Analysis
- max time kernel
151s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 15:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
405a9f6e8d764521c5576360161b6b00_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
405a9f6e8d764521c5576360161b6b00_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 405a9f6e8d764521c5576360161b6b00_NeikiAnalytics.exe
- Size 2.7MB
- Sample240603-s3sanscc92
- SHA256 372241d8096e58499ccb5fa0989d5673df9f1440b27ef603a5a1541766c176da
- MD5 405a9f6e8d764521c5576360161b6b00
- SHA1 e547ee0ef04192845d7a16eda7b3af7fcc210bd6
- SHA512 1c8f43b578a7b657a0eab10373fdcbef99585469c1a1adc47c301be43a36cabff0f477472a661e0f049c88018df7e2a8a99bc07d78c2ce73d8371e431b800b07
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LB99w4Sx:+R0pI/IQlUoMPdmpSp14
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4348 aoptiloc.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\Galax1E\\dobxloc.exe" 405a9f6e8d764521c5576360161b6b00_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\IntelprocIQ\\aoptiloc.exe" 405a9f6e8d764521c5576360161b6b00_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2212 405a9f6e8d764521c5576360161b6b00_NeikiAnalytics.exe 2212 405a9f6e8d764521c5576360161b6b00_NeikiAnalytics.exe 2212 405a9f6e8d764521c5576360161b6b00_NeikiAnalytics.exe 2212 405a9f6e8d764521c5576360161b6b00_NeikiAnalytics.exe 4348 aoptiloc.exe 4348 aoptiloc.exe 2212 405a9f6e8d764521c5576360161b6b00_NeikiAnalytics.exe 2212 405a9f6e8d764521c5576360161b6b00_NeikiAnalytics.exe 4348 aoptiloc.exe 4348 aoptiloc.exe 2212 405a9f6e8d764521c5576360161b6b00_NeikiAnalytics.exe 2212 405a9f6e8d764521c5576360161b6b00_NeikiAnalytics.exe 4348 aoptiloc.exe 4348 aoptiloc.exe 2212 405a9f6e8d764521c5576360161b6b00_NeikiAnalytics.exe 2212 405a9f6e8d764521c5576360161b6b00_NeikiAnalytics.exe 4348 aoptiloc.exe 4348 aoptiloc.exe 2212 405a9f6e8d764521c5576360161b6b00_NeikiAnalytics.exe 2212 405a9f6e8d764521c5576360161b6b00_NeikiAnalytics.exe 4348 aoptiloc.exe 4348 aoptiloc.exe 2212 405a9f6e8d764521c5576360161b6b00_NeikiAnalytics.exe 2212 405a9f6e8d764521c5576360161b6b00_NeikiAnalytics.exe 4348 aoptiloc.exe 4348 aoptiloc.exe 2212 405a9f6e8d764521c5576360161b6b00_NeikiAnalytics.exe 2212 405a9f6e8d764521c5576360161b6b00_NeikiAnalytics.exe 4348 aoptiloc.exe 4348 aoptiloc.exe 2212 405a9f6e8d764521c5576360161b6b00_NeikiAnalytics.exe 2212 405a9f6e8d764521c5576360161b6b00_NeikiAnalytics.exe 4348 aoptiloc.exe 4348 aoptiloc.exe 2212 405a9f6e8d764521c5576360161b6b00_NeikiAnalytics.exe 2212 405a9f6e8d764521c5576360161b6b00_NeikiAnalytics.exe 4348 aoptiloc.exe 4348 aoptiloc.exe 2212 405a9f6e8d764521c5576360161b6b00_NeikiAnalytics.exe 2212 405a9f6e8d764521c5576360161b6b00_NeikiAnalytics.exe 4348 aoptiloc.exe 4348 aoptiloc.exe 2212 405a9f6e8d764521c5576360161b6b00_NeikiAnalytics.exe 2212 405a9f6e8d764521c5576360161b6b00_NeikiAnalytics.exe 4348 aoptiloc.exe 4348 aoptiloc.exe 2212 405a9f6e8d764521c5576360161b6b00_NeikiAnalytics.exe 2212 405a9f6e8d764521c5576360161b6b00_NeikiAnalytics.exe 4348 aoptiloc.exe 4348 aoptiloc.exe 2212 405a9f6e8d764521c5576360161b6b00_NeikiAnalytics.exe 2212 405a9f6e8d764521c5576360161b6b00_NeikiAnalytics.exe 4348 aoptiloc.exe 4348 aoptiloc.exe 2212 405a9f6e8d764521c5576360161b6b00_NeikiAnalytics.exe 2212 405a9f6e8d764521c5576360161b6b00_NeikiAnalytics.exe 4348 aoptiloc.exe 4348 aoptiloc.exe 2212 405a9f6e8d764521c5576360161b6b00_NeikiAnalytics.exe 2212 405a9f6e8d764521c5576360161b6b00_NeikiAnalytics.exe 4348 aoptiloc.exe 4348 aoptiloc.exe 2212 405a9f6e8d764521c5576360161b6b00_NeikiAnalytics.exe 2212 405a9f6e8d764521c5576360161b6b00_NeikiAnalytics.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2212 wrote to memory of 4348 2212 405a9f6e8d764521c5576360161b6b00_NeikiAnalytics.exe 91 PID 2212 wrote to memory of 4348 2212 405a9f6e8d764521c5576360161b6b00_NeikiAnalytics.exe 91 PID 2212 wrote to memory of 4348 2212 405a9f6e8d764521c5576360161b6b00_NeikiAnalytics.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\405a9f6e8d764521c5576360161b6b00_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\405a9f6e8d764521c5576360161b6b00_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\IntelprocIQ\aoptiloc.exeC:\IntelprocIQ\aoptiloc.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3684 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:81⤵PID:2636
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Galax1E\dobxloc.exe
- Size 40KB
- SHA256 9e45282e8eeb5841d5488451159ecf7c0d624298f5a9e8526453c6e441669b27
- MD5 74989033a42aa902d7286309e776f149
- SHA1 a113580653b2d9cc7d4ee507beb2bd71e7a6cadb
- SHA512 c392200c79871970e079d49463b216326b07cfe50990036e2221dc95c171a135ae6b3f35474492f9ef26cd95272823805a25537f407216dbd4e6d81b71794a3b
- SSDEEP 768:PLT5ZRHUj7TRxRVED1bHKFO3Hq/KDsDZe+exJAqsQQsw4Wwn68/yxo4y5x37s:nD8RxTo1TKFO3H0KEZHAA5y4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\IntelprocIQ\aoptiloc.exe
- Size 2.7MB
- SHA256 d142aa2a5befbcee07014397ee958ea59455867018bf2eab641e9fc8add5e916
- MD5 cb784cb15434103f744aa5f2925ac1de
- SHA1 491a123edcb44474d776c952342d59d2431bc69f
- SHA512 f35b31eb12b3d91b7e4339aa972114f304df51ce3639564b156c00f945c20dfe199246519b01f1e4731c14d216519990b3032b6ac6fd078428c8d4250b903bb4
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LB59w4Sx:+R0pI/IQlUoMPdmpSpR4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 205B
- SHA256 b2d58a24c571b6130e9330aa8a6a41aa19236a9ec4ba28a151e09369282a44ee
- MD5 8ca5ac0646a83b12bcb33c3f92486327
- SHA1 a6b7eb5b19c98ff81aafb4fab7909fb3d375d446
- SHA512 06c9978a8e87e632453925449623d8eed282b754230f8978fd611676e4b6b9d181dc3f20478f612c3bbb560285ed71fc13c4181c2b9e5c7bcc0d323152c9786e
- MD5 SHA1 SHA512