Analysis
- max time kernel
149s - max time network
127s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 16:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d69bcc715611405104cfc49f1fb7e850_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
d69bcc715611405104cfc49f1fb7e850_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target d69bcc715611405104cfc49f1fb7e850_NeikiAnalytics.exe
- Size 2.7MB
- Sample240603-tpan5sdb78
- SHA256 44bd14898aa8abade723e9b4dbcd6828e5492073d2ae4c4a4c0e4f60d39f7143
- MD5 d69bcc715611405104cfc49f1fb7e850
- SHA1 8dee7181749d62c31d154045a2bbfc06c3a0663f
- SHA512 99ce5637cd2db2b189897ffe336e2cceaf606e9e5396e826ab1113667c35abcf8e8915fe81ca0f8d87a0952499d56ce794318a7ae767c7f398157006d1f96a5f
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LB99w4Sx:+R0pI/IQlUoMPdmpSpd4
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 684 aoptiec.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\SysDrvSQ\\aoptiec.exe" d69bcc715611405104cfc49f1fb7e850_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\KaVB08\\optidevec.exe" d69bcc715611405104cfc49f1fb7e850_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1072 d69bcc715611405104cfc49f1fb7e850_NeikiAnalytics.exe 1072 d69bcc715611405104cfc49f1fb7e850_NeikiAnalytics.exe 1072 d69bcc715611405104cfc49f1fb7e850_NeikiAnalytics.exe 1072 d69bcc715611405104cfc49f1fb7e850_NeikiAnalytics.exe 684 aoptiec.exe 684 aoptiec.exe 1072 d69bcc715611405104cfc49f1fb7e850_NeikiAnalytics.exe 1072 d69bcc715611405104cfc49f1fb7e850_NeikiAnalytics.exe 684 aoptiec.exe 684 aoptiec.exe 1072 d69bcc715611405104cfc49f1fb7e850_NeikiAnalytics.exe 1072 d69bcc715611405104cfc49f1fb7e850_NeikiAnalytics.exe 684 aoptiec.exe 684 aoptiec.exe 1072 d69bcc715611405104cfc49f1fb7e850_NeikiAnalytics.exe 1072 d69bcc715611405104cfc49f1fb7e850_NeikiAnalytics.exe 684 aoptiec.exe 684 aoptiec.exe 1072 d69bcc715611405104cfc49f1fb7e850_NeikiAnalytics.exe 1072 d69bcc715611405104cfc49f1fb7e850_NeikiAnalytics.exe 684 aoptiec.exe 684 aoptiec.exe 1072 d69bcc715611405104cfc49f1fb7e850_NeikiAnalytics.exe 1072 d69bcc715611405104cfc49f1fb7e850_NeikiAnalytics.exe 684 aoptiec.exe 684 aoptiec.exe 1072 d69bcc715611405104cfc49f1fb7e850_NeikiAnalytics.exe 1072 d69bcc715611405104cfc49f1fb7e850_NeikiAnalytics.exe 684 aoptiec.exe 684 aoptiec.exe 1072 d69bcc715611405104cfc49f1fb7e850_NeikiAnalytics.exe 1072 d69bcc715611405104cfc49f1fb7e850_NeikiAnalytics.exe 684 aoptiec.exe 684 aoptiec.exe 1072 d69bcc715611405104cfc49f1fb7e850_NeikiAnalytics.exe 1072 d69bcc715611405104cfc49f1fb7e850_NeikiAnalytics.exe 684 aoptiec.exe 684 aoptiec.exe 1072 d69bcc715611405104cfc49f1fb7e850_NeikiAnalytics.exe 1072 d69bcc715611405104cfc49f1fb7e850_NeikiAnalytics.exe 684 aoptiec.exe 684 aoptiec.exe 1072 d69bcc715611405104cfc49f1fb7e850_NeikiAnalytics.exe 1072 d69bcc715611405104cfc49f1fb7e850_NeikiAnalytics.exe 684 aoptiec.exe 684 aoptiec.exe 1072 d69bcc715611405104cfc49f1fb7e850_NeikiAnalytics.exe 1072 d69bcc715611405104cfc49f1fb7e850_NeikiAnalytics.exe 684 aoptiec.exe 684 aoptiec.exe 1072 d69bcc715611405104cfc49f1fb7e850_NeikiAnalytics.exe 1072 d69bcc715611405104cfc49f1fb7e850_NeikiAnalytics.exe 684 aoptiec.exe 684 aoptiec.exe 1072 d69bcc715611405104cfc49f1fb7e850_NeikiAnalytics.exe 1072 d69bcc715611405104cfc49f1fb7e850_NeikiAnalytics.exe 684 aoptiec.exe 684 aoptiec.exe 1072 d69bcc715611405104cfc49f1fb7e850_NeikiAnalytics.exe 1072 d69bcc715611405104cfc49f1fb7e850_NeikiAnalytics.exe 684 aoptiec.exe 684 aoptiec.exe 1072 d69bcc715611405104cfc49f1fb7e850_NeikiAnalytics.exe 1072 d69bcc715611405104cfc49f1fb7e850_NeikiAnalytics.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1072 wrote to memory of 684 1072 d69bcc715611405104cfc49f1fb7e850_NeikiAnalytics.exe 99 PID 1072 wrote to memory of 684 1072 d69bcc715611405104cfc49f1fb7e850_NeikiAnalytics.exe 99 PID 1072 wrote to memory of 684 1072 d69bcc715611405104cfc49f1fb7e850_NeikiAnalytics.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\d69bcc715611405104cfc49f1fb7e850_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\d69bcc715611405104cfc49f1fb7e850_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\SysDrvSQ\aoptiec.exeC:\SysDrvSQ\aoptiec.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4008,i,5711962389779687290,1245653010537220991,262144 --variations-seed-version --mojo-platform-channel-handle=4084 /prefetch:81⤵PID:4348
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\KaVB08\optidevec.exe
- Size 2.7MB
- SHA256 57daa264c5d760a7c8bced67e76b4a2e05726a49ab2c5a96b34832f4977cb674
- MD5 397133b1b30fcdbcac36dee5d1e884dd
- SHA1 ad5aaeaafa511113e140207016d1f945cdf29f69
- SHA512 f8f8a5a6de87e6a3f186f64ed703231c696cb6dd7b2e342234e928068ca941d9a0ca4c1aabfa82d28cbbcb4303e2d0f2404ecabb52b521214298fe5d5aaadaa6
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBi9w4Sx:+R0pI/IQlUoMPdmpSp84
- MD5 SHA1 SHA512 SSDEEP
- Path C:\SysDrvSQ\aoptiec.exe
- Size 2.7MB
- SHA256 3938bf321194511937007ee00f86ccf55ebadc727a5aa83d2792fdf2d9200ca6
- MD5 1c384fc5469baa159a3eaac5f03a063a
- SHA1 7f849a5e10e75bc9f9ba8772fb34385f2fab823e
- SHA512 b3f940bdba38266829db03cf31078f1f1d8b02a4600eccf9f8901de9fe387cbafc03b6469e10e6a95c7b058238204b049cc29a6506fe05711526a85eea49dea2
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LB79w4Sx:+R0pI/IQlUoMPdmpSpf4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 206B
- SHA256 e03fc20b5fb416b57fc06b4c4f003dba6236e88046f7b813d75d72b3efc42fa2
- MD5 d336cea9921b904cc5c7b24c1cbab82e
- SHA1 7f40137d9568a092664a0b591ba34da6b9464d45
- SHA512 0ea2e68e7a6d09785392d8ea3c0f92e9bc5cdfa482efad3647d6761e57fa5947d6332fd4767ef7014d702cd14e1375926a958c81df75dfaf62cc3d8b1abbdce8
- MD5 SHA1 SHA512