Analysis
- max time kernel
150s - max time network
123s - platform
windows7_x64 - resource
win7-20240508-en - resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system - submitted
13/06/2024, 03:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5a0861fcea3df7725076f609e1c04fa0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
5a0861fcea3df7725076f609e1c04fa0_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 5a0861fcea3df7725076f609e1c04fa0_NeikiAnalytics.exe
- Size 3.6MB
- Sample240613-drlanawcql
- SHA256 cec4f0f681ba56db89bdccc1a490c9f310fe795b6d8653d3726ad0bc44e80e54
- MD5 5a0861fcea3df7725076f609e1c04fa0
- SHA1 0a65acfe7c85e40f7bbec326950671841b9e3634
- SHA512 479bb9d2ff82b3c75ce9517def0311c2e389a1f2c40989b7a85be221b487a84355495e24827ae1c72b7c2889e4f90bafb3d0c5dc2dc34bb210183c2f5f1f6586
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBJB/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUp+bVz8eLFcz
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysdevopti.exe 5a0861fcea3df7725076f609e1c04fa0_NeikiAnalytics.exe - Executes dropped EXE 2 IoCs
pid Process 2348 sysdevopti.exe 2748 xdobec.exe - Loads dropped DLL 2 IoCs
pid Process 1936 5a0861fcea3df7725076f609e1c04fa0_NeikiAnalytics.exe 1936 5a0861fcea3df7725076f609e1c04fa0_NeikiAnalytics.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\GalaxAR\\optialoc.exe" 5a0861fcea3df7725076f609e1c04fa0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\SysDrv4W\\xdobec.exe" 5a0861fcea3df7725076f609e1c04fa0_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1936 5a0861fcea3df7725076f609e1c04fa0_NeikiAnalytics.exe 1936 5a0861fcea3df7725076f609e1c04fa0_NeikiAnalytics.exe 2348 sysdevopti.exe 2748 xdobec.exe 2348 sysdevopti.exe 2748 xdobec.exe 2348 sysdevopti.exe 2748 xdobec.exe 2348 sysdevopti.exe 2748 xdobec.exe 2348 sysdevopti.exe 2748 xdobec.exe 2348 sysdevopti.exe 2748 xdobec.exe 2348 sysdevopti.exe 2748 xdobec.exe 2348 sysdevopti.exe 2748 xdobec.exe 2348 sysdevopti.exe 2748 xdobec.exe 2348 sysdevopti.exe 2748 xdobec.exe 2348 sysdevopti.exe 2748 xdobec.exe 2348 sysdevopti.exe 2748 xdobec.exe 2348 sysdevopti.exe 2748 xdobec.exe 2348 sysdevopti.exe 2748 xdobec.exe 2348 sysdevopti.exe 2748 xdobec.exe 2348 sysdevopti.exe 2748 xdobec.exe 2348 sysdevopti.exe 2748 xdobec.exe 2348 sysdevopti.exe 2748 xdobec.exe 2348 sysdevopti.exe 2748 xdobec.exe 2348 sysdevopti.exe 2748 xdobec.exe 2348 sysdevopti.exe 2748 xdobec.exe 2348 sysdevopti.exe 2748 xdobec.exe 2348 sysdevopti.exe 2748 xdobec.exe 2348 sysdevopti.exe 2748 xdobec.exe 2348 sysdevopti.exe 2748 xdobec.exe 2348 sysdevopti.exe 2748 xdobec.exe 2348 sysdevopti.exe 2748 xdobec.exe 2348 sysdevopti.exe 2748 xdobec.exe 2348 sysdevopti.exe 2748 xdobec.exe 2348 sysdevopti.exe 2748 xdobec.exe 2348 sysdevopti.exe 2748 xdobec.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1936 wrote to memory of 2348 1936 5a0861fcea3df7725076f609e1c04fa0_NeikiAnalytics.exe 28 PID 1936 wrote to memory of 2348 1936 5a0861fcea3df7725076f609e1c04fa0_NeikiAnalytics.exe 28 PID 1936 wrote to memory of 2348 1936 5a0861fcea3df7725076f609e1c04fa0_NeikiAnalytics.exe 28 PID 1936 wrote to memory of 2348 1936 5a0861fcea3df7725076f609e1c04fa0_NeikiAnalytics.exe 28 PID 1936 wrote to memory of 2748 1936 5a0861fcea3df7725076f609e1c04fa0_NeikiAnalytics.exe 29 PID 1936 wrote to memory of 2748 1936 5a0861fcea3df7725076f609e1c04fa0_NeikiAnalytics.exe 29 PID 1936 wrote to memory of 2748 1936 5a0861fcea3df7725076f609e1c04fa0_NeikiAnalytics.exe 29 PID 1936 wrote to memory of 2748 1936 5a0861fcea3df7725076f609e1c04fa0_NeikiAnalytics.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a0861fcea3df7725076f609e1c04fa0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5a0861fcea3df7725076f609e1c04fa0_NeikiAnalytics.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysdevopti.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysdevopti.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2348
-
-
C:\SysDrv4W\xdobec.exeC:\SysDrv4W\xdobec.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2748
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\GalaxAR\optialoc.exe
- Size 3.6MB
- SHA256 1e623d316c6ab07843922cf85687bed34f7790dcc18a73972f1380dacbc747aa
- MD5 cd891a2a800aba29f949445618d7b848
- SHA1 46cde49348b024468e464eafe50d86947ff939d5
- SHA512 1d4e87b3848e12526139661ce0a1c8790ab11fe4a7fc9a5c181751f7bf7ca61de4263cbebff6c76ae3cc6b52fd0f8cb1201d7303e430c21e7dd7c454a0525679
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBTB/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUpMbVz8eLFcz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\GalaxAR\optialoc.exe
- Size 3.6MB
- SHA256 ddcde48663b4527a9095c5d89637585a3d41996382f3da70eed35deb37d2d05f
- MD5 88de7fb853359aac96e47adab0e5e3e0
- SHA1 5b88823964ce5592d82240bf78f111ffd22330e5
- SHA512 9158e8aaa4ee1a5f4ad60fd4be006cd0d6ac36ccfaacd56bd1c3f6d993164e7e69ff8209cbb22cc86f8783c14ab5bf0ea830e2de631d1d7dec34b3c410d93bbf
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBuB/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUpNbVz8eLFcz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\SysDrv4W\xdobec.exe
- Size 3.6MB
- SHA256 dc1f49638797fdb3bbb2a25fdf286910e749303c407417aba5b2691d32981a30
- MD5 dfe82444d8eb307c18cef9b3d024a96d
- SHA1 cca639e36c77b49bb813e381bd2d70ce73ede3bf
- SHA512 903bd5441d6ce3f82f2ef6285a895d97ea6c6d4d3f3192530c0375ef1ee837cee409563bcbbc45492f3cf01fdbb20006a24dcc509e8b49407c6f27932e2f55b5
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBHB/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUpgbVz8eLFcz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_6.1_Admin.ini
- Size 173B
- SHA256 a6cb1dd9d79b8032392833fe432ea3c44bfe0fe3daab680b2e73ec738367d38d
- MD5 7cda6fe3cb987156bc668aa262a6753b
- SHA1 562f4185f3035235af9af127844fd4dd6470df0b
- SHA512 a400c0e3918ff31934ba4f16a671a27f10b681e0070321d96de1243c7fe5ec4af5026eebf18653bc4084e766abed87dafba3f29af6ff155be54a9b920028ab47
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_6.1_Admin.ini
- Size 205B
- SHA256 98865abc878a7aa4d5d817de3fdef39c2582d3ebe05c651ee2c99cb012fc8216
- MD5 104a9d7d23633c47910ebc05c881b2cd
- SHA1 3c665d890698c6028ffb0226ac8870f7c0b7975d
- SHA512 37a7761a56060768df186270b7e88d61f1e43335d5fc333eb19b954d10d8f71f205f646d0dcd98d753f6d12e12c0e0ffd90e3dfcf718f0b3144dad3f276c4d1f
- MD5 SHA1 SHA512
- Path \Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysdevopti.exe
- Size 3.6MB
- SHA256 6e366d81dcf3a706bee8e56f091b237e15db2be874ffcdd5cd5c77212a683b2c
- MD5 fda6eb01d8fe19ef4ef0af7b1689a707
- SHA1 04dd87abfdd3f81e25889aed4986e967c7cb9b92
- SHA512 df18cce860c6035b327ad37d7f71450f105d9b6a1d0b9cdd799f27eeb8840e2953690c2df0f8edc7070aab40c5c3b8231ffa212d4b70ce08ec89c494e4022371
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBvB/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUpMbVz8eLFcz
- MD5 SHA1 SHA512 SSDEEP