Analysis
- max time kernel
150s - max time network
126s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 17:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d0e8175306ff6452305cd5a2d89614d0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
d0e8175306ff6452305cd5a2d89614d0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target d0e8175306ff6452305cd5a2d89614d0_NeikiAnalytics.exe
- Size 2.6MB
- Sample240603-wdp1ssfc86
- SHA256 39241a0af7d1fc490c61dd7b2f26a5c2883f616d746918b4f6532150327399b2
- MD5 d0e8175306ff6452305cd5a2d89614d0
- SHA1 0dae4760b56833adb33d4cd70b736e6a3be09af5
- SHA512 fca069664bd58876b9fb281597ea1f33f46c443f8837c0bc3879267546a6f6d1365dcdbb85ccb34cf97f1162a6e31fdba2a552d5c64d99d938bdb85cbe869a56
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBcB/bS:sxX7QnxrloE5dpUpTb
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevopti.exe d0e8175306ff6452305cd5a2d89614d0_NeikiAnalytics.exe - Executes dropped EXE 2 IoCs
pid Process 1084 locdevopti.exe 2964 devdobsys.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\IntelprocJQ\\devdobsys.exe" d0e8175306ff6452305cd5a2d89614d0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\LabZ9G\\optialoc.exe" d0e8175306ff6452305cd5a2d89614d0_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2532 d0e8175306ff6452305cd5a2d89614d0_NeikiAnalytics.exe 2532 d0e8175306ff6452305cd5a2d89614d0_NeikiAnalytics.exe 2532 d0e8175306ff6452305cd5a2d89614d0_NeikiAnalytics.exe 2532 d0e8175306ff6452305cd5a2d89614d0_NeikiAnalytics.exe 1084 locdevopti.exe 1084 locdevopti.exe 2964 devdobsys.exe 2964 devdobsys.exe 1084 locdevopti.exe 1084 locdevopti.exe 2964 devdobsys.exe 2964 devdobsys.exe 1084 locdevopti.exe 1084 locdevopti.exe 2964 devdobsys.exe 2964 devdobsys.exe 1084 locdevopti.exe 1084 locdevopti.exe 2964 devdobsys.exe 2964 devdobsys.exe 1084 locdevopti.exe 1084 locdevopti.exe 2964 devdobsys.exe 2964 devdobsys.exe 1084 locdevopti.exe 1084 locdevopti.exe 2964 devdobsys.exe 2964 devdobsys.exe 1084 locdevopti.exe 1084 locdevopti.exe 2964 devdobsys.exe 2964 devdobsys.exe 1084 locdevopti.exe 1084 locdevopti.exe 2964 devdobsys.exe 2964 devdobsys.exe 1084 locdevopti.exe 1084 locdevopti.exe 2964 devdobsys.exe 2964 devdobsys.exe 1084 locdevopti.exe 1084 locdevopti.exe 2964 devdobsys.exe 2964 devdobsys.exe 1084 locdevopti.exe 1084 locdevopti.exe 2964 devdobsys.exe 2964 devdobsys.exe 1084 locdevopti.exe 1084 locdevopti.exe 2964 devdobsys.exe 2964 devdobsys.exe 1084 locdevopti.exe 1084 locdevopti.exe 2964 devdobsys.exe 2964 devdobsys.exe 1084 locdevopti.exe 1084 locdevopti.exe 2964 devdobsys.exe 2964 devdobsys.exe 1084 locdevopti.exe 1084 locdevopti.exe 2964 devdobsys.exe 2964 devdobsys.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2532 wrote to memory of 1084 2532 d0e8175306ff6452305cd5a2d89614d0_NeikiAnalytics.exe 81 PID 2532 wrote to memory of 1084 2532 d0e8175306ff6452305cd5a2d89614d0_NeikiAnalytics.exe 81 PID 2532 wrote to memory of 1084 2532 d0e8175306ff6452305cd5a2d89614d0_NeikiAnalytics.exe 81 PID 2532 wrote to memory of 2964 2532 d0e8175306ff6452305cd5a2d89614d0_NeikiAnalytics.exe 82 PID 2532 wrote to memory of 2964 2532 d0e8175306ff6452305cd5a2d89614d0_NeikiAnalytics.exe 82 PID 2532 wrote to memory of 2964 2532 d0e8175306ff6452305cd5a2d89614d0_NeikiAnalytics.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\d0e8175306ff6452305cd5a2d89614d0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\d0e8175306ff6452305cd5a2d89614d0_NeikiAnalytics.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevopti.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevopti.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1084
-
-
C:\IntelprocJQ\devdobsys.exeC:\IntelprocJQ\devdobsys.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2964
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\IntelprocJQ\devdobsys.exe
- Size 1.2MB
- SHA256 dafac931efd38b6fea68c6f71167fdd825c96cdf65d4e548637580e5769131f3
- MD5 52226a9e409167095ba3a7f761c73987
- SHA1 356e41a4f8c4ee7935b736cf59b5e65512badebe
- SHA512 196c5f8312d1caa49dfeda86f99d54d46d787a9bde48ca896c481f44744639e69444201d830efd17e0daf70ef9a1ca19316861383ab05473c7d063be1f59a69f
- SSDEEP 24576:6nxDZV7xMyu6qJ2WSYxBdSqpcVdm5XRVpQO3chiIcr1RhSKntaxtooblyiuaf:sxX7665YxRVplZzSKntlGIi
- MD5 SHA1 SHA512 SSDEEP
- Path C:\IntelprocJQ\devdobsys.exe
- Size 2.6MB
- SHA256 bc4ab9eeccc7751c12696cf2865f580bf972e7723a5b49a3675b3de2cf3303df
- MD5 be89e0558f1d28bb740c8a321b6c5898
- SHA1 a92998196e8c6879cc61c655eacf70893baa3e00
- SHA512 16a094c83509cbc22ea0d88ee4c0a857ed9e1d30d1b693ba6de072ef5821a494403e4fced45676eb98781cc46717d59fee333d32c7410457c2efe2facf078985
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBgB/bS:sxX7QnxrloE5dpUp7b
- MD5 SHA1 SHA512 SSDEEP
- Path C:\LabZ9G\optialoc.exe
- Size 2.6MB
- SHA256 f12cac64c77883febeb10af4cf40521d1fa6bd056f5772c8cfecc6ce6acb53f3
- MD5 488324b6f93d6c33f4740b6fd68b0ff4
- SHA1 7980a9dd80442f749bd7a0ab3fd675dd9f7c97de
- SHA512 cdc66ff740264cb18b5c391d2c0c1bc5bfa542f4d6ab85cdeea6e1550d0ce930cc731b6efb3984d27b79266a07fd5b7beea336847d5ae7f777c8ae18d1f06e41
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB5B/bS:sxX7QnxrloE5dpUpOb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\LabZ9G\optialoc.exe
- Size 517KB
- SHA256 9bd4f4e2a47afe0fb71a46b27a0b394bbb7f24ae7fb7923f6aceaad7b0f6fd97
- MD5 1fee45d56a9bf5b6c244d7890c00b7b5
- SHA1 2ea77d6ed67f177d6d22a1e418dd546810632448
- SHA512 6052fa3269fdaf6d2685416434c1c7346dacfb7d7460cc0553c6452e5ecdc4bf71d24866ee17e4e681e46950f351c1a15fb1d10af3d1829c9f0a3891e6179be3
- SSDEEP 12288:6ne3n0DmAm67YEjAyu6qJ/+WS5axBdSqpcVdSxL5XOEVpQL:6nxDZV7xMyu6qJ2WSYxBdSqpcVdm5XRU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 210B
- SHA256 e7e400d8536664a31a62abe5fafe023f7a61be0352c352beb1e0a3d5319e5ea6
- MD5 124872ae596c3b306bfa8d2f9aa3a1b5
- SHA1 f538b73f179e8574b27f43e6ba2179be780cc19e
- SHA512 8a5a0f453a76e7c7f1f5af4b2f4cfd7c65d204d747b476ff3a1a5f7a5895962d40389ce330a80219ee69a5451fbec6afb98e764d9bb84c19cb4dc77e19fc12f4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 178B
- SHA256 b74e1563bab0dde85645e2e692a83747cf7757fa98e787850182418174e1cafe
- MD5 82b3b9485186294c6b1597313d9dfe29
- SHA1 f6416d3a2dfc1300fbb7169680238a88c3319fff
- SHA512 dadbd7689e9f932a7a036223e29892c5cf2bd1009ddc433e88fba7223da31c274dccdd6fe466e5b6a143ab5c5fabbfdd6ebee0e817c22e73ce22b5a6675198b8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locdevopti.exe
- Size 2.6MB
- SHA256 4075f9db07e8c99a07d4690d95d00f455ebd4bb878721a247d7b3a4b26c135ad
- MD5 da823268bcd417289ddae9ad50a8d45b
- SHA1 8649bcf0998780344b226dc0096564d6d21522a1
- SHA512 e7014199492d486270429c168a3ebf56c3a314944d8b804ae783053a86aed0bf36777c06a74f16a31d7051498a47d7aa2020d1f96be25d3e1ee7be1d70dc0ece
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBwB/bS:sxX7QnxrloE5dpUpHb
- MD5 SHA1 SHA512 SSDEEP