Analysis
- max time kernel
149s - max time network
93s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 03:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5c73ec55e962d1713711bec2767d85a0_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
5c73ec55e962d1713711bec2767d85a0_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 5c73ec55e962d1713711bec2767d85a0_NeikiAnalytics.exe
- Size 2.7MB
- Sample240613-ehhc3sxbqr
- SHA256 6fd21e8d2d91290d6601c396bd21873b5a2b2189b5c4ed49e3e5549b52642377
- MD5 5c73ec55e962d1713711bec2767d85a0
- SHA1 0d621b5b41d5d9c0ac21cfb10c749a30be6a5889
- SHA512 fc2601ce63373a27e0d983589dc0264c869f61d8df8362623b66bb66478249b8c4475a91d967ab9b5825e0f24063133ab7b74b42e74f975d83d23f55b381f928
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LB29w4Sx:+R0pI/IQlUoMPdmpSpM4
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3856 aoptiec.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\FilesUW\\aoptiec.exe" 5c73ec55e962d1713711bec2767d85a0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\Galax8J\\dobdevec.exe" 5c73ec55e962d1713711bec2767d85a0_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1020 5c73ec55e962d1713711bec2767d85a0_NeikiAnalytics.exe 1020 5c73ec55e962d1713711bec2767d85a0_NeikiAnalytics.exe 1020 5c73ec55e962d1713711bec2767d85a0_NeikiAnalytics.exe 1020 5c73ec55e962d1713711bec2767d85a0_NeikiAnalytics.exe 3856 aoptiec.exe 3856 aoptiec.exe 1020 5c73ec55e962d1713711bec2767d85a0_NeikiAnalytics.exe 1020 5c73ec55e962d1713711bec2767d85a0_NeikiAnalytics.exe 3856 aoptiec.exe 3856 aoptiec.exe 1020 5c73ec55e962d1713711bec2767d85a0_NeikiAnalytics.exe 1020 5c73ec55e962d1713711bec2767d85a0_NeikiAnalytics.exe 3856 aoptiec.exe 3856 aoptiec.exe 1020 5c73ec55e962d1713711bec2767d85a0_NeikiAnalytics.exe 1020 5c73ec55e962d1713711bec2767d85a0_NeikiAnalytics.exe 3856 aoptiec.exe 3856 aoptiec.exe 1020 5c73ec55e962d1713711bec2767d85a0_NeikiAnalytics.exe 1020 5c73ec55e962d1713711bec2767d85a0_NeikiAnalytics.exe 3856 aoptiec.exe 3856 aoptiec.exe 1020 5c73ec55e962d1713711bec2767d85a0_NeikiAnalytics.exe 1020 5c73ec55e962d1713711bec2767d85a0_NeikiAnalytics.exe 3856 aoptiec.exe 3856 aoptiec.exe 1020 5c73ec55e962d1713711bec2767d85a0_NeikiAnalytics.exe 1020 5c73ec55e962d1713711bec2767d85a0_NeikiAnalytics.exe 3856 aoptiec.exe 3856 aoptiec.exe 1020 5c73ec55e962d1713711bec2767d85a0_NeikiAnalytics.exe 1020 5c73ec55e962d1713711bec2767d85a0_NeikiAnalytics.exe 3856 aoptiec.exe 3856 aoptiec.exe 1020 5c73ec55e962d1713711bec2767d85a0_NeikiAnalytics.exe 1020 5c73ec55e962d1713711bec2767d85a0_NeikiAnalytics.exe 3856 aoptiec.exe 3856 aoptiec.exe 1020 5c73ec55e962d1713711bec2767d85a0_NeikiAnalytics.exe 1020 5c73ec55e962d1713711bec2767d85a0_NeikiAnalytics.exe 3856 aoptiec.exe 3856 aoptiec.exe 1020 5c73ec55e962d1713711bec2767d85a0_NeikiAnalytics.exe 1020 5c73ec55e962d1713711bec2767d85a0_NeikiAnalytics.exe 3856 aoptiec.exe 3856 aoptiec.exe 1020 5c73ec55e962d1713711bec2767d85a0_NeikiAnalytics.exe 1020 5c73ec55e962d1713711bec2767d85a0_NeikiAnalytics.exe 3856 aoptiec.exe 3856 aoptiec.exe 1020 5c73ec55e962d1713711bec2767d85a0_NeikiAnalytics.exe 1020 5c73ec55e962d1713711bec2767d85a0_NeikiAnalytics.exe 3856 aoptiec.exe 3856 aoptiec.exe 1020 5c73ec55e962d1713711bec2767d85a0_NeikiAnalytics.exe 1020 5c73ec55e962d1713711bec2767d85a0_NeikiAnalytics.exe 3856 aoptiec.exe 3856 aoptiec.exe 1020 5c73ec55e962d1713711bec2767d85a0_NeikiAnalytics.exe 1020 5c73ec55e962d1713711bec2767d85a0_NeikiAnalytics.exe 3856 aoptiec.exe 3856 aoptiec.exe 1020 5c73ec55e962d1713711bec2767d85a0_NeikiAnalytics.exe 1020 5c73ec55e962d1713711bec2767d85a0_NeikiAnalytics.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1020 wrote to memory of 3856 1020 5c73ec55e962d1713711bec2767d85a0_NeikiAnalytics.exe 87 PID 1020 wrote to memory of 3856 1020 5c73ec55e962d1713711bec2767d85a0_NeikiAnalytics.exe 87 PID 1020 wrote to memory of 3856 1020 5c73ec55e962d1713711bec2767d85a0_NeikiAnalytics.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\5c73ec55e962d1713711bec2767d85a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5c73ec55e962d1713711bec2767d85a0_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\FilesUW\aoptiec.exeC:\FilesUW\aoptiec.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3856
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\FilesUW\aoptiec.exe
- Size 2.7MB
- SHA256 0927e7a2692c42a4d0b70175bc4cd0047649f2954be065d51f152a49d341f453
- MD5 12f6f1d42fd48c040c46b602840508bf
- SHA1 d49c696812a7ac6bd05651f7f92864c57bd9e4c1
- SHA512 80f13c7e9ecda61a93d199b036076171ecdc322cdac32581ac66ea3c35d76959a06238a160b3be69e41da3a9ab9b13cb9764126e3280e9b1c834d25967a4d71b
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBg9w4Sx:+R0pI/IQlUoMPdmpSpe4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Galax8J\dobdevec.exe
- Size 200KB
- SHA256 4ab8c75cabe0340aff53b04059e68c3d346fac77ca02a0a1e9fdc8ae1fc4d05f
- MD5 112acaa17916e925f8b18173c7863ebd
- SHA1 e5789b47e6f7f61156213c8734ee0f89e9e41b52
- SHA512 8991d039519e492a7e77771352423e9e6711051ca3145e3eb1b3324298a3fac88e0395c90fabae474bf5abac7cec4242130998b1a92c7baa2659153f5b4f8333
- SSDEEP 6144:n+yJ3H0j/5G3NOFSakgnPPN27fzgLtCDL:n+e3H0j/4cFSakgnCf8xCDL
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Galax8J\dobdevec.exe
- Size 2.7MB
- SHA256 ecb3203019f59a6cf6c94f99e4b4d7846a8857047971f20b1483c68e1bc0fe10
- MD5 7a9ecb68b30ddeb9a1f924a7617cc8bc
- SHA1 0cce5ded5fc4cb0b580ac535959c350d9e14864f
- SHA512 5a4812660290fe5e3f625265cf9c9d1b2fd9b6dd330c40a4b0809362815c438584cb9805ada8f9c89d045714a3a15c8b76edd20f9d5beb69dc88b6f037ab3c31
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBg9w4Sx:+R0pI/IQlUoMPdmpSp+4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 202B
- SHA256 f32f44ff9678736900a5b7e20660f68b85e7cb8695a0f3eee84a07520fc8af8c
- MD5 557b744b69852df504ee5c2e08c83709
- SHA1 d5c7419620c9ee9e0d8c6637e23f200ed90fbf57
- SHA512 879e72e32b41d2a3880797ea01af629f8d90dc653541560f071c7f4ad083ae553bb254e85bdbaede92115b4d7c7eeb449b21179522eb6eb34b490564ecaf5a0b
- MD5 SHA1 SHA512