Analysis
- max time kernel
149s - max time network
96s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 15:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c3a51509e5666b52b89e70ae11e4e280_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
c3a51509e5666b52b89e70ae11e4e280_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target c3a51509e5666b52b89e70ae11e4e280_NeikiAnalytics.exe
- Size 4.0MB
- Sample240603-spr3raaf4v
- SHA256 6ad63697f3050d716ec5ec52ef24c97bf578eec2476f7e27bd71020a97b70c22
- MD5 c3a51509e5666b52b89e70ae11e4e280
- SHA1 669cf4f8e4c08125ca56b78107536cc0198c1682
- SHA512 01f08c254d02fc6a472bd7d9f4fd0f988afdfbbaf8f568fbac646fc142ea876f4d0a3854d0373c4cf8da3fb927678b585ea5ad69f86bfe8f63784446c78b2568
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB/B/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUpMbVz8eLFcz
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locadob.exe c3a51509e5666b52b89e70ae11e4e280_NeikiAnalytics.exe - Executes dropped EXE 2 IoCs
pid Process 2984 locadob.exe 2904 xbodloc.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\FilesLK\\xbodloc.exe" c3a51509e5666b52b89e70ae11e4e280_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\MintYJ\\optidevsys.exe" c3a51509e5666b52b89e70ae11e4e280_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4492 c3a51509e5666b52b89e70ae11e4e280_NeikiAnalytics.exe 4492 c3a51509e5666b52b89e70ae11e4e280_NeikiAnalytics.exe 4492 c3a51509e5666b52b89e70ae11e4e280_NeikiAnalytics.exe 4492 c3a51509e5666b52b89e70ae11e4e280_NeikiAnalytics.exe 2984 locadob.exe 2984 locadob.exe 2904 xbodloc.exe 2904 xbodloc.exe 2984 locadob.exe 2984 locadob.exe 2904 xbodloc.exe 2904 xbodloc.exe 2984 locadob.exe 2984 locadob.exe 2904 xbodloc.exe 2904 xbodloc.exe 2984 locadob.exe 2984 locadob.exe 2904 xbodloc.exe 2904 xbodloc.exe 2984 locadob.exe 2984 locadob.exe 2904 xbodloc.exe 2904 xbodloc.exe 2984 locadob.exe 2984 locadob.exe 2904 xbodloc.exe 2904 xbodloc.exe 2984 locadob.exe 2984 locadob.exe 2904 xbodloc.exe 2904 xbodloc.exe 2984 locadob.exe 2984 locadob.exe 2904 xbodloc.exe 2904 xbodloc.exe 2984 locadob.exe 2984 locadob.exe 2904 xbodloc.exe 2904 xbodloc.exe 2984 locadob.exe 2984 locadob.exe 2904 xbodloc.exe 2904 xbodloc.exe 2984 locadob.exe 2984 locadob.exe 2904 xbodloc.exe 2904 xbodloc.exe 2984 locadob.exe 2984 locadob.exe 2904 xbodloc.exe 2904 xbodloc.exe 2984 locadob.exe 2984 locadob.exe 2904 xbodloc.exe 2904 xbodloc.exe 2984 locadob.exe 2984 locadob.exe 2904 xbodloc.exe 2904 xbodloc.exe 2984 locadob.exe 2984 locadob.exe 2904 xbodloc.exe 2904 xbodloc.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4492 wrote to memory of 2984 4492 c3a51509e5666b52b89e70ae11e4e280_NeikiAnalytics.exe 84 PID 4492 wrote to memory of 2984 4492 c3a51509e5666b52b89e70ae11e4e280_NeikiAnalytics.exe 84 PID 4492 wrote to memory of 2984 4492 c3a51509e5666b52b89e70ae11e4e280_NeikiAnalytics.exe 84 PID 4492 wrote to memory of 2904 4492 c3a51509e5666b52b89e70ae11e4e280_NeikiAnalytics.exe 87 PID 4492 wrote to memory of 2904 4492 c3a51509e5666b52b89e70ae11e4e280_NeikiAnalytics.exe 87 PID 4492 wrote to memory of 2904 4492 c3a51509e5666b52b89e70ae11e4e280_NeikiAnalytics.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\c3a51509e5666b52b89e70ae11e4e280_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\c3a51509e5666b52b89e70ae11e4e280_NeikiAnalytics.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locadob.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locadob.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2984
-
-
C:\FilesLK\xbodloc.exeC:\FilesLK\xbodloc.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2904
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\FilesLK\xbodloc.exe
- Size 4.0MB
- SHA256 ec83091349f7f6765206a60e055922e1408da57ef454dcf94c8a363cc505ed98
- MD5 49d5ebb9bccb8eb21ec3bd3f88a5720d
- SHA1 03b6a05b88b781b243d5b189b12339c35b32618a
- SHA512 1bdbac96ec4bbc5485fc916922e59fc42ca95e32ceb93438f41d8c364be28d306b431c701d54fa77bc83b0f77d0848813695de654e97ba734ba57e6a4b615e56
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBwB/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUpDbVz8eLFcz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MintYJ\optidevsys.exe
- Size 4.0MB
- SHA256 250b50f4402478ceace8cccbf55db74b432d7c747d35e03e257aadfcfaa438aa
- MD5 f351e3879d7dc7dcf816fe1e7c657799
- SHA1 92f6bf1baa2de1ee495b4aeebf0510f74e5725f3
- SHA512 88d85f7467192aa1ab655cfafa4a5d900618950026db3a12bb29a1962c827986c4eeddc2691f448a2b5c01ff668a1d8424a43e08a6eb3b6067dac88514e205ce
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB7B/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUp0bVz8eLFcz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MintYJ\optidevsys.exe
- Size 250KB
- SHA256 3e4da521dda4545e1aff68ac5682926cd9c49db9ed9bf026fd5af95afd295fc3
- MD5 065a5381c50d5669d1e30339612c5428
- SHA1 b3633442a9f36aee600a2ac810db8e5b075a71a1
- SHA512 575838dce7a6fa09177b3e52d63e929e1416a24b47cd1e81b9c27cf5ffd4a8c8eeecf669e5a40a6801ff21b3908e4f676a159dd16b17984cfb8c3c95da168206
- SSDEEP 6144:6nyJ3n0Dm7+zm6wr6YEjAumIann6qJ/mB9D+nnS3:6ne3n0DmAm67YEjAyu6qJ/+WS3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 203B
- SHA256 17c7010087ac5184aa38eb6bcc1ee3d2fb79e9a79beaf2253f66981c350b3d2e
- MD5 a48da801b03ec09a80052945577ae593
- SHA1 9fdc5d9201ee424cd7bde62721ffb8e8af050d75
- SHA512 3a4aa245b096fb986c5599fa37b817f2b8f8bd16bb6c36b0ecef89463ba1a0630b9366e10a0dd7279eaf7ee9a00900cdbd198611c210ed7d70b0e05a64b1d47c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 171B
- SHA256 2c7b09f36ea43f998103da4e8330304e980103604417fc179d7e907359b1f16b
- MD5 6c66e8b69b597dbdc11c0556cb51c3b4
- SHA1 19048b3d1e73865a3e7184209c095886478bc501
- SHA512 df2a1f0a1f6fb9871ac356125a8065eff396b74a77c9d344c0466873d55ddbff3e1efe13ad7263039d209b4e6e48f4dc06d8aa77ff49ad408e498f5f8b61e516
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locadob.exe
- Size 4.0MB
- SHA256 386072f9877a216fc480aea1fc84ac89e6fb086d5783b97ca0de3ebc6f13d42c
- MD5 bb4f8ca5d631fb59b875d3792c0f140e
- SHA1 f9fcbc4a054ee40e47f8d8158e1940f246a67878
- SHA512 af2d50e45b77eed34409025da6512ba6ff2af6775746e08861de5c0e16c3fc53a952a7b7613d055fe9ec6c66ffa564d17d6b026a6da376d3506b0a600682a754
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBiB/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUpZbVz8eLFcz
- MD5 SHA1 SHA512 SSDEEP