Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
05/06/2024, 01:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
28b9ecb8e6ee0a55cfc68c6d3e58f4c0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
28b9ecb8e6ee0a55cfc68c6d3e58f4c0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 28b9ecb8e6ee0a55cfc68c6d3e58f4c0_NeikiAnalytics.exe
- Size 3.1MB
- Sample240605-ccf7qaag9w
- SHA256 fc9588db328c2e8ab8570d20281c95876ba61e8e634ef67b8bf6cdb3ac06c213
- MD5 28b9ecb8e6ee0a55cfc68c6d3e58f4c0
- SHA1 b54743ca42b7fe31cb856a56d806bd623c567524
- SHA512 fc1d6c28f0c87d59207232718182a85b936928bfb7856ff9b539eadd787eae379be5a81432de4126f2fb6b3445204bbd3c5c74c6226ab5d6cd22d9f13aa5655c
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBdB/bSqz8:sxX7QnxrloE5dpUpWbVz8
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysdevdob.exe 28b9ecb8e6ee0a55cfc68c6d3e58f4c0_NeikiAnalytics.exe - Executes dropped EXE 2 IoCs
pid Process 4904 sysdevdob.exe 4376 xoptiec.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\IntelprocG7\\xoptiec.exe" 28b9ecb8e6ee0a55cfc68c6d3e58f4c0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\GalaxN8\\optidevloc.exe" 28b9ecb8e6ee0a55cfc68c6d3e58f4c0_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4444 28b9ecb8e6ee0a55cfc68c6d3e58f4c0_NeikiAnalytics.exe 4444 28b9ecb8e6ee0a55cfc68c6d3e58f4c0_NeikiAnalytics.exe 4444 28b9ecb8e6ee0a55cfc68c6d3e58f4c0_NeikiAnalytics.exe 4444 28b9ecb8e6ee0a55cfc68c6d3e58f4c0_NeikiAnalytics.exe 4904 sysdevdob.exe 4904 sysdevdob.exe 4376 xoptiec.exe 4376 xoptiec.exe 4904 sysdevdob.exe 4904 sysdevdob.exe 4376 xoptiec.exe 4376 xoptiec.exe 4904 sysdevdob.exe 4904 sysdevdob.exe 4376 xoptiec.exe 4376 xoptiec.exe 4904 sysdevdob.exe 4904 sysdevdob.exe 4376 xoptiec.exe 4376 xoptiec.exe 4904 sysdevdob.exe 4904 sysdevdob.exe 4376 xoptiec.exe 4376 xoptiec.exe 4904 sysdevdob.exe 4904 sysdevdob.exe 4376 xoptiec.exe 4376 xoptiec.exe 4904 sysdevdob.exe 4904 sysdevdob.exe 4376 xoptiec.exe 4376 xoptiec.exe 4904 sysdevdob.exe 4904 sysdevdob.exe 4376 xoptiec.exe 4376 xoptiec.exe 4904 sysdevdob.exe 4904 sysdevdob.exe 4376 xoptiec.exe 4376 xoptiec.exe 4904 sysdevdob.exe 4904 sysdevdob.exe 4376 xoptiec.exe 4376 xoptiec.exe 4904 sysdevdob.exe 4904 sysdevdob.exe 4376 xoptiec.exe 4376 xoptiec.exe 4904 sysdevdob.exe 4904 sysdevdob.exe 4376 xoptiec.exe 4376 xoptiec.exe 4904 sysdevdob.exe 4904 sysdevdob.exe 4376 xoptiec.exe 4376 xoptiec.exe 4904 sysdevdob.exe 4904 sysdevdob.exe 4376 xoptiec.exe 4376 xoptiec.exe 4904 sysdevdob.exe 4904 sysdevdob.exe 4376 xoptiec.exe 4376 xoptiec.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4444 wrote to memory of 4904 4444 28b9ecb8e6ee0a55cfc68c6d3e58f4c0_NeikiAnalytics.exe 88 PID 4444 wrote to memory of 4904 4444 28b9ecb8e6ee0a55cfc68c6d3e58f4c0_NeikiAnalytics.exe 88 PID 4444 wrote to memory of 4904 4444 28b9ecb8e6ee0a55cfc68c6d3e58f4c0_NeikiAnalytics.exe 88 PID 4444 wrote to memory of 4376 4444 28b9ecb8e6ee0a55cfc68c6d3e58f4c0_NeikiAnalytics.exe 91 PID 4444 wrote to memory of 4376 4444 28b9ecb8e6ee0a55cfc68c6d3e58f4c0_NeikiAnalytics.exe 91 PID 4444 wrote to memory of 4376 4444 28b9ecb8e6ee0a55cfc68c6d3e58f4c0_NeikiAnalytics.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\28b9ecb8e6ee0a55cfc68c6d3e58f4c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\28b9ecb8e6ee0a55cfc68c6d3e58f4c0_NeikiAnalytics.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysdevdob.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysdevdob.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4904
-
-
C:\IntelprocG7\xoptiec.exeC:\IntelprocG7\xoptiec.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4376
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\GalaxN8\optidevloc.exe
- Size 3.1MB
- SHA256 d6290d41ece854a2fc8cc076bfd1690fc58ecc5f89d4d3d5d636ca135890e766
- MD5 a21100c94d316d8a7b3823f09ccd2f9a
- SHA1 929af042eb86de4b527a9be6271407ec58c18edb
- SHA512 a5946b48fcff7f157784d5e3bab0488cd75919564816d84610f2b14b40a80c86811eaa832a54f87a2e169205ec5e541defc1477c101ef3d1286dd1fa01e3143e
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBkB/bSqz8:sxX7QnxrloE5dpUpDbVz8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\GalaxN8\optidevloc.exe
- Size 3.1MB
- SHA256 48543afe842f1ee4bc0fd9124fe2e7a08d556a0e6c45914914b23ba6c6f95ecd
- MD5 7468fe46b74574ab9207e0a60193233d
- SHA1 41579cbbcb6c4270a0c9b4321cf8077bb08c03e4
- SHA512 d01877d75faff43eac71ccab8a70655f76fb44646c5780caa0199de0e2a5c972c2bb1f17848e6fa3d5997a9078e8b3d2f0fce197b957b3a4de5f407edd640a7d
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB8B/bSqz8:sxX7QnxrloE5dpUp7bVz8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\IntelprocG7\xoptiec.exe
- Size 701KB
- SHA256 6ec123e2ec9413c352ce6f2a5a3c3b625d9a1f7d4230f71ae237c1d336c6c9d8
- MD5 f42ef52d1be0163dab9a48addd49157b
- SHA1 f7f9c6d42e58269ab08455b626f03b471f48812c
- SHA512 df213ace42db00d4b9ef1f16f25511a49029159db2ba5237e1348d9346447064b3ae4ca40d34f36efee0ca9b4d76301198d5d49948767adac05cdbfb5f3d15c0
- SSDEEP 12288:6ne3n0DmAm67YEjAyu6qJ/+WS5axBdSqpcVdSxL5XOEVpQEPcCchj:6nxDZV7xMyu6qJ2WSYxBdSqpcVdm5XRC
- MD5 SHA1 SHA512 SSDEEP
- Path C:\IntelprocG7\xoptiec.exe
- Size 3.1MB
- SHA256 64395b13bcfef0b2952a13c8580b0a62de84880c4dd08cd19d69f4bea44aecec
- MD5 d5e1609d9ac1f771c893d4df9f0397d7
- SHA1 f5c7675558e4204ded1ef20aaafa7a3b3eb6ee3e
- SHA512 dad4ec8ad09dce904a1fce11ff2daacfb2c660be9d9d869a776108d455f75c2d638e1d3f511d0beb8c08de073572b8aa7dc0d799f03286d13e948a9ab8e9cd67
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBHB/bSqz8:sxX7QnxrloE5dpUpMbVz8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 210B
- SHA256 f258aeaaba9d395d8cd38f69e78abf654f46e68576cae3911616dd83554012c9
- MD5 d95ee347f2e0d79d060f4ccfd188699c
- SHA1 05736bb6d3448000c86485cbd3cd5b8ad153dfcb
- SHA512 e6e0d82b8c0c0870d839df493a3ac8fb4ad3a510ae3c2575b191c8bcb7573a7ac484778a92ebd1c399a2939b44c2966e15f324827f5d1bccae3a64628432211c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 178B
- SHA256 ee0392ff36c70cb8b4a7106f77872c736229db855044a06849d534cc8b47719a
- MD5 74a7c184dfa23ee707cdd58faa557858
- SHA1 a9c1b13bbde7f5f9724bf2c8df36de140d7e3411
- SHA512 f863dd4f4d79170ceab8d6a270ebe2b0417e768e3a175435cb9007b28dbca6cd1e9a1159b1583a55705507a09cf101624663773d8747a0e77c93fc5e093e6b00
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysdevdob.exe
- Size 3.1MB
- SHA256 5ef38b855c70bdf539292f32cb6424f938f3111cb585d044527bd3dad05a3c82
- MD5 a4eed93ffbfc1e68da75b847162566d5
- SHA1 06251980f5addc4ab71598872c0ea810e5ad0068
- SHA512 b60e81fac5a3a0bf22382b0b010b91ad0176edadb7692b49dc2ea7fed4edf392d2330431e26ebcf8f3db2446a164243ef1e7c34b810334ddeea75af3ee6e2762
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBPB/bSqz8:sxX7QnxrloE5dpUpAbVz8
- MD5 SHA1 SHA512 SSDEEP