Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 17:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8b4426996693609e2d40bf2a3d41a7a0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
8b4426996693609e2d40bf2a3d41a7a0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 8b4426996693609e2d40bf2a3d41a7a0_NeikiAnalytics.exe
- Size 4.1MB
- Sample240603-vre73see68
- SHA256 59055ba3471d7ddbf86640a2024fe2de6f5f2f25d3292d80cb93c97e56b04168
- MD5 8b4426996693609e2d40bf2a3d41a7a0
- SHA1 4c8629f8671dda5b7f9576a8b02ac76bdd4cc176
- SHA512 0175c1d73178fefce40d8153623ec826334dd532b31b5cd6032433ffe9aca0ba5327e8bfefb0635cc15740669311840f189ce3eab4785e71c6146d24040b3324
- SSDEEP 98304:+R0pI/IQlUoMPdmpSpt4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdmu5n9klRKN41v
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation Admin% - Executes dropped EXE 2 IoCs
pid Process 2624 xoptiec.exe 2860 Admin% - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\IntelprocG7\\xoptiec.exe" 8b4426996693609e2d40bf2a3d41a7a0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\GalaxN8\\optidevloc.exe" 8b4426996693609e2d40bf2a3d41a7a0_NeikiAnalytics.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 2356 ipconfig.exe 2616 NETSTAT.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3660 8b4426996693609e2d40bf2a3d41a7a0_NeikiAnalytics.exe 3660 8b4426996693609e2d40bf2a3d41a7a0_NeikiAnalytics.exe 3660 8b4426996693609e2d40bf2a3d41a7a0_NeikiAnalytics.exe 3660 8b4426996693609e2d40bf2a3d41a7a0_NeikiAnalytics.exe 2624 xoptiec.exe 2624 xoptiec.exe 3660 8b4426996693609e2d40bf2a3d41a7a0_NeikiAnalytics.exe 3660 8b4426996693609e2d40bf2a3d41a7a0_NeikiAnalytics.exe 2624 xoptiec.exe 2624 xoptiec.exe 2860 Admin% 2860 Admin% 3660 8b4426996693609e2d40bf2a3d41a7a0_NeikiAnalytics.exe 3660 8b4426996693609e2d40bf2a3d41a7a0_NeikiAnalytics.exe 2624 xoptiec.exe 2624 xoptiec.exe 2860 Admin% 2860 Admin% 3660 8b4426996693609e2d40bf2a3d41a7a0_NeikiAnalytics.exe 3660 8b4426996693609e2d40bf2a3d41a7a0_NeikiAnalytics.exe 2624 xoptiec.exe 2624 xoptiec.exe 2860 Admin% 2860 Admin% 3660 8b4426996693609e2d40bf2a3d41a7a0_NeikiAnalytics.exe 3660 8b4426996693609e2d40bf2a3d41a7a0_NeikiAnalytics.exe 2624 xoptiec.exe 2624 xoptiec.exe 2860 Admin% 2860 Admin% 3660 8b4426996693609e2d40bf2a3d41a7a0_NeikiAnalytics.exe 3660 8b4426996693609e2d40bf2a3d41a7a0_NeikiAnalytics.exe 2624 xoptiec.exe 2624 xoptiec.exe 2860 Admin% 2860 Admin% 3660 8b4426996693609e2d40bf2a3d41a7a0_NeikiAnalytics.exe 3660 8b4426996693609e2d40bf2a3d41a7a0_NeikiAnalytics.exe 2624 xoptiec.exe 2624 xoptiec.exe 2860 Admin% 2860 Admin% 3660 8b4426996693609e2d40bf2a3d41a7a0_NeikiAnalytics.exe 3660 8b4426996693609e2d40bf2a3d41a7a0_NeikiAnalytics.exe 2624 xoptiec.exe 2624 xoptiec.exe 2860 Admin% 2860 Admin% 3660 8b4426996693609e2d40bf2a3d41a7a0_NeikiAnalytics.exe 3660 8b4426996693609e2d40bf2a3d41a7a0_NeikiAnalytics.exe 2624 xoptiec.exe 2624 xoptiec.exe 2860 Admin% 2860 Admin% 3660 8b4426996693609e2d40bf2a3d41a7a0_NeikiAnalytics.exe 3660 8b4426996693609e2d40bf2a3d41a7a0_NeikiAnalytics.exe 2624 xoptiec.exe 2624 xoptiec.exe 2860 Admin% 2860 Admin% 3660 8b4426996693609e2d40bf2a3d41a7a0_NeikiAnalytics.exe 3660 8b4426996693609e2d40bf2a3d41a7a0_NeikiAnalytics.exe 2624 xoptiec.exe 2624 xoptiec.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2616 NETSTAT.EXE - Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 3660 wrote to memory of 2624 3660 8b4426996693609e2d40bf2a3d41a7a0_NeikiAnalytics.exe 88 PID 3660 wrote to memory of 2624 3660 8b4426996693609e2d40bf2a3d41a7a0_NeikiAnalytics.exe 88 PID 3660 wrote to memory of 2624 3660 8b4426996693609e2d40bf2a3d41a7a0_NeikiAnalytics.exe 88 PID 2624 wrote to memory of 2860 2624 xoptiec.exe 91 PID 2624 wrote to memory of 2860 2624 xoptiec.exe 91 PID 2624 wrote to memory of 2860 2624 xoptiec.exe 91 PID 2860 wrote to memory of 3156 2860 Admin% 100 PID 2860 wrote to memory of 3156 2860 Admin% 100 PID 2860 wrote to memory of 3156 2860 Admin% 100 PID 2860 wrote to memory of 4180 2860 Admin% 102 PID 2860 wrote to memory of 4180 2860 Admin% 102 PID 2860 wrote to memory of 4180 2860 Admin% 102 PID 2860 wrote to memory of 1988 2860 Admin% 104 PID 2860 wrote to memory of 1988 2860 Admin% 104 PID 2860 wrote to memory of 1988 2860 Admin% 104 PID 3156 wrote to memory of 2356 3156 cmd.exe 106 PID 3156 wrote to memory of 2356 3156 cmd.exe 106 PID 3156 wrote to memory of 2356 3156 cmd.exe 106 PID 4180 wrote to memory of 2616 4180 cmd.exe 107 PID 4180 wrote to memory of 2616 4180 cmd.exe 107 PID 4180 wrote to memory of 2616 4180 cmd.exe 107 PID 2860 wrote to memory of 4216 2860 Admin% 115 PID 2860 wrote to memory of 4216 2860 Admin% 115 PID 2860 wrote to memory of 4216 2860 Admin% 115
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b4426996693609e2d40bf2a3d41a7a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\8b4426996693609e2d40bf2a3d41a7a0_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\IntelprocG7\xoptiec.exeC:\IntelprocG7\xoptiec.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin%C:\Users\Admin%3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ipconfig > C:\Users\Admin\ipconfig.txt4⤵
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Windows\SysWOW64\ipconfig.exeipconfig5⤵
- Gathers network information
PID:2356
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c netstat -a > C:\Users\Admin\netstat.txt4⤵
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Windows\SysWOW64\NETSTAT.EXEnetstat -a5⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:2616
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c dir C:\*.txt /b /s >> C:\Users\Admin\grubb.list4⤵PID:1988
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c dir C:\*.doc /b /s >> C:\Users\Admin\grubb.list4⤵PID:4216
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\GalaxN8\optidevloc.exe
- Size 256B
- SHA256 82e8f656f8eb55c46453962cd11965172a5564eb82c56788f85f83dda46995a8
- MD5 7b3cffac7066949173af9dec430e50ef
- SHA1 4c7dd08e8b1cbe82c512820c7053bd053b06d424
- SHA512 23b204cb0e6bdfb0aa9170914f3a82b60f8ddda4c76fd13b8df933d68165658435a634f1fa5974cde19cb1ee82cc61a4618c9b581c7ae6d0dfb43223fe6e8151
- MD5 SHA1 SHA512
- Path C:\GalaxN8\optidevloc.exe
- Size 4.1MB
- SHA256 40962885a733f7c6986525e21493176e507e04d53f6cfc1a5ba87e47836c5c9f
- MD5 e908c776ae45c4e778edd73266690aa0
- SHA1 076aba2cccd982f1b8536da781ba823e4203a5d8
- SHA512 c4fb2915d9a8f24ba425ff236bf0ec1a1e56213b650d287c7fb722c8ce0a3ad2e6f28d889133d916926cad2a8c63017723e5f73225518d3690f87ef62fc749d4
- SSDEEP 98304:+R0pI/IQlUoMPdmpSpS4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdmZ5n9klRKN41v
- MD5 SHA1 SHA512 SSDEEP
- Path C:\GalaxN8\optidevloc.exe
- Size 20KB
- SHA256 6d936842e9500ac54f463f0aa28fe02f76bc48a010a4ba7fd4b6882d2b5e599b
- MD5 b92414c672ba9e2925b6757c19791fc3
- SHA1 a11b84b2fca34660c4b4d3eef04dbc31b34f40b6
- SHA512 518fb89373465fc5d3855acf15cf212b475a8da5649ccc0b520528f04fedc0294ad911407201f8e00807879a5c14098a17c34e837296d7662ac2b7861814bf4b
- SSDEEP 384:PLT5lDnYcy/ES70S7Tq6xRVtLiD1APk/h:PLT5ZRHUj7TRxRVED1bJ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\IntelprocG7\xoptiec.exe
- Size 4.1MB
- SHA256 271bd16024632d550527cd49efafb7438a88406c936ae41e55953b53e5fa82ac
- MD5 c37762043e6bf391f868752966965690
- SHA1 4c66bb1adbcad7e9c9c80dc2913f3b30ae421756
- SHA512 0407674f6491a03587aa52640f1de5070f85fb0460548acfb1fdef8aaae687b4b5afe2130050e3b2d210fc6d392b5f144941c1b27d711aa8825e16149d5948bd
- SSDEEP 98304:+R0pI/IQlUoMPdmpSps4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdmb5n9klRKN41v
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin%
- Size 4.1MB
- SHA256 e09a7197261420859b036c03dbf428eafea8a83fd0f3e3d16fa043967fdab621
- MD5 cbf06098316d64f76fc7e67c0bbe9ac7
- SHA1 28e55e502b73d269c4a6a8c0401b29a2823a989e
- SHA512 fe395fc54355f33bbdcd121752410c186257d18c6327a599d9d6e90e675a0488157ed5ebe094e154912e3ff6a38576aed78cc1a00f0dce5bf074f0153b179c0b
- SSDEEP 98304:+R0pI/IQlUoMPdmpSpf4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdmc5n9klRKN41v
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 213B
- SHA256 b398d5463342fdee3802cec35b34bb2f74f6caf56c28454e8cf49eeab36bbddd
- MD5 d632fddcd46d36573e9ae46cf9d6dd82
- SHA1 ba5343a02a2bf1c671e0e8129c988a01099d3ec3
- SHA512 d58925714a7219e54e443057795b582ba5d447fc84b772debc7569c0858b001e0321be89014eeb0c7f788f61783c6c700b61fe8801efcc9a56b6b11b2227d7da
- MD5 SHA1 SHA512
- Path C:\Users\Admin\grubb.list
- Size 40KB
- SHA256 5551182c242523d678b230bd9da0522c017850240bb3318e747197e5ac9c5bd4
- MD5 eb9b4ae18eb34cff9544fdaed468b6ef
- SHA1 9a3c5d90fe049b7d141f67c23e1ab7e3056cf6e7
- SHA512 9614ca8213b83e0a7e565ba2db1b24e56015d5df68a0fe796d80704d7d853d0396f756409d384827e90a1d6f237e798362ac8b2fee44be48ec84ce0c4f5e29ff
- SSDEEP 384:o6/XOYA6Zt/nv1MJGzCWMkg6Oo70adWoRGPslqjA6UdhF:o6/XTttOo7dD
- MD5 SHA1 SHA512 SSDEEP