Overview

overview

7

Static

static

3

e090443fd9...cs.exe

windows7-x64

7

e090443fd9...cs.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    16/05/2024, 13:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    e090443fd92ee1ed82dbb74f8fc5c200_NeikiAnalytics.exe

  • Size

    2.7MB

  • MD5

    e090443fd92ee1ed82dbb74f8fc5c200

  • SHA1

    6cbfecf2d5f17424ee1634a8240ff398688dd9ad

  • SHA256

    96656b314bd09cb2125181cd382465a7bb6b4c774f61ba524de1693b5ee581b6

  • SHA512

    afb4c94a2e70d3142b11c4a1560d6901ddbc765945ccdb99fd7a2a006864384661be48a46943e8ed3c6cffcf4398d1541702781530c44e7fce79f66f0700bdcb

  • SSDEEP

    49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LB69w4Sx:+R0pI/IQlUoMPdmpSpI4

Score
7/10
persistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e090443fd92ee1ed82dbb74f8fc5c200_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\e090443fd92ee1ed82dbb74f8fc5c200_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2264
    • C:\AdobeSB\xbodec.exe
      C:\AdobeSB\xbodec.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:2740

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\MintNT\dobaloc.exe
          Filesize

          2.7MB

          MD5

          121a4e6f862c695c21f751f357d26e93

          SHA1

          327bbaca1fbe40b33625bd32dbeee206525700c8

          SHA256

          1d46b0a22e519f5bb7cb2ba2cf0058f4f50406df529e2c9162598490936d18e8

          SHA512

          15b6dd33914071e93277c187187b25d4c3bfd5971266535f02b7117913c26cca00537b3e69f5dbca6946c5de13606d4294ec83f22ca4fb020ac2950e0b08bf95

          Download Submit

        • C:\Users\Admin\253086396416_6.1_Admin.ini
          Filesize

          199B

          MD5

          1e229b65592b4e97ec710b07be5595fd

          SHA1

          4d2df60102b129c441ac6fd90f74dff7cbee2cff

          SHA256

          d9c435c00470e1455df143785a5bbfdf92ee758f0cae9e0ebde410291d262443

          SHA512

          0d1022c56aa604851ec5170b24cb5dbc82cdecb3fc4b5c2d9bc3420131be5ac32361f83ec2c943f4327d5f689896ad1b1efa026a912031d45567f3b6049bd5db

          Download Submit

        • \AdobeSB\xbodec.exe
          Filesize

          2.7MB

          MD5

          c2dc58b1c95451c0a1e4462fcc37191c

          SHA1

          a26523a814d96c0d9bf1e344731999dad6f976dc

          SHA256

          3a51cfd01aa41bb7f5d1493b60354dbe0ce197bd9a68a0e5dca80608ae272a3b

          SHA512

          2d00c56faa65af23b237eb6dd697c54482409c7e79b64b29b7903e53ccbeb54de594a42d1d5f2e4083fbe93baf0c8c348fc958fc5d9aa730ec573b4257d03ece

          Download Submit