Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
14/06/2024, 00:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
955ecdd0d58b47bb1d808ab8eca60740_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
955ecdd0d58b47bb1d808ab8eca60740_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 955ecdd0d58b47bb1d808ab8eca60740_NeikiAnalytics.exe
- Size 3.0MB
- Sample240614-bbsnpaydma
- SHA256 822829fd40fad4b640c3f9282653596b5cb8abfea1d282efe8b9d3cccc75d9b6
- MD5 955ecdd0d58b47bb1d808ab8eca60740
- SHA1 518f3470aa259c2d2ce52f277466fa383d1c8714
- SHA512 079058274d5e99587146ac322c762f755a066eb2316e153733a5e052b82a7c91efd19f20caae83f4b9622b3f88c25b236b04060e274b0f7e518b57a399e0ddfe
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB2B/bSqz8b6LNX:sxX7QnxrloE5dpUpFbVz8eLF
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecdevopti.exe 955ecdd0d58b47bb1d808ab8eca60740_NeikiAnalytics.exe - Executes dropped EXE 2 IoCs
pid Process 2960 ecdevopti.exe 1580 xoptisys.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\Adobe7H\\xoptisys.exe" 955ecdd0d58b47bb1d808ab8eca60740_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\Galax7B\\bodxloc.exe" 955ecdd0d58b47bb1d808ab8eca60740_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2288 955ecdd0d58b47bb1d808ab8eca60740_NeikiAnalytics.exe 2288 955ecdd0d58b47bb1d808ab8eca60740_NeikiAnalytics.exe 2288 955ecdd0d58b47bb1d808ab8eca60740_NeikiAnalytics.exe 2288 955ecdd0d58b47bb1d808ab8eca60740_NeikiAnalytics.exe 2960 ecdevopti.exe 2960 ecdevopti.exe 1580 xoptisys.exe 1580 xoptisys.exe 2960 ecdevopti.exe 2960 ecdevopti.exe 1580 xoptisys.exe 1580 xoptisys.exe 2960 ecdevopti.exe 2960 ecdevopti.exe 1580 xoptisys.exe 1580 xoptisys.exe 2960 ecdevopti.exe 2960 ecdevopti.exe 1580 xoptisys.exe 1580 xoptisys.exe 2960 ecdevopti.exe 2960 ecdevopti.exe 1580 xoptisys.exe 1580 xoptisys.exe 2960 ecdevopti.exe 2960 ecdevopti.exe 1580 xoptisys.exe 1580 xoptisys.exe 2960 ecdevopti.exe 2960 ecdevopti.exe 1580 xoptisys.exe 1580 xoptisys.exe 2960 ecdevopti.exe 2960 ecdevopti.exe 1580 xoptisys.exe 1580 xoptisys.exe 2960 ecdevopti.exe 2960 ecdevopti.exe 1580 xoptisys.exe 1580 xoptisys.exe 2960 ecdevopti.exe 2960 ecdevopti.exe 1580 xoptisys.exe 1580 xoptisys.exe 2960 ecdevopti.exe 2960 ecdevopti.exe 1580 xoptisys.exe 1580 xoptisys.exe 2960 ecdevopti.exe 2960 ecdevopti.exe 1580 xoptisys.exe 1580 xoptisys.exe 2960 ecdevopti.exe 2960 ecdevopti.exe 1580 xoptisys.exe 1580 xoptisys.exe 2960 ecdevopti.exe 2960 ecdevopti.exe 1580 xoptisys.exe 1580 xoptisys.exe 2960 ecdevopti.exe 2960 ecdevopti.exe 1580 xoptisys.exe 1580 xoptisys.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2288 wrote to memory of 2960 2288 955ecdd0d58b47bb1d808ab8eca60740_NeikiAnalytics.exe 85 PID 2288 wrote to memory of 2960 2288 955ecdd0d58b47bb1d808ab8eca60740_NeikiAnalytics.exe 85 PID 2288 wrote to memory of 2960 2288 955ecdd0d58b47bb1d808ab8eca60740_NeikiAnalytics.exe 85 PID 2288 wrote to memory of 1580 2288 955ecdd0d58b47bb1d808ab8eca60740_NeikiAnalytics.exe 86 PID 2288 wrote to memory of 1580 2288 955ecdd0d58b47bb1d808ab8eca60740_NeikiAnalytics.exe 86 PID 2288 wrote to memory of 1580 2288 955ecdd0d58b47bb1d808ab8eca60740_NeikiAnalytics.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\955ecdd0d58b47bb1d808ab8eca60740_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\955ecdd0d58b47bb1d808ab8eca60740_NeikiAnalytics.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecdevopti.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecdevopti.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2960
-
-
C:\Adobe7H\xoptisys.exeC:\Adobe7H\xoptisys.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1580
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Adobe7H\xoptisys.exe
- Size 3.0MB
- SHA256 431e62d0c2abdc56c0affef0336f1935bb3130af2d9988de2624e21d61244cab
- MD5 02ee9f0110e161880ef4fd3c4d1feaee
- SHA1 2921f6640d21c74a7ebcd275c41ec18510018bbd
- SHA512 f9a32fe7201f0a68e40d035d06bb9a3c15b031a56e6542c960cbb4593fe9edadc2ac76a00b9b4b89ce49fd2a772b9d6956edfad4b8acb3dc59c7b46dc574644b
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBYB/bSqz8b6LNX:sxX7QnxrloE5dpUpPbVz8eLF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Galax7B\bodxloc.exe
- Size 1.5MB
- SHA256 2f53b68bd477aa0da4fd1b5edc5663a863ab1ef3646b1b724b1b970e40c8821a
- MD5 cca118916af6655322daa2d71895b290
- SHA1 a4b35309215c06df48665113adeb9691168f4179
- SHA512 7bab88b92ed37369f77aff72593357d59c43244447007a7142fb445cb872d7e7873f8f4c112a1d13336945068e4ce76d41af74b8e3b4133205f534904cd123d7
- SSDEEP 24576:6nxDZV7xMyu6qJ2WSYxBdSqpcVdm5XRVpQO3chiIcr1RhSKntaxtooblyiuafDDP:sxX7665YxRVplZzSKntlGIiT+HvRdpY
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Galax7B\bodxloc.exe
- Size 3.0MB
- SHA256 addd4239ef11cfcc410b817f9da9889ff221cb0b34e71d021cd6e754507370e7
- MD5 82aeac7cbf5b5f4586ad65b96b703ed0
- SHA1 7f7d3a9cee710f8780b002dc6a19381e52ea7e8b
- SHA512 474128e78ccdfa658b592305aaa297bf2ccddf6f282fb2f455959d65f5bcf881c5eaa341f2d3eddddde3d9006d5e4a0f0730e01c8c256832a423e1d6d8d15ef7
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBkB/bSqz8b6LNX:sxX7QnxrloE5dpUpDbVz8eLF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 204B
- SHA256 c7f42ff3fade416c4e09e9cdebf5138afb6512685c9b752d71f535446d8d5eb9
- MD5 b7d4e789dbe8aaff0e22005232d66884
- SHA1 561bb99b8bf60cd817be81e70a1514013689ff99
- SHA512 9772d0d833083c9f49d10d230410304c5e2cc1c361d08d88fe665d101dc041a8ae5b7a388fe62086ff833a6ad91f22ebd3d616e985b3b96f7705ec292c1f2943
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 172B
- SHA256 2d43757e34c4cc2f430a8e4d5c4b3109a2b226d49086e751cbcacf0cbec4cd56
- MD5 ffaa8f5b267d209a4b61366b458b0679
- SHA1 7f9effe04f4a1de5f0aae4ef4659ae94d7bf9264
- SHA512 8ec34760f695bfd5effabade3d4d982c98fa556379f058d1590b7dafbfae5f0fef4cc33e421928739582a603855a350b6fc71fe2df5e50df1a8c630fb0eb8213
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecdevopti.exe
- Size 3.0MB
- SHA256 c6eafecc11fd3560043e90b3c63b3703454be8d552e8d91534d875d1193f6251
- MD5 e76fc6560093a4492564be7f96387456
- SHA1 f14ea942ce724c7b5d80c989c61ea986f14f5c16
- SHA512 bded25cf0d16b97d6b0431e9eca59e278032cf8e08a5cde907af94c4ed3049d419426bff61e006e3a0665f1f6fb3936f210e9a27355f87f79aa638d3cab6595c
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBOB/bSqz8b6LNX:sxX7QnxrloE5dpUpxbVz8eLF
- MD5 SHA1 SHA512 SSDEEP