Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 09:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
715cddfe0b3d154609f3efc93eabda90_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
715cddfe0b3d154609f3efc93eabda90_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 715cddfe0b3d154609f3efc93eabda90_NeikiAnalytics.exe
- Size 4.1MB
- Sample240613-lnwk8axcpr
- SHA256 3d4beb0e5b7f2a12a2e63fe498b2642004140c3bea0fc51cb9568acfa8dda431
- MD5 715cddfe0b3d154609f3efc93eabda90
- SHA1 bf94dc335d16e6645b917803a7ecdbf5c58c2543
- SHA512 3f56c2fb886d101f9fb46378a869b328483a9098458b70ab0ed9c6405dd73d4dca302ac9084a737f8e68bc153d5771a7d4c21292f914c9ccfb825e16715769cf
- SSDEEP 98304:+R0pI/IQlUoMPdmpSpc4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdmL5n9klRKN41v
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1364 devoptiec.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\SysDrvYY\\devoptiec.exe" 715cddfe0b3d154609f3efc93eabda90_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\LabZ0L\\dobdevsys.exe" 715cddfe0b3d154609f3efc93eabda90_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1312 715cddfe0b3d154609f3efc93eabda90_NeikiAnalytics.exe 1312 715cddfe0b3d154609f3efc93eabda90_NeikiAnalytics.exe 1312 715cddfe0b3d154609f3efc93eabda90_NeikiAnalytics.exe 1312 715cddfe0b3d154609f3efc93eabda90_NeikiAnalytics.exe 1364 devoptiec.exe 1364 devoptiec.exe 1312 715cddfe0b3d154609f3efc93eabda90_NeikiAnalytics.exe 1312 715cddfe0b3d154609f3efc93eabda90_NeikiAnalytics.exe 1364 devoptiec.exe 1364 devoptiec.exe 1312 715cddfe0b3d154609f3efc93eabda90_NeikiAnalytics.exe 1312 715cddfe0b3d154609f3efc93eabda90_NeikiAnalytics.exe 1364 devoptiec.exe 1364 devoptiec.exe 1312 715cddfe0b3d154609f3efc93eabda90_NeikiAnalytics.exe 1312 715cddfe0b3d154609f3efc93eabda90_NeikiAnalytics.exe 1364 devoptiec.exe 1364 devoptiec.exe 1312 715cddfe0b3d154609f3efc93eabda90_NeikiAnalytics.exe 1312 715cddfe0b3d154609f3efc93eabda90_NeikiAnalytics.exe 1364 devoptiec.exe 1364 devoptiec.exe 1312 715cddfe0b3d154609f3efc93eabda90_NeikiAnalytics.exe 1312 715cddfe0b3d154609f3efc93eabda90_NeikiAnalytics.exe 1364 devoptiec.exe 1364 devoptiec.exe 1312 715cddfe0b3d154609f3efc93eabda90_NeikiAnalytics.exe 1312 715cddfe0b3d154609f3efc93eabda90_NeikiAnalytics.exe 1364 devoptiec.exe 1364 devoptiec.exe 1312 715cddfe0b3d154609f3efc93eabda90_NeikiAnalytics.exe 1312 715cddfe0b3d154609f3efc93eabda90_NeikiAnalytics.exe 1364 devoptiec.exe 1364 devoptiec.exe 1312 715cddfe0b3d154609f3efc93eabda90_NeikiAnalytics.exe 1312 715cddfe0b3d154609f3efc93eabda90_NeikiAnalytics.exe 1364 devoptiec.exe 1364 devoptiec.exe 1312 715cddfe0b3d154609f3efc93eabda90_NeikiAnalytics.exe 1312 715cddfe0b3d154609f3efc93eabda90_NeikiAnalytics.exe 1364 devoptiec.exe 1364 devoptiec.exe 1312 715cddfe0b3d154609f3efc93eabda90_NeikiAnalytics.exe 1312 715cddfe0b3d154609f3efc93eabda90_NeikiAnalytics.exe 1364 devoptiec.exe 1364 devoptiec.exe 1312 715cddfe0b3d154609f3efc93eabda90_NeikiAnalytics.exe 1312 715cddfe0b3d154609f3efc93eabda90_NeikiAnalytics.exe 1364 devoptiec.exe 1364 devoptiec.exe 1312 715cddfe0b3d154609f3efc93eabda90_NeikiAnalytics.exe 1312 715cddfe0b3d154609f3efc93eabda90_NeikiAnalytics.exe 1364 devoptiec.exe 1364 devoptiec.exe 1312 715cddfe0b3d154609f3efc93eabda90_NeikiAnalytics.exe 1312 715cddfe0b3d154609f3efc93eabda90_NeikiAnalytics.exe 1364 devoptiec.exe 1364 devoptiec.exe 1312 715cddfe0b3d154609f3efc93eabda90_NeikiAnalytics.exe 1312 715cddfe0b3d154609f3efc93eabda90_NeikiAnalytics.exe 1364 devoptiec.exe 1364 devoptiec.exe 1312 715cddfe0b3d154609f3efc93eabda90_NeikiAnalytics.exe 1312 715cddfe0b3d154609f3efc93eabda90_NeikiAnalytics.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1312 wrote to memory of 1364 1312 715cddfe0b3d154609f3efc93eabda90_NeikiAnalytics.exe 85 PID 1312 wrote to memory of 1364 1312 715cddfe0b3d154609f3efc93eabda90_NeikiAnalytics.exe 85 PID 1312 wrote to memory of 1364 1312 715cddfe0b3d154609f3efc93eabda90_NeikiAnalytics.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\715cddfe0b3d154609f3efc93eabda90_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\715cddfe0b3d154609f3efc93eabda90_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\SysDrvYY\devoptiec.exeC:\SysDrvYY\devoptiec.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1364
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\LabZ0L\dobdevsys.exe
- Size 4.1MB
- SHA256 e9006e7b88f748104225440d3229c8c06d81878cadf8e84cbc3345db07325d7e
- MD5 9dc53a52e2889edacbb62c0af8500868
- SHA1 2ae9b6bc696136ee7714590b89f917a3f12fc1d2
- SHA512 d36f475d6f581eb44277f86e12a06c7bd7750114e98fc6c21fdc7b88eaa9f1f95a61c5a31a702ec94b0e1ae177533f7f9410c77e3dde21dafa808fd7639b810d
- SSDEEP 98304:+R0pI/IQlUoMPdmpSp34ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdmM5n9klRKN41v
- MD5 SHA1 SHA512 SSDEEP
- Path C:\SysDrvYY\devoptiec.exe
- Size 4.1MB
- SHA256 ac914aabe6217815749ccd3173d33ffc3278c300397971dc47936439a528e609
- MD5 f03685fcacdcf92f92a59ffd2b58295e
- SHA1 6ce222eb7e71c56fd7926e7707d695fb3f7c1b06
- SHA512 a33df87de82ba8569672f6999b1e3ba0a7709637639107aa103e0ef8eb5e3789259f21686fc10349d3858653897892b793d4b82d97588a09330c611b94de652a
- SSDEEP 98304:+R0pI/IQlUoMPdmpSpX4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdmU5n9klRKN41v
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 207B
- SHA256 6ab99b88efe01196d1d5de7d60ad99ad12bda54d33d24cd88f0597799623e5d1
- MD5 0c8e821d22bc7e5ce3dbc5bd5d5aaf2d
- SHA1 eeb24868ffbdd9df0f51e6e94409f016bdbe52bd
- SHA512 7fcd46e0201ff7ec0c8adb30d346ed67ba2508c4eb4e357d939b2c6abdc84cc56a21a1a84d9f7f4ba1e4c94159bb2d291fa7cc16b8aa60f6e133134de45c5e72
- MD5 SHA1 SHA512