Overview

overview

7

Static

static

3

e090443fd9...cs.exe

windows7-x64

7

e090443fd9...cs.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/05/2024, 13:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    e090443fd92ee1ed82dbb74f8fc5c200_NeikiAnalytics.exe

  • Size

    2.7MB

  • MD5

    e090443fd92ee1ed82dbb74f8fc5c200

  • SHA1

    6cbfecf2d5f17424ee1634a8240ff398688dd9ad

  • SHA256

    96656b314bd09cb2125181cd382465a7bb6b4c774f61ba524de1693b5ee581b6

  • SHA512

    afb4c94a2e70d3142b11c4a1560d6901ddbc765945ccdb99fd7a2a006864384661be48a46943e8ed3c6cffcf4398d1541702781530c44e7fce79f66f0700bdcb

  • SSDEEP

    49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LB69w4Sx:+R0pI/IQlUoMPdmpSpI4

Score
7/10
persistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e090443fd92ee1ed82dbb74f8fc5c200_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\e090443fd92ee1ed82dbb74f8fc5c200_NeikiAnalytics.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:468
    • C:\AdobeWE\xdobsys.exe
      C:\AdobeWE\xdobsys.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:2748

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\AdobeWE\xdobsys.exe
          Filesize

          2.7MB

          MD5

          3685107dadf783c6500f26aa0c4f1a69

          SHA1

          91ce2b5fcad00055a1455c4252f04ace5b46375e

          SHA256

          855a92092188e47fbcb55a0e8c453939d305c3d9bb49b13cf30a76093f639784

          SHA512

          2900999c03fdbe54d3d648e0b89819b4aaa84234cd85fa840b4cde02ddf604bbc5a248ae7fe33f012d178715df93156c3938d00a6cea36325c446284328627dd

          Download Submit

        • C:\KaVBZ2\optixec.exe
          Filesize

          2.7MB

          MD5

          01dbcd424a53c3a3775fbb8444461b53

          SHA1

          c8e27e103ac201584a59810cc20af04e031242ce

          SHA256

          61d0e572cf542eee514bfe3a62d11d17250f927fe047233995e2c0a9d16a495a

          SHA512

          7d8a7b73af51f6d60a91deeb41fdbeb07204c17600d0478f9ba01d39098dd3b872981b019fcaa98eac3ae1b1fdc94003d3387b1c9eb699a196314cf8faa15e73

          Download Submit

        • C:\Users\Admin\253086396416_10.0_Admin.ini
          Filesize

          202B

          MD5

          ef637f0ff24b29e3793d02fa0a682438

          SHA1

          e60dd6bd67923652b4123f5bad06c120f25765fc

          SHA256

          7748bbfb674775c091633944147d6582592e7e42469d4a3c7722a912cb4adef2

          SHA512

          1ee71dd0abaf567ec554d6d45b0789b8b3815e059084163d734d7e3400fdc1f17569876c53defb1646e909eb89c800b4c69f8cb0b03919623eff5084cab5f9a8

          Download Submit