84f7afbdafcb51a33b579ffd2259286a94d53ee350d9025f68c53297b37587d1

Analysis

max time kernel
149s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
08-05-2024 02:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a79d34e178e4cf8dda36264522c205e0_NEIKI.exe
Size

2.7MB
MD5

a79d34e178e4cf8dda36264522c205e0
SHA1

ea8747c303f8decaf317783a6acf598bd68d9dd4
SHA256

84f7afbdafcb51a33b579ffd2259286a94d53ee350d9025f68c53297b37587d1
SHA512

8d62afc96191fc0e83003333bc1f05edba5d860d9bec715d65217e4ae0f7cc01a6082f1b19be791cfef0593feae48d0e1ef38bab0c796184a107ed26a5a7846b
SSDEEP

49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBj9w4Sx:+R0pI/IQlUoMPdmpSpr4

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5084	xdobloc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\SysDrvYS\\xdobloc.exe"	a79d34e178e4cf8dda36264522c205e0_NEIKI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\GalaxER\\dobdevloc.exe"	a79d34e178e4cf8dda36264522c205e0_NEIKI.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4088	a79d34e178e4cf8dda36264522c205e0_NEIKI.exe
4088	a79d34e178e4cf8dda36264522c205e0_NEIKI.exe
4088	a79d34e178e4cf8dda36264522c205e0_NEIKI.exe
4088	a79d34e178e4cf8dda36264522c205e0_NEIKI.exe
5084	xdobloc.exe
5084	xdobloc.exe
4088	a79d34e178e4cf8dda36264522c205e0_NEIKI.exe
4088	a79d34e178e4cf8dda36264522c205e0_NEIKI.exe
5084	xdobloc.exe
5084	xdobloc.exe
4088	a79d34e178e4cf8dda36264522c205e0_NEIKI.exe
4088	a79d34e178e4cf8dda36264522c205e0_NEIKI.exe
5084	xdobloc.exe
5084	xdobloc.exe
4088	a79d34e178e4cf8dda36264522c205e0_NEIKI.exe
4088	a79d34e178e4cf8dda36264522c205e0_NEIKI.exe
5084	xdobloc.exe
5084	xdobloc.exe
4088	a79d34e178e4cf8dda36264522c205e0_NEIKI.exe
4088	a79d34e178e4cf8dda36264522c205e0_NEIKI.exe
5084	xdobloc.exe
5084	xdobloc.exe
4088	a79d34e178e4cf8dda36264522c205e0_NEIKI.exe
4088	a79d34e178e4cf8dda36264522c205e0_NEIKI.exe
5084	xdobloc.exe
5084	xdobloc.exe
4088	a79d34e178e4cf8dda36264522c205e0_NEIKI.exe
4088	a79d34e178e4cf8dda36264522c205e0_NEIKI.exe
5084	xdobloc.exe
5084	xdobloc.exe
4088	a79d34e178e4cf8dda36264522c205e0_NEIKI.exe
4088	a79d34e178e4cf8dda36264522c205e0_NEIKI.exe
5084	xdobloc.exe
5084	xdobloc.exe
4088	a79d34e178e4cf8dda36264522c205e0_NEIKI.exe
4088	a79d34e178e4cf8dda36264522c205e0_NEIKI.exe
5084	xdobloc.exe
5084	xdobloc.exe
4088	a79d34e178e4cf8dda36264522c205e0_NEIKI.exe
4088	a79d34e178e4cf8dda36264522c205e0_NEIKI.exe
5084	xdobloc.exe
5084	xdobloc.exe
4088	a79d34e178e4cf8dda36264522c205e0_NEIKI.exe
4088	a79d34e178e4cf8dda36264522c205e0_NEIKI.exe
5084	xdobloc.exe
5084	xdobloc.exe
4088	a79d34e178e4cf8dda36264522c205e0_NEIKI.exe
4088	a79d34e178e4cf8dda36264522c205e0_NEIKI.exe
5084	xdobloc.exe
5084	xdobloc.exe
4088	a79d34e178e4cf8dda36264522c205e0_NEIKI.exe
4088	a79d34e178e4cf8dda36264522c205e0_NEIKI.exe
5084	xdobloc.exe
5084	xdobloc.exe
4088	a79d34e178e4cf8dda36264522c205e0_NEIKI.exe
4088	a79d34e178e4cf8dda36264522c205e0_NEIKI.exe
5084	xdobloc.exe
5084	xdobloc.exe
4088	a79d34e178e4cf8dda36264522c205e0_NEIKI.exe
4088	a79d34e178e4cf8dda36264522c205e0_NEIKI.exe
5084	xdobloc.exe
5084	xdobloc.exe
4088	a79d34e178e4cf8dda36264522c205e0_NEIKI.exe
4088	a79d34e178e4cf8dda36264522c205e0_NEIKI.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4088 wrote to memory of 5084	4088	a79d34e178e4cf8dda36264522c205e0_NEIKI.exe	93
PID 4088 wrote to memory of 5084	4088	a79d34e178e4cf8dda36264522c205e0_NEIKI.exe	93
PID 4088 wrote to memory of 5084	4088	a79d34e178e4cf8dda36264522c205e0_NEIKI.exe	93

C:\Users\Admin\AppData\Local\Temp\a79d34e178e4cf8dda36264522c205e0_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\a79d34e178e4cf8dda36264522c205e0_NEIKI.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4088
- C:\SysDrvYS\xdobloc.exe
  C:\SysDrvYS\xdobloc.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:5084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\GalaxER\dobdevloc.exe

Filesize
2.7MB

MD5
be248888e20d6dfb189978ee3aeb90df

SHA1
ca13aa03ef4f8e5fb91d6571bbd5658cffd11fa4

SHA256
0710bc411960f05423a1a5e8d4bee00bc07b2b526bb50ce8935e56d7ad38cc13

SHA512
83336479815c054da0d9dfc0d18901ec5f2ad1f647494f892d74795aaf7292afc6525a7156d9c71d41ed8bc70b4b100defbaf06c54492901842be5d8e32b09af

Download Submit
C:\SysDrvYS\xdobloc.exe

Filesize
2.7MB

MD5
5b948f274f62df437ce1de7fd626f843

SHA1
4b85e332d4f6d817457fd25dc4b9e74f9e4b8101

SHA256
0837c88b300193e443cea8222c02a41ecc43afd16ae586c5f293cf8d1121babd

SHA512
434dcc88b8a2b80623055fc2f9178d24f28d48502d0e366ad6c49b0c8ee27c1780bb46f409face996b5dea2bb9d149e5ea371f6e1a381a8a65fba7d7a4a6f4c2

Download Submit
C:\Users\Admin\253086396416_10.0_Admin.ini

Filesize
206B

MD5
817a9796a4c9b93ab4662314aa04acfb

SHA1
3b49999337a21f139de425de2a9c19523cdc6673

SHA256
e272059917d56f4e335b7293f501ab9f0153be1d83ad473a64a3d9ca38196833

SHA512
08a2a627cad57fd7527116c74cf961b38ec6a465bd741e5975246494cd76f48fa304abd0ba56880168bdd4e20b0b58cb459acdfd5e122c1d26fa5afdec36d0cc

Download Submit