod.exe 2276 ecabod.exe 1404 devoptisys.exe 1404 devoptisys.exe 2276 ecabod.exe 2276 ecabod.exe 1404 devoptisys.exe 1404 devoptisys.exe 2276 ecabod.exe 2276 ecabod.exe 1404 devoptisys.exe 1404 devoptisys.exe 2276 ecabod.exe 2276 ecabod.exe 1404 devoptisys.exe 1404 devoptisys.exe 2276 ecabod.exe 2276 ecabod.exe 1404 devoptisys.exe 1404 devoptisys.exe 2276 ecabod.exe 2276 ecabod.exe 1404 devoptisys.exe 1404 devoptisys.exe 2276 ecabod.exe 2276 ecabod.exe 1404 devoptisys.exe 1404 devoptisys.exe 2276 ecabod.exe 2276 ecabod.exe 1404 devoptisys.exe 1404 devoptisys.exe 2276 ecabod.exe 2276 ecabod.exe 1404 devoptisys.exe 1404 devoptisys.exe 2276 ecabod.exe 2276 ecabod.exe 1404 devoptisys.exe 1404 devoptisys.exe 2276 ecabod.exe 2276 ecabod.exe 1404 devoptisys.exe 1404 devoptisys.exe 2276 ecabod.exe 2276 ecabod.exe 1404 devoptisys.exe 1404 devoptisys.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2008 wrote to memory of 2276 2008 a38750969e769ebfbd1071d4c97a5cb0_NeikiAnalytics.exe 92 PID 2008 wrote to memory of 2276 2008 a38750969e769ebfbd1071d4c97a5cb0_NeikiAnalytics.exe 92 PID 2008 wrote to memory of 2276 2008 a38750969e769ebfbd1071d4c97a5cb0_NeikiAnalytics.exe 92 PID 2008 wrote to memory of 1404 2008 a38750969e769ebfbd1071d4c97a5cb0_NeikiAnalytics.exe 95 PID 2008 wrote to memory of 1404 2008 a38750969e769ebfbd1071d4c97a5cb0_NeikiAnalytics.exe 95 PID 2008 wrote to memory of 1404 2008 a38750969e769ebfbd1071d4c97a5cb0_NeikiAnalytics.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\a38750969e769ebfbd1071d4c97a5cb0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a38750969e769ebfbd1071d4c97a5cb0_NeikiAnalytics.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecabod.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecabod.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2276
-
-
C:\UserDot1V\devoptisys.exeC:\UserDot1V\devoptisys.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1404
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\LabZET\dobaloc.exe
- Size 3.1MB
- SHA256 70802f3ad009c934fda073352d0489b06c38529a766301d45b8eda10d315bc99
- MD5 fac754d2516417290603819fd2d27cf8
- SHA1 4b0bd048f0feee9742a766fe2e668437e2c1ac36
- SHA512 b083e8bb030c8a7842b77e4da2b17b5f45731f294d93a23e7a984d170b11cf3c509864eedb526406238bdacded60413d4ee6667181e18e6564ef8b1cf0091845
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBMB/bSqz8:sxX7QnxrloE5dpUpnbVz8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\LabZET\dobaloc.exe
- Size 1018KB
- SHA256 42bd2999f989d6accf7e4bcdb2952cc26f3b08dde9b0ed6bff54f35bca991c74
- MD5 79d4dd13cae8581a9d5cf65296fbb100
- SHA1 7544c0560d4953d55fba1993ed19885d04f4d1e3
- SHA512 4cdcedd274953e2f093fa942d9148454f8ffc33fdd933b1bbbf983f5ba2664f9f511186c12d72c83bb5134966652bcf791f81fbb54a8e0357fbaf606e1a7a566
- SSDEEP 24576:6nxDZV7xMyu6qJ2WSYxBdSqpcVdm5XRVpQO3chiIcr1RhSKntaxtok:sxX7665YxRVplZzSKntlk
- MD5 SHA1 SHA512 SSDEEP
- Path C:\UserDot1V\devoptisys.exe
- Size 2.7MB
- SHA256 9aeab6b29c97448cf7f5dd85ff9ebb2ae0fe796e4afd86c25571f0752dffa96a
- MD5 504fa4c88e66c448ebc3e1b5a5623ac7
- SHA1 551f898a0fa71f3ab3db8aadede0ef94756ca8f5
- SHA512 19942ddd8f1a085ffa225f4508763ae83bfef6131bbe9498f4d38c2923e06fff2ba752efd58af25a3fd0c33830c04c3ec5d25e5edabd8f0d89f127189ccdad1b
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBKB/bSqU:sxX7QnxrloE5dpUplbVU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\UserDot1V\devoptisys.exe
- Size 3.1MB
- SHA256 26feede209b01f4ef290eb4b2ae7cc09be0503dd22bceb5c5c9d824c42363eab
- MD5 af6ee7e62ca4c6c19be52b9abb6d86dc
- SHA1 487f6a43d3b159bc3731a44e4afa3b7b8c1ee553
- SHA512 a3a4d031bb14a6b6ac7f5f8fd061f2c310fb3e84a17c181e1874fbb205bc381631f6efbd9f1465fe61b0fd7ca6af34d7dff7c55947b094cd7c80f9b0733e403a
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBKB/bSqz8:sxX7QnxrloE5dpUplbVz8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 204B
- SHA256 92ab3c42e9779a865d80b79a09e5c4e9404b2fe12eb24be11f251bc3a8957c0a
- MD5 fcf876cc9668e7d4384f8670f35292f0
- SHA1 6e4bb69bb3b8f37723169dcfd57a99dab444acdf
- SHA512 c7dd4c0603880e2e7e32454bcb393ea7ed219d0677f923b26bcf1708cb171661d54110282ffaec35e060db70d3a5c35a215ddc457f280070b21bfa2d78abe9de
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 172B
- SHA256 ba9c0cf3e22a91a3240cd48bdb5e44e1df4173e04e78120f1ecaeba65917481c
- MD5 9f68d640b9cbaff448f54b4101c49693
- SHA1 050f3a392fe7f4a323966b6c0e59a7ea48bfbe68
- SHA512 c5ae440d796330cc58febc37eb1e4a1d60d11c26b1825520db3e14b9b20477006f2e556981e9ea929cf18cb16e1790092cd5534ea9a3824f3a6e62b43ba405de
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecabod.exe
- Size 3.1MB
- SHA256 8026e1a32d66c71eb58ccbed61f10af41f689bedd81d38932d29b27f9a417794
- MD5 7c940dc374fb65bcb0ebe9803c922bb3
- SHA1 3da1af6ddb5746e5c496fe9d867c7781afe6c73a
- SHA512 fe0624d9f8dd04c9fd1add3c6126f5bb0640b1ba3fb4da9d6bf3b76dc98f402e0c3677777eb396f73fa97257da9f7c2005516c52ddef8b9d3474e84565869669
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB1B/bSqz8:sxX7QnxrloE5dpUpybVz8
- MD5 SHA1 SHA512 SSDEEP