0f93efc89e29f6d148ce8604fca329bc1aa0f3ae3c2f09a01dd50f53bf2a5da7

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 08:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

33c95fd1f204d858ade941a8e6263740_NEIKI.exe
Size

4.1MB
MD5

33c95fd1f204d858ade941a8e6263740
SHA1

e64f6a41d500f79e0145a961b9742cbf84ed4284
SHA256

0f93efc89e29f6d148ce8604fca329bc1aa0f3ae3c2f09a01dd50f53bf2a5da7
SHA512

92f94976524b9cb86ff796fca6e630b6a9ec5d5a81251cb3c5eaa9d8fa73386b66c2c1780772324e32ee2acde98a81728b8933bd6e4fcdb7393f3421dc1bb68a
SSDEEP

98304:+R0pI/IQlUoMPdmpSp04ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdmr5n9klRKN41v

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4084	devbodec.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\IntelprocP1\\devbodec.exe"	33c95fd1f204d858ade941a8e6263740_NEIKI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\KaVBA2\\optixloc.exe"	33c95fd1f204d858ade941a8e6263740_NEIKI.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5068	33c95fd1f204d858ade941a8e6263740_NEIKI.exe
5068	33c95fd1f204d858ade941a8e6263740_NEIKI.exe
5068	33c95fd1f204d858ade941a8e6263740_NEIKI.exe
5068	33c95fd1f204d858ade941a8e6263740_NEIKI.exe
4084	devbodec.exe
4084	devbodec.exe
5068	33c95fd1f204d858ade941a8e6263740_NEIKI.exe
5068	33c95fd1f204d858ade941a8e6263740_NEIKI.exe
4084	devbodec.exe
4084	devbodec.exe
5068	33c95fd1f204d858ade941a8e6263740_NEIKI.exe
5068	33c95fd1f204d858ade941a8e6263740_NEIKI.exe
4084	devbodec.exe
4084	devbodec.exe
5068	33c95fd1f204d858ade941a8e6263740_NEIKI.exe
5068	33c95fd1f204d858ade941a8e6263740_NEIKI.exe
4084	devbodec.exe
4084	devbodec.exe
5068	33c95fd1f204d858ade941a8e6263740_NEIKI.exe
5068	33c95fd1f204d858ade941a8e6263740_NEIKI.exe
4084	devbodec.exe
4084	devbodec.exe
5068	33c95fd1f204d858ade941a8e6263740_NEIKI.exe
5068	33c95fd1f204d858ade941a8e6263740_NEIKI.exe
4084	devbodec.exe
4084	devbodec.exe
5068	33c95fd1f204d858ade941a8e6263740_NEIKI.exe
5068	33c95fd1f204d858ade941a8e6263740_NEIKI.exe
4084	devbodec.exe
4084	devbodec.exe
5068	33c95fd1f204d858ade941a8e6263740_NEIKI.exe
5068	33c95fd1f204d858ade941a8e6263740_NEIKI.exe
4084	devbodec.exe
4084	devbodec.exe
5068	33c95fd1f204d858ade941a8e6263740_NEIKI.exe
5068	33c95fd1f204d858ade941a8e6263740_NEIKI.exe
4084	devbodec.exe
4084	devbodec.exe
5068	33c95fd1f204d858ade941a8e6263740_NEIKI.exe
5068	33c95fd1f204d858ade941a8e6263740_NEIKI.exe
4084	devbodec.exe
4084	devbodec.exe
5068	33c95fd1f204d858ade941a8e6263740_NEIKI.exe
5068	33c95fd1f204d858ade941a8e6263740_NEIKI.exe
4084	devbodec.exe
4084	devbodec.exe
5068	33c95fd1f204d858ade941a8e6263740_NEIKI.exe
5068	33c95fd1f204d858ade941a8e6263740_NEIKI.exe
4084	devbodec.exe
4084	devbodec.exe
5068	33c95fd1f204d858ade941a8e6263740_NEIKI.exe
5068	33c95fd1f204d858ade941a8e6263740_NEIKI.exe
4084	devbodec.exe
4084	devbodec.exe
5068	33c95fd1f204d858ade941a8e6263740_NEIKI.exe
5068	33c95fd1f204d858ade941a8e6263740_NEIKI.exe
4084	devbodec.exe
4084	devbodec.exe
5068	33c95fd1f204d858ade941a8e6263740_NEIKI.exe
5068	33c95fd1f204d858ade941a8e6263740_NEIKI.exe
4084	devbodec.exe
4084	devbodec.exe
5068	33c95fd1f204d858ade941a8e6263740_NEIKI.exe
5068	33c95fd1f204d858ade941a8e6263740_NEIKI.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5068 wrote to memory of 4084	5068	33c95fd1f204d858ade941a8e6263740_NEIKI.exe	88
PID 5068 wrote to memory of 4084	5068	33c95fd1f204d858ade941a8e6263740_NEIKI.exe	88
PID 5068 wrote to memory of 4084	5068	33c95fd1f204d858ade941a8e6263740_NEIKI.exe	88

C:\Users\Admin\AppData\Local\Temp\33c95fd1f204d858ade941a8e6263740_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\33c95fd1f204d858ade941a8e6263740_NEIKI.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5068
- C:\IntelprocP1\devbodec.exe
  C:\IntelprocP1\devbodec.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:4084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\IntelprocP1\devbodec.exe

Filesize
4.1MB

MD5
f144800f762afe7036d2180fe740ff4c

SHA1
a0c085e60f7f868efcdf9964ed25283cd701edab

SHA256
5db0ba03b5da3f9ddb95ad1fbed9a2d582a19ebe5b46e9d586afb6c9a074d205

SHA512
4da44305e325bd8d9926b7d9e72109abe9d56ee958ff0731f9a8f370e208f975cfaa7649212ecbd1300c517c0e029967baa84d80697b3aa2541dd60fa798ecd6

Download Submit
C:\KaVBA2\optixloc.exe

Filesize
4.1MB

MD5
f0eaf73e0d57492f86537c7083c16051

SHA1
ea7f151233a1ad540f9f1ca6590f16b0647aaa4e

SHA256
4274bc818aed328cace638363b6928e3967504b7a30a7a9d9ffdc6539b76bcd9

SHA512
44059a78f5be29bee1fad55f69ce86a2884b3087eae56f216caca1fc88533f5766ec5e355e8751104a6b3590090b7bc2e1b066dc29555041999d6fccec375c9b

Download Submit
C:\Users\Admin\253086396416_10.0_Admin.ini

Filesize
208B

MD5
46271f54941215b8091aeba080b2dd9c

SHA1
edbdddbabf6dcca2b13362eba9ee5657050e9d76

SHA256
1dc18a65ce356ee472f3c1fc75425a449aa9407ee769fea0e50864c7d495b7a4

SHA512
077bd5c72864a67830fbdf0407fc1029d6dd2ad537e760711660dec51b2df47def134f8147fac70c2cb4b07aaa6ecc0d6199a3a5ad3c5a63c22e07fb1aa1ace4

Download Submit