Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

a621c91df7...cs.exe

windows7-x64

7

a621c91df7...cs.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    13/05/2024, 07:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a621c91df7d84f9eebcc11495cfc73a0_NeikiAnalytics.exe

  • Size

    2.7MB

  • MD5

    a621c91df7d84f9eebcc11495cfc73a0

  • SHA1

    bd0ce59e9f655ca610c8a767f320b11873854328

  • SHA256

    d8e63687c9b3f3754d31656365f63689174887fb47c01016ffb8017e3167efb3

  • SHA512

    5fa15b6c611f482c8bd9146da2e8342602df3b772e6e26a07e4426e62edfc8ae199280f1abae1ccf74236b77a3753c1fc2cca4f02c16ad1e76a7207535282ac1

  • SSDEEP

    49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBD9w4Sx:+R0pI/IQlUoMPdmpSpH4

Score
7/10
persistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a621c91df7d84f9eebcc11495cfc73a0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\a621c91df7d84f9eebcc11495cfc73a0_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2244
    • C:\SysDrvVF\devdobsys.exe
      C:\SysDrvVF\devdobsys.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:2476

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\KaVBEL\bodaec.exe
    Filesize

    2.7MB

    MD5

    e94553ee4be61cd67c3f7c47056bdb03

    SHA1

    05ffc7432fb1b29b913282bb106131e092c5665b

    SHA256

    f87559d281b0522c67f3a36a1739743eed2153d72893cf971117bdce56105430

    SHA512

    a14d14e7ef091c24825cbf340249c5036fb4625b2e174fa77789c48c1edb0968ee1d9a71eeaa7ce4b73e7d741f3a71f79b9281ed530a54c0f5947c78d34b17e6

    Download Submit

  • C:\Users\Admin\253086396416_6.1_Admin.ini
    Filesize

    202B

    MD5

    0a397dcf8b1f463c1f616de4a6bf31d4

    SHA1

    fa1f2241172c1cf3b4beef016ff6063e7e2a4857

    SHA256

    9217c72d9de0bdf12bbe7bb40a1731ae71351a9290e605640f2e56646d7431e1

    SHA512

    01f980ad3a28fa31268ad798d58565bd1af74c6651cf07bb4cb2922ed43eb22b1585259b6f6d1cde8fe0488b6f149c6129176710429019b03a658fbcbd7520ef

    Download Submit

  • \SysDrvVF\devdobsys.exe
    Filesize

    2.7MB

    MD5

    4aa13f74b592a966a03352b7f53376ff

    SHA1

    69c9a661db64db6eb3bde884145ceea2f18c835a

    SHA256

    6cd613babcbc3e5c7ae6048b539d4cf0d0f55b2462d301ea6bfc32bb4873ea00

    SHA512

    1cb96bb09867a47d532f5a6a27f908228c9f2def61d60c6b32aba6b05a6db4f6892224cda2e5c7ed3d7038db71732c066c05aec369314a83ac0765e8d65a7191

    Download Submit