Analysis
- max time kernel
151s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
08/06/2024, 19:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f6db2e1eca285b7baef8adfbd9cf5fd0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
f6db2e1eca285b7baef8adfbd9cf5fd0_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target f6db2e1eca285b7baef8adfbd9cf5fd0_NeikiAnalytics.exe
- Size 4.0MB
- Sample240608-yb68eaga29
- SHA256 63a29f6efed4baabd8aad206afc897bae4e3c35a12f765413221f2f9569c94d3
- MD5 f6db2e1eca285b7baef8adfbd9cf5fd0
- SHA1 243f3cd339906398eb4d0251f8f2a76356d075f8
- SHA512 b93491e82c00a801f4eeaa7725f071f64bb3497350ae556a8ce6d90012e2e93d219671cb5b4329c7eb0eaddc4f26ed9c59db85b4ebb612aa46c33c05a7db60a9
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBbB/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUp8bVz8eLFcz
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecxbod.exe f6db2e1eca285b7baef8adfbd9cf5fd0_NeikiAnalytics.exe - Executes dropped EXE 2 IoCs
pid Process 3116 ecxbod.exe 4064 xbodloc.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\UserDotFW\\xbodloc.exe" f6db2e1eca285b7baef8adfbd9cf5fd0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\Mint6N\\optiaec.exe" f6db2e1eca285b7baef8adfbd9cf5fd0_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3508 f6db2e1eca285b7baef8adfbd9cf5fd0_NeikiAnalytics.exe 3508 f6db2e1eca285b7baef8adfbd9cf5fd0_NeikiAnalytics.exe 3508 f6db2e1eca285b7baef8adfbd9cf5fd0_NeikiAnalytics.exe 3508 f6db2e1eca285b7baef8adfbd9cf5fd0_NeikiAnalytics.exe 3116 ecxbod.exe 3116 ecxbod.exe 4064 xbodloc.exe 4064 xbodloc.exe 3116 ecxbod.exe 3116 ecxbod.exe 4064 xbodloc.exe 4064 xbodloc.exe 3116 ecxbod.exe 3116 ecxbod.exe 4064 xbodloc.exe 4064 xbodloc.exe 3116 ecxbod.exe 3116 ecxbod.exe 4064 xbodloc.exe 4064 xbodloc.exe 3116 ecxbod.exe 3116 ecxbod.exe 4064 xbodloc.exe 4064 xbodloc.exe 3116 ecxbod.exe 3116 ecxbod.exe 4064 xbodloc.exe 4064 xbodloc.exe 3116 ecxbod.exe 3116 ecxbod.exe 4064 xbodloc.exe 4064 xbodloc.exe 3116 ecxbod.exe 3116 ecxbod.exe 4064 xbodloc.exe 4064 xbodloc.exe 3116 ecxbod.exe 3116 ecxbod.exe 4064 xbodloc.exe 4064 xbodloc.exe 3116 ecxbod.exe 3116 ecxbod.exe 4064 xbodloc.exe 4064 xbodloc.exe 3116 ecxbod.exe 3116 ecxbod.exe 4064 xbodloc.exe 4064 xbodloc.exe 3116 ecxbod.exe 3116 ecxbod.exe 4064 xbodloc.exe 4064 xbodloc.exe 3116 ecxbod.exe 3116 ecxbod.exe 4064 xbodloc.exe 4064 xbodloc.exe 3116 ecxbod.exe 3116 ecxbod.exe 4064 xbodloc.exe 4064 xbodloc.exe 3116 ecxbod.exe 3116 ecxbod.exe 4064 xbodloc.exe 4064 xbodloc.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3508 wrote to memory of 3116 3508 f6db2e1eca285b7baef8adfbd9cf5fd0_NeikiAnalytics.exe 90 PID 3508 wrote to memory of 3116 3508 f6db2e1eca285b7baef8adfbd9cf5fd0_NeikiAnalytics.exe 90 PID 3508 wrote to memory of 3116 3508 f6db2e1eca285b7baef8adfbd9cf5fd0_NeikiAnalytics.exe 90 PID 3508 wrote to memory of 4064 3508 f6db2e1eca285b7baef8adfbd9cf5fd0_NeikiAnalytics.exe 91 PID 3508 wrote to memory of 4064 3508 f6db2e1eca285b7baef8adfbd9cf5fd0_NeikiAnalytics.exe 91 PID 3508 wrote to memory of 4064 3508 f6db2e1eca285b7baef8adfbd9cf5fd0_NeikiAnalytics.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\f6db2e1eca285b7baef8adfbd9cf5fd0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\f6db2e1eca285b7baef8adfbd9cf5fd0_NeikiAnalytics.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecxbod.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecxbod.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3116
-
-
C:\UserDotFW\xbodloc.exeC:\UserDotFW\xbodloc.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1348 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:81⤵PID:4616
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Mint6N\optiaec.exe
- Size 4.0MB
- SHA256 06b66a8e6c891166c5dde2fdcbd0fe94cc6c27b7340efae6df5b7faf4d96176c
- MD5 6fbed019455dd759e06530d22a37bf71
- SHA1 92c4d8793481b3b79927170b0ad5cf07cb189bbd
- SHA512 24eb0b8538b056aabe8e7c194acbea242bbb4c59c3f770fb4f644a019c848dcb08b7b7cc8d00c2368ed91d802c530b61b1b5de564b8c06b81dfbee117e1f3c4a
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBOB/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUplbVz8eLFcz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Mint6N\optiaec.exe
- Size 307KB
- SHA256 33d5cbd219c0364619b6b06a1f36cb0208bde7d7b23375556541cc94b31bd930
- MD5 102f7bac70123a2f9e364873c6f6d110
- SHA1 d5ba16dea2ba86959e249e431f52605bce42343d
- SHA512 a9a5ff416391fad5e49daef33e6fe169c94617f41bc3916201ec7979d3be5078abce8f11a8b2dfb80633ca12e790a952861621a6ddb491f2c76bf795089b3e39
- SSDEEP 6144:6nyJ3n0Dm7+zm6wr6YEjAumIann6qJ/mB9D+nnS5ax2SNm9WdF7Uqpg:6ne3n0DmAm67YEjAyu6qJ/+WS5axBdSj
- MD5 SHA1 SHA512 SSDEEP
- Path C:\UserDotFW\xbodloc.exe
- Size 4KB
- SHA256 6e27085c9b049479ed4b5d515c82d49091d1d0d6a70cc1af4fe1e085816236d4
- MD5 ede40b36034d11420daf9b761d447622
- SHA1 83e69cb72e12fd8ccd507bfa21133e1fca0fd5d7
- SHA512 0fc2330cfab1d7a2fa7e55f9cc177aa246de7f672540212721ca9232920652a2306906719e60af2bd37ca2fc9074d2244a5514fdc7f344e7c4006b4c69a75120
- MD5 SHA1 SHA512
- Path C:\UserDotFW\xbodloc.exe
- Size 4.0MB
- SHA256 f712605ea36077df34fb8e829d82888ba7f2238d8ceb2d9b2925df31baf44804
- MD5 c23bce28e27d742bd44fa28d377e7927
- SHA1 900fe9a6b4bb46160c7033db1ca4078106f7af5d
- SHA512 d27a46032b38a312de6c58b7940e429d693d633d56e299f60ae6a7bf7fe898bc39760a06ae298d7a1a44eb210e233eedb66ff69ea4e171bc4216fb450f4fbfd5
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBtB/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUp+bVz8eLFcz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 201B
- SHA256 a34abdb9a52d594ab09cc6cfd468f6a63be9374a6fb46995c47455e312878a58
- MD5 59f5132413cc0cecfb714031b808ae08
- SHA1 ae5efe3132e0ec2870d4a0fbe8c1a09964eb1356
- SHA512 655b83fbe25cd42ed1cd896e7b3491e379e792d3cd6b7c6f568e4106090bfb02407635cfa4a28ce73d9d7e95589d1463a66a2b37401c87ecbf79967453e5c4a1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 169B
- SHA256 dfd553543d296d2150329c185f433f51753c4dfd0239dce9c0480b4369d4900e
- MD5 57fdf768966313a06715f46700d21285
- SHA1 7142a19bc1345dc6e1578e6fec7c626921f9a463
- SHA512 9fadc823ea7c8e0cb2b9edc5a9f713887ac65ff7973c2f31fe7b04b6014a8f14ed41497baca6d1a2fbe27e7cd63070b1269d5b1d26213b7b368037c10f6a39a4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecxbod.exe
- Size 4.0MB
- SHA256 0f613691294017c18b69cf2820b3f9960437a8804ff547a80ec06a1b84ddb116
- MD5 bab3b7bcc158cee909132150e816c793
- SHA1 5d963ed06481fee3086ee1ae7201e3068b47af31
- SHA512 12b7bc360c55bb461a4e17b5b6dc517a1da85f4728d7e17ba036b009bee1bab0d54132dd81941c8a9a41fccb1e5bbe4864a4064bad3f33f993b8837cf84a9af9
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LByB/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUptbVz8eLFcz
- MD5 SHA1 SHA512 SSDEEP