Analysis
- max time kernel
150s - max time network
51s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 03:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5bda9bcf5c906737b67fc3e01fc374e0_NeikiAnalytics.exe
Resource
win7-20240611-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
5bda9bcf5c906737b67fc3e01fc374e0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 5bda9bcf5c906737b67fc3e01fc374e0_NeikiAnalytics.exe
- Size 3.1MB
- Sample240613-ebt4aswhrn
- SHA256 39825b96cabf19ac29ee9dc3ad9d49c9daed4e176e2eeff742aafab63e619c4b
- MD5 5bda9bcf5c906737b67fc3e01fc374e0
- SHA1 12075b48fe688594ca8134fa2803edea71ecc1cf
- SHA512 fbb9753e426194baa5d8de5d4d44973a6beefc691e9b1bba586d43ad703fddfaae9fe76a5070d8ce794c1614c4f7fbd139e92b76de0c169694e73f188313cbef
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBxB/bSqz8:sxX7QnxrloE5dpUpebVz8
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysaopti.exe 5bda9bcf5c906737b67fc3e01fc374e0_NeikiAnalytics.exe - Executes dropped EXE 2 IoCs
pid Process 3296 sysaopti.exe 1016 xdobloc.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\GalaxBT\\dobdevsys.exe" 5bda9bcf5c906737b67fc3e01fc374e0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\UserDotQD\\xdobloc.exe" 5bda9bcf5c906737b67fc3e01fc374e0_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2792 5bda9bcf5c906737b67fc3e01fc374e0_NeikiAnalytics.exe 2792 5bda9bcf5c906737b67fc3e01fc374e0_NeikiAnalytics.exe 2792 5bda9bcf5c906737b67fc3e01fc374e0_NeikiAnalytics.exe 2792 5bda9bcf5c906737b67fc3e01fc374e0_NeikiAnalytics.exe 3296 sysaopti.exe 3296 sysaopti.exe 1016 xdobloc.exe 1016 xdobloc.exe 3296 sysaopti.exe 3296 sysaopti.exe 1016 xdobloc.exe 1016 xdobloc.exe 3296 sysaopti.exe 3296 sysaopti.exe 1016 xdobloc.exe 1016 xdobloc.exe 3296 sysaopti.exe 3296 sysaopti.exe 1016 xdobloc.exe 1016 xdobloc.exe 3296 sysaopti.exe 3296 sysaopti.exe 1016 xdobloc.exe 1016 xdobloc.exe 3296 sysaopti.exe 3296 sysaopti.exe 1016 xdobloc.exe 1016 xdobloc.exe 3296 sysaopti.exe 3296 sysaopti.exe 1016 xdobloc.exe 1016 xdobloc.exe 3296 sysaopti.exe 3296 sysaopti.exe 1016 xdobloc.exe 1016 xdobloc.exe 3296 sysaopti.exe 3296 sysaopti.exe 1016 xdobloc.exe 1016 xdobloc.exe 3296 sysaopti.exe 3296 sysaopti.exe 1016 xdobloc.exe 1016 xdobloc.exe 3296 sysaopti.exe 3296 sysaopti.exe 1016 xdobloc.exe 1016 xdobloc.exe 3296 sysaopti.exe 3296 sysaopti.exe 1016 xdobloc.exe 1016 xdobloc.exe 3296 sysaopti.exe 3296 sysaopti.exe 1016 xdobloc.exe 1016 xdobloc.exe 3296 sysaopti.exe 3296 sysaopti.exe 1016 xdobloc.exe 1016 xdobloc.exe 3296 sysaopti.exe 3296 sysaopti.exe 1016 xdobloc.exe 1016 xdobloc.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2792 wrote to memory of 3296 2792 5bda9bcf5c906737b67fc3e01fc374e0_NeikiAnalytics.exe 85 PID 2792 wrote to memory of 3296 2792 5bda9bcf5c906737b67fc3e01fc374e0_NeikiAnalytics.exe 85 PID 2792 wrote to memory of 3296 2792 5bda9bcf5c906737b67fc3e01fc374e0_NeikiAnalytics.exe 85 PID 2792 wrote to memory of 1016 2792 5bda9bcf5c906737b67fc3e01fc374e0_NeikiAnalytics.exe 86 PID 2792 wrote to memory of 1016 2792 5bda9bcf5c906737b67fc3e01fc374e0_NeikiAnalytics.exe 86 PID 2792 wrote to memory of 1016 2792 5bda9bcf5c906737b67fc3e01fc374e0_NeikiAnalytics.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\5bda9bcf5c906737b67fc3e01fc374e0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5bda9bcf5c906737b67fc3e01fc374e0_NeikiAnalytics.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysaopti.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysaopti.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3296
-
-
C:\UserDotQD\xdobloc.exeC:\UserDotQD\xdobloc.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1016
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\GalaxBT\dobdevsys.exe
- Size 2.6MB
- SHA256 5a77f0e9c286e823978b21c993cd8847184d678c3b3c5b545f74792a2dc16ffe
- MD5 5eb070252d8ef00ee121ccaa611737f4
- SHA1 d7d4864e83efa11bbec8ad37bf70c718498e141a
- SHA512 2c79f4747983bf4dc5ba6206206ab0a039448feb7ed1d21e2cbd99a173797785a11ef3e39896b481d551fa37ed981290c7656380b62d7f757c036bcf2a7fdf70
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBXB/bSp:sxX7QnxrloE5dpUpwbS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\GalaxBT\dobdevsys.exe
- Size 615KB
- SHA256 8792be509e525f9fb04233917c7a16872f42933fe29a0783af016ec361048f82
- MD5 7e94b7c02dac91553204eca8fa82452d
- SHA1 6488fbec063c70d076db8a5b8d8a15225561eb0a
- SHA512 fddd463b251b9b388f4acaa9945d8da6e136c71b8a64e05d848cab24d1c615087f59b9227d22b4d4aa843b31b4c94f418822236eb377bb103b92553bf240dc9f
- SSDEEP 12288:6ne3n0DmAm67YEjAyu6qJ/+WS5axBdSqpcVdSxL5XOEVpQEPcCf:6nxDZV7xMyu6qJ2WSYxBdSqpcVdm5XRt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\UserDotQD\xdobloc.exe
- Size 3.1MB
- SHA256 e13c30a75d130a988ee6c85fb581a87e681b12e5a147d960e45bfb10a9b11e6e
- MD5 882e61708d0e4b16694253fcbb11b251
- SHA1 50cddcbad38da028d3a85bf28ff536fd453a5d58
- SHA512 e12d418a8a1ac85fbdc6c2d7967bc14cbdf8fa6e39941ff82956c3c810df6448952fce58e19deef25ab4eebfcdd7aed13749a583df558dfbd3c3f790589b3b04
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBRB/bSqz8:sxX7QnxrloE5dpUpObVz8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 206B
- SHA256 4332fcf22769184e45a00b72b72e246feed1f94b6f3c8fe58cb00fcced667c28
- MD5 c8c5f675830a736cbf83d86c7dec7d3d
- SHA1 81e6065b1925c85d3e8c8e18602badf7f5e79eae
- SHA512 d35943714b2919dfe43bd7fa9ce4d134037db9a2b5f3ec463f769b80b691caf3fb77e33d391109b7368414aa4d722bea52e122ec7e964eea5572d571a740fc9c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 174B
- SHA256 8b42d2e205731929ea420139054a6dc5463142814549b10c6a31dc881180a38c
- MD5 7bc27bb3e75135ef34d0e53a96993240
- SHA1 7ba831b3efdfb245b8c86fa7c4a11e3df2c2e5ae
- SHA512 51b761c0b48b6544d5fc024e12169b20fce8f96cf3005373aa1b1fe47b536a955bef5a65dd757e0d8f611a8db903d0763bb421ed8e7aaef94c475a0d10aa320d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysaopti.exe
- Size 3.1MB
- SHA256 423d056b2f307b6789b766baf1ebf389f06f17662bc5dbe002666ebce075c2d5
- MD5 8524b433c3d924996e208d60a7a84dc4
- SHA1 6e77aca12860ef07cba8ac5a0396c513683c6939
- SHA512 7583eb9b3c78f052663397d89398d95d585513e828dbbd487d87eece6234f7527b4096c93f37bc9719c0e1fab286ccfe18f3c5c531bc5e3a0e1d6574a53de3b3
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBqB/bSqz8:sxX7QnxrloE5dpUpxbVz8
- MD5 SHA1 SHA512 SSDEEP