8a15c447962d7bd823fc5d3e5366d2e70cd3f7571a24e862d4bd2a4c4cf13b72

Analysis

max time kernel
149s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
20/05/2024, 09:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e231a1341ced50815580646f8823e920_NeikiAnalytics.exe
Size

2.7MB
MD5

e231a1341ced50815580646f8823e920
SHA1

87f388d6add431386df3593aa339089c10d50320
SHA256

8a15c447962d7bd823fc5d3e5366d2e70cd3f7571a24e862d4bd2a4c4cf13b72
SHA512

c455a4c84afa28dfebacbf6dfb07c69d24c7101df63c7310b038de788792a0476f3bfbbd228d3fb24a4d2699bcb4c7aef63d0401cea9a852395fe31ccc4ce164
SSDEEP

49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LB+9w4Sx:+R0pI/IQlUoMPdmpSp44

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1740	xdobsys.exe

Loads dropped DLL 1 IoCs

pid	Process
2192	e231a1341ced50815580646f8823e920_NeikiAnalytics.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\AdobeXU\\xdobsys.exe"	e231a1341ced50815580646f8823e920_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\VidHV\\bodxsys.exe"	e231a1341ced50815580646f8823e920_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2192	e231a1341ced50815580646f8823e920_NeikiAnalytics.exe
2192	e231a1341ced50815580646f8823e920_NeikiAnalytics.exe
1740	xdobsys.exe
2192	e231a1341ced50815580646f8823e920_NeikiAnalytics.exe
1740	xdobsys.exe
2192	e231a1341ced50815580646f8823e920_NeikiAnalytics.exe
1740	xdobsys.exe
2192	e231a1341ced50815580646f8823e920_NeikiAnalytics.exe
1740	xdobsys.exe
2192	e231a1341ced50815580646f8823e920_NeikiAnalytics.exe
1740	xdobsys.exe
2192	e231a1341ced50815580646f8823e920_NeikiAnalytics.exe
1740	xdobsys.exe
2192	e231a1341ced50815580646f8823e920_NeikiAnalytics.exe
1740	xdobsys.exe
2192	e231a1341ced50815580646f8823e920_NeikiAnalytics.exe
1740	xdobsys.exe
2192	e231a1341ced50815580646f8823e920_NeikiAnalytics.exe
1740	xdobsys.exe
2192	e231a1341ced50815580646f8823e920_NeikiAnalytics.exe
1740	xdobsys.exe
2192	e231a1341ced50815580646f8823e920_NeikiAnalytics.exe
1740	xdobsys.exe
2192	e231a1341ced50815580646f8823e920_NeikiAnalytics.exe
1740	xdobsys.exe
2192	e231a1341ced50815580646f8823e920_NeikiAnalytics.exe
1740	xdobsys.exe
2192	e231a1341ced50815580646f8823e920_NeikiAnalytics.exe
1740	xdobsys.exe
2192	e231a1341ced50815580646f8823e920_NeikiAnalytics.exe
1740	xdobsys.exe
2192	e231a1341ced50815580646f8823e920_NeikiAnalytics.exe
1740	xdobsys.exe
2192	e231a1341ced50815580646f8823e920_NeikiAnalytics.exe
1740	xdobsys.exe
2192	e231a1341ced50815580646f8823e920_NeikiAnalytics.exe
1740	xdobsys.exe
2192	e231a1341ced50815580646f8823e920_NeikiAnalytics.exe
1740	xdobsys.exe
2192	e231a1341ced50815580646f8823e920_NeikiAnalytics.exe
1740	xdobsys.exe
2192	e231a1341ced50815580646f8823e920_NeikiAnalytics.exe
1740	xdobsys.exe
2192	e231a1341ced50815580646f8823e920_NeikiAnalytics.exe
1740	xdobsys.exe
2192	e231a1341ced50815580646f8823e920_NeikiAnalytics.exe
1740	xdobsys.exe
2192	e231a1341ced50815580646f8823e920_NeikiAnalytics.exe
1740	xdobsys.exe
2192	e231a1341ced50815580646f8823e920_NeikiAnalytics.exe
1740	xdobsys.exe
2192	e231a1341ced50815580646f8823e920_NeikiAnalytics.exe
1740	xdobsys.exe
2192	e231a1341ced50815580646f8823e920_NeikiAnalytics.exe
1740	xdobsys.exe
2192	e231a1341ced50815580646f8823e920_NeikiAnalytics.exe
1740	xdobsys.exe
2192	e231a1341ced50815580646f8823e920_NeikiAnalytics.exe
1740	xdobsys.exe
2192	e231a1341ced50815580646f8823e920_NeikiAnalytics.exe
1740	xdobsys.exe
2192	e231a1341ced50815580646f8823e920_NeikiAnalytics.exe
1740	xdobsys.exe
2192	e231a1341ced50815580646f8823e920_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 1740	2192	e231a1341ced50815580646f8823e920_NeikiAnalytics.exe	28
PID 2192 wrote to memory of 1740	2192	e231a1341ced50815580646f8823e920_NeikiAnalytics.exe	28
PID 2192 wrote to memory of 1740	2192	e231a1341ced50815580646f8823e920_NeikiAnalytics.exe	28
PID 2192 wrote to memory of 1740	2192	e231a1341ced50815580646f8823e920_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\e231a1341ced50815580646f8823e920_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\e231a1341ced50815580646f8823e920_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2192
- C:\AdobeXU\xdobsys.exe
  C:\AdobeXU\xdobsys.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\253086396416_6.1_Admin.ini

Filesize
200B

MD5
ab28a2cf40bb729fa0034348fb3078af

SHA1
8a61d74ebb3728fa7b31c971cdf8c1158dfd778e

SHA256
72c2645c760d6912fee4016969094a61a26da49b02be193ceecb19f7d1387ee2

SHA512
7d2188ae94aa9bdacccb064248d7c478720349b12da6ae13d96be1fd03dcf4e04c91b97553d19c9ee3db9ef6e0c31ae618e39cc0ab05529e161c5ec0bf5ea204

Download Submit
C:\VidHV\bodxsys.exe

Filesize
2.7MB

MD5
9fafa0c44dc734665562fd73113dd4e0

SHA1
c881f8bfbb6d0e6f764c27a3bfd580535ed3d6b5

SHA256
6e0227564977a574534b55a4e130f0b4c6b49bf22e74e0f924a713b21668ebb7

SHA512
c275898b677aca61c2892bd0e9e8d5c6c95daed34162c3b78d30f163fc60126c6b5ed0a1c17bd4de79d61a81cc0140d1e01d1e20da834d381a6c3d6f298ff001

Download Submit
\AdobeXU\xdobsys.exe

Filesize
2.7MB

MD5
4f65e8c023c4c28b7b41eea4232f7a03

SHA1
fdac6ce371ea0e8f134f19fb5914df69899d0b1c

SHA256
8978782c4f5c8694db72dc5ac1fa08621db1c63ac694ebc7e66afe93776012c9

SHA512
d536a4be51f711255270bef56c624018d5d37e5b74e6d027466a8b1cbab3a140bbf7276c9cdb0db29452ba694223eaf8a8e719c9cb3d25a04287ffbbb6b880c0

Download Submit