Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 12:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7c3715bacbee6bdc901d0ba4e225c8b0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
7c3715bacbee6bdc901d0ba4e225c8b0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 7c3715bacbee6bdc901d0ba4e225c8b0_NeikiAnalytics.exe
- Size 4.1MB
- Sample240613-pmta9aydmc
- SHA256 6379ce4457d7c1164e273ab7dd5a76797b9eaa8811c7371703f9732285f7f6b6
- MD5 7c3715bacbee6bdc901d0ba4e225c8b0
- SHA1 f55c605bdb94a37d729ea31c365d1da83a6d1603
- SHA512 ef35b0aa0940529ccc3b19d4f915b73f138f86893f1b37ef4d7ec740d77442f5c3a8c98afd7b4347da9a641b87c448566430d0dc18629b32641277b2832150c7
- SSDEEP 98304:+R0pI/IQlUoMPdmpSpN4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdmW5n9klRKN41v
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3720 xoptiec.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\Intelproc3G\\xoptiec.exe" 7c3715bacbee6bdc901d0ba4e225c8b0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\GalaxTX\\boddevec.exe" 7c3715bacbee6bdc901d0ba4e225c8b0_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1004 7c3715bacbee6bdc901d0ba4e225c8b0_NeikiAnalytics.exe 1004 7c3715bacbee6bdc901d0ba4e225c8b0_NeikiAnalytics.exe 1004 7c3715bacbee6bdc901d0ba4e225c8b0_NeikiAnalytics.exe 1004 7c3715bacbee6bdc901d0ba4e225c8b0_NeikiAnalytics.exe 3720 xoptiec.exe 3720 xoptiec.exe 1004 7c3715bacbee6bdc901d0ba4e225c8b0_NeikiAnalytics.exe 1004 7c3715bacbee6bdc901d0ba4e225c8b0_NeikiAnalytics.exe 3720 xoptiec.exe 3720 xoptiec.exe 1004 7c3715bacbee6bdc901d0ba4e225c8b0_NeikiAnalytics.exe 1004 7c3715bacbee6bdc901d0ba4e225c8b0_NeikiAnalytics.exe 3720 xoptiec.exe 3720 xoptiec.exe 1004 7c3715bacbee6bdc901d0ba4e225c8b0_NeikiAnalytics.exe 1004 7c3715bacbee6bdc901d0ba4e225c8b0_NeikiAnalytics.exe 3720 xoptiec.exe 3720 xoptiec.exe 1004 7c3715bacbee6bdc901d0ba4e225c8b0_NeikiAnalytics.exe 1004 7c3715bacbee6bdc901d0ba4e225c8b0_NeikiAnalytics.exe 3720 xoptiec.exe 3720 xoptiec.exe 1004 7c3715bacbee6bdc901d0ba4e225c8b0_NeikiAnalytics.exe 1004 7c3715bacbee6bdc901d0ba4e225c8b0_NeikiAnalytics.exe 3720 xoptiec.exe 3720 xoptiec.exe 1004 7c3715bacbee6bdc901d0ba4e225c8b0_NeikiAnalytics.exe 1004 7c3715bacbee6bdc901d0ba4e225c8b0_NeikiAnalytics.exe 3720 xoptiec.exe 3720 xoptiec.exe 1004 7c3715bacbee6bdc901d0ba4e225c8b0_NeikiAnalytics.exe 1004 7c3715bacbee6bdc901d0ba4e225c8b0_NeikiAnalytics.exe 3720 xoptiec.exe 3720 xoptiec.exe 1004 7c3715bacbee6bdc901d0ba4e225c8b0_NeikiAnalytics.exe 1004 7c3715bacbee6bdc901d0ba4e225c8b0_NeikiAnalytics.exe 3720 xoptiec.exe 3720 xoptiec.exe 1004 7c3715bacbee6bdc901d0ba4e225c8b0_NeikiAnalytics.exe 1004 7c3715bacbee6bdc901d0ba4e225c8b0_NeikiAnalytics.exe 3720 xoptiec.exe 3720 xoptiec.exe 1004 7c3715bacbee6bdc901d0ba4e225c8b0_NeikiAnalytics.exe 1004 7c3715bacbee6bdc901d0ba4e225c8b0_NeikiAnalytics.exe 3720 xoptiec.exe 3720 xoptiec.exe 1004 7c3715bacbee6bdc901d0ba4e225c8b0_NeikiAnalytics.exe 1004 7c3715bacbee6bdc901d0ba4e225c8b0_NeikiAnalytics.exe 3720 xoptiec.exe 3720 xoptiec.exe 1004 7c3715bacbee6bdc901d0ba4e225c8b0_NeikiAnalytics.exe 1004 7c3715bacbee6bdc901d0ba4e225c8b0_NeikiAnalytics.exe 3720 xoptiec.exe 3720 xoptiec.exe 1004 7c3715bacbee6bdc901d0ba4e225c8b0_NeikiAnalytics.exe 1004 7c3715bacbee6bdc901d0ba4e225c8b0_NeikiAnalytics.exe 3720 xoptiec.exe 3720 xoptiec.exe 1004 7c3715bacbee6bdc901d0ba4e225c8b0_NeikiAnalytics.exe 1004 7c3715bacbee6bdc901d0ba4e225c8b0_NeikiAnalytics.exe 3720 xoptiec.exe 3720 xoptiec.exe 1004 7c3715bacbee6bdc901d0ba4e225c8b0_NeikiAnalytics.exe 1004 7c3715bacbee6bdc901d0ba4e225c8b0_NeikiAnalytics.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1004 wrote to memory of 3720 1004 7c3715bacbee6bdc901d0ba4e225c8b0_NeikiAnalytics.exe 86 PID 1004 wrote to memory of 3720 1004 7c3715bacbee6bdc901d0ba4e225c8b0_NeikiAnalytics.exe 86 PID 1004 wrote to memory of 3720 1004 7c3715bacbee6bdc901d0ba4e225c8b0_NeikiAnalytics.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\7c3715bacbee6bdc901d0ba4e225c8b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\7c3715bacbee6bdc901d0ba4e225c8b0_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Intelproc3G\xoptiec.exeC:\Intelproc3G\xoptiec.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3720
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\GalaxTX\boddevec.exe
- Size 3.6MB
- SHA256 de0c5dad4bf5897ad6b61299f918e915e4d539e39232de500f87a00011d2b4df
- MD5 0141c673cf6858c725d9e96c3b90bbbc
- SHA1 86bd118a88aa73fefb548d3ba41aaf4d9a4e5236
- SHA512 7b5b7c6d1fac5cee0ed23c919ff8c231a0a76b7dee52e7af341036f4107ceca95a33359a1bfba89343b72fb0762024a86b94431f1271aab7a51e20cff6748993
- SSDEEP 98304:+R0pI/IQlUoMPdmpSpO4ADtnkgvNWlw6R:+R0pIAQhMPdm95n9klRR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\GalaxTX\boddevec.exe
- Size 4.1MB
- SHA256 1c7bda3350ecc29524db313b5180b0ce7935fdc6dc45559e33748851355ce11e
- MD5 6d8c42b89b37c489d15b5eb3ee2dfdc6
- SHA1 ae9156f43053b343e62583ddadac74b19a695fae
- SHA512 a63d682fdf4d6b9446456a482256f798e4e6913bb6888a9a4817ac84c308313990b74076f78d9297b2731d299c46659c2f8ed9a6b6f41683f2c3df45630c90a0
- SSDEEP 98304:+R0pI/IQlUoMPdmpSpO4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdm95n9klRKN41v
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Intelproc3G\xoptiec.exe
- Size 4.1MB
- SHA256 c4a047a5fc7bdb23d9d600ab7074909b1321c202aab09e3b563204ae98b7e4ba
- MD5 10749ec373f671d025803aa883c3cf0e
- SHA1 8ae41c49ced666a0b46000938926410206d26cea
- SHA512 01904165d71216f20691cbd6348a73c8c47b0c248f76abac86158352a19ed679b978ad5b6ecebe6855ee93e4b5ebe69287f9ba9781fa8ddb79ed32afe9cd0387
- SSDEEP 98304:+R0pI/IQlUoMPdmpSpk4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdmf5n9klRKN41v
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 206B
- SHA256 7faa1375d47594b09b4ddaf333ed4dffb3a26b2ac1001cd7d8907d52cbc02e41
- MD5 7d87b5807b1ca812f17081dcdd965c70
- SHA1 5d51bcdde95ad32dac03322b747103047aa033ba
- SHA512 c071aaa03fb1d432131876dee49eed8293744cc0a4d4870a2ec3128f9d2f75e46218e18c71236ca3e37f79222d1b804d0efa4c6f5cecf41f2a56b997f121ea2b
- MD5 SHA1 SHA512