Analysis
- max time kernel
149s - max time network
94s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 09:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7278bd7a1e3c0d0a7722af544e24b600_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
7278bd7a1e3c0d0a7722af544e24b600_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 7278bd7a1e3c0d0a7722af544e24b600_NeikiAnalytics.exe
- Size 2.7MB
- Sample240613-lzhthatepf
- SHA256 6d1d8e515722f0778b2b0e571545efc34ceb72af990b7e9c1bd9594ceb0c69a7
- MD5 7278bd7a1e3c0d0a7722af544e24b600
- SHA1 e72c92bdaaee14507b6e686c2c90dc1014dce3e3
- SHA512 acaef049b56fbf69405df51ca9f797d370465841121144ff891826c9c71565dc11c1b0aec247a425b30be87e0ecf1eeb71091e66c711a11cbf12c17dbabe9f66
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LB+9w4Sx:+R0pI/IQlUoMPdmpSpI4
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 628 xoptisys.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\FilesEX\\xoptisys.exe" 7278bd7a1e3c0d0a7722af544e24b600_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\Galax9O\\bodxec.exe" 7278bd7a1e3c0d0a7722af544e24b600_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2928 7278bd7a1e3c0d0a7722af544e24b600_NeikiAnalytics.exe 2928 7278bd7a1e3c0d0a7722af544e24b600_NeikiAnalytics.exe 2928 7278bd7a1e3c0d0a7722af544e24b600_NeikiAnalytics.exe 2928 7278bd7a1e3c0d0a7722af544e24b600_NeikiAnalytics.exe 628 xoptisys.exe 628 xoptisys.exe 2928 7278bd7a1e3c0d0a7722af544e24b600_NeikiAnalytics.exe 2928 7278bd7a1e3c0d0a7722af544e24b600_NeikiAnalytics.exe 628 xoptisys.exe 628 xoptisys.exe 2928 7278bd7a1e3c0d0a7722af544e24b600_NeikiAnalytics.exe 2928 7278bd7a1e3c0d0a7722af544e24b600_NeikiAnalytics.exe 628 xoptisys.exe 628 xoptisys.exe 2928 7278bd7a1e3c0d0a7722af544e24b600_NeikiAnalytics.exe 2928 7278bd7a1e3c0d0a7722af544e24b600_NeikiAnalytics.exe 628 xoptisys.exe 628 xoptisys.exe 2928 7278bd7a1e3c0d0a7722af544e24b600_NeikiAnalytics.exe 2928 7278bd7a1e3c0d0a7722af544e24b600_NeikiAnalytics.exe 628 xoptisys.exe 628 xoptisys.exe 2928 7278bd7a1e3c0d0a7722af544e24b600_NeikiAnalytics.exe 2928 7278bd7a1e3c0d0a7722af544e24b600_NeikiAnalytics.exe 628 xoptisys.exe 628 xoptisys.exe 2928 7278bd7a1e3c0d0a7722af544e24b600_NeikiAnalytics.exe 2928 7278bd7a1e3c0d0a7722af544e24b600_NeikiAnalytics.exe 628 xoptisys.exe 628 xoptisys.exe 2928 7278bd7a1e3c0d0a7722af544e24b600_NeikiAnalytics.exe 2928 7278bd7a1e3c0d0a7722af544e24b600_NeikiAnalytics.exe 628 xoptisys.exe 628 xoptisys.exe 2928 7278bd7a1e3c0d0a7722af544e24b600_NeikiAnalytics.exe 2928 7278bd7a1e3c0d0a7722af544e24b600_NeikiAnalytics.exe 628 xoptisys.exe 628 xoptisys.exe 2928 7278bd7a1e3c0d0a7722af544e24b600_NeikiAnalytics.exe 2928 7278bd7a1e3c0d0a7722af544e24b600_NeikiAnalytics.exe 628 xoptisys.exe 628 xoptisys.exe 2928 7278bd7a1e3c0d0a7722af544e24b600_NeikiAnalytics.exe 2928 7278bd7a1e3c0d0a7722af544e24b600_NeikiAnalytics.exe 628 xoptisys.exe 628 xoptisys.exe 2928 7278bd7a1e3c0d0a7722af544e24b600_NeikiAnalytics.exe 2928 7278bd7a1e3c0d0a7722af544e24b600_NeikiAnalytics.exe 628 xoptisys.exe 628 xoptisys.exe 2928 7278bd7a1e3c0d0a7722af544e24b600_NeikiAnalytics.exe 2928 7278bd7a1e3c0d0a7722af544e24b600_NeikiAnalytics.exe 628 xoptisys.exe 628 xoptisys.exe 2928 7278bd7a1e3c0d0a7722af544e24b600_NeikiAnalytics.exe 2928 7278bd7a1e3c0d0a7722af544e24b600_NeikiAnalytics.exe 628 xoptisys.exe 628 xoptisys.exe 2928 7278bd7a1e3c0d0a7722af544e24b600_NeikiAnalytics.exe 2928 7278bd7a1e3c0d0a7722af544e24b600_NeikiAnalytics.exe 628 xoptisys.exe 628 xoptisys.exe 2928 7278bd7a1e3c0d0a7722af544e24b600_NeikiAnalytics.exe 2928 7278bd7a1e3c0d0a7722af544e24b600_NeikiAnalytics.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2928 wrote to memory of 628 2928 7278bd7a1e3c0d0a7722af544e24b600_NeikiAnalytics.exe 84 PID 2928 wrote to memory of 628 2928 7278bd7a1e3c0d0a7722af544e24b600_NeikiAnalytics.exe 84 PID 2928 wrote to memory of 628 2928 7278bd7a1e3c0d0a7722af544e24b600_NeikiAnalytics.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\7278bd7a1e3c0d0a7722af544e24b600_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\7278bd7a1e3c0d0a7722af544e24b600_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\FilesEX\xoptisys.exeC:\FilesEX\xoptisys.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:628
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\FilesEX\xoptisys.exe
- Size 2.7MB
- SHA256 23068d61950e3073270db6dd7deeb4656c405a2a10752742f4b8ec5f1b3a93da
- MD5 d47ffe1acac0fca4fe5e7bab25e64a7a
- SHA1 895f252be22927ddee16187174cc4d4fac1b4d85
- SHA512 d92b1c2698da188885f6cc3320ffa618767cec2dc13b9ff256dd0bb0c109451b7a775f22c70451c50229be7e221396e1eb6eccd270163511bdb106680280077b
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBQ9w4Sx:+R0pI/IQlUoMPdmpSp+4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Galax9O\bodxec.exe
- Size 2.7MB
- SHA256 4e5f7d493ad6408041a77324e4041917bcdb67e5b45d9c5b36f62e8fbc4ce374
- MD5 d8731877f77b41668bacd0fd280642ae
- SHA1 dd572875387aefd57b73214b943ee38bd6e1d784
- SHA512 5f43cd5d5ae0768db7a21090d5aecf7c00cc0e0ad3b3903faab244295353550e9d5dab7c66e7b2494dbb2f7c1e00069399845f54dacfbbcb08f3993b6559ed2d
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBn9w4Sx:+R0pI/IQlUoMPdmpSpj4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 201B
- SHA256 892aff37e5b11fb03287477658c8fc3136c363d39d7c3eab0a2e8025aac10e51
- MD5 6fabdc803fbad7c8c6a2b589bda63f0e
- SHA1 49be1c0fc1defd3024c61f90b01178fb96e11869
- SHA512 6d402461a2ebac095e678b34d9837dfd265cfd24b5410c9218e4804f53fde993dfc19c3034fdeae506b65646a2a1b10b9f8f3d825e613780dc9040cacec33a9c
- MD5 SHA1 SHA512