Analysis
- max time kernel
150s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 17:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
669c575184d8bdb774d6b2d5f5179260_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
669c575184d8bdb774d6b2d5f5179260_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 669c575184d8bdb774d6b2d5f5179260_NeikiAnalytics.exe
- Size 3.1MB
- Sample240603-vt2h4aef56
- SHA256 129b4a65f55ac4a387c79dfc739ad0069ed37585d46b3f817d5a17ec3511ab0b
- MD5 669c575184d8bdb774d6b2d5f5179260
- SHA1 19c5992e19e0b7f805626b068681b7fa5e11d4bf
- SHA512 42ad75278d1101a0a384a0848f8235ecf5ca953017d2448a514e78227b31885ec6fe92ebd7e3a63acf84b333710075c767e423249339ff2a0485bdfd6bc4e098
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBpB/bSqz8:sxX7QnxrloE5dpUpWbVz8
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecadob.exe 669c575184d8bdb774d6b2d5f5179260_NeikiAnalytics.exe - Executes dropped EXE 2 IoCs
pid Process 4108 ecadob.exe 908 devdobloc.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\Intelproc2J\\devdobloc.exe" 669c575184d8bdb774d6b2d5f5179260_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\Mint2F\\optidevloc.exe" 669c575184d8bdb774d6b2d5f5179260_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1188 669c575184d8bdb774d6b2d5f5179260_NeikiAnalytics.exe 1188 669c575184d8bdb774d6b2d5f5179260_NeikiAnalytics.exe 1188 669c575184d8bdb774d6b2d5f5179260_NeikiAnalytics.exe 1188 669c575184d8bdb774d6b2d5f5179260_NeikiAnalytics.exe 4108 ecadob.exe 4108 ecadob.exe 908 devdobloc.exe 908 devdobloc.exe 4108 ecadob.exe 4108 ecadob.exe 908 devdobloc.exe 908 devdobloc.exe 4108 ecadob.exe 4108 ecadob.exe 908 devdobloc.exe 908 devdobloc.exe 4108 ecadob.exe 4108 ecadob.exe 908 devdobloc.exe 908 devdobloc.exe 4108 ecadob.exe 4108 ecadob.exe 908 devdobloc.exe 908 devdobloc.exe 4108 ecadob.exe 4108 ecadob.exe 908 devdobloc.exe 908 devdobloc.exe 4108 ecadob.exe 4108 ecadob.exe 908 devdobloc.exe 908 devdobloc.exe 4108 ecadob.exe 4108 ecadob.exe 908 devdobloc.exe 908 devdobloc.exe 4108 ecadob.exe 4108 ecadob.exe 908 devdobloc.exe 908 devdobloc.exe 4108 ecadob.exe 4108 ecadob.exe 908 devdobloc.exe 908 devdobloc.exe 4108 ecadob.exe 4108 ecadob.exe 908 devdobloc.exe 908 devdobloc.exe 4108 ecadob.exe 4108 ecadob.exe 908 devdobloc.exe 908 devdobloc.exe 4108 ecadob.exe 4108 ecadob.exe 908 devdobloc.exe 908 devdobloc.exe 4108 ecadob.exe 4108 ecadob.exe 908 devdobloc.exe 908 devdobloc.exe 4108 ecadob.exe 4108 ecadob.exe 908 devdobloc.exe 908 devdobloc.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1188 wrote to memory of 4108 1188 669c575184d8bdb774d6b2d5f5179260_NeikiAnalytics.exe 89 PID 1188 wrote to memory of 4108 1188 669c575184d8bdb774d6b2d5f5179260_NeikiAnalytics.exe 89 PID 1188 wrote to memory of 4108 1188 669c575184d8bdb774d6b2d5f5179260_NeikiAnalytics.exe 89 PID 1188 wrote to memory of 908 1188 669c575184d8bdb774d6b2d5f5179260_NeikiAnalytics.exe 90 PID 1188 wrote to memory of 908 1188 669c575184d8bdb774d6b2d5f5179260_NeikiAnalytics.exe 90 PID 1188 wrote to memory of 908 1188 669c575184d8bdb774d6b2d5f5179260_NeikiAnalytics.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\669c575184d8bdb774d6b2d5f5179260_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\669c575184d8bdb774d6b2d5f5179260_NeikiAnalytics.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecadob.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecadob.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4108
-
-
C:\Intelproc2J\devdobloc.exeC:\Intelproc2J\devdobloc.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4140 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:81⤵PID:3084
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Intelproc2J\devdobloc.exe
- Size 3.1MB
- SHA256 b90d19d3a0dcca01a52bb17d4e593b363e6034ec89bf38160e1862bf3f65c828
- MD5 2a9646f64823a9f3364968ef8ad07a8c
- SHA1 4d622e06b94cef5df7e0816d8150ebd7592ccd6e
- SHA512 37f9c9a448db28e68e5d8745dec2d170d4b508d7a9e36e6b73639090eaec91bf43790bd00166ce8cd997645cb6a40400f4bee32eddcc50da083abdccb5b54d0e
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBrB/bSqz8:sxX7QnxrloE5dpUpkbVz8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Mint2F\optidevloc.exe
- Size 123KB
- SHA256 574c3d79128b7d5cef9b074edb3eba745d55c1596c6545b67114825a3edca001
- MD5 9eb53b52bae5ba89c111cee2fbecedb7
- SHA1 f2219efbf58e2f65d1ec24b41f14be4fde4177a9
- SHA512 769228330d72be3776d493f1e7dce4616fa15c7b6fe56b1f174f650ac7700086efc13cb344d52c275fc2bc6210995d1fb858ed60450bde63c7356228687005db
- SSDEEP 3072:6uOByTKI3n0dZHm7+zsMcSgUXwr6a/Ej2vfGm1:6nyJ3n0Dm7+zm6wr6YEjAum1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Mint2F\optidevloc.exe
- Size 14KB
- SHA256 ea6a4772229675d6d0144ac1cf4f7831259b4edd25d7706903c3f2e2e3ca7243
- MD5 3d45b0eaee6cd60ad4f5568ac16ef258
- SHA1 d7e11caa9a67cadd55724afe2d1d84adab824cea
- SHA512 2d25a653389ee60d4d1a922b31cda5d7dac66d70cb6b72b1e60925b039a1066d16fe93dd478af6cc0fe4eb3b73c7cab86c4cc39eb4f0fb4da694adef8999708b
- SSDEEP 192:0fgezXzDzjUHK9d9/XYxFn8E/ES76xS7BzFqJgjYJjay:04ezXTIk/IxT/ES70S7TqOOx
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 208B
- SHA256 c9a4d07ab840b869dbe4bd19b86540f047a79ba8e76fff64efcd7511dede0b36
- MD5 bd0274e319fdf10de0d14d631bff30ae
- SHA1 b5537522fd56d6ce31f0d5bb260687efc31647ec
- SHA512 3e388333f66a101ab1551bda64438d6d1e8733c7b8ff65d770673a09e746a4f628d7034b7ea20ce71d96322c695657a9f517af26a6addbb7f5cc5c6d7b02c7d0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 176B
- SHA256 e31d92fdb677f461675f0a924e8c59e68bee6ea9be6271f7f5509f4328cc6a32
- MD5 8ef7f27c7187b9928c7f76b2bacdcb4b
- SHA1 0f9defab41a3f9f7d2e23d8e66efed986b9f3a1c
- SHA512 373ea253655309f2cb28aeb1875c5f25f60921f22ecfaf373f8a112e63733172974fe8f51107c6ab8a3f731dce1d215f27688bd7b93ea3bb29112e6cc56ba4a7
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecadob.exe
- Size 3.1MB
- SHA256 5271dd3df9a91453927a29fd4a059503f9fcb9961b06365d991d466a4c74c24e
- MD5 aeaf110f296fec0c99a337f0c2dfdd5f
- SHA1 7bcb5c8b0d5c55a03d5b8dd27c8418e94f3d7dec
- SHA512 3e4fd026a5bbe121679436b92d8c6ef9a2d491862d1fa9f4ce1316dd6eaee2876f84da0d0f6536ad8e27d0486969cfda4b7c2c6c88b8a5d7818f41ce1b6e9429
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBIB/bSqz8:sxX7QnxrloE5dpUpfbVz8
- MD5 SHA1 SHA512 SSDEEP