Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 09:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6f62bded8662dfca7d28de1343f7fce0_NeikiAnalytics.exe
Resource
win7-20240611-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
6f62bded8662dfca7d28de1343f7fce0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 6f62bded8662dfca7d28de1343f7fce0_NeikiAnalytics.exe
- Size 3.0MB
- Sample240613-k3dhhswdlr
- SHA256 59ad963cbbafec5fc6966c89ebe8aedbbc25d81cdebc7139acd161b93b658167
- MD5 6f62bded8662dfca7d28de1343f7fce0
- SHA1 880adf1d58982317832bd84f8d2fcf17c2915671
- SHA512 0413302c268a518afc9cf98409da343e94fb690853edbd57863fb6fe618f440a9781a3071d462365df5778cdd314c1994554f05cbd2b68ce0ccc8cd800985497
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBKB/bSqz8b6:sxX7QnxrloE5dpUp1bVz8e
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecxbod.exe 6f62bded8662dfca7d28de1343f7fce0_NeikiAnalytics.exe - Executes dropped EXE 2 IoCs
pid Process 2952 ecxbod.exe 4780 devoptisys.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\FilesMX\\devoptisys.exe" 6f62bded8662dfca7d28de1343f7fce0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\KaVBAD\\optialoc.exe" 6f62bded8662dfca7d28de1343f7fce0_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1592 6f62bded8662dfca7d28de1343f7fce0_NeikiAnalytics.exe 1592 6f62bded8662dfca7d28de1343f7fce0_NeikiAnalytics.exe 1592 6f62bded8662dfca7d28de1343f7fce0_NeikiAnalytics.exe 1592 6f62bded8662dfca7d28de1343f7fce0_NeikiAnalytics.exe 2952 ecxbod.exe 2952 ecxbod.exe 4780 devoptisys.exe 4780 devoptisys.exe 2952 ecxbod.exe 2952 ecxbod.exe 4780 devoptisys.exe 4780 devoptisys.exe 2952 ecxbod.exe 2952 ecxbod.exe 4780 devoptisys.exe 4780 devoptisys.exe 2952 ecxbod.exe 2952 ecxbod.exe 4780 devoptisys.exe 4780 devoptisys.exe 2952 ecxbod.exe 2952 ecxbod.exe 4780 devoptisys.exe 4780 devoptisys.exe 2952 ecxbod.exe 2952 ecxbod.exe 4780 devoptisys.exe 4780 devoptisys.exe 2952 ecxbod.exe 2952 ecxbod.exe 4780 devoptisys.exe 4780 devoptisys.exe 2952 ecxbod.exe 2952 ecxbod.exe 4780 devoptisys.exe 4780 devoptisys.exe 2952 ecxbod.exe 2952 ecxbod.exe 4780 devoptisys.exe 4780 devoptisys.exe 2952 ecxbod.exe 2952 ecxbod.exe 4780 devoptisys.exe 4780 devoptisys.exe 2952 ecxbod.exe 2952 ecxbod.exe 4780 devoptisys.exe 4780 devoptisys.exe 2952 ecxbod.exe 2952 ecxbod.exe 4780 devoptisys.exe 4780 devoptisys.exe 2952 ecxbod.exe 2952 ecxbod.exe 4780 devoptisys.exe 4780 devoptisys.exe 2952 ecxbod.exe 2952 ecxbod.exe 4780 devoptisys.exe 4780 devoptisys.exe 2952 ecxbod.exe 2952 ecxbod.exe 4780 devoptisys.exe 4780 devoptisys.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1592 wrote to memory of 2952 1592 6f62bded8662dfca7d28de1343f7fce0_NeikiAnalytics.exe 93 PID 1592 wrote to memory of 2952 1592 6f62bded8662dfca7d28de1343f7fce0_NeikiAnalytics.exe 93 PID 1592 wrote to memory of 2952 1592 6f62bded8662dfca7d28de1343f7fce0_NeikiAnalytics.exe 93 PID 1592 wrote to memory of 4780 1592 6f62bded8662dfca7d28de1343f7fce0_NeikiAnalytics.exe 94 PID 1592 wrote to memory of 4780 1592 6f62bded8662dfca7d28de1343f7fce0_NeikiAnalytics.exe 94 PID 1592 wrote to memory of 4780 1592 6f62bded8662dfca7d28de1343f7fce0_NeikiAnalytics.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\6f62bded8662dfca7d28de1343f7fce0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\6f62bded8662dfca7d28de1343f7fce0_NeikiAnalytics.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecxbod.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecxbod.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2952
-
-
C:\FilesMX\devoptisys.exeC:\FilesMX\devoptisys.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4172,i,6166776566165096562,4582328833313060853,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:81⤵PID:3020
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\FilesMX\devoptisys.exe
- Size 830KB
- SHA256 48f10c047bceda5ed3477ad28611e92701cbf6586baf230e04b6ea3610d07055
- MD5 3c204db48658e7d951c1987181cde53c
- SHA1 4fd89e273b1a3aa772558cd329f1f4a2e5f8eef3
- SHA512 7e81f40ca808a6a5e55fa93d299bfc06cdff8a6374acdd89ad68d1369bf4aff7c48fb9282c90afb02b831402227c98ca46d340ee36567323655ede451b31b5b2
- SSDEEP 24576:6nxDZV7xMyu6qJ2WSYxBdSqpcVdm5XRVpQO3chiIcr1R6:sxX7665YxRVplZg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\FilesMX\devoptisys.exe
- Size 3.0MB
- SHA256 7da3cc4610124f127566a04d60c408df2d326d54a587889c3b77048a43441f53
- MD5 90b9e6c1bf065bd100ffb5b7af0eb8b0
- SHA1 c7a2e94c7819adff7e2287321bb7a3382d4d8669
- SHA512 a8d78bfa6ed9f4db18f0e8b83cc65fc31b39dadc01329618faf4bdaae871f92b1a84ec3e9b80fe9018f4a7052617d767fdc310319601abc0f1178f86420a95ac
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBDB/bSqz8b6:sxX7QnxrloE5dpUpgbVz8e
- MD5 SHA1 SHA512 SSDEEP
- Path C:\KaVBAD\optialoc.exe
- Size 325KB
- SHA256 95a33d3fa35586e42b663f1cf97d3184c65fee1efba3b30b733e37acc8ae0abd
- MD5 d475b4a397250cfb0f2e5b4472ac78b7
- SHA1 16a04300b17246a3b73356389bdb07cea3c8427f
- SHA512 7f98de896ceb74e45d6e330e473dc5b4709aa784f82823dad7b032c5e4c62aa85140b835b507180b75c906a91b0d6681f53debfdd10d509176f523913f5c1caa
- SSDEEP 6144:6nyJ3n0Dm7+zm6wr6YEjAumIann6qJ/mB9D+nnS5ax2SNm9WdF7Uqpv:6ne3n0DmAm67YEjAyu6qJ/+WS5axBdSA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\KaVBAD\optialoc.exe
- Size 3.0MB
- SHA256 5c77e469b57cbf03f9faba417c831fc93a40004259c52599f47a71d159cd7504
- MD5 87a0e12157a78123f685777cd5a503ed
- SHA1 11f1d62821721008f60c36d0187a094c82eadfa9
- SHA512 32862c7216be4e04ec2fbdd6d326c64e4255a6ae3d1971010af5c47d2064dd88102c0ee214be1ebfd3ea63cb046edd4650313cf14bebfc1c346b8bd7892e5240
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBmB/bSqz8b6:sxX7QnxrloE5dpUpdbVz8e
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 203B
- SHA256 816bd4783f4afbe9d08d7e3b03994a238e41623a3cb4a13750332037a85de7ee
- MD5 9169d5a56f34266294410ddb33c4ed67
- SHA1 32736e283c0188be60f2781b408f647a0515f247
- SHA512 cd3610b286855ad3dceb24edd0d0e0a25723294d7027f9b11c273967b47ba5af35c101e8af6f446a1b5398bb6ed3ffa1e7a1d301751b75baf215ae0b8c9f0632
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 171B
- SHA256 88b8c8d8f3de3b1037ff01ecf2cb5cc60eb4b67ea0373dcbc480730650713d55
- MD5 ba44f44b285aec74922c90f482f8cddc
- SHA1 691a69d13e0f6a51cadc95946389f8d62491aba2
- SHA512 7dbbce93ca8a93cfbdcf9f4f902e23dbbf28a7fb615816793ad9c92ee3e58c73bc72ec0c75dbed621ed56d0a80537c2b19f11e1d861b5b4a38984269b8ebbe10
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecxbod.exe
- Size 3.0MB
- SHA256 50ee5264426464554dfb73cbd72a4fcdda0bdb332c1ec82112f43fce9fd83a84
- MD5 c2129de3018f0f2638254ff5cfc2c6d3
- SHA1 c29382cfd52d0d5751517af42d1f5c465a0a3086
- SHA512 c34e58ca7a52ca235f3bd9f1a080889b839d89c319c54bd3d6aed6fbacce115f665777a72cabd2830f88c26103c752cc0e806a1155411cc90e6b34429f107632
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBEB/bSqz8b6:sxX7QnxrloE5dpUpzbVz8e
- MD5 SHA1 SHA512 SSDEEP