81a21ce893d9f35bde1db7d653b25eb9ef47659ddf20481ed9a81872f18133fa

Analysis

max time kernel
149s
max time network
118s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
16-05-2024 12:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

df17bdfe527dd991755c2ac4486da640_NeikiAnalytics.exe
Size

2.7MB
MD5

df17bdfe527dd991755c2ac4486da640
SHA1

c862096e3e14ca1506ca3549a7cb0e08fcdc5bee
SHA256

81a21ce893d9f35bde1db7d653b25eb9ef47659ddf20481ed9a81872f18133fa
SHA512

ffea65f0014c3e13071989be05002d70dfa67fbb9d6fe05f34b349c29e119cd98373fd4e3cf1ef42a68bf0e828eb0b7155ac298c3b269d7de595eca33c01b3dd
SSDEEP

49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBO9w4Sx:+R0pI/IQlUoMPdmpSpw4

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2752	devbodloc.exe

Loads dropped DLL 1 IoCs

pid	Process
1600	df17bdfe527dd991755c2ac4486da640_NeikiAnalytics.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\Galax4N\\bodxec.exe"	df17bdfe527dd991755c2ac4486da640_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\UserDotW4\\devbodloc.exe"	df17bdfe527dd991755c2ac4486da640_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1600	df17bdfe527dd991755c2ac4486da640_NeikiAnalytics.exe
1600	df17bdfe527dd991755c2ac4486da640_NeikiAnalytics.exe
2752	devbodloc.exe
1600	df17bdfe527dd991755c2ac4486da640_NeikiAnalytics.exe
2752	devbodloc.exe
1600	df17bdfe527dd991755c2ac4486da640_NeikiAnalytics.exe
2752	devbodloc.exe
1600	df17bdfe527dd991755c2ac4486da640_NeikiAnalytics.exe
2752	devbodloc.exe
1600	df17bdfe527dd991755c2ac4486da640_NeikiAnalytics.exe
2752	devbodloc.exe
1600	df17bdfe527dd991755c2ac4486da640_NeikiAnalytics.exe
2752	devbodloc.exe
1600	df17bdfe527dd991755c2ac4486da640_NeikiAnalytics.exe
2752	devbodloc.exe
1600	df17bdfe527dd991755c2ac4486da640_NeikiAnalytics.exe
2752	devbodloc.exe
1600	df17bdfe527dd991755c2ac4486da640_NeikiAnalytics.exe
2752	devbodloc.exe
1600	df17bdfe527dd991755c2ac4486da640_NeikiAnalytics.exe
2752	devbodloc.exe
1600	df17bdfe527dd991755c2ac4486da640_NeikiAnalytics.exe
2752	devbodloc.exe
1600	df17bdfe527dd991755c2ac4486da640_NeikiAnalytics.exe
2752	devbodloc.exe
1600	df17bdfe527dd991755c2ac4486da640_NeikiAnalytics.exe
2752	devbodloc.exe
1600	df17bdfe527dd991755c2ac4486da640_NeikiAnalytics.exe
2752	devbodloc.exe
1600	df17bdfe527dd991755c2ac4486da640_NeikiAnalytics.exe
2752	devbodloc.exe
1600	df17bdfe527dd991755c2ac4486da640_NeikiAnalytics.exe
2752	devbodloc.exe
1600	df17bdfe527dd991755c2ac4486da640_NeikiAnalytics.exe
2752	devbodloc.exe
1600	df17bdfe527dd991755c2ac4486da640_NeikiAnalytics.exe
2752	devbodloc.exe
1600	df17bdfe527dd991755c2ac4486da640_NeikiAnalytics.exe
2752	devbodloc.exe
1600	df17bdfe527dd991755c2ac4486da640_NeikiAnalytics.exe
2752	devbodloc.exe
1600	df17bdfe527dd991755c2ac4486da640_NeikiAnalytics.exe
2752	devbodloc.exe
1600	df17bdfe527dd991755c2ac4486da640_NeikiAnalytics.exe
2752	devbodloc.exe
1600	df17bdfe527dd991755c2ac4486da640_NeikiAnalytics.exe
2752	devbodloc.exe
1600	df17bdfe527dd991755c2ac4486da640_NeikiAnalytics.exe
2752	devbodloc.exe
1600	df17bdfe527dd991755c2ac4486da640_NeikiAnalytics.exe
2752	devbodloc.exe
1600	df17bdfe527dd991755c2ac4486da640_NeikiAnalytics.exe
2752	devbodloc.exe
1600	df17bdfe527dd991755c2ac4486da640_NeikiAnalytics.exe
2752	devbodloc.exe
1600	df17bdfe527dd991755c2ac4486da640_NeikiAnalytics.exe
2752	devbodloc.exe
1600	df17bdfe527dd991755c2ac4486da640_NeikiAnalytics.exe
2752	devbodloc.exe
1600	df17bdfe527dd991755c2ac4486da640_NeikiAnalytics.exe
2752	devbodloc.exe
1600	df17bdfe527dd991755c2ac4486da640_NeikiAnalytics.exe
2752	devbodloc.exe
1600	df17bdfe527dd991755c2ac4486da640_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 2752	1600	df17bdfe527dd991755c2ac4486da640_NeikiAnalytics.exe	28
PID 1600 wrote to memory of 2752	1600	df17bdfe527dd991755c2ac4486da640_NeikiAnalytics.exe	28
PID 1600 wrote to memory of 2752	1600	df17bdfe527dd991755c2ac4486da640_NeikiAnalytics.exe	28
PID 1600 wrote to memory of 2752	1600	df17bdfe527dd991755c2ac4486da640_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\df17bdfe527dd991755c2ac4486da640_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\df17bdfe527dd991755c2ac4486da640_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1600
- C:\UserDotW4\devbodloc.exe
  C:\UserDotW4\devbodloc.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Galax4N\bodxec.exe

Filesize
2.7MB

MD5
b3724c3f1e51f6747a08b01a82cca0bc

SHA1
533d7096db2e7afed1f161b00ba260550930da06

SHA256
b7827207ad63c3bd34ed922ec2fdbf293203f759494615a6110b96bb9362cc1d

SHA512
464a191eba0f3e9304141aaea6b44302ff6bde9aaa665030637d58d0df57c394bcd39e92dd5f870fa625decb6613a5b7627200bb49a8fe5b29b56181809eb809

Download Submit
C:\Users\Admin\253086396416_6.1_Admin.ini

Filesize
203B

MD5
185b0cf5cb5b55b1f06d0888a6e2aee0

SHA1
5ac5eb328c1d7f02c59772aa131fec8d47613149

SHA256
a3492e3b2ca80757f28c65b6b9d224a2c4269e14ddc0f2f3fdb2d39fa5d19346

SHA512
cc07f05f2b121e52453784d9d02e8f3eff79190bc4c30ae3b2a69fb74300127018c34ff40c5bf78b7120dbf892f64fefc5019a2c54642c218d79c99722b38d72

Download Submit
\UserDotW4\devbodloc.exe

Filesize
2.7MB

MD5
91d7086224bd0ec35644236ce854254d

SHA1
78aad309e9708c5f25acef37fdb2978e32295424

SHA256
870dd42e19ab0e353f49ee20e43e3fc17a312e4178401165db9ef03367dad86c

SHA512
38178bf9033c428430ca940a8b5b8010e6200d285e24dbe924fbc003126ff73dd4734c9cb714479ee880c2d38c857ca0d61ebda47e43bda404168270b868e7b5

Download Submit