Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10/05/2024, 18:38
Static task
static1
Behavioral task
behavioral1
Sample
446bf0565c0507f9f62cb98f193e7990_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
446bf0565c0507f9f62cb98f193e7990_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
446bf0565c0507f9f62cb98f193e7990_NeikiAnalytics.exe
-
Size
2.7MB
-
MD5
446bf0565c0507f9f62cb98f193e7990
-
SHA1
94ec372c1411146d091a32497bfb48592705b4ee
-
SHA256
4435fe9487982f3a859f218196182c22d409185ae4a25ccce3fb1ab4c40632c0
-
SHA512
d0f3558b264271d1f5aeb5f2b91092756d0d306d58bd2b62cf96c2ad5628cd67993eca4fb0afbffe90e46b574c7b25e5880fa7454072012463a2e75026ec62f3
-
SSDEEP
49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LB79w4Sx:+R0pI/IQlUoMPdmpSpH4
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2300 xdobloc.exe -
Loads dropped DLL 1 IoCs
pid Process 1500 446bf0565c0507f9f62cb98f193e7990_NeikiAnalytics.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\Files2F\\xdobloc.exe" 446bf0565c0507f9f62cb98f193e7990_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\GalaxTC\\optidevec.exe" 446bf0565c0507f9f62cb98f193e7990_NeikiAnalytics.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1500 446bf0565c0507f9f62cb98f193e7990_NeikiAnalytics.exe 1500 446bf0565c0507f9f62cb98f193e7990_NeikiAnalytics.exe 2300 xdobloc.exe 1500 446bf0565c0507f9f62cb98f193e7990_NeikiAnalytics.exe 2300 xdobloc.exe 1500 446bf0565c0507f9f62cb98f193e7990_NeikiAnalytics.exe 2300 xdobloc.exe 1500 446bf0565c0507f9f62cb98f193e7990_NeikiAnalytics.exe 2300 xdobloc.exe 1500 446bf0565c0507f9f62cb98f193e7990_NeikiAnalytics.exe 2300 xdobloc.exe 1500 446bf0565c0507f9f62cb98f193e7990_NeikiAnalytics.exe 2300 xdobloc.exe 1500 446bf0565c0507f9f62cb98f193e7990_NeikiAnalytics.exe 2300 xdobloc.exe 1500 446bf0565c0507f9f62cb98f193e7990_NeikiAnalytics.exe 2300 xdobloc.exe 1500 446bf0565c0507f9f62cb98f193e7990_NeikiAnalytics.exe 2300 xdobloc.exe 1500 446bf0565c0507f9f62cb98f193e7990_NeikiAnalytics.exe 2300 xdobloc.exe 1500 446bf0565c0507f9f62cb98f193e7990_NeikiAnalytics.exe 2300 xdobloc.exe 1500 446bf0565c0507f9f62cb98f193e7990_NeikiAnalytics.exe 2300 xdobloc.exe 1500 446bf0565c0507f9f62cb98f193e7990_NeikiAnalytics.exe 2300 xdobloc.exe 1500 446bf0565c0507f9f62cb98f193e7990_NeikiAnalytics.exe 2300 xdobloc.exe 1500 446bf0565c0507f9f62cb98f193e7990_NeikiAnalytics.exe 2300 xdobloc.exe 1500 446bf0565c0507f9f62cb98f193e7990_NeikiAnalytics.exe 2300 xdobloc.exe 1500 446bf0565c0507f9f62cb98f193e7990_NeikiAnalytics.exe 2300 xdobloc.exe 1500 446bf0565c0507f9f62cb98f193e7990_NeikiAnalytics.exe 2300 xdobloc.exe 1500 446bf0565c0507f9f62cb98f193e7990_NeikiAnalytics.exe 2300 xdobloc.exe 1500 446bf0565c0507f9f62cb98f193e7990_NeikiAnalytics.exe 2300 xdobloc.exe 1500 446bf0565c0507f9f62cb98f193e7990_NeikiAnalytics.exe 2300 xdobloc.exe 1500 446bf0565c0507f9f62cb98f193e7990_NeikiAnalytics.exe 2300 xdobloc.exe 1500 446bf0565c0507f9f62cb98f193e7990_NeikiAnalytics.exe 2300 xdobloc.exe 1500 446bf0565c0507f9f62cb98f193e7990_NeikiAnalytics.exe 2300 xdobloc.exe 1500 446bf0565c0507f9f62cb98f193e7990_NeikiAnalytics.exe 2300 xdobloc.exe 1500 446bf0565c0507f9f62cb98f193e7990_NeikiAnalytics.exe 2300 xdobloc.exe 1500 446bf0565c0507f9f62cb98f193e7990_NeikiAnalytics.exe 2300 xdobloc.exe 1500 446bf0565c0507f9f62cb98f193e7990_NeikiAnalytics.exe 2300 xdobloc.exe 1500 446bf0565c0507f9f62cb98f193e7990_NeikiAnalytics.exe 2300 xdobloc.exe 1500 446bf0565c0507f9f62cb98f193e7990_NeikiAnalytics.exe 2300 xdobloc.exe 1500 446bf0565c0507f9f62cb98f193e7990_NeikiAnalytics.exe 2300 xdobloc.exe 1500 446bf0565c0507f9f62cb98f193e7990_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1500 wrote to memory of 2300 1500 446bf0565c0507f9f62cb98f193e7990_NeikiAnalytics.exe 28 PID 1500 wrote to memory of 2300 1500 446bf0565c0507f9f62cb98f193e7990_NeikiAnalytics.exe 28 PID 1500 wrote to memory of 2300 1500 446bf0565c0507f9f62cb98f193e7990_NeikiAnalytics.exe 28 PID 1500 wrote to memory of 2300 1500 446bf0565c0507f9f62cb98f193e7990_NeikiAnalytics.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\446bf0565c0507f9f62cb98f193e7990_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\446bf0565c0507f9f62cb98f193e7990_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Files2F\xdobloc.exeC:\Files2F\xdobloc.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2300
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD5c8a6eba01843369b79f43f0d1dcc7c19
SHA103f39e8c0202860814ee63eea550fe2a0fc779d3
SHA2564e640961f32228646ecec90baa0d4768a51fd64e1ec3c00747713b3938438783
SHA51290fe34957ee8b123bdfad08dc31d447e7cd4812fc00d50dd69ecdaf3ec030229cd9759223dd7b7e3d564d78d48c824dd2613f0c89dc1ebaff829e981462ece03
-
Filesize
204B
MD52243d3000a2aeea235ddc54526b85e6a
SHA12b79315c5c354a3072a4ea837b6afc735cdc0a8c
SHA256f8f7f0591e11b16d7c61e30fc21c62d76eb913b54741a6eaab4e4cadb431f9ac
SHA5127c789e2616116db1c318e00df9bd6d46f03dcd3583ddbe992a1e0b9506f752813146d0a20f27704fe8a74bf08a08d5e5150c678d3c1c30a570ca641ca09af782
-
Filesize
2.7MB
MD5eb5c43cc4f1a53b0b031e9810760291a
SHA1dbaee5ec63aa788c9ceac7907c36b99b28ddd433
SHA256ce4bdc33c6d5697adfecce8237f7f4c442563db8666534a1d4ee53b7cc104c65
SHA5129fefbf75ae6037c76bb8700891c7e9c19dc49608dc4863a4557e66f3f8d571ee07405fbc7ee68601e004e2a18d94f3e417729f97378fb64ad8347d33815a30ad