Overview

overview

7

Static

static

3

db4142d90a...cs.exe

windows7-x64

7

db4142d90a...cs.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    155s
  • max time network
    161s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/05/2024, 10:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    db4142d90a946ab98dd13ae5230e4790_NeikiAnalytics.exe

  • Size

    2.7MB

  • MD5

    db4142d90a946ab98dd13ae5230e4790

  • SHA1

    a6640896fbd9b0a5c5d0b33dcc63a51e6114e872

  • SHA256

    7e7c3fc39ae6c0c90d12ec3876c1355c25d0a7a4719f8263c8f90b30bd34732c

  • SHA512

    b63d09b89b65379a6a84753cbc72fdbbc4d45bba72b1010bb3f57ac33c14471492c56c531fc3b7506d5b14750663f82339c771e82e31526636123de0869079f1

  • SSDEEP

    49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBL9w4Sx:+R0pI/IQlUoMPdmpSpf4

Score
7/10
persistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\db4142d90a946ab98dd13ae5230e4790_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\db4142d90a946ab98dd13ae5230e4790_NeikiAnalytics.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4416
    • C:\SysDrvKE\adobsys.exe
      C:\SysDrvKE\adobsys.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:2684
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2052 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:5004

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\LabZOX\dobdevec.exe
            Filesize

            9KB

            MD5

            676d55289ebe3b95f7296c256f4e82c2

            SHA1

            e60fbfe20f6dd5e273a0227788c9737ab9d0dc40

            SHA256

            4867ed928df39dede7eab002d04b85c682bda0ce96a32a6a33727628533d99db

            SHA512

            f22d87cd5f6b42194b6e873536fa1708a76308c650bbac952cbbe2e1ff6d7ec7e3dd9d2fc548fcde369b32f35c3cf65558db74c57f1b0e0b1ffa1edffbb007db

            Download Submit

          • C:\SysDrvKE\adobsys.exe
            Filesize

            2.7MB

            MD5

            9bda46fbea0b25edab75056400f877b1

            SHA1

            ca0bb59238f8581f601bf9184961fae7d3ebc782

            SHA256

            5f2c91930bb82c6cf3429f8cfff37812639100861051beb6bf42069a69d5d4fd

            SHA512

            2eb5738bf2050cc28c44f9739df83c4538fb21834e1ef1abe49e68e4e26335daae9d40eefc81d21471266900aa953570196f8a31fdc7bad9ea86da13ac1f5c43

            Download Submit

          • C:\Users\Admin\253086396416_10.0_Admin.ini
            Filesize

            202B

            MD5

            e1a638bf8bf3308ad3eb6b46506b82a6

            SHA1

            6c4c09b03c857e772292a27fb6999b43d891397a

            SHA256

            d1853d88e4f6be258b27efbf9a70a117154a2f8a6ce7b00ebe58bc205d5beb09

            SHA512

            bcaad247e991cf3227333933bb5e74d8d9b5a603c07db6bc34f5184b072d17e5098ba9a3a4b393de0b26befb33892473dc74bfde23b24bd7105218547c8054c2

            Download Submit