Analysis
- max time kernel
150s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 13:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a5a13f5aac3add55c000b9dde15e0ab0_NeikiAnalytics.exe
Resource
win7-20240215-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
a5a13f5aac3add55c000b9dde15e0ab0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target a5a13f5aac3add55c000b9dde15e0ab0_NeikiAnalytics.exe
- Size 3.0MB
- Sample240603-q9ebaagg3v
- SHA256 88ae07d85d60d51af851f90a878c16491573549eff57380b89805a27573a8a0a
- MD5 a5a13f5aac3add55c000b9dde15e0ab0
- SHA1 967ffc2f344e23d803cb5c9debc8398edd97132e
- SHA512 a5e95105068cd98c8ecb021b153fc540405678744229f8a02adf4338e033baf1b6ce81ca94dce8c795ebf5915b13c4e123e05108a036ec9325d1135633bb8287
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBBB/bSqz8:sxX7QnxrloE5dpUpObVz8
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecdevbod.exe a5a13f5aac3add55c000b9dde15e0ab0_NeikiAnalytics.exe - Executes dropped EXE 2 IoCs
pid Process 3656 ecdevbod.exe 3952 aoptiec.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\SysDrvDT\\aoptiec.exe" a5a13f5aac3add55c000b9dde15e0ab0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\VidOB\\boddevsys.exe" a5a13f5aac3add55c000b9dde15e0ab0_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4584 a5a13f5aac3add55c000b9dde15e0ab0_NeikiAnalytics.exe 4584 a5a13f5aac3add55c000b9dde15e0ab0_NeikiAnalytics.exe 4584 a5a13f5aac3add55c000b9dde15e0ab0_NeikiAnalytics.exe 4584 a5a13f5aac3add55c000b9dde15e0ab0_NeikiAnalytics.exe 3656 ecdevbod.exe 3656 ecdevbod.exe 3952 aoptiec.exe 3952 aoptiec.exe 3656 ecdevbod.exe 3656 ecdevbod.exe 3952 aoptiec.exe 3952 aoptiec.exe 3656 ecdevbod.exe 3656 ecdevbod.exe 3952 aoptiec.exe 3952 aoptiec.exe 3656 ecdevbod.exe 3656 ecdevbod.exe 3952 aoptiec.exe 3952 aoptiec.exe 3656 ecdevbod.exe 3656 ecdevbod.exe 3952 aoptiec.exe 3952 aoptiec.exe 3656 ecdevbod.exe 3656 ecdevbod.exe 3952 aoptiec.exe 3952 aoptiec.exe 3656 ecdevbod.exe 3656 ecdevbod.exe 3952 aoptiec.exe 3952 aoptiec.exe 3656 ecdevbod.exe 3656 ecdevbod.exe 3952 aoptiec.exe 3952 aoptiec.exe 3656 ecdevbod.exe 3656 ecdevbod.exe 3952 aoptiec.exe 3952 aoptiec.exe 3656 ecdevbod.exe 3656 ecdevbod.exe 3952 aoptiec.exe 3952 aoptiec.exe 3656 ecdevbod.exe 3656 ecdevbod.exe 3952 aoptiec.exe 3952 aoptiec.exe 3656 ecdevbod.exe 3656 ecdevbod.exe 3952 aoptiec.exe 3952 aoptiec.exe 3656 ecdevbod.exe 3656 ecdevbod.exe 3952 aoptiec.exe 3952 aoptiec.exe 3656 ecdevbod.exe 3656 ecdevbod.exe 3952 aoptiec.exe 3952 aoptiec.exe 3656 ecdevbod.exe 3656 ecdevbod.exe 3952 aoptiec.exe 3952 aoptiec.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4584 wrote to memory of 3656 4584 a5a13f5aac3add55c000b9dde15e0ab0_NeikiAnalytics.exe 87 PID 4584 wrote to memory of 3656 4584 a5a13f5aac3add55c000b9dde15e0ab0_NeikiAnalytics.exe 87 PID 4584 wrote to memory of 3656 4584 a5a13f5aac3add55c000b9dde15e0ab0_NeikiAnalytics.exe 87 PID 4584 wrote to memory of 3952 4584 a5a13f5aac3add55c000b9dde15e0ab0_NeikiAnalytics.exe 88 PID 4584 wrote to memory of 3952 4584 a5a13f5aac3add55c000b9dde15e0ab0_NeikiAnalytics.exe 88 PID 4584 wrote to memory of 3952 4584 a5a13f5aac3add55c000b9dde15e0ab0_NeikiAnalytics.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\a5a13f5aac3add55c000b9dde15e0ab0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a5a13f5aac3add55c000b9dde15e0ab0_NeikiAnalytics.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecdevbod.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecdevbod.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3656
-
-
C:\SysDrvDT\aoptiec.exeC:\SysDrvDT\aoptiec.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3952
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\SysDrvDT\aoptiec.exe
- Size 1.8MB
- SHA256 6c529c71c52230f330980b09820b9406fb4682497691c46010235fb6c5acba43
- MD5 71cb086cc3c2f43b8e11c1f9a20c428a
- SHA1 ade82760fc58991d0cdfe6f49b7d8cadc2b119c5
- SHA512 e504d0e840dec35b3a1563145ca0ed2b29573d828084a891ee463fffa2c1fb98480b5598be71d24a9102ad22fee9185a4fd984e9165d9e326510aa6fd07dbb9d
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjKi:sxX7QnxrloE5dpUpF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\SysDrvDT\aoptiec.exe
- Size 3.0MB
- SHA256 dfe1adfab3bf263487356ad95e9076ab3c66e4ad8623df714477cabf36c54ad2
- MD5 24e3cfa8c84b306c3d55074716f3f84a
- SHA1 d50b8e71951d16b5ec50636cc94dacfa6b2fc8ba
- SHA512 1d0297c8a772d91ec84b834bf4ff42956a2e7431d24a3830dfa76dac2ce61e7854be971b3f897c96550fd6aeef7cd64e7744b4df3a6c42dbfc4f3d85d65aee7f
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBIB/bSqz8:sxX7QnxrloE5dpUpnbVz8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 203B
- SHA256 8715b42ea2e1cea01bf9bf1201c170449732148fb28315291e756fcc948dccde
- MD5 eb9212312c898416cbc4ae4ce8a6fe06
- SHA1 b9c1f8dd664bcb07bff091ab783bef5a377ef2b0
- SHA512 4e265707e200ab09d7f95ced460eb40e8c7e9e0d0d79533b1972e2e69e46211124cf405aa46d1c00a0d62ab33beb7ec4835bf92970fe37fc5594bc357c3d8a80
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 171B
- SHA256 abc48463f50c78228955935addc6b9b3331dc66073988e3fb30c61b3bde869d9
- MD5 c499a9377a4290bba1ffe15797f0c81a
- SHA1 b14876950f52aad52f786cbe413a34b112e053c8
- SHA512 f34441dfe6813da5b48e5bfc3530c0c63b1a95498b5c0db216ac24c46baab980349239ef952b54ec8d9406b399361d5e3a2d865817ec9f802288ec74f056a0e6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecdevbod.exe
- Size 3.0MB
- SHA256 e06185516716703eeb1389eb8a4c25b473c86b48ffc342ef55de1e2a24664f8c
- MD5 24911de073a69584e3e47653a848529c
- SHA1 494d2998adbb2abd319a6a651f3d5789544545c5
- SHA512 b5ac7417c0cd9e935dbfa836aa5c5c613a27cc2846fbba621e0b9bdc01754221a9ee711a1b955f6c5d7d1b08077e2188d55ae5bb3fc05c34f0fd2f77fe86eec7
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBNB/bSqz8:sxX7QnxrloE5dpUpubVz8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\VidOB\boddevsys.exe
- Size 3.0MB
- SHA256 92c923580294e9f5812ddcd520ed8cd4fd5ff116631fbeee114e0e90faae74dd
- MD5 939baaf19926d6360bed0b3d7623b930
- SHA1 c507de793ad4a7c08bc2ad4d4e30f9c314d667f5
- SHA512 2c09358449a01b780126d1d02d937a0e1cad905bdd87cde0078c550b7dcd79c2b3c04f01a8afc75ac0807d83b4874a8f1c8d675ca006084d5ecc4e3f347e37b5
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBHB/bSqz8:sxX7QnxrloE5dpUp0bVz8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\VidOB\boddevsys.exe
- Size 2.4MB
- SHA256 445fdfd277274e4b4371e137f0f1d933ebcfbbcaccd7189ce322b240d82af7da
- MD5 62e745e29a73057aa2a34b1f19eec96f
- SHA1 c9ad4f290f9f7ea83f698ba5d905a4eb90196dfb
- SHA512 62a6e8d0836f4b36054e9092592f7805b4e2f00aff7f26c01fcc6e4a916608afc84662e0174db69fdc40c2a23e6e6cc434c4eaf86171e1f016bfe4e114cfd7c5
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBcBz:sxX7QnxrloE5dpUpn
- MD5 SHA1 SHA512 SSDEEP