Analysis
- max time kernel
150s - max time network
123s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 15:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
29f6973b101f74ac1cdf3a11891680e0_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
29f6973b101f74ac1cdf3a11891680e0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 29f6973b101f74ac1cdf3a11891680e0_NeikiAnalytics.exe
- Size 2.6MB
- Sample240603-tb97vabe4t
- SHA256 2083460c8382f66f512432d3953ac3f962f451f65ac0af334b01d2a8187be7a5
- MD5 29f6973b101f74ac1cdf3a11891680e0
- SHA1 fa8312b2eea034465f74e285c3582a4e877232b3
- SHA512 560c4620c61d474df4c30d729216a4c5bc6a92a52359645f67fa3c860f8185ef2a8e4dd0b518d91d59096599d354a6bdae9426dc056000e8db2b9a21d68aea61
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBPB/bS:sxX7QnxrloE5dpUpob
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxopti.exe 29f6973b101f74ac1cdf3a11891680e0_NeikiAnalytics.exe - Executes dropped EXE 2 IoCs
pid Process 1652 locxopti.exe 4700 xoptiloc.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\IntelprocDQ\\xoptiloc.exe" 29f6973b101f74ac1cdf3a11891680e0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\Mint42\\optidevloc.exe" 29f6973b101f74ac1cdf3a11891680e0_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4884 29f6973b101f74ac1cdf3a11891680e0_NeikiAnalytics.exe 4884 29f6973b101f74ac1cdf3a11891680e0_NeikiAnalytics.exe 4884 29f6973b101f74ac1cdf3a11891680e0_NeikiAnalytics.exe 4884 29f6973b101f74ac1cdf3a11891680e0_NeikiAnalytics.exe 1652 locxopti.exe 1652 locxopti.exe 4700 xoptiloc.exe 4700 xoptiloc.exe 1652 locxopti.exe 1652 locxopti.exe 4700 xoptiloc.exe 4700 xoptiloc.exe 1652 locxopti.exe 1652 locxopti.exe 4700 xoptiloc.exe 4700 xoptiloc.exe 1652 locxopti.exe 1652 locxopti.exe 4700 xoptiloc.exe 4700 xoptiloc.exe 1652 locxopti.exe 1652 locxopti.exe 4700 xoptiloc.exe 4700 xoptiloc.exe 1652 locxopti.exe 1652 locxopti.exe 4700 xoptiloc.exe 4700 xoptiloc.exe 1652 locxopti.exe 1652 locxopti.exe 4700 xoptiloc.exe 4700 xoptiloc.exe 1652 locxopti.exe 1652 locxopti.exe 4700 xoptiloc.exe 4700 xoptiloc.exe 1652 locxopti.exe 1652 locxopti.exe 4700 xoptiloc.exe 4700 xoptiloc.exe 1652 locxopti.exe 1652 locxopti.exe 4700 xoptiloc.exe 4700 xoptiloc.exe 1652 locxopti.exe 1652 locxopti.exe 4700 xoptiloc.exe 4700 xoptiloc.exe 1652 locxopti.exe 1652 locxopti.exe 4700 xoptiloc.exe 4700 xoptiloc.exe 1652 locxopti.exe 1652 locxopti.exe 4700 xoptiloc.exe 4700 xoptiloc.exe 1652 locxopti.exe 1652 locxopti.exe 4700 xoptiloc.exe 4700 xoptiloc.exe 1652 locxopti.exe 1652 locxopti.exe 4700 xoptiloc.exe 4700 xoptiloc.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4884 wrote to memory of 1652 4884 29f6973b101f74ac1cdf3a11891680e0_NeikiAnalytics.exe 83 PID 4884 wrote to memory of 1652 4884 29f6973b101f74ac1cdf3a11891680e0_NeikiAnalytics.exe 83 PID 4884 wrote to memory of 1652 4884 29f6973b101f74ac1cdf3a11891680e0_NeikiAnalytics.exe 83 PID 4884 wrote to memory of 4700 4884 29f6973b101f74ac1cdf3a11891680e0_NeikiAnalytics.exe 84 PID 4884 wrote to memory of 4700 4884 29f6973b101f74ac1cdf3a11891680e0_NeikiAnalytics.exe 84 PID 4884 wrote to memory of 4700 4884 29f6973b101f74ac1cdf3a11891680e0_NeikiAnalytics.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\29f6973b101f74ac1cdf3a11891680e0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\29f6973b101f74ac1cdf3a11891680e0_NeikiAnalytics.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxopti.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxopti.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1652
-
-
C:\IntelprocDQ\xoptiloc.exeC:\IntelprocDQ\xoptiloc.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4700
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\IntelprocDQ\xoptiloc.exe
- Size 1.1MB
- SHA256 efc8da9aa39842168c4935d2967429e9f9842e5d6755cbe8945280efd5ea7262
- MD5 b54d80660e5e4455b9a0b7af63cc79a7
- SHA1 670bc8c2253a940834470e18dfc1cfb74261e600
- SHA512 99c60470ea6b90dab4158d1596e5d9647eec3f94bd58d2946cff687762ce7d36aecf286b74baef53b78075cb5da84da141cff6a75f8f0f73dc301339d4be57ad
- SSDEEP 24576:6nxDZV7xMyu6qJ2WSYxBdSqpcVdm5XRVpQO3chiIcr1RhSKntaxtooV:sxX7665YxRVplZzSKntlS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\IntelprocDQ\xoptiloc.exe
- Size 2.6MB
- SHA256 f306288f3ada4373cab828f3cf8275e86778887e0990d9ec55a5f99092bd571c
- MD5 15a44276ce1df66fc621a810a60398ff
- SHA1 5365f765dc83ac61886651d32859c7bc9c9c0fa2
- SHA512 7367195427023ea32a5c2d6fdf0c244d28a0db2f53c995ea5add2103a8e7f49a5e94c8b2227372d2dd8b8191a25e194bdf4d47188634d8ec9aff675d0f423f62
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB5B/bS:sxX7QnxrloE5dpUpWb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Mint42\optidevloc.exe
- Size 19KB
- SHA256 7c02f64b740ff9995b503e0f1e0c8c01d837aa4bd8585709cf0f8dfe61831374
- MD5 d016b0ad254ae9664284c6bec29c5ba6
- SHA1 7ae5e9559a1832a9fb2100c1032f300c8dc78e9e
- SHA512 c22c1b33c86d3a40515e18681d66290f6976b7510b3d4fce432a93ed4220ed0ce1cc8d8f3ddbabfe38b8176b15e6f826172e59fc74b34f4e1ca4414306ea2430
- SSDEEP 384:04ezXTIk/IxT/ES70S7TqOODVtLiD1APE/P:xezkk/DUj7TlODVED17X
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Mint42\optidevloc.exe
- Size 15KB
- SHA256 1f30a15b454a01e1f02a566860b6dea8fe2debfee04aa9dcd02eff1b374b5385
- MD5 62f17a18e2665228331086e6e938bfcc
- SHA1 8e2aada25ef3eee33045d7c08ce27d04adfb7da4
- SHA512 0cde9444b74a958f01e657a2f49550b28dac6697a6d01cdde84a080468781943e73e4ca36b1efb6ce7bebd85c014c8ebf526f60943adf83ef100be6249c3a5f3
- SSDEEP 192:0fgezXzDzjUHK9d9/XYxFn8E/ES76xS7BzFqJgjYJjafiVKj:04ezXTIk/IxT/ES70S7TqOODVA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 209B
- SHA256 a4648a0801b1aeef59616864988c94d7f2e75265da5bd77ed81b32f9ea6da4c3
- MD5 0cbe293b99255388f263fca229c77305
- SHA1 a901e8d5da73f5f5716bdd9e8d8ff14d2b0f984b
- SHA512 1acb4915254982a85fe02e34839aa28c6475397e5ac70a11a8937f9e218e0aa61f0ac599388a88f9d9b0c945ed82ea55c24db21d242ddfe28c695c3348e5b2b5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 177B
- SHA256 81709ea9c6d318cc07432896cdc25a31212fce6b97e0f95a671aa8b1fdb4f19c
- MD5 f7b98c0c1db9c531d5310622f6873321
- SHA1 645260ffb2f7a49d731b2a9a700ee4aa3040df79
- SHA512 6f286c156b2523e7f1a933596e18427e688a41a17db8d2400bfbb7684c1fa27949fa2060cb2717740af189783c18562eff718848aad5e163da55629f373e6155
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxopti.exe
- Size 2.6MB
- SHA256 2d9cf54eb9b85c8b645f1f036b8aee7e0c067a64835ceba9e25114c2d2c1b60a
- MD5 4a98c898680f5b691fe6ddec25f2a8c6
- SHA1 4b924296d12e22f532ec3a09d60feb1d5ec944e0
- SHA512 ef1325286b8984bf7ffdcd098d5e2e597e8458294daa46a0f9c9b633202d77ca395f2f94a66165be77517059fee21e46151d6ac2fe45658b99d1e9238e0d07a8
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBSB/bS:sxX7QnxrloE5dpUpJb
- MD5 SHA1 SHA512 SSDEEP