3703425772d5a91af4e1ee26a13cb60d783bcb29ce9201ec708e7a3188e23dda

Analysis

max time kernel
149s
max time network
123s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 03:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3703425772d5a91af4e1ee26a13cb60d783bcb29ce9201ec708e7a3188e23dda_NeikiAnalytics.exe
Size

4.1MB
MD5

44e5aa239da8186a0bc6346a02553750
SHA1

385e5fdaa79604d11ca51d5b8c1907fcf0cbcd77
SHA256

3703425772d5a91af4e1ee26a13cb60d783bcb29ce9201ec708e7a3188e23dda
SHA512

e6880a3788d3afeff5929a56960c68353c604bbb53dd311cfb0ee3c3a7387aaa267006bfa6f62182c80a0261cdeab4997a28231ed9f642a36a2ea7e719ebc7c1
SSDEEP

98304:+R0pI/IQlUoMPdmpSpp4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdmK5n9klRKN41v

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2028	xoptisys.exe

Loads dropped DLL 1 IoCs

pid	Process
1284	3703425772d5a91af4e1ee26a13cb60d783bcb29ce9201ec708e7a3188e23dda_NeikiAnalytics.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\LabZ02\\optidevloc.exe"	3703425772d5a91af4e1ee26a13cb60d783bcb29ce9201ec708e7a3188e23dda_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\FilesC4\\xoptisys.exe"	3703425772d5a91af4e1ee26a13cb60d783bcb29ce9201ec708e7a3188e23dda_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1284	3703425772d5a91af4e1ee26a13cb60d783bcb29ce9201ec708e7a3188e23dda_NeikiAnalytics.exe
1284	3703425772d5a91af4e1ee26a13cb60d783bcb29ce9201ec708e7a3188e23dda_NeikiAnalytics.exe
2028	xoptisys.exe
1284	3703425772d5a91af4e1ee26a13cb60d783bcb29ce9201ec708e7a3188e23dda_NeikiAnalytics.exe
2028	xoptisys.exe
1284	3703425772d5a91af4e1ee26a13cb60d783bcb29ce9201ec708e7a3188e23dda_NeikiAnalytics.exe
2028	xoptisys.exe
1284	3703425772d5a91af4e1ee26a13cb60d783bcb29ce9201ec708e7a3188e23dda_NeikiAnalytics.exe
2028	xoptisys.exe
1284	3703425772d5a91af4e1ee26a13cb60d783bcb29ce9201ec708e7a3188e23dda_NeikiAnalytics.exe
2028	xoptisys.exe
1284	3703425772d5a91af4e1ee26a13cb60d783bcb29ce9201ec708e7a3188e23dda_NeikiAnalytics.exe
2028	xoptisys.exe
1284	3703425772d5a91af4e1ee26a13cb60d783bcb29ce9201ec708e7a3188e23dda_NeikiAnalytics.exe
2028	xoptisys.exe
1284	3703425772d5a91af4e1ee26a13cb60d783bcb29ce9201ec708e7a3188e23dda_NeikiAnalytics.exe
2028	xoptisys.exe
1284	3703425772d5a91af4e1ee26a13cb60d783bcb29ce9201ec708e7a3188e23dda_NeikiAnalytics.exe
2028	xoptisys.exe
1284	3703425772d5a91af4e1ee26a13cb60d783bcb29ce9201ec708e7a3188e23dda_NeikiAnalytics.exe
2028	xoptisys.exe
1284	3703425772d5a91af4e1ee26a13cb60d783bcb29ce9201ec708e7a3188e23dda_NeikiAnalytics.exe
2028	xoptisys.exe
1284	3703425772d5a91af4e1ee26a13cb60d783bcb29ce9201ec708e7a3188e23dda_NeikiAnalytics.exe
2028	xoptisys.exe
1284	3703425772d5a91af4e1ee26a13cb60d783bcb29ce9201ec708e7a3188e23dda_NeikiAnalytics.exe
2028	xoptisys.exe
1284	3703425772d5a91af4e1ee26a13cb60d783bcb29ce9201ec708e7a3188e23dda_NeikiAnalytics.exe
2028	xoptisys.exe
1284	3703425772d5a91af4e1ee26a13cb60d783bcb29ce9201ec708e7a3188e23dda_NeikiAnalytics.exe
2028	xoptisys.exe
1284	3703425772d5a91af4e1ee26a13cb60d783bcb29ce9201ec708e7a3188e23dda_NeikiAnalytics.exe
2028	xoptisys.exe
1284	3703425772d5a91af4e1ee26a13cb60d783bcb29ce9201ec708e7a3188e23dda_NeikiAnalytics.exe
2028	xoptisys.exe
1284	3703425772d5a91af4e1ee26a13cb60d783bcb29ce9201ec708e7a3188e23dda_NeikiAnalytics.exe
2028	xoptisys.exe
1284	3703425772d5a91af4e1ee26a13cb60d783bcb29ce9201ec708e7a3188e23dda_NeikiAnalytics.exe
2028	xoptisys.exe
1284	3703425772d5a91af4e1ee26a13cb60d783bcb29ce9201ec708e7a3188e23dda_NeikiAnalytics.exe
2028	xoptisys.exe
1284	3703425772d5a91af4e1ee26a13cb60d783bcb29ce9201ec708e7a3188e23dda_NeikiAnalytics.exe
2028	xoptisys.exe
1284	3703425772d5a91af4e1ee26a13cb60d783bcb29ce9201ec708e7a3188e23dda_NeikiAnalytics.exe
2028	xoptisys.exe
1284	3703425772d5a91af4e1ee26a13cb60d783bcb29ce9201ec708e7a3188e23dda_NeikiAnalytics.exe
2028	xoptisys.exe
1284	3703425772d5a91af4e1ee26a13cb60d783bcb29ce9201ec708e7a3188e23dda_NeikiAnalytics.exe
2028	xoptisys.exe
1284	3703425772d5a91af4e1ee26a13cb60d783bcb29ce9201ec708e7a3188e23dda_NeikiAnalytics.exe
2028	xoptisys.exe
1284	3703425772d5a91af4e1ee26a13cb60d783bcb29ce9201ec708e7a3188e23dda_NeikiAnalytics.exe
2028	xoptisys.exe
1284	3703425772d5a91af4e1ee26a13cb60d783bcb29ce9201ec708e7a3188e23dda_NeikiAnalytics.exe
2028	xoptisys.exe
1284	3703425772d5a91af4e1ee26a13cb60d783bcb29ce9201ec708e7a3188e23dda_NeikiAnalytics.exe
2028	xoptisys.exe
1284	3703425772d5a91af4e1ee26a13cb60d783bcb29ce9201ec708e7a3188e23dda_NeikiAnalytics.exe
2028	xoptisys.exe
1284	3703425772d5a91af4e1ee26a13cb60d783bcb29ce9201ec708e7a3188e23dda_NeikiAnalytics.exe
2028	xoptisys.exe
1284	3703425772d5a91af4e1ee26a13cb60d783bcb29ce9201ec708e7a3188e23dda_NeikiAnalytics.exe
2028	xoptisys.exe
1284	3703425772d5a91af4e1ee26a13cb60d783bcb29ce9201ec708e7a3188e23dda_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1284 wrote to memory of 2028	1284	3703425772d5a91af4e1ee26a13cb60d783bcb29ce9201ec708e7a3188e23dda_NeikiAnalytics.exe	28
PID 1284 wrote to memory of 2028	1284	3703425772d5a91af4e1ee26a13cb60d783bcb29ce9201ec708e7a3188e23dda_NeikiAnalytics.exe	28
PID 1284 wrote to memory of 2028	1284	3703425772d5a91af4e1ee26a13cb60d783bcb29ce9201ec708e7a3188e23dda_NeikiAnalytics.exe	28
PID 1284 wrote to memory of 2028	1284	3703425772d5a91af4e1ee26a13cb60d783bcb29ce9201ec708e7a3188e23dda_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\3703425772d5a91af4e1ee26a13cb60d783bcb29ce9201ec708e7a3188e23dda_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3703425772d5a91af4e1ee26a13cb60d783bcb29ce9201ec708e7a3188e23dda_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1284
- C:\FilesC4\xoptisys.exe
  C:\FilesC4\xoptisys.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\LabZ02\optidevloc.exe

Filesize
4.1MB

MD5
abb2e1a3e41d8670cfe6650363751224

SHA1
8787ff02fc5f248d02f141628a04d593f83fcb17

SHA256
32435f898b2dda7480333ff9d0950dbacd60e94863d260dc7aa43394ee92b6a4

SHA512
f2b73f5d894b8a5d3c6dac6331809c63fc718c7a65b2116a5114a0e5ba6afeb627c697bcd332a6fbbc52c24d3d554bdec0de9af9305af9906ffc3ff0ce26b517

Download Submit
C:\Users\Admin\253086396416_6.1_Admin.ini

Filesize
204B

MD5
478c0d9a89ca74eaa81fc5f701b40426

SHA1
0a54bef1946738c515d6ba9e2ec223655f4f1eac

SHA256
3fb2b78df90df501cb6c93bf1861b964562878eabcfa20f7bc07c3149ae303eb

SHA512
ff6795acace247b555a2f3e4d48dedd1101e49f8c67b19682f1964063d24f779c2210d4a6b457e1825b1a5afed43d309426b772fdb83809f96bba9c156e95b4a

Download Submit
\FilesC4\xoptisys.exe

Filesize
4.1MB

MD5
442b84fd713b642e15b70f48c2075d1f

SHA1
24859f8da8ae296abad3fbacc27df3e836f8a6c8

SHA256
132efed2f7faa563cabb795e31b7a96f209ed6e8ed8d9076456f7b877a42ccec

SHA512
85751dfb2ac5bf68d9bcfb4945122010ca53fb1c3c32d6ea8ab4efd79e896442c1d4a0701f9541d2d988de22dfa41f7db29d4eb506c0a51be5274c85000b122e

Download Submit