Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
08/06/2024, 14:28
Static task
static1
Behavioral task
behavioral1
Sample
c23164dbedc67bcd12876522f55dbf10_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
c23164dbedc67bcd12876522f55dbf10_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
c23164dbedc67bcd12876522f55dbf10_NeikiAnalytics.exe
-
Size
3.0MB
-
MD5
c23164dbedc67bcd12876522f55dbf10
-
SHA1
6c2396cdaf58c0b888824c1fc047423f7745b620
-
SHA256
989995251f92b2d1b6d8ff4a588b76f8a462dab65cb4870c0a9dad27056a30ec
-
SHA512
84b376102004559a09427cb6b2c00eb9ac9f15656af892c5c26175fd17fdd793e7f1bb55f466c1264af9f7da983093d87106fb52aa46ac81fdf60ff4779c72c3
-
SSDEEP
49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBGB/bSqz8b6LNX:sxX7QnxrloE5dpUpdbVz8eLF
Malware Config
Signatures
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecaopti.exe c23164dbedc67bcd12876522f55dbf10_NeikiAnalytics.exe -
Executes dropped EXE 2 IoCs
pid Process 2160 ecaopti.exe 848 devdobloc.exe -
Loads dropped DLL 2 IoCs
pid Process 2920 c23164dbedc67bcd12876522f55dbf10_NeikiAnalytics.exe 2920 c23164dbedc67bcd12876522f55dbf10_NeikiAnalytics.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\UserDotI0\\devdobloc.exe" c23164dbedc67bcd12876522f55dbf10_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\GalaxXL\\bodxsys.exe" c23164dbedc67bcd12876522f55dbf10_NeikiAnalytics.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2920 c23164dbedc67bcd12876522f55dbf10_NeikiAnalytics.exe 2920 c23164dbedc67bcd12876522f55dbf10_NeikiAnalytics.exe 2160 ecaopti.exe 848 devdobloc.exe 2160 ecaopti.exe 848 devdobloc.exe 2160 ecaopti.exe 848 devdobloc.exe 2160 ecaopti.exe 848 devdobloc.exe 2160 ecaopti.exe 848 devdobloc.exe 2160 ecaopti.exe 848 devdobloc.exe 2160 ecaopti.exe 848 devdobloc.exe 2160 ecaopti.exe 848 devdobloc.exe 2160 ecaopti.exe 848 devdobloc.exe 2160 ecaopti.exe 848 devdobloc.exe 2160 ecaopti.exe 848 devdobloc.exe 2160 ecaopti.exe 848 devdobloc.exe 2160 ecaopti.exe 848 devdobloc.exe 2160 ecaopti.exe 848 devdobloc.exe 2160 ecaopti.exe 848 devdobloc.exe 2160 ecaopti.exe 848 devdobloc.exe 2160 ecaopti.exe 848 devdobloc.exe 2160 ecaopti.exe 848 devdobloc.exe 2160 ecaopti.exe 848 devdobloc.exe 2160 ecaopti.exe 848 devdobloc.exe 2160 ecaopti.exe 848 devdobloc.exe 2160 ecaopti.exe 848 devdobloc.exe 2160 ecaopti.exe 848 devdobloc.exe 2160 ecaopti.exe 848 devdobloc.exe 2160 ecaopti.exe 848 devdobloc.exe 2160 ecaopti.exe 848 devdobloc.exe 2160 ecaopti.exe 848 devdobloc.exe 2160 ecaopti.exe 848 devdobloc.exe 2160 ecaopti.exe 848 devdobloc.exe 2160 ecaopti.exe 848 devdobloc.exe 2160 ecaopti.exe 848 devdobloc.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2920 wrote to memory of 2160 2920 c23164dbedc67bcd12876522f55dbf10_NeikiAnalytics.exe 28 PID 2920 wrote to memory of 2160 2920 c23164dbedc67bcd12876522f55dbf10_NeikiAnalytics.exe 28 PID 2920 wrote to memory of 2160 2920 c23164dbedc67bcd12876522f55dbf10_NeikiAnalytics.exe 28 PID 2920 wrote to memory of 2160 2920 c23164dbedc67bcd12876522f55dbf10_NeikiAnalytics.exe 28 PID 2920 wrote to memory of 848 2920 c23164dbedc67bcd12876522f55dbf10_NeikiAnalytics.exe 29 PID 2920 wrote to memory of 848 2920 c23164dbedc67bcd12876522f55dbf10_NeikiAnalytics.exe 29 PID 2920 wrote to memory of 848 2920 c23164dbedc67bcd12876522f55dbf10_NeikiAnalytics.exe 29 PID 2920 wrote to memory of 848 2920 c23164dbedc67bcd12876522f55dbf10_NeikiAnalytics.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\c23164dbedc67bcd12876522f55dbf10_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\c23164dbedc67bcd12876522f55dbf10_NeikiAnalytics.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecaopti.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecaopti.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2160
-
-
C:\UserDotI0\devdobloc.exeC:\UserDotI0\devdobloc.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:848
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.0MB
MD5ab25ef7b9799f9f5bf14a152dc845333
SHA1f2651b77cfad2abf59996e5d49f36345d81520db
SHA256bf64ee580070817c9ce4397e000c66e1db738b295afa9c224009b15894279d5b
SHA512eb9bc606567650f3099a8dca2ffb2ed01d338fa154a9dd86ddb5e5908799b4f334a71ba95c0ac4a154a685a7249df53f44f56fa4d22d268fc008d2bace8c7736
-
Filesize
3.0MB
MD5344ab737047e1aee4f577e32544debac
SHA15f3542f558919dd5996118475eadae647bac53b4
SHA256c63c5ddc1501981fcc67c89cadd01a6623113d27dd41e649b981e2f1151d4b94
SHA51274f0cc6f802ba43f788d01c905de3a940d3ef20255270da69ec313067f374f6c8c15c46068d2b9789d8c6a842e0c8d426316d0359432aa3adb99e4509fb305f4
-
Filesize
3.0MB
MD5c1fdae2e57b2765bf7cf539b5285d0a7
SHA13195ba56b7432256ba4c9aef65df64dd991a1b76
SHA256a25c43c7110a27b10eac3f395b1e4efbb80d4720c7cf2a63cde93f740b11c5fa
SHA5123c0d43a164cfe89db33bf45327112c6f35fdc9eae3069448e1f6071b9bc1496e75547c408cdfec4aca33bfd7041d39337a4f28f4014688237f3944676346f217
-
Filesize
173B
MD5fc7c47fe848565142a43008441217222
SHA1df637ab4729b060b4785c4d30caf465214a5ef2f
SHA2563758852cfd6e2b351b9bbf668ac69d1ae27fc970b13c95e29189670be4dee762
SHA5129556be0e7b8c838aee594f922f47444f60a863426c48cccb80aa5d1774150cc12c616ee886af1c969c379e0b3b84c14f647703cc78e76cae3d54646c90ae6c36
-
Filesize
205B
MD58ec770cd69a63d2ad7df4c51511f0951
SHA181f22feed879d24e2490d939109128a5e06051e7
SHA2568d866fc0c6d6203c44e971e8fb09171b55b3fac8e5aa81e9c3f54a44322e5266
SHA5129151a6dd30d05cac58f48b61aa78125dd57474917b52984ee0985503906e475f9591eabb47e4d06eb61dc8cba0ec85e783a41731a8c135a50298f7d4e12a7ae0
-
Filesize
3.0MB
MD5a150ea297abf73a83b1bbfbb97722745
SHA1199e20acdc7308484ef8290464ea01a81563cb89
SHA256b037ee72a9b679b1d60e9d86b4bc35a73c4041be8bce5ee6757c00e30c55819b
SHA51231b89af87d9d032dea346f86afc8f6aa8d7d41ec3c3c4ce1528e140fecdaae003fe4db600be791db6a3e1c8d24b4b030f5707502bbd26d0281984b43e7e9613c