Analysis
- max time kernel
151s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 17:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e00ccffa0340d19d52aa4f09dc47b320_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
e00ccffa0340d19d52aa4f09dc47b320_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target e00ccffa0340d19d52aa4f09dc47b320_NeikiAnalytics.exe
- Size 2.6MB
- Sample240603-v54gtsfa64
- SHA256 ce9c9b996dea3a851d4ea3ab4de7544babe31468ce21cd701e90e58e6c36a487
- MD5 e00ccffa0340d19d52aa4f09dc47b320
- SHA1 d57eb654c2765322b94cab8dd426d821e6eccf72
- SHA512 c8144cc4a01dad44d6c62d0351d3abdf236427f625115ec51fc9b1876af1ea4130e1461cb067a4a6614a570ea66e498a94930a998548aa7de70b19b1f0adc1c1
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBtB/bS:sxX7QnxrloE5dpUpCb
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecdevopti.exe e00ccffa0340d19d52aa4f09dc47b320_NeikiAnalytics.exe - Executes dropped EXE 2 IoCs
pid Process 5276 ecdevopti.exe 3104 aoptiec.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\Intelproc45\\aoptiec.exe" e00ccffa0340d19d52aa4f09dc47b320_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\GalaxLA\\optidevec.exe" e00ccffa0340d19d52aa4f09dc47b320_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3040 e00ccffa0340d19d52aa4f09dc47b320_NeikiAnalytics.exe 3040 e00ccffa0340d19d52aa4f09dc47b320_NeikiAnalytics.exe 3040 e00ccffa0340d19d52aa4f09dc47b320_NeikiAnalytics.exe 3040 e00ccffa0340d19d52aa4f09dc47b320_NeikiAnalytics.exe 5276 ecdevopti.exe 5276 ecdevopti.exe 3104 aoptiec.exe 3104 aoptiec.exe 5276 ecdevopti.exe 5276 ecdevopti.exe 3104 aoptiec.exe 3104 aoptiec.exe 5276 ecdevopti.exe 5276 ecdevopti.exe 3104 aoptiec.exe 3104 aoptiec.exe 5276 ecdevopti.exe 5276 ecdevopti.exe 3104 aoptiec.exe 3104 aoptiec.exe 5276 ecdevopti.exe 5276 ecdevopti.exe 3104 aoptiec.exe 3104 aoptiec.exe 5276 ecdevopti.exe 5276 ecdevopti.exe 3104 aoptiec.exe 3104 aoptiec.exe 5276 ecdevopti.exe 5276 ecdevopti.exe 3104 aoptiec.exe 3104 aoptiec.exe 5276 ecdevopti.exe 5276 ecdevopti.exe 3104 aoptiec.exe 3104 aoptiec.exe 5276 ecdevopti.exe 5276 ecdevopti.exe 3104 aoptiec.exe 3104 aoptiec.exe 5276 ecdevopti.exe 5276 ecdevopti.exe 3104 aoptiec.exe 3104 aoptiec.exe 5276 ecdevopti.exe 5276 ecdevopti.exe 3104 aoptiec.exe 3104 aoptiec.exe 5276 ecdevopti.exe 5276 ecdevopti.exe 3104 aoptiec.exe 3104 aoptiec.exe 5276 ecdevopti.exe 5276 ecdevopti.exe 3104 aoptiec.exe 3104 aoptiec.exe 5276 ecdevopti.exe 5276 ecdevopti.exe 3104 aoptiec.exe 3104 aoptiec.exe 5276 ecdevopti.exe 5276 ecdevopti.exe 3104 aoptiec.exe 3104 aoptiec.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3040 wrote to memory of 5276 3040 e00ccffa0340d19d52aa4f09dc47b320_NeikiAnalytics.exe 91 PID 3040 wrote to memory of 5276 3040 e00ccffa0340d19d52aa4f09dc47b320_NeikiAnalytics.exe 91 PID 3040 wrote to memory of 5276 3040 e00ccffa0340d19d52aa4f09dc47b320_NeikiAnalytics.exe 91 PID 3040 wrote to memory of 3104 3040 e00ccffa0340d19d52aa4f09dc47b320_NeikiAnalytics.exe 92 PID 3040 wrote to memory of 3104 3040 e00ccffa0340d19d52aa4f09dc47b320_NeikiAnalytics.exe 92 PID 3040 wrote to memory of 3104 3040 e00ccffa0340d19d52aa4f09dc47b320_NeikiAnalytics.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\e00ccffa0340d19d52aa4f09dc47b320_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\e00ccffa0340d19d52aa4f09dc47b320_NeikiAnalytics.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecdevopti.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecdevopti.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5276
-
-
C:\Intelproc45\aoptiec.exeC:\Intelproc45\aoptiec.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3104 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:81⤵PID:3216
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\GalaxLA\optidevec.exe
- Size 17KB
- SHA256 3227f9af271ae26f02716cbbbd5e8a0b4a176449b90b8f9212a982bc1aff2679
- MD5 de7175166b9ff0cdd866fdc4fd9b11bb
- SHA1 26ce9e5dad36bac744ae30b037c9538afc41fd9c
- SHA512 20bdffd0a3c54460e8cdc1d24ed8f302626a9e162692b0b345c002b73ec4b8cbf259ca56ff2d4f92a3ab43a45d6db8b5b1a876295cde75434e22ba77f6072523
- SSDEEP 192:0fgezXzDzjUHK9d9/XYxFn8E/ES76xS7BzFqJgjYJjafiVKYLJSliGT9:04ezXTIk/IxT/ES70S7TqOODVtLiD9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\GalaxLA\optidevec.exe
- Size 2.6MB
- SHA256 8cb826168c66d380262cefeb6780ea917ac9fea00b27abec1571e875516fd798
- MD5 9c7496d1f696969930a7d7b7156f7ce5
- SHA1 9091faaa49b9179bd86bf31f7b7eb822f9a3e0fd
- SHA512 340a3175bc7f3f6cc9c77231d94025e5da4adabb20d00a76550f5b9be272ea2c76f79419c66a8a23ef55e06a8a6b2d4f3d62340a60f3253e068478e68dbeeacd
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBwB/bS:sxX7QnxrloE5dpUp3b
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Intelproc45\aoptiec.exe
- Size 2.6MB
- SHA256 03309c587e14c4eb555a1ca7c7a114126a104651fa78c656f002a5ae058d790d
- MD5 9695159b91328604ab2f5c614f458e10
- SHA1 d786372d0669c8dccfd78d6352c6ac4a1ced68b6
- SHA512 7e07219a3f2f675b72f5ed3ef297ee8084e26165f7d98473c712c8ba28a8ee473659359c33c31943ef603caeed4dc4df6887bd87dbcaf4b0bec5c6c50459d776
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBoB/bS:sxX7QnxrloE5dpUp3b
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 209B
- SHA256 5998d0187fd4b19832d25df04ccc1ba7f9e14473698278aca48d270854b5d9ab
- MD5 0898fdf15667e24bbff0d4d907d9bb72
- SHA1 929e5c0adbfdafd125a70572de09ffa957f53dfc
- SHA512 d376d0a437372badbe8c3dfc4aaed6e2880f612637fefac939fe1279bbd1176e320aef69f59dd2568a14e15309ef91a1fd5d6b22abe74057ce1cf85ff5f4a897
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 177B
- SHA256 7c0df3c1e73bff0792f29cb8b12b5e65f12225352444ed75048101d75f407fba
- MD5 542630d58101d22e290e786d3f6f6771
- SHA1 a9085f4f0b77100f73a30b39cc54dbc91eb93646
- SHA512 4ccdaa48b5b7bdc20db3619bf4ccc475d218ac4f1e9a17c6d8bed6fe316aecbe2bbadbadea0781b9e1f676d7ca93c95daac0ead27b4cec81ee9b31aad0ff72b9
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecdevopti.exe
- Size 2.6MB
- SHA256 d005685071a727dc0d0dd9d41de37fe7a67401858e0866b900728908bbdb6091
- MD5 5cfd6bbe1c73d6127da50c6a6f00b4e2
- SHA1 0941a44b1de0a767faf2a2cf66ab93af6ac50860
- SHA512 9f624373fdcce938468be7de985e3c99651c98e83187904b5a443f5293d2423d41746b46db44eb51fcb1bec5ef065b252325178d6054b1e0299482e2300a43fb
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB2B/bS:sxX7QnxrloE5dpUpJb
- MD5 SHA1 SHA512 SSDEEP