Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 16:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
79622261297efedc0c835afd355b6070_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
79622261297efedc0c835afd355b6070_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 79622261297efedc0c835afd355b6070_NeikiAnalytics.exe
- Size 2.6MB
- Sample240603-t16wqadf35
- SHA256 ad20c69e0898152a16e0ed628bcceff73ce553344b6a72d1aeb4d2e1735e8e26
- MD5 79622261297efedc0c835afd355b6070
- SHA1 189300abac6d566f85c5aa3220e8f3f66cc0ae1f
- SHA512 cf87ad042c22bfb70ed7adff275c5ca759efdcd14aa3fd9027d78f0ee4a6222528aca2b74d864052784be7dca93e7bfdf396af4ab1664f7aa544032ff4289d00
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBSB/bS:sxX7QnxrloE5dpUpdb
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecadob.exe 79622261297efedc0c835afd355b6070_NeikiAnalytics.exe - Executes dropped EXE 2 IoCs
pid Process 2280 ecadob.exe 2820 devoptiloc.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\AdobeAQ\\devoptiloc.exe" 79622261297efedc0c835afd355b6070_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\Galax8A\\bodaec.exe" 79622261297efedc0c835afd355b6070_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3892 79622261297efedc0c835afd355b6070_NeikiAnalytics.exe 3892 79622261297efedc0c835afd355b6070_NeikiAnalytics.exe 3892 79622261297efedc0c835afd355b6070_NeikiAnalytics.exe 3892 79622261297efedc0c835afd355b6070_NeikiAnalytics.exe 2280 ecadob.exe 2280 ecadob.exe 2820 devoptiloc.exe 2820 devoptiloc.exe 2280 ecadob.exe 2280 ecadob.exe 2820 devoptiloc.exe 2820 devoptiloc.exe 2280 ecadob.exe 2280 ecadob.exe 2820 devoptiloc.exe 2820 devoptiloc.exe 2280 ecadob.exe 2280 ecadob.exe 2820 devoptiloc.exe 2820 devoptiloc.exe 2280 ecadob.exe 2280 ecadob.exe 2820 devoptiloc.exe 2820 devoptiloc.exe 2280 ecadob.exe 2280 ecadob.exe 2820 devoptiloc.exe 2820 devoptiloc.exe 2280 ecadob.exe 2280 ecadob.exe 2820 devoptiloc.exe 2820 devoptiloc.exe 2280 ecadob.exe 2280 ecadob.exe 2820 devoptiloc.exe 2820 devoptiloc.exe 2280 ecadob.exe 2280 ecadob.exe 2820 devoptiloc.exe 2820 devoptiloc.exe 2280 ecadob.exe 2280 ecadob.exe 2820 devoptiloc.exe 2820 devoptiloc.exe 2280 ecadob.exe 2280 ecadob.exe 2820 devoptiloc.exe 2820 devoptiloc.exe 2280 ecadob.exe 2280 ecadob.exe 2820 devoptiloc.exe 2820 devoptiloc.exe 2280 ecadob.exe 2280 ecadob.exe 2820 devoptiloc.exe 2820 devoptiloc.exe 2280 ecadob.exe 2280 ecadob.exe 2820 devoptiloc.exe 2820 devoptiloc.exe 2280 ecadob.exe 2280 ecadob.exe 2820 devoptiloc.exe 2820 devoptiloc.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3892 wrote to memory of 2280 3892 79622261297efedc0c835afd355b6070_NeikiAnalytics.exe 85 PID 3892 wrote to memory of 2280 3892 79622261297efedc0c835afd355b6070_NeikiAnalytics.exe 85 PID 3892 wrote to memory of 2280 3892 79622261297efedc0c835afd355b6070_NeikiAnalytics.exe 85 PID 3892 wrote to memory of 2820 3892 79622261297efedc0c835afd355b6070_NeikiAnalytics.exe 86 PID 3892 wrote to memory of 2820 3892 79622261297efedc0c835afd355b6070_NeikiAnalytics.exe 86 PID 3892 wrote to memory of 2820 3892 79622261297efedc0c835afd355b6070_NeikiAnalytics.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\79622261297efedc0c835afd355b6070_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\79622261297efedc0c835afd355b6070_NeikiAnalytics.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecadob.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecadob.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2280
-
-
C:\AdobeAQ\devoptiloc.exeC:\AdobeAQ\devoptiloc.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2820
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\AdobeAQ\devoptiloc.exe
- Size 2.6MB
- SHA256 6071adb478e13e3c71a18c9de56a95e5901785ec53fc671c65febbd3c8496bfd
- MD5 68cf6e3cca924e76f0c0400bb39b6c2a
- SHA1 07140739f4bff3d41ce7932f4118b7a4afb077a6
- SHA512 a2f51849ae2720cc6d2cb8512051378067aec3e43947aabf4bdfc0d144e9ba27b798f1b97f4f6a00e2d3f582c36986a811834b7eb9947919b3140988635e4a75
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LByB/bS:sxX7QnxrloE5dpUphb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Galax8A\bodaec.exe
- Size 52KB
- SHA256 b1ff5dbfa7ee8014ccc94d7a92b4561a31b334a840746b14a24d22412d05d787
- MD5 69c0b2555663358261c997f6c659f06b
- SHA1 313def4705bf1ef0bdc2e35f27ced0a05f517943
- SHA512 52134c0edddedd0c8adc7176eb281ff11a952f3b251c10ea8d855ce68f222387ab7b406e5d6594d95879d5cd52e28532da6c0d9610fbc0dcd59b943269b82523
- SSDEEP 768:xezkk/DUj7TlODVED17nKFO3nq/KjsDZe+pxsjqsXQJ+YWNn6q8/oIovypoRMkfn:ABalOBo1TKFO3n0KkZHqX7+g2lWXQm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Galax8A\bodaec.exe
- Size 2.6MB
- SHA256 3fdf831e1215ad94d002502da1eb1715b09207073c349c7d13e8af6ce528d392
- MD5 f463f1f2e42b8d8a43a47a4010ba4476
- SHA1 662a5f331012170d413ca86a5f2d9be0cafab4c8
- SHA512 a268b944d07ce589230ffc80f198ded5a020f1d33e5aad4b8b1b94b546f72390734ba35c10bd282499f59aa24430a51daaafd264934bb9a6794d023a8e6c3e9c
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBIB/bS:sxX7QnxrloE5dpUpXb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 202B
- SHA256 a9a14db8788e6c2325c5120692f755e3871ededd0757e184527ec5bb230f1b4a
- MD5 fbbdc9a2c89a3f50d0a7b1978dbe8c5c
- SHA1 58252fbb4d0df8021e268bf5074679e2a9de26ce
- SHA512 a3da38f340602e01163be40819c3f08a278c7b5bf73da8aba7215cd59f668e62dead112951bbb107ad729c847762f248054e67bb0f8a4cec6ae3fb327f7e6d36
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 170B
- SHA256 f46f81e1d33a2056f2850210cfc3d02a4cd2b5a64bd677785b0f6071363deb82
- MD5 89f0e8dcae8d91bd555b1adf10e5483c
- SHA1 a47b6df9fd7f84b7f8f3dc10734cec25499d408a
- SHA512 a1e53fbcef86a8134bf79ee6896cdb13d7c9305742b75c66e2d8f8999e619615858d346c334790a608ffe9ec980493387b06d774ff9835807b7712b34197dea5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecadob.exe
- Size 2.6MB
- SHA256 56f09778cb0f3fd42ab0692fe2160c1be05a1cb4b98c5b26fadca1ff2cfe69f9
- MD5 429cc2ef94610bf175cf4cbc8b6205d3
- SHA1 ab18988b0c74b60d980ce656c38b8217812a096a
- SHA512 5018f37976c8a47122d841d0061209bdc6bea2117362343386cd9e2131fb4baf328abb8f03c948b91668d7f6c77993fe1dffeff5c9bcd53a2cc6fd117986ca36
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB8B/bS:sxX7QnxrloE5dpUp7b
- MD5 SHA1 SHA512 SSDEEP