Analysis
- max time kernel
149s - max time network
110s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 19:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
174beb4d21e09208b2ed4cc670ed8820_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
174beb4d21e09208b2ed4cc670ed8820_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 174beb4d21e09208b2ed4cc670ed8820_NeikiAnalytics.exe
- Size 3.0MB
- Sample240603-x3asvagg44
- SHA256 54faec692f9c9757b9ffe641b63f457a7711bb70a8e36c5d11d6ae217b3dac4e
- MD5 174beb4d21e09208b2ed4cc670ed8820
- SHA1 9cc7fbbaab013988ba2665af517f00684c29d646
- SHA512 9345bfc20e114b268e496d05bd44710509b6f4225a0e338de77510b20c50215309c26011d11ff10b66b461ac162dc8fa75d7e9df3510a27506a33452693a02a0
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBBB/bSqz8b6LNX:sxX7QnxrloE5dpUpebVz8eLF
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysaopti.exe 174beb4d21e09208b2ed4cc670ed8820_NeikiAnalytics.exe - Executes dropped EXE 2 IoCs
pid Process 4792 sysaopti.exe 4828 xoptisys.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\UserDot0D\\xoptisys.exe" 174beb4d21e09208b2ed4cc670ed8820_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\LabZ0J\\optialoc.exe" 174beb4d21e09208b2ed4cc670ed8820_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1712 174beb4d21e09208b2ed4cc670ed8820_NeikiAnalytics.exe 1712 174beb4d21e09208b2ed4cc670ed8820_NeikiAnalytics.exe 1712 174beb4d21e09208b2ed4cc670ed8820_NeikiAnalytics.exe 1712 174beb4d21e09208b2ed4cc670ed8820_NeikiAnalytics.exe 4792 sysaopti.exe 4792 sysaopti.exe 4828 xoptisys.exe 4828 xoptisys.exe 4792 sysaopti.exe 4792 sysaopti.exe 4828 xoptisys.exe 4828 xoptisys.exe 4792 sysaopti.exe 4792 sysaopti.exe 4828 xoptisys.exe 4828 xoptisys.exe 4792 sysaopti.exe 4792 sysaopti.exe 4828 xoptisys.exe 4828 xoptisys.exe 4792 sysaopti.exe 4792 sysaopti.exe 4828 xoptisys.exe 4828 xoptisys.exe 4792 sysaopti.exe 4792 sysaopti.exe 4828 xoptisys.exe 4828 xoptisys.exe 4792 sysaopti.exe 4792 sysaopti.exe 4828 xoptisys.exe 4828 xoptisys.exe 4792 sysaopti.exe 4792 sysaopti.exe 4828 xoptisys.exe 4828 xoptisys.exe 4792 sysaopti.exe 4792 sysaopti.exe 4828 xoptisys.exe 4828 xoptisys.exe 4792 sysaopti.exe 4792 sysaopti.exe 4828 xoptisys.exe 4828 xoptisys.exe 4792 sysaopti.exe 4792 sysaopti.exe 4828 xoptisys.exe 4828 xoptisys.exe 4792 sysaopti.exe 4792 sysaopti.exe 4828 xoptisys.exe 4828 xoptisys.exe 4792 sysaopti.exe 4792 sysaopti.exe 4828 xoptisys.exe 4828 xoptisys.exe 4792 sysaopti.exe 4792 sysaopti.exe 4828 xoptisys.exe 4828 xoptisys.exe 4792 sysaopti.exe 4792 sysaopti.exe 4828 xoptisys.exe 4828 xoptisys.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1712 wrote to memory of 4792 1712 174beb4d21e09208b2ed4cc670ed8820_NeikiAnalytics.exe 87 PID 1712 wrote to memory of 4792 1712 174beb4d21e09208b2ed4cc670ed8820_NeikiAnalytics.exe 87 PID 1712 wrote to memory of 4792 1712 174beb4d21e09208b2ed4cc670ed8820_NeikiAnalytics.exe 87 PID 1712 wrote to memory of 4828 1712 174beb4d21e09208b2ed4cc670ed8820_NeikiAnalytics.exe 91 PID 1712 wrote to memory of 4828 1712 174beb4d21e09208b2ed4cc670ed8820_NeikiAnalytics.exe 91 PID 1712 wrote to memory of 4828 1712 174beb4d21e09208b2ed4cc670ed8820_NeikiAnalytics.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\174beb4d21e09208b2ed4cc670ed8820_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\174beb4d21e09208b2ed4cc670ed8820_NeikiAnalytics.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysaopti.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysaopti.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4792
-
-
C:\UserDot0D\xoptisys.exeC:\UserDot0D\xoptisys.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4828
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\LabZ0J\optialoc.exe
- Size 3.0MB
- SHA256 528fc14a38ce1abcf9bc1b98132b588a3433b2f4827830e4689c3f2d3f80dac9
- MD5 29d2c7ea9710de76fa28ae91b6a74187
- SHA1 743169996ba7dafdc895b5ecaa3f415c52a663ee
- SHA512 56aea6b32424ef486419ff7697f896c56918c7941c8a5c31cc285688b36735ac279dff401770ebc8d3c7a8d35229bca1213f10e89f70ba4534b72683111daf9a
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBdB/bSqz8b6LNX:sxX7QnxrloE5dpUpSbVz8eLF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\LabZ0J\optialoc.exe
- Size 3.0MB
- SHA256 ef6c4c822373c28eecb14ed470ee81404a3c232c47545204ac0df61b9a745d8e
- MD5 a12d2a988be062204f33bb7d34727a8a
- SHA1 5d923d40f297452a0f006612140ceaabbebde3d9
- SHA512 ca954be49cd83760bc2ceccb1b4bb6d25df16a5a4add58b0bfaa8156434f2a1ed5efbec90ce67a64e66198369813619dc50431a23140b12bcad37e92d00534db
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBCB/bSqz8b6LNX:sxX7QnxrloE5dpUpBbVz8eLF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\UserDot0D\xoptisys.exe
- Size 3.0MB
- SHA256 194738220dfa336f6bd5274a63ad269adba21243840aa1c1321a118ecbcf6601
- MD5 fa6116b2b27b55d7b6a041d20fa93b8d
- SHA1 a906df32a15b8217a462e655df8f0607451c57f3
- SHA512 60344c3e4768ef38280b988cd70aa6fe35783f086950524ff22e269f7017007e3ec29f6e0282fbfa8a8fe852cee87f38f51e93905a3487a51dd3a3626cbf5187
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBHB/bSqz8b6LNX:sxX7QnxrloE5dpUpsbVz8eLF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 205B
- SHA256 cb3f37edc39f479a44194858ded3a5efa5d7fd8ee92ad534b0ac7da0c711cec5
- MD5 b8436182323e160393fa6256caf46c40
- SHA1 3ac8a019fb99af362cede319ba15b08d1a69ac12
- SHA512 c13d52c735abf8de92ff7f25580db40bc94ad8f42913c4dbcc47b0f142c168d91875900d265e9e4d57973fd2f861b0c9eb215c050c446a0edadcd1aeca14803e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 173B
- SHA256 05e0e60c17d9ce704139ea4641c9d6630aed717d7306302b4993a06d76b2f601
- MD5 e589704f09568e269776c9baaae6901f
- SHA1 84af746794d48b99cdd04d0850f4d19c10f6b0f7
- SHA512 0be91a0608235cb5d1af4123af1b936268824a6832f524ab5bd6386f89693996e9e568589296d9608edd6831a7a5529c17c4517890f926380a8b0dc743810b76
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysaopti.exe
- Size 3.0MB
- SHA256 c6db36dfa884d2fb06721b6dee1bf970c0b7d9ac272b255caa05fb92685304e0
- MD5 92a407ec89b0391ac9e371cc06dda5ea
- SHA1 7ff243b668cfd716fb0dc0b9a1fa648e7253c4bf
- SHA512 47ba7e1ab6d9a7fd6720469d72f89366fa97e15d0200fe13fb51a6d04dfe948c5d1757583e8506b6180db979bc8542286cd14069c51dbf8927a1d0ac85ed169e
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBgB/bSqz8b6LNX:sxX7QnxrloE5dpUpTbVz8eLF
- MD5 SHA1 SHA512 SSDEEP