Analysis
- max time kernel
149s - max time network
101s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 16:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
680c1dd5ec51bafd7df9561086419940_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
680c1dd5ec51bafd7df9561086419940_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 680c1dd5ec51bafd7df9561086419940_NeikiAnalytics.exe
- Size 4.1MB
- Sample240603-vfer6seb53
- SHA256 69c37b9b97c351c6bc067788e1e35d694a8818ceb271d05e23489bb3b1aa4043
- MD5 680c1dd5ec51bafd7df9561086419940
- SHA1 2a4d052c6cc739f4ca50eef4732ba96fec641b01
- SHA512 d298bce99e0c9b9eeadd2f63a0d22b13848f4903e30f31433580edfb96541cb1ba41ddad66cd1ab3c0c9017efb4fca17f3cbf0b89824c38068c07f3e51177c16
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBtB/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUpCbVz8eLFcz
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecdevdob.exe 680c1dd5ec51bafd7df9561086419940_NeikiAnalytics.exe - Executes dropped EXE 2 IoCs
pid Process 2284 ecdevdob.exe 5072 aoptiec.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\Files9G\\aoptiec.exe" 680c1dd5ec51bafd7df9561086419940_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\Mint4J\\optiaec.exe" 680c1dd5ec51bafd7df9561086419940_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4036 680c1dd5ec51bafd7df9561086419940_NeikiAnalytics.exe 4036 680c1dd5ec51bafd7df9561086419940_NeikiAnalytics.exe 4036 680c1dd5ec51bafd7df9561086419940_NeikiAnalytics.exe 4036 680c1dd5ec51bafd7df9561086419940_NeikiAnalytics.exe 2284 ecdevdob.exe 2284 ecdevdob.exe 5072 aoptiec.exe 5072 aoptiec.exe 2284 ecdevdob.exe 2284 ecdevdob.exe 5072 aoptiec.exe 5072 aoptiec.exe 2284 ecdevdob.exe 2284 ecdevdob.exe 5072 aoptiec.exe 5072 aoptiec.exe 2284 ecdevdob.exe 2284 ecdevdob.exe 5072 aoptiec.exe 5072 aoptiec.exe 2284 ecdevdob.exe 2284 ecdevdob.exe 5072 aoptiec.exe 5072 aoptiec.exe 2284 ecdevdob.exe 2284 ecdevdob.exe 5072 aoptiec.exe 5072 aoptiec.exe 2284 ecdevdob.exe 2284 ecdevdob.exe 5072 aoptiec.exe 5072 aoptiec.exe 2284 ecdevdob.exe 2284 ecdevdob.exe 5072 aoptiec.exe 5072 aoptiec.exe 2284 ecdevdob.exe 2284 ecdevdob.exe 5072 aoptiec.exe 5072 aoptiec.exe 2284 ecdevdob.exe 2284 ecdevdob.exe 5072 aoptiec.exe 5072 aoptiec.exe 2284 ecdevdob.exe 2284 ecdevdob.exe 5072 aoptiec.exe 5072 aoptiec.exe 2284 ecdevdob.exe 2284 ecdevdob.exe 5072 aoptiec.exe 5072 aoptiec.exe 2284 ecdevdob.exe 2284 ecdevdob.exe 5072 aoptiec.exe 5072 aoptiec.exe 2284 ecdevdob.exe 2284 ecdevdob.exe 5072 aoptiec.exe 5072 aoptiec.exe 2284 ecdevdob.exe 2284 ecdevdob.exe 5072 aoptiec.exe 5072 aoptiec.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4036 wrote to memory of 2284 4036 680c1dd5ec51bafd7df9561086419940_NeikiAnalytics.exe 87 PID 4036 wrote to memory of 2284 4036 680c1dd5ec51bafd7df9561086419940_NeikiAnalytics.exe 87 PID 4036 wrote to memory of 2284 4036 680c1dd5ec51bafd7df9561086419940_NeikiAnalytics.exe 87 PID 4036 wrote to memory of 5072 4036 680c1dd5ec51bafd7df9561086419940_NeikiAnalytics.exe 89 PID 4036 wrote to memory of 5072 4036 680c1dd5ec51bafd7df9561086419940_NeikiAnalytics.exe 89 PID 4036 wrote to memory of 5072 4036 680c1dd5ec51bafd7df9561086419940_NeikiAnalytics.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\680c1dd5ec51bafd7df9561086419940_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\680c1dd5ec51bafd7df9561086419940_NeikiAnalytics.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecdevdob.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecdevdob.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2284
-
-
C:\Files9G\aoptiec.exeC:\Files9G\aoptiec.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5072
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Files9G\aoptiec.exe
- Size 4.1MB
- SHA256 e1973a886feb520ad40553f2f010259881ca995cbd4e2885dc52eeecff2ec0a3
- MD5 049d9b6098df9a16136c8510defde6ef
- SHA1 0907958aa1db14ca5eb2510e4b1cf6f4e5a1cf9b
- SHA512 f54ec602aff61170c5a3f6c18134baf8bf19ae55bce90bd2db378a207d9d17e6357e367f0845d038a3719d1a6eb4cdf0c81d9dd0dc1247a79557a0f0a98dc6fb
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBwB/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUpXbVz8eLFcz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Mint4J\optiaec.exe
- Size 4.1MB
- SHA256 47c56cc1d08ea18d285582b8a3975d708fc5c7e3a6a8c1f949496c5590d1f467
- MD5 22af65214bc5a4e9b0ca4491bba76879
- SHA1 d9ef6f2b1ed70bb3f555a52b17e843cd68735405
- SHA512 09f25f55da92437bf6902bc351e920f92042a83f6f6076d504f8a81e0e8c7dd5d9ef54e87968c0825e1fe7a4f0d6c88817cf9b7ff555016b517d3beefa11fbf5
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBtB/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUpObVz8eLFcz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Mint4J\optiaec.exe
- Size 582KB
- SHA256 14aff9b262d70b25b2d6b670fe13153a28731912361d2ada792c7ac23338f85a
- MD5 993afae43cb51a34173fd0aa01d92e8b
- SHA1 4693479849b67c13ef5820b254ea7809e69e3d1a
- SHA512 b36d9670a85d337ac4bc4d4372d5f2c9a0670c0deffd2e4845b90d11202bfd0af441b2241f70fd83e90c419a0ce24bf9abdac7cbc8ba01c0a99e26fae20504b4
- SSDEEP 12288:6ne3n0DmAm67YEjAyu6qJ/+WS5axBdSqpcVdSxL5XOEVpQEX:6nxDZV7xMyu6qJ2WSYxBdSqpcVdm5XR5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 201B
- SHA256 60368aef9a3b154ca83544480ca374af716d535b476e63043959f0c077cd84dd
- MD5 cee5eb87891b09c1a64d73533edafb9e
- SHA1 c1cc2b7c0840d4a402af23af2695f92346e926fe
- SHA512 1575734e0913a9609452c5184c7c0272c65a9487f33568b925b94e47567eb0a4d88dc40eed984d0e93a8784aaf638c2e2073948bdb81fa38586b90c0c58bb946
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 169B
- SHA256 ca76d0e7a36df31ab2289419e8bc6b9b8d367ba44836b869ce44b45632f6ba6b
- MD5 38b147dad3fa779fe9e0ac684f4c2bb9
- SHA1 112d7673ba012d06f1fb66a1d651d62d0af80962
- SHA512 c4951adaff4c2ddbc3009f6a3c09ebac9f50b458871a2f3ff5c85a6891cd3acb09984a819eddc2afc7acfd00d7330eee04de15c97f8609e37408c6491afc9d4a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecdevdob.exe
- Size 4.1MB
- SHA256 a7754bfb1cc4e8806a771acaafb01b9dab8430a0cf8e4e177f65c26922a3b1e9
- MD5 dbd405904a5e221f0d9367ef50449d92
- SHA1 f63d2afec3eac5943e5abc71771a7fac7b53e3bc
- SHA512 867d51f5c10bc93950a0e43c4931116f984a3c8b1d1803a8b5cfee595a1022e5603409559594950fcdd299a5295571b37f09aec3a0824e171eb7ade6c6e2f052
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBRB/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUpObVz8eLFcz
- MD5 SHA1 SHA512 SSDEEP