74b548dd0d1484609f4d9dfda256d350bb17e210136e1a3032cabc34d1d4247f

Analysis

max time kernel
149s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
15-05-2024 20:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

28044d9ddcca4c99b887d3af019dcb20_NeikiAnalytics.exe
Size

2.7MB
MD5

28044d9ddcca4c99b887d3af019dcb20
SHA1

25191bae37815e797b9d35f01a5ac7ed8d43235a
SHA256

74b548dd0d1484609f4d9dfda256d350bb17e210136e1a3032cabc34d1d4247f
SHA512

54b7c3dbac33ae5aad23acee34a4ded385006cfeddc83993473b77c5e2eabba3b1330c1d8d1095249a8cf785e046fa9e3867fafa021d93864686737a75b7319c
SSDEEP

49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBw9w4Sx:+R0pI/IQlUoMPdmpSpy4

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2680	xdobec.exe

Loads dropped DLL 1 IoCs

pid	Process
1988	28044d9ddcca4c99b887d3af019dcb20_NeikiAnalytics.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\SysDrv4W\\xdobec.exe"	28044d9ddcca4c99b887d3af019dcb20_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\GalaxAR\\optialoc.exe"	28044d9ddcca4c99b887d3af019dcb20_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1988	28044d9ddcca4c99b887d3af019dcb20_NeikiAnalytics.exe
1988	28044d9ddcca4c99b887d3af019dcb20_NeikiAnalytics.exe
2680	xdobec.exe
1988	28044d9ddcca4c99b887d3af019dcb20_NeikiAnalytics.exe
2680	xdobec.exe
1988	28044d9ddcca4c99b887d3af019dcb20_NeikiAnalytics.exe
2680	xdobec.exe
1988	28044d9ddcca4c99b887d3af019dcb20_NeikiAnalytics.exe
2680	xdobec.exe
1988	28044d9ddcca4c99b887d3af019dcb20_NeikiAnalytics.exe
2680	xdobec.exe
1988	28044d9ddcca4c99b887d3af019dcb20_NeikiAnalytics.exe
2680	xdobec.exe
1988	28044d9ddcca4c99b887d3af019dcb20_NeikiAnalytics.exe
2680	xdobec.exe
1988	28044d9ddcca4c99b887d3af019dcb20_NeikiAnalytics.exe
2680	xdobec.exe
1988	28044d9ddcca4c99b887d3af019dcb20_NeikiAnalytics.exe
2680	xdobec.exe
1988	28044d9ddcca4c99b887d3af019dcb20_NeikiAnalytics.exe
2680	xdobec.exe
1988	28044d9ddcca4c99b887d3af019dcb20_NeikiAnalytics.exe
2680	xdobec.exe
1988	28044d9ddcca4c99b887d3af019dcb20_NeikiAnalytics.exe
2680	xdobec.exe
1988	28044d9ddcca4c99b887d3af019dcb20_NeikiAnalytics.exe
2680	xdobec.exe
1988	28044d9ddcca4c99b887d3af019dcb20_NeikiAnalytics.exe
2680	xdobec.exe
1988	28044d9ddcca4c99b887d3af019dcb20_NeikiAnalytics.exe
2680	xdobec.exe
1988	28044d9ddcca4c99b887d3af019dcb20_NeikiAnalytics.exe
2680	xdobec.exe
1988	28044d9ddcca4c99b887d3af019dcb20_NeikiAnalytics.exe
2680	xdobec.exe
1988	28044d9ddcca4c99b887d3af019dcb20_NeikiAnalytics.exe
2680	xdobec.exe
1988	28044d9ddcca4c99b887d3af019dcb20_NeikiAnalytics.exe
2680	xdobec.exe
1988	28044d9ddcca4c99b887d3af019dcb20_NeikiAnalytics.exe
2680	xdobec.exe
1988	28044d9ddcca4c99b887d3af019dcb20_NeikiAnalytics.exe
2680	xdobec.exe
1988	28044d9ddcca4c99b887d3af019dcb20_NeikiAnalytics.exe
2680	xdobec.exe
1988	28044d9ddcca4c99b887d3af019dcb20_NeikiAnalytics.exe
2680	xdobec.exe
1988	28044d9ddcca4c99b887d3af019dcb20_NeikiAnalytics.exe
2680	xdobec.exe
1988	28044d9ddcca4c99b887d3af019dcb20_NeikiAnalytics.exe
2680	xdobec.exe
1988	28044d9ddcca4c99b887d3af019dcb20_NeikiAnalytics.exe
2680	xdobec.exe
1988	28044d9ddcca4c99b887d3af019dcb20_NeikiAnalytics.exe
2680	xdobec.exe
1988	28044d9ddcca4c99b887d3af019dcb20_NeikiAnalytics.exe
2680	xdobec.exe
1988	28044d9ddcca4c99b887d3af019dcb20_NeikiAnalytics.exe
2680	xdobec.exe
1988	28044d9ddcca4c99b887d3af019dcb20_NeikiAnalytics.exe
2680	xdobec.exe
1988	28044d9ddcca4c99b887d3af019dcb20_NeikiAnalytics.exe
2680	xdobec.exe
1988	28044d9ddcca4c99b887d3af019dcb20_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 2680	1988	28044d9ddcca4c99b887d3af019dcb20_NeikiAnalytics.exe	28
PID 1988 wrote to memory of 2680	1988	28044d9ddcca4c99b887d3af019dcb20_NeikiAnalytics.exe	28
PID 1988 wrote to memory of 2680	1988	28044d9ddcca4c99b887d3af019dcb20_NeikiAnalytics.exe	28
PID 1988 wrote to memory of 2680	1988	28044d9ddcca4c99b887d3af019dcb20_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\28044d9ddcca4c99b887d3af019dcb20_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\28044d9ddcca4c99b887d3af019dcb20_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1988
- C:\SysDrv4W\xdobec.exe
  C:\SysDrv4W\xdobec.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\GalaxAR\optialoc.exe

Filesize
2.7MB

MD5
fa3640ae19f3afe1c1014b1b7ba4fd90

SHA1
5436972105343af2a9a0ab864420b03db88564bb

SHA256
d29c4d34569993bfaa3ac38ada418f647b1d295fc7edbc226ad0f0c98b584097

SHA512
f6d632179949b8e684543e111a2b885aca2a6da9d50e1ffc57cd9a1e2cdef5cf504d98f647c9c1b02f4be23ec698b0d5283c0c50228862364a4220c5a6fdf163

Download Submit
C:\Users\Admin\253086396416_6.1_Admin.ini

Filesize
205B

MD5
12fe73ee1aec8f21e8c2f0135463370c

SHA1
b9a9878b0643d7a37f743ffff753e160c2c829c7

SHA256
292c996adbe00ef692f4b00582e129b4b7b770c466ff3c6f9bff614955e61616

SHA512
2cd55b6e2182ccab8f323b00058c9aea370add713a3d30c473fc2b5d242bacb0c8aa60e5652065e60a8c8752ba9a2927da8e499420fa46bb038050acafb92c11

Download Submit
\SysDrv4W\xdobec.exe

Filesize
2.7MB

MD5
02b6e6c4241b29932fd62412239b8b74

SHA1
fc74421a6f806265ff1a5f2657e7c9787b1bfaea

SHA256
fe1d0e54bdf896036d56e48038848de5d883b9e22fc568a0451d55e0da0c553c

SHA512
a7103eec03e5d8889455d445dce6a8f045c9e1394178bed578d2a3f17a71e1e49b8cb8a04524235e111edd8177056b510fa6e58c3b17c4cd8e93e3018a52b643

Download Submit