Analysis
- max time kernel
150s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 02:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
55a036fdae09590e18cef9c0a196fd60_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
55a036fdae09590e18cef9c0a196fd60_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 55a036fdae09590e18cef9c0a196fd60_NeikiAnalytics.exe
- Size 4.1MB
- Sample240613-cfpchatglr
- SHA256 3b8869c9fff93302feae5ac112679dc3454d0b76f9cb8a99528bf1287d396dec
- MD5 55a036fdae09590e18cef9c0a196fd60
- SHA1 2beddde416bba7352b27becbd6f5ad8fc0bd3730
- SHA512 4ea5eb1366dd9b45a74ce871f23a95ba8aba1f580a1881771a2f4ecb2b9d076d1638cc03b624fbdc5fc40ead7c65842c898c8d96564eb11efbb353a28c8390a7
- SSDEEP 98304:+R0pI/IQlUoMPdmpSpP4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdmw5n9klRKN41v
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4024 aoptiloc.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\SysDrv7F\\aoptiloc.exe" 55a036fdae09590e18cef9c0a196fd60_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\VidZQ\\optixec.exe" 55a036fdae09590e18cef9c0a196fd60_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2256 55a036fdae09590e18cef9c0a196fd60_NeikiAnalytics.exe 2256 55a036fdae09590e18cef9c0a196fd60_NeikiAnalytics.exe 2256 55a036fdae09590e18cef9c0a196fd60_NeikiAnalytics.exe 2256 55a036fdae09590e18cef9c0a196fd60_NeikiAnalytics.exe 4024 aoptiloc.exe 4024 aoptiloc.exe 2256 55a036fdae09590e18cef9c0a196fd60_NeikiAnalytics.exe 2256 55a036fdae09590e18cef9c0a196fd60_NeikiAnalytics.exe 4024 aoptiloc.exe 4024 aoptiloc.exe 2256 55a036fdae09590e18cef9c0a196fd60_NeikiAnalytics.exe 2256 55a036fdae09590e18cef9c0a196fd60_NeikiAnalytics.exe 4024 aoptiloc.exe 4024 aoptiloc.exe 2256 55a036fdae09590e18cef9c0a196fd60_NeikiAnalytics.exe 2256 55a036fdae09590e18cef9c0a196fd60_NeikiAnalytics.exe 4024 aoptiloc.exe 4024 aoptiloc.exe 2256 55a036fdae09590e18cef9c0a196fd60_NeikiAnalytics.exe 2256 55a036fdae09590e18cef9c0a196fd60_NeikiAnalytics.exe 4024 aoptiloc.exe 4024 aoptiloc.exe 2256 55a036fdae09590e18cef9c0a196fd60_NeikiAnalytics.exe 2256 55a036fdae09590e18cef9c0a196fd60_NeikiAnalytics.exe 4024 aoptiloc.exe 4024 aoptiloc.exe 2256 55a036fdae09590e18cef9c0a196fd60_NeikiAnalytics.exe 2256 55a036fdae09590e18cef9c0a196fd60_NeikiAnalytics.exe 4024 aoptiloc.exe 4024 aoptiloc.exe 2256 55a036fdae09590e18cef9c0a196fd60_NeikiAnalytics.exe 2256 55a036fdae09590e18cef9c0a196fd60_NeikiAnalytics.exe 4024 aoptiloc.exe 4024 aoptiloc.exe 2256 55a036fdae09590e18cef9c0a196fd60_NeikiAnalytics.exe 2256 55a036fdae09590e18cef9c0a196fd60_NeikiAnalytics.exe 4024 aoptiloc.exe 4024 aoptiloc.exe 2256 55a036fdae09590e18cef9c0a196fd60_NeikiAnalytics.exe 2256 55a036fdae09590e18cef9c0a196fd60_NeikiAnalytics.exe 4024 aoptiloc.exe 4024 aoptiloc.exe 2256 55a036fdae09590e18cef9c0a196fd60_NeikiAnalytics.exe 2256 55a036fdae09590e18cef9c0a196fd60_NeikiAnalytics.exe 4024 aoptiloc.exe 4024 aoptiloc.exe 2256 55a036fdae09590e18cef9c0a196fd60_NeikiAnalytics.exe 2256 55a036fdae09590e18cef9c0a196fd60_NeikiAnalytics.exe 4024 aoptiloc.exe 4024 aoptiloc.exe 2256 55a036fdae09590e18cef9c0a196fd60_NeikiAnalytics.exe 2256 55a036fdae09590e18cef9c0a196fd60_NeikiAnalytics.exe 4024 aoptiloc.exe 4024 aoptiloc.exe 2256 55a036fdae09590e18cef9c0a196fd60_NeikiAnalytics.exe 2256 55a036fdae09590e18cef9c0a196fd60_NeikiAnalytics.exe 4024 aoptiloc.exe 4024 aoptiloc.exe 2256 55a036fdae09590e18cef9c0a196fd60_NeikiAnalytics.exe 2256 55a036fdae09590e18cef9c0a196fd60_NeikiAnalytics.exe 4024 aoptiloc.exe 4024 aoptiloc.exe 2256 55a036fdae09590e18cef9c0a196fd60_NeikiAnalytics.exe 2256 55a036fdae09590e18cef9c0a196fd60_NeikiAnalytics.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2256 wrote to memory of 4024 2256 55a036fdae09590e18cef9c0a196fd60_NeikiAnalytics.exe 85 PID 2256 wrote to memory of 4024 2256 55a036fdae09590e18cef9c0a196fd60_NeikiAnalytics.exe 85 PID 2256 wrote to memory of 4024 2256 55a036fdae09590e18cef9c0a196fd60_NeikiAnalytics.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\55a036fdae09590e18cef9c0a196fd60_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\55a036fdae09590e18cef9c0a196fd60_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\SysDrv7F\aoptiloc.exeC:\SysDrv7F\aoptiloc.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4024
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\SysDrv7F\aoptiloc.exe
- Size 4.1MB
- SHA256 914a5b2d2f9c029d4c5396a21417595d615b118df0266f61459f5311b88d474f
- MD5 c3800ed27c2134461c118772e2cca689
- SHA1 086294681a45a761f91f0925d41a08f8ca91cd3f
- SHA512 b05061af5c125f1e28f702df01d09f5eecee099078ded630fc18476a2665825f42607b253a1256a85608442dc051121c6b1cead5d4c68bd1982f2984be996798
- SSDEEP 98304:+R0pI/IQlUoMPdmpSp84ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdmb5n9klRKN41v
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 201B
- SHA256 a8e5e7091c0e0888640af2bd3e565b3411117ecade4ceb3fe70ccab8abd45dda
- MD5 7a0c3340a4241208936000c406b33d8d
- SHA1 dc998a4575d86144cec84bc58f7decad9d2c41a5
- SHA512 ac364dacfde6cde07fed620e4f211460c078eb6373e9bb2fd3766e0d638bfd130ec25de15094404e2c35ca9306be11fd3bb4e0dcfb3fa02d6c6ff874441164c1
- MD5 SHA1 SHA512
- Path C:\VidZQ\optixec.exe
- Size 4.1MB
- SHA256 8c6635f4e83b48bf605ad8bcb956fc5b5b8c2aa0d15c4ae0dd060433f627defc
- MD5 6ffffae6ff58954e4b65437cee070106
- SHA1 5258361f523e669066e932e585947359b3698e59
- SHA512 039cedb28e491dd06d4adcaf34219841cbbb3250bf3d518627ab1b4c955d456970f0123c2f005bf39993583e547592dfbd33a17bf7825b3555ee547b9be1d896
- SSDEEP 98304:+R0pI/IQlUoMPdmpSpn4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdmY5n9klRKN41v
- MD5 SHA1 SHA512 SSDEEP