4019e3c24599bc3cab08d6ec5b7ec5cebebd8c8fcc13d8c323108a45ddde1c24

Analysis

max time kernel
149s
max time network
126s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
14/05/2024, 11:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c4329085e6b51e382d7536bfa2c63f30_NeikiAnalytics.exe
Size

4.1MB
MD5

c4329085e6b51e382d7536bfa2c63f30
SHA1

6e915648ef6490e06cb434ea671de15cdcd19252
SHA256

4019e3c24599bc3cab08d6ec5b7ec5cebebd8c8fcc13d8c323108a45ddde1c24
SHA512

a3da4526e9604ce182ee148f3f827c250417a1d5eeeb27df074450658e8fc47798247f131d1903dd10e0c134ead4323af01b106352b8cf02bc9d121b58d35065
SSDEEP

98304:+R0pI/IQlUoMPdmpSpD4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdmg5n9klRKN41v

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3008	adobec.exe

Loads dropped DLL 1 IoCs

pid	Process
1968	c4329085e6b51e382d7536bfa2c63f30_NeikiAnalytics.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\MintLR\\optidevloc.exe"	c4329085e6b51e382d7536bfa2c63f30_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\SysDrvDR\\adobec.exe"	c4329085e6b51e382d7536bfa2c63f30_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1968	c4329085e6b51e382d7536bfa2c63f30_NeikiAnalytics.exe
1968	c4329085e6b51e382d7536bfa2c63f30_NeikiAnalytics.exe
3008	adobec.exe
1968	c4329085e6b51e382d7536bfa2c63f30_NeikiAnalytics.exe
3008	adobec.exe
1968	c4329085e6b51e382d7536bfa2c63f30_NeikiAnalytics.exe
3008	adobec.exe
1968	c4329085e6b51e382d7536bfa2c63f30_NeikiAnalytics.exe
3008	adobec.exe
1968	c4329085e6b51e382d7536bfa2c63f30_NeikiAnalytics.exe
3008	adobec.exe
1968	c4329085e6b51e382d7536bfa2c63f30_NeikiAnalytics.exe
3008	adobec.exe
1968	c4329085e6b51e382d7536bfa2c63f30_NeikiAnalytics.exe
3008	adobec.exe
1968	c4329085e6b51e382d7536bfa2c63f30_NeikiAnalytics.exe
3008	adobec.exe
1968	c4329085e6b51e382d7536bfa2c63f30_NeikiAnalytics.exe
3008	adobec.exe
1968	c4329085e6b51e382d7536bfa2c63f30_NeikiAnalytics.exe
3008	adobec.exe
1968	c4329085e6b51e382d7536bfa2c63f30_NeikiAnalytics.exe
3008	adobec.exe
1968	c4329085e6b51e382d7536bfa2c63f30_NeikiAnalytics.exe
3008	adobec.exe
1968	c4329085e6b51e382d7536bfa2c63f30_NeikiAnalytics.exe
3008	adobec.exe
1968	c4329085e6b51e382d7536bfa2c63f30_NeikiAnalytics.exe
3008	adobec.exe
1968	c4329085e6b51e382d7536bfa2c63f30_NeikiAnalytics.exe
3008	adobec.exe
1968	c4329085e6b51e382d7536bfa2c63f30_NeikiAnalytics.exe
3008	adobec.exe
1968	c4329085e6b51e382d7536bfa2c63f30_NeikiAnalytics.exe
3008	adobec.exe
1968	c4329085e6b51e382d7536bfa2c63f30_NeikiAnalytics.exe
3008	adobec.exe
1968	c4329085e6b51e382d7536bfa2c63f30_NeikiAnalytics.exe
3008	adobec.exe
1968	c4329085e6b51e382d7536bfa2c63f30_NeikiAnalytics.exe
3008	adobec.exe
1968	c4329085e6b51e382d7536bfa2c63f30_NeikiAnalytics.exe
3008	adobec.exe
1968	c4329085e6b51e382d7536bfa2c63f30_NeikiAnalytics.exe
3008	adobec.exe
1968	c4329085e6b51e382d7536bfa2c63f30_NeikiAnalytics.exe
3008	adobec.exe
1968	c4329085e6b51e382d7536bfa2c63f30_NeikiAnalytics.exe
3008	adobec.exe
1968	c4329085e6b51e382d7536bfa2c63f30_NeikiAnalytics.exe
3008	adobec.exe
1968	c4329085e6b51e382d7536bfa2c63f30_NeikiAnalytics.exe
3008	adobec.exe
1968	c4329085e6b51e382d7536bfa2c63f30_NeikiAnalytics.exe
3008	adobec.exe
1968	c4329085e6b51e382d7536bfa2c63f30_NeikiAnalytics.exe
3008	adobec.exe
1968	c4329085e6b51e382d7536bfa2c63f30_NeikiAnalytics.exe
3008	adobec.exe
1968	c4329085e6b51e382d7536bfa2c63f30_NeikiAnalytics.exe
3008	adobec.exe
1968	c4329085e6b51e382d7536bfa2c63f30_NeikiAnalytics.exe
3008	adobec.exe
1968	c4329085e6b51e382d7536bfa2c63f30_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 3008	1968	c4329085e6b51e382d7536bfa2c63f30_NeikiAnalytics.exe	28
PID 1968 wrote to memory of 3008	1968	c4329085e6b51e382d7536bfa2c63f30_NeikiAnalytics.exe	28
PID 1968 wrote to memory of 3008	1968	c4329085e6b51e382d7536bfa2c63f30_NeikiAnalytics.exe	28
PID 1968 wrote to memory of 3008	1968	c4329085e6b51e382d7536bfa2c63f30_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\c4329085e6b51e382d7536bfa2c63f30_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\c4329085e6b51e382d7536bfa2c63f30_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1968
- C:\SysDrvDR\adobec.exe
  C:\SysDrvDR\adobec.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:3008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MintLR\optidevloc.exe

Filesize
4.1MB

MD5
708247ddc0b32f34d88aea27f42fa5a9

SHA1
5895feb2b2ad993b79b59aa01704fc5ed1413ce7

SHA256
1c4b68b84c86e542c672f26ce2ae06dfe81113448dc257e37895d2e73ff15057

SHA512
69b132874b11a540f548eae28329c98dfcae70fdf8d3be7633fcfdeef62b37094c31fe13bf80f5d8f7fd059ddc70051074ac312a6597b36073624693862aa6fe

Download Submit
C:\Users\Admin\253086396416_6.1_Admin.ini

Filesize
202B

MD5
cdb12c5dc833919179434cdad1be648c

SHA1
edc087aa8331c8e4305e4e725cb155c9f9bb10eb

SHA256
eebf53f1201a0073566be47004478eb3c5777da7a3177a0e0949a47ae6ea3a4d

SHA512
baff3d86e296dc74ad237a2b55c6572ddf0599b48ad244e95b645db44935177c3f37f00fdb518843533cd4ad17ed03ba1abd6e6cf917696847d59e2c12349361

Download Submit
\SysDrvDR\adobec.exe

Filesize
4.1MB

MD5
a61ae5fb7b61b908d4ff7901a882ab30

SHA1
28c8d711ed1aaf436935b6e70a8672727acfef42

SHA256
6d11d01e8cfec0d18f1bbb5a832d09ebc76c4b9fc109c6ef0ab144025514fcd5

SHA512
6c5b45720a85ffe71f9bd0536bab1db5627f00185e2ca8770eb379d8bf7cb2576e81b34a15ce848cbcaec18d62cd6008909b6defb35389857994ce811acb9bac

Download Submit