Analysis
- max time kernel
149s - max time network
51s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
11/06/2024, 14:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
379abc2b492f5a20e0244002302406c0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
379abc2b492f5a20e0244002302406c0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 379abc2b492f5a20e0244002302406c0_NeikiAnalytics.exe
- Size 2.7MB
- Sample240611-rlkc3azglm
- SHA256 449a7f758ef289a4d4a48d27108be1ba7991606bb299d038e6a75be8140c9309
- MD5 379abc2b492f5a20e0244002302406c0
- SHA1 fa1d279e3d9b8d308412fb1e638811b5b4a7340a
- SHA512 9a5b51628b56310126b3079ffca6821b3f76884a5bf92f49675d0fc74833c3faa5a37c4cbac9b28c7a829062b086a17efaa63e88d914863bff7ba062aee17cbc
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBn9w4Sx:+R0pI/IQlUoMPdmpSpP4
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5016 aoptisys.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\UserDotVX\\aoptisys.exe" 379abc2b492f5a20e0244002302406c0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\MintU5\\optiaec.exe" 379abc2b492f5a20e0244002302406c0_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2068 379abc2b492f5a20e0244002302406c0_NeikiAnalytics.exe 2068 379abc2b492f5a20e0244002302406c0_NeikiAnalytics.exe 2068 379abc2b492f5a20e0244002302406c0_NeikiAnalytics.exe 2068 379abc2b492f5a20e0244002302406c0_NeikiAnalytics.exe 5016 aoptisys.exe 5016 aoptisys.exe 2068 379abc2b492f5a20e0244002302406c0_NeikiAnalytics.exe 2068 379abc2b492f5a20e0244002302406c0_NeikiAnalytics.exe 5016 aoptisys.exe 5016 aoptisys.exe 2068 379abc2b492f5a20e0244002302406c0_NeikiAnalytics.exe 2068 379abc2b492f5a20e0244002302406c0_NeikiAnalytics.exe 5016 aoptisys.exe 5016 aoptisys.exe 2068 379abc2b492f5a20e0244002302406c0_NeikiAnalytics.exe 2068 379abc2b492f5a20e0244002302406c0_NeikiAnalytics.exe 5016 aoptisys.exe 5016 aoptisys.exe 2068 379abc2b492f5a20e0244002302406c0_NeikiAnalytics.exe 2068 379abc2b492f5a20e0244002302406c0_NeikiAnalytics.exe 5016 aoptisys.exe 5016 aoptisys.exe 2068 379abc2b492f5a20e0244002302406c0_NeikiAnalytics.exe 2068 379abc2b492f5a20e0244002302406c0_NeikiAnalytics.exe 5016 aoptisys.exe 5016 aoptisys.exe 2068 379abc2b492f5a20e0244002302406c0_NeikiAnalytics.exe 2068 379abc2b492f5a20e0244002302406c0_NeikiAnalytics.exe 5016 aoptisys.exe 5016 aoptisys.exe 2068 379abc2b492f5a20e0244002302406c0_NeikiAnalytics.exe 2068 379abc2b492f5a20e0244002302406c0_NeikiAnalytics.exe 5016 aoptisys.exe 5016 aoptisys.exe 2068 379abc2b492f5a20e0244002302406c0_NeikiAnalytics.exe 2068 379abc2b492f5a20e0244002302406c0_NeikiAnalytics.exe 5016 aoptisys.exe 5016 aoptisys.exe 2068 379abc2b492f5a20e0244002302406c0_NeikiAnalytics.exe 2068 379abc2b492f5a20e0244002302406c0_NeikiAnalytics.exe 5016 aoptisys.exe 5016 aoptisys.exe 2068 379abc2b492f5a20e0244002302406c0_NeikiAnalytics.exe 2068 379abc2b492f5a20e0244002302406c0_NeikiAnalytics.exe 5016 aoptisys.exe 5016 aoptisys.exe 2068 379abc2b492f5a20e0244002302406c0_NeikiAnalytics.exe 2068 379abc2b492f5a20e0244002302406c0_NeikiAnalytics.exe 5016 aoptisys.exe 5016 aoptisys.exe 2068 379abc2b492f5a20e0244002302406c0_NeikiAnalytics.exe 2068 379abc2b492f5a20e0244002302406c0_NeikiAnalytics.exe 5016 aoptisys.exe 5016 aoptisys.exe 2068 379abc2b492f5a20e0244002302406c0_NeikiAnalytics.exe 2068 379abc2b492f5a20e0244002302406c0_NeikiAnalytics.exe 5016 aoptisys.exe 5016 aoptisys.exe 2068 379abc2b492f5a20e0244002302406c0_NeikiAnalytics.exe 2068 379abc2b492f5a20e0244002302406c0_NeikiAnalytics.exe 5016 aoptisys.exe 5016 aoptisys.exe 2068 379abc2b492f5a20e0244002302406c0_NeikiAnalytics.exe 2068 379abc2b492f5a20e0244002302406c0_NeikiAnalytics.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2068 wrote to memory of 5016 2068 379abc2b492f5a20e0244002302406c0_NeikiAnalytics.exe 85 PID 2068 wrote to memory of 5016 2068 379abc2b492f5a20e0244002302406c0_NeikiAnalytics.exe 85 PID 2068 wrote to memory of 5016 2068 379abc2b492f5a20e0244002302406c0_NeikiAnalytics.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\379abc2b492f5a20e0244002302406c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\379abc2b492f5a20e0244002302406c0_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\UserDotVX\aoptisys.exeC:\UserDotVX\aoptisys.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5016
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\MintU5\optiaec.exe
- Size 2KB
- SHA256 125b5a9aa572a1070c03f3b83132f9e06b5bb82e5c000611e06a74e30ea4cf15
- MD5 75ce4e8c53f9b6806ac1eb9333389f45
- SHA1 d1bda301f8ae47d55344588ed4a41c720ce6cc09
- SHA512 b97e02a2f3b8e866cd1b872e369bf45c8c5a571bba9b4c1cb0798c76dd158e0c2ea0d76112eda77efb805b72b9c6717ef4bb14b7ae168f58c76a56afdf517cc1
- MD5 SHA1 SHA512
- Path C:\UserDotVX\aoptisys.exe
- Size 2.7MB
- SHA256 0ada4dd094415db70a3f1f30949c8f80734496e5c7e6e958dbf328546d92be30
- MD5 3fc21cb530a5e01bad3bcb45843def8d
- SHA1 4f2ce2565abbd69af8cb86aeec7a45b8a98e3531
- SHA512 6818cb7a7ffa249db68e06637cc8175ab411b3d81a56d339db8baafae02e4418df3b577505e4135c68e472821c1cf5e4f33b3194e4a8321ee59c29e211790b5c
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBT9w4Sx:+R0pI/IQlUoMPdmpSp34
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 204B
- SHA256 995ae71a8c77352276c2e4dd315d0edbf89e7b640517a30c1757e7f6b52e2cdb
- MD5 9a3f4fd0197fe7e8e91897b3a82d8cc5
- SHA1 0b3bd503abcb456537bce591b382b442c8ded066
- SHA512 625c141b3a30cd58c1e1da0a64492423d9208b228f7aadc4ebe38e586c708f77fb8e4b3a5f98625b0251d0fd099b0e9481e1174da4069089082c29c5b4a09593
- MD5 SHA1 SHA512