Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 19:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8e61639eaaf6f328552b42e95f34b1b0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
8e61639eaaf6f328552b42e95f34b1b0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 8e61639eaaf6f328552b42e95f34b1b0_NeikiAnalytics.exe
- Size 3.1MB
- Sample240603-xtgj2age62
- SHA256 a52eca5370d82466f26f22cfb0df466daf5d43f9b686c317f0c2461075f8b433
- MD5 8e61639eaaf6f328552b42e95f34b1b0
- SHA1 9aa62175e4b8e0e5572d62fb4b69343435eaf847
- SHA512 616b994b47abd227ef099ef2d1f6a92276491eff13cd2dab0a54a10662f92c460d854a9eae9a3c66aa05783dd7482a39667d17d03c769a9cf63f114dee23c211
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBeB/bSqz8:sxX7QnxrloE5dpUpVbVz8
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysxopti.exe 8e61639eaaf6f328552b42e95f34b1b0_NeikiAnalytics.exe - Executes dropped EXE 2 IoCs
pid Process 4564 sysxopti.exe 860 xbodloc.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\SysDrvW2\\xbodloc.exe" 8e61639eaaf6f328552b42e95f34b1b0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\Galax0L\\boddevec.exe" 8e61639eaaf6f328552b42e95f34b1b0_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4824 8e61639eaaf6f328552b42e95f34b1b0_NeikiAnalytics.exe 4824 8e61639eaaf6f328552b42e95f34b1b0_NeikiAnalytics.exe 4824 8e61639eaaf6f328552b42e95f34b1b0_NeikiAnalytics.exe 4824 8e61639eaaf6f328552b42e95f34b1b0_NeikiAnalytics.exe 4564 sysxopti.exe 4564 sysxopti.exe 860 xbodloc.exe 860 xbodloc.exe 4564 sysxopti.exe 4564 sysxopti.exe 860 xbodloc.exe 860 xbodloc.exe 4564 sysxopti.exe 4564 sysxopti.exe 860 xbodloc.exe 860 xbodloc.exe 4564 sysxopti.exe 4564 sysxopti.exe 860 xbodloc.exe 860 xbodloc.exe 4564 sysxopti.exe 4564 sysxopti.exe 860 xbodloc.exe 860 xbodloc.exe 4564 sysxopti.exe 4564 sysxopti.exe 860 xbodloc.exe 860 xbodloc.exe 4564 sysxopti.exe 4564 sysxopti.exe 860 xbodloc.exe 860 xbodloc.exe 4564 sysxopti.exe 4564 sysxopti.exe 860 xbodloc.exe 860 xbodloc.exe 4564 sysxopti.exe 4564 sysxopti.exe 860 xbodloc.exe 860 xbodloc.exe 4564 sysxopti.exe 4564 sysxopti.exe 860 xbodloc.exe 860 xbodloc.exe 4564 sysxopti.exe 4564 sysxopti.exe 860 xbodloc.exe 860 xbodloc.exe 4564 sysxopti.exe 4564 sysxopti.exe 860 xbodloc.exe 860 xbodloc.exe 4564 sysxopti.exe 4564 sysxopti.exe 860 xbodloc.exe 860 xbodloc.exe 4564 sysxopti.exe 4564 sysxopti.exe 860 xbodloc.exe 860 xbodloc.exe 4564 sysxopti.exe 4564 sysxopti.exe 860 xbodloc.exe 860 xbodloc.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4824 wrote to memory of 4564 4824 8e61639eaaf6f328552b42e95f34b1b0_NeikiAnalytics.exe 84 PID 4824 wrote to memory of 4564 4824 8e61639eaaf6f328552b42e95f34b1b0_NeikiAnalytics.exe 84 PID 4824 wrote to memory of 4564 4824 8e61639eaaf6f328552b42e95f34b1b0_NeikiAnalytics.exe 84 PID 4824 wrote to memory of 860 4824 8e61639eaaf6f328552b42e95f34b1b0_NeikiAnalytics.exe 85 PID 4824 wrote to memory of 860 4824 8e61639eaaf6f328552b42e95f34b1b0_NeikiAnalytics.exe 85 PID 4824 wrote to memory of 860 4824 8e61639eaaf6f328552b42e95f34b1b0_NeikiAnalytics.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\8e61639eaaf6f328552b42e95f34b1b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\8e61639eaaf6f328552b42e95f34b1b0_NeikiAnalytics.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysxopti.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysxopti.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4564
-
-
C:\SysDrvW2\xbodloc.exeC:\SysDrvW2\xbodloc.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:860
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Galax0L\boddevec.exe
- Size 8KB
- SHA256 1b3fa51ede60d19459b442b532eb4b1d11097bb17170bf5ee14f3ea9b861a657
- MD5 b6a3be42755c871ed4a546b6cfb8e5e8
- SHA1 45db3ee8541418f154843d4a791071b3c3c65177
- SHA512 a8da5f15c36d992cfc7ca775a317e0993eb466cea69d4ada5e081faf4966bd49fffeba4f7da600f3f85df157c088f8a8667bf63290d81e9aec5b08b27cd1e42e
- SSDEEP 96:3k1Ycg+n1FZlXnzDnznTT3jkHnHO1n9dn9FhXY2:0fgezXzDzjUHK9d9/XY2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Galax0L\boddevec.exe
- Size 3.1MB
- SHA256 f180801d50d5b319bd040908aa18e3132323c165c3563862183fb35c337a7b16
- MD5 4e207ac87c69f46e5d4808fc430b9132
- SHA1 d8e0af6505ead67c7d77432cae64c12bf3ea29bf
- SHA512 adf963675d1610c2dbec98c2a7cab10f0513a17ead6f272470d7a69d22f169ce0a2971cced06266fe5568c6b81b8ad1aa0d432504c154fb979bb183987da4251
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBfB/bSqz8:sxX7QnxrloE5dpUpEbVz8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\SysDrvW2\xbodloc.exe
- Size 179KB
- SHA256 3d3072d4afe057ce10151ad8b3992a79747277d4684a9ea4822514ab17665479
- MD5 bf71ccff1edb7ebe7864719a59242753
- SHA1 414fbca2dae2f26f15e5f25177e9b85ce2ffdda8
- SHA512 d648674f41d48d4b110d4cc743eef9026ea990dc4b5f5b63d0507bd3e6257e5a44ed758794700f7bf03c546f7cb4f0523a3c50b27d9b8ef6591f3be16c66bcee
- SSDEEP 3072:6uOByTKI3n0dZHm7+zsMcSgUXwr6a/Ej2vfGm+7s+ndOPtiT7gVU:6nyJ3n0Dm7+zm6wr6YEjAumIaU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\SysDrvW2\xbodloc.exe
- Size 3.1MB
- SHA256 b5732af95bc6df2038ba8a8fcd401172c50da17a30504b24b21a5e940dd7a400
- MD5 5d17299410a70b0482a9bd22365ebf94
- SHA1 9212cb95de34a9763eaddf078d2dcd014e12e1bb
- SHA512 dccf1775ea8ea99e383f6ba412c37b6565d62b34c4f958f8239aeca17c5a6fe5896df9eb65ae091cb125ae7b7d0e98e38015a1547717ae4cae630a8509802e4d
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBEB/bSqz8:sxX7QnxrloE5dpUpnbVz8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 204B
- SHA256 777a15b5eae14104f1ebe9c8965dc82c9f77c289f3bd11eafdb5afaf1d4ac4eb
- MD5 34a8da5436584128d931b363cf88513e
- SHA1 9f674306b1a758558d3b34239e80109d4d9fa71d
- SHA512 1e620faf3b4d3dad6945b58d0f54fc8cdcab3cddbf86299ec81a71247b665dcc0d617d788006b49bfbfc893da0feaa045fb8ee181adc5cfe8b7ac95a84a0c131
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 172B
- SHA256 27b27421fdc7523c80c0481f7ad45782eb5bcf52736647cf5027fc3c0aa736dd
- MD5 2229de4fb3a5f1e213150cff2be7fc3d
- SHA1 fce70723eb5d64ccd8c9e6fe0da1423697513e51
- SHA512 2c6e856b7822f1601c1754994b56581f84eaaf55c88d96d66f3eb7a06e3e88d1c0984b8322175663dbe3831110ddab4c8bdba466091a1178f2797fbde739f9cd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysxopti.exe
- Size 3.1MB
- SHA256 e781da9dddf7984da364e066afdb6103ed599a736c75da51677af6fd49df77e3
- MD5 c800780a054217db6b779f1d2cdb4ed1
- SHA1 482392d0ed15b3b102fccbce555ce320661b51b5
- SHA512 d8d6dc44a08d2d16d5dbb10dba5744f522be97c50cea9f6e5b2e42714184f30dd29df281e2e7efa18c89c6066d959df3a5c136fb48a1a8b79f10737d578fffcb
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBSB/bSqz8:sxX7QnxrloE5dpUp5bVz8
- MD5 SHA1 SHA512 SSDEEP