31284639c86ef5263cf34f710c3fec7d21e0e5e9a294b0a9d4842c97a81a9b57

Analysis

max time kernel
148s
max time network
126s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01/07/2024, 03:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

31284639c86ef5263cf34f710c3fec7d21e0e5e9a294b0a9d4842c97a81a9b57_NeikiAnalytics.exe
Size

351KB
MD5

5916df5e00d3efe65503acc4d17b11b0
SHA1

8012934a13944738dbdf59b35845c4ee6997dbc3
SHA256

31284639c86ef5263cf34f710c3fec7d21e0e5e9a294b0a9d4842c97a81a9b57
SHA512

a06123e68c619b03e273c0068a6d340c1f2c5ca774a4dfd3078cb800f1fc42e1d086fbdc2c38cbd52a5d3e19a31287c9d86271e76ffd03b7480e2fb34cb49807
SSDEEP

6144:Cs0N0GfEoS6ko+7bRD0I6qgG6z6QnkNblLIFifV9y7T+1lJri8Ey:n0N0GfE0ko+xD0I6tGo659b9I+c8E

Score

7^/10

persistence

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxopti[jln[kn[nl[kn	31284639c86ef5263cf34f710c3fec7d21e0e5e9a294b0a9d4842c97a81a9b57_NeikiAnalytics.exe

Executes dropped EXE 2 IoCs

pid	Process
3040	locxopti[jln[kn[nl[kn
2656	abodec.exe

Loads dropped DLL 4 IoCs

pid	Process
1368	31284639c86ef5263cf34f710c3fec7d21e0e5e9a294b0a9d4842c97a81a9b57_NeikiAnalytics.exe
1368	31284639c86ef5263cf34f710c3fec7d21e0e5e9a294b0a9d4842c97a81a9b57_NeikiAnalytics.exe
1368	31284639c86ef5263cf34f710c3fec7d21e0e5e9a294b0a9d4842c97a81a9b57_NeikiAnalytics.exe
1368	31284639c86ef5263cf34f710c3fec7d21e0e5e9a294b0a9d4842c97a81a9b57_NeikiAnalytics.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\IntelprocZJ\\abodec.exe"	31284639c86ef5263cf34f710c3fec7d21e0e5e9a294b0a9d4842c97a81a9b57_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\LabZ6I\\optiasys.exe"	31284639c86ef5263cf34f710c3fec7d21e0e5e9a294b0a9d4842c97a81a9b57_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1368	31284639c86ef5263cf34f710c3fec7d21e0e5e9a294b0a9d4842c97a81a9b57_NeikiAnalytics.exe
1368	31284639c86ef5263cf34f710c3fec7d21e0e5e9a294b0a9d4842c97a81a9b57_NeikiAnalytics.exe
3040	locxopti[jln[kn[nl[kn
2656	abodec.exe
3040	locxopti[jln[kn[nl[kn
2656	abodec.exe
3040	locxopti[jln[kn[nl[kn
2656	abodec.exe
3040	locxopti[jln[kn[nl[kn
2656	abodec.exe
3040	locxopti[jln[kn[nl[kn
2656	abodec.exe
3040	locxopti[jln[kn[nl[kn
2656	abodec.exe
3040	locxopti[jln[kn[nl[kn
2656	abodec.exe
3040	locxopti[jln[kn[nl[kn
2656	abodec.exe
3040	locxopti[jln[kn[nl[kn
2656	abodec.exe
3040	locxopti[jln[kn[nl[kn
2656	abodec.exe
3040	locxopti[jln[kn[nl[kn
2656	abodec.exe
3040	locxopti[jln[kn[nl[kn
2656	abodec.exe
3040	locxopti[jln[kn[nl[kn
2656	abodec.exe
3040	locxopti[jln[kn[nl[kn
2656	abodec.exe
3040	locxopti[jln[kn[nl[kn
2656	abodec.exe
3040	locxopti[jln[kn[nl[kn
2656	abodec.exe
3040	locxopti[jln[kn[nl[kn
2656	abodec.exe
3040	locxopti[jln[kn[nl[kn
2656	abodec.exe
3040	locxopti[jln[kn[nl[kn
2656	abodec.exe
3040	locxopti[jln[kn[nl[kn
2656	abodec.exe
3040	locxopti[jln[kn[nl[kn
2656	abodec.exe
3040	locxopti[jln[kn[nl[kn
2656	abodec.exe
3040	locxopti[jln[kn[nl[kn
2656	abodec.exe
3040	locxopti[jln[kn[nl[kn
2656	abodec.exe
3040	locxopti[jln[kn[nl[kn
2656	abodec.exe
3040	locxopti[jln[kn[nl[kn
2656	abodec.exe
3040	locxopti[jln[kn[nl[kn
2656	abodec.exe
3040	locxopti[jln[kn[nl[kn
2656	abodec.exe
3040	locxopti[jln[kn[nl[kn
2656	abodec.exe
3040	locxopti[jln[kn[nl[kn
2656	abodec.exe
3040	locxopti[jln[kn[nl[kn
2656	abodec.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 3040	1368	31284639c86ef5263cf34f710c3fec7d21e0e5e9a294b0a9d4842c97a81a9b57_NeikiAnalytics.exe	29
PID 1368 wrote to memory of 3040	1368	31284639c86ef5263cf34f710c3fec7d21e0e5e9a294b0a9d4842c97a81a9b57_NeikiAnalytics.exe	29
PID 1368 wrote to memory of 3040	1368	31284639c86ef5263cf34f710c3fec7d21e0e5e9a294b0a9d4842c97a81a9b57_NeikiAnalytics.exe	29
PID 1368 wrote to memory of 3040	1368	31284639c86ef5263cf34f710c3fec7d21e0e5e9a294b0a9d4842c97a81a9b57_NeikiAnalytics.exe	29
PID 1368 wrote to memory of 2656	1368	31284639c86ef5263cf34f710c3fec7d21e0e5e9a294b0a9d4842c97a81a9b57_NeikiAnalytics.exe	30
PID 1368 wrote to memory of 2656	1368	31284639c86ef5263cf34f710c3fec7d21e0e5e9a294b0a9d4842c97a81a9b57_NeikiAnalytics.exe	30
PID 1368 wrote to memory of 2656	1368	31284639c86ef5263cf34f710c3fec7d21e0e5e9a294b0a9d4842c97a81a9b57_NeikiAnalytics.exe	30
PID 1368 wrote to memory of 2656	1368	31284639c86ef5263cf34f710c3fec7d21e0e5e9a294b0a9d4842c97a81a9b57_NeikiAnalytics.exe	30

C:\Users\Admin\AppData\Local\Temp\31284639c86ef5263cf34f710c3fec7d21e0e5e9a294b0a9d4842c97a81a9b57_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\31284639c86ef5263cf34f710c3fec7d21e0e5e9a294b0a9d4842c97a81a9b57_NeikiAnalytics.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxopti[jln[kn[nl[kn
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxopti[jln[kn[nl[kn"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:3040
- C:\IntelprocZJ\abodec.exe
  C:\IntelprocZJ\abodec.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\LabZ6I\optiasys.exe

Filesize
351KB

MD5
96ddc3f703b92341f315535cd67980d6

SHA1
e75b41e4f37d1b81204a72c3adc6c5715abc17a8

SHA256
bb7bc59912fb11b701eee8f02120f879cdfcfe42393a5674bf155dad6af6dcbe

SHA512
05491bf815b77b77d1fc204509d89a3cc714f4cca1d8a7893a4e08b9ef44b7cffc60eedbbb1787a098d7aaa620b7392f19655f030843a80223fbb8549326a61b

Download Submit
C:\Users\Admin\253086396416_6.1_Admin.ini

Filesize
179B

MD5
e4abb9a1930eb86c6751bb27fb1433e8

SHA1
2b012469935f6276619bb61eb6af1742289fce00

SHA256
343d2c25a499fa3219200eb1dd6c618dc2fb9af0363211529b310cca6a5ea38d

SHA512
5e748248239684a6c1ac52c859c32b4d7984154020a089442f33bb020efdfdcee70557de476ea5a3a83c078ab40201fbfee68ec75c3653c5ccb1bc9832088f3a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxopti[jln[kn[nl[kn

Filesize
351KB

MD5
6f7c3586c79327c3d4b561f94de9b087

SHA1
eb55ce54334c541525c72f1e7f12f8cd967db704

SHA256
8af4eab4ed9f0acd167072ae1dd5602dce7f2b1feaa5dba76a610d2c8a3896d8

SHA512
87d6125462ae35103631b402c5c114db1420ee732fb17029391debc45add604dc1527aed4141a2bd4e346d167edffb2e7a08fee0cbb64cf9f54d0c0fbfdddd69

Download Submit
\IntelprocZJ\abodec.exe

Filesize
351KB

MD5
0aa3155084b07d6156086bdc42ec12b1

SHA1
f4fc97424d861107d35e62ecfbe5493e3c1357b7

SHA256
451d16ddb79660f45790aefc6ec8269b4f6ea32ccdf5330573f4318cec0d1bf1

SHA512
de9c5f5864d78440a21d639e3668afd6e2f42c59e94be28269021c3b697b999c12c2c5cdffb7d3e69fafc277c2f17f895302985eb8cc9e28744d83cda8c8c432

Download Submit