Analysis
- max time kernel
149s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
06/06/2024, 20:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
376b60de8076e62c64a92be0b77e3670_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
376b60de8076e62c64a92be0b77e3670_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 376b60de8076e62c64a92be0b77e3670_NeikiAnalytics.exe
- Size 4.1MB
- Sample240606-ywtstabd3w
- SHA256 4c1a9d385c2205f3fd873de29385e462d6dd1f523117da8ce3eac9a6eb20b6d4
- MD5 376b60de8076e62c64a92be0b77e3670
- SHA1 63ebbe556e2ba79952dcec738ae69524ff872d9c
- SHA512 050e0e1463853a66842f48dc78163cd793eec3f21d234d528fcf3f06960f90ac15cc375d476b3dafa91cc860596d488b22004aef77b3b8955db7f17a3b879f89
- SSDEEP 98304:+R0pI/IQlUoMPdmpSpf4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdmA5n9klRKN41v
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 736 xoptiloc.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\MintXN\\optidevec.exe" 376b60de8076e62c64a92be0b77e3670_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\FilesK2\\xoptiloc.exe" 376b60de8076e62c64a92be0b77e3670_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2140 376b60de8076e62c64a92be0b77e3670_NeikiAnalytics.exe 2140 376b60de8076e62c64a92be0b77e3670_NeikiAnalytics.exe 2140 376b60de8076e62c64a92be0b77e3670_NeikiAnalytics.exe 2140 376b60de8076e62c64a92be0b77e3670_NeikiAnalytics.exe 736 xoptiloc.exe 736 xoptiloc.exe 2140 376b60de8076e62c64a92be0b77e3670_NeikiAnalytics.exe 2140 376b60de8076e62c64a92be0b77e3670_NeikiAnalytics.exe 736 xoptiloc.exe 736 xoptiloc.exe 2140 376b60de8076e62c64a92be0b77e3670_NeikiAnalytics.exe 2140 376b60de8076e62c64a92be0b77e3670_NeikiAnalytics.exe 736 xoptiloc.exe 736 xoptiloc.exe 2140 376b60de8076e62c64a92be0b77e3670_NeikiAnalytics.exe 2140 376b60de8076e62c64a92be0b77e3670_NeikiAnalytics.exe 736 xoptiloc.exe 736 xoptiloc.exe 2140 376b60de8076e62c64a92be0b77e3670_NeikiAnalytics.exe 2140 376b60de8076e62c64a92be0b77e3670_NeikiAnalytics.exe 736 xoptiloc.exe 736 xoptiloc.exe 2140 376b60de8076e62c64a92be0b77e3670_NeikiAnalytics.exe 2140 376b60de8076e62c64a92be0b77e3670_NeikiAnalytics.exe 736 xoptiloc.exe 736 xoptiloc.exe 2140 376b60de8076e62c64a92be0b77e3670_NeikiAnalytics.exe 2140 376b60de8076e62c64a92be0b77e3670_NeikiAnalytics.exe 736 xoptiloc.exe 736 xoptiloc.exe 2140 376b60de8076e62c64a92be0b77e3670_NeikiAnalytics.exe 2140 376b60de8076e62c64a92be0b77e3670_NeikiAnalytics.exe 736 xoptiloc.exe 736 xoptiloc.exe 2140 376b60de8076e62c64a92be0b77e3670_NeikiAnalytics.exe 2140 376b60de8076e62c64a92be0b77e3670_NeikiAnalytics.exe 736 xoptiloc.exe 736 xoptiloc.exe 2140 376b60de8076e62c64a92be0b77e3670_NeikiAnalytics.exe 2140 376b60de8076e62c64a92be0b77e3670_NeikiAnalytics.exe 736 xoptiloc.exe 736 xoptiloc.exe 2140 376b60de8076e62c64a92be0b77e3670_NeikiAnalytics.exe 2140 376b60de8076e62c64a92be0b77e3670_NeikiAnalytics.exe 736 xoptiloc.exe 736 xoptiloc.exe 2140 376b60de8076e62c64a92be0b77e3670_NeikiAnalytics.exe 2140 376b60de8076e62c64a92be0b77e3670_NeikiAnalytics.exe 736 xoptiloc.exe 736 xoptiloc.exe 2140 376b60de8076e62c64a92be0b77e3670_NeikiAnalytics.exe 2140 376b60de8076e62c64a92be0b77e3670_NeikiAnalytics.exe 736 xoptiloc.exe 736 xoptiloc.exe 2140 376b60de8076e62c64a92be0b77e3670_NeikiAnalytics.exe 2140 376b60de8076e62c64a92be0b77e3670_NeikiAnalytics.exe 736 xoptiloc.exe 736 xoptiloc.exe 2140 376b60de8076e62c64a92be0b77e3670_NeikiAnalytics.exe 2140 376b60de8076e62c64a92be0b77e3670_NeikiAnalytics.exe 736 xoptiloc.exe 736 xoptiloc.exe 2140 376b60de8076e62c64a92be0b77e3670_NeikiAnalytics.exe 2140 376b60de8076e62c64a92be0b77e3670_NeikiAnalytics.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2140 wrote to memory of 736 2140 376b60de8076e62c64a92be0b77e3670_NeikiAnalytics.exe 89 PID 2140 wrote to memory of 736 2140 376b60de8076e62c64a92be0b77e3670_NeikiAnalytics.exe 89 PID 2140 wrote to memory of 736 2140 376b60de8076e62c64a92be0b77e3670_NeikiAnalytics.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\376b60de8076e62c64a92be0b77e3670_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\376b60de8076e62c64a92be0b77e3670_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\FilesK2\xoptiloc.exeC:\FilesK2\xoptiloc.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:736
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\FilesK2\xoptiloc.exe
- Size 4.1MB
- SHA256 e171fcd9f88bb74ad8ce0296decdeff1958770c158d86a129a221af236230118
- MD5 d63e6574852ee9761f21fc68bd24f7b4
- SHA1 9c63ffa532800e9f4bcc52137c97883da70c0f9d
- SHA512 d2964dac924a199817589cf33e4f0c79387986d2b80ed1dee272d052b3e8fabe0ed7a0f3f9a3432f496bef8ccf2973ab54d7ac9a5787af42c6722669235c2195
- SSDEEP 98304:+R0pI/IQlUoMPdmpSpU4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdmr5n9klRKN41v
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MintXN\optidevec.exe
- Size 34KB
- SHA256 e6c6be4bdfb8fbd2709223992778aa6d7d3bdc158aa733f5bbe8bf7283b4f93e
- MD5 4761f87107c0f0cc0833112e2196bf26
- SHA1 bb9f0541a1f125d58f08441864cb2fc5876a8190
- SHA512 a0a2557dac71bb1d0bc475566f13d0605821f01c38b01ef97baf149a8ce99762f339df73cbf10964bfef6152dcab6cb549ea8ee6db654b4353caabbaad1231be
- SSDEEP 768:PLT5ZRHUj7TRxRVED1bHKFO3Hq/KDsDZe+exJAqsQQsw4WwnG:nD8RxTo1TKFO3H0KEZHAAz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MintXN\optidevec.exe
- Size 4.1MB
- SHA256 a696ce5e0e8bed0c7df79bcd3f8c0244eb7de002d155e1f46a95e4f292f4737c
- MD5 a00f011752c06c06d49db4486d5ab463
- SHA1 122a37ea348ac9b868ef4d79132241f436ae2bf9
- SHA512 461ccf7bd32d8629fa9c97fcfcbedcaea9936368db711720f2660df537abec99d2e36477767b881df022f68dd89900e7d17db36e8f14f43909ff17da57c701fc
- SSDEEP 98304:+R0pI/IQlUoMPdmpSpJ4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdmy5n9klRKN41v
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 202B
- SHA256 e0c71f5a0ca0c7677bf41e049a789a2d97fee1bdd0515d6b5d1b042af91f8e4f
- MD5 effc1015444456b610dfb1ee6dcb9dac
- SHA1 8a630799382b1af5aec890d15501a61c5152dcae
- SHA512 b3ff410ce0edf71e0c94e220a65a67f03406254b32d345392aaf97d89a71892f5080199f7e003127d951f286969a78d6248db34021b498122d3ebfe5ae5baf92
- MD5 SHA1 SHA512