Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 03:47
Static task
static1
Behavioral task
behavioral1
Sample
16c07fd307b37d086158199966bdc2b0_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
16c07fd307b37d086158199966bdc2b0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
16c07fd307b37d086158199966bdc2b0_NeikiAnalytics.exe
-
Size
4.1MB
-
MD5
16c07fd307b37d086158199966bdc2b0
-
SHA1
1e479b4353a001bd3eab408f3d09574caedacefe
-
SHA256
e2c5910a4a3ff579667e48cd8f7ffa9ab7f57101a1ab4c121611de32ca070762
-
SHA512
69bca23edbc49de843db93d982717f2552f56b76d8f6fd950b50061a77276a014673b80cfb597c30c430ce87fe379e43e3765770e4b4e942a062d5ad32420622
-
SSDEEP
98304:+R0pI/IQlUoMPdmpSpR4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdm25n9klRKN41v
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
devbodec.exepid process 1496 devbodec.exe -
Loads dropped DLL 1 IoCs
Processes:
16c07fd307b37d086158199966bdc2b0_NeikiAnalytics.exepid process 2812 16c07fd307b37d086158199966bdc2b0_NeikiAnalytics.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
16c07fd307b37d086158199966bdc2b0_NeikiAnalytics.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\SysDrv4F\\devbodec.exe" 16c07fd307b37d086158199966bdc2b0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\Galax2F\\bodxloc.exe" 16c07fd307b37d086158199966bdc2b0_NeikiAnalytics.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
16c07fd307b37d086158199966bdc2b0_NeikiAnalytics.exedevbodec.exepid process 2812 16c07fd307b37d086158199966bdc2b0_NeikiAnalytics.exe 2812 16c07fd307b37d086158199966bdc2b0_NeikiAnalytics.exe 1496 devbodec.exe 2812 16c07fd307b37d086158199966bdc2b0_NeikiAnalytics.exe 1496 devbodec.exe 2812 16c07fd307b37d086158199966bdc2b0_NeikiAnalytics.exe 1496 devbodec.exe 2812 16c07fd307b37d086158199966bdc2b0_NeikiAnalytics.exe 1496 devbodec.exe 2812 16c07fd307b37d086158199966bdc2b0_NeikiAnalytics.exe 1496 devbodec.exe 2812 16c07fd307b37d086158199966bdc2b0_NeikiAnalytics.exe 1496 devbodec.exe 2812 16c07fd307b37d086158199966bdc2b0_NeikiAnalytics.exe 1496 devbodec.exe 2812 16c07fd307b37d086158199966bdc2b0_NeikiAnalytics.exe 1496 devbodec.exe 2812 16c07fd307b37d086158199966bdc2b0_NeikiAnalytics.exe 1496 devbodec.exe 2812 16c07fd307b37d086158199966bdc2b0_NeikiAnalytics.exe 1496 devbodec.exe 2812 16c07fd307b37d086158199966bdc2b0_NeikiAnalytics.exe 1496 devbodec.exe 2812 16c07fd307b37d086158199966bdc2b0_NeikiAnalytics.exe 1496 devbodec.exe 2812 16c07fd307b37d086158199966bdc2b0_NeikiAnalytics.exe 1496 devbodec.exe 2812 16c07fd307b37d086158199966bdc2b0_NeikiAnalytics.exe 1496 devbodec.exe 2812 16c07fd307b37d086158199966bdc2b0_NeikiAnalytics.exe 1496 devbodec.exe 2812 16c07fd307b37d086158199966bdc2b0_NeikiAnalytics.exe 1496 devbodec.exe 2812 16c07fd307b37d086158199966bdc2b0_NeikiAnalytics.exe 1496 devbodec.exe 2812 16c07fd307b37d086158199966bdc2b0_NeikiAnalytics.exe 1496 devbodec.exe 2812 16c07fd307b37d086158199966bdc2b0_NeikiAnalytics.exe 1496 devbodec.exe 2812 16c07fd307b37d086158199966bdc2b0_NeikiAnalytics.exe 1496 devbodec.exe 2812 16c07fd307b37d086158199966bdc2b0_NeikiAnalytics.exe 1496 devbodec.exe 2812 16c07fd307b37d086158199966bdc2b0_NeikiAnalytics.exe 1496 devbodec.exe 2812 16c07fd307b37d086158199966bdc2b0_NeikiAnalytics.exe 1496 devbodec.exe 2812 16c07fd307b37d086158199966bdc2b0_NeikiAnalytics.exe 1496 devbodec.exe 2812 16c07fd307b37d086158199966bdc2b0_NeikiAnalytics.exe 1496 devbodec.exe 2812 16c07fd307b37d086158199966bdc2b0_NeikiAnalytics.exe 1496 devbodec.exe 2812 16c07fd307b37d086158199966bdc2b0_NeikiAnalytics.exe 1496 devbodec.exe 2812 16c07fd307b37d086158199966bdc2b0_NeikiAnalytics.exe 1496 devbodec.exe 2812 16c07fd307b37d086158199966bdc2b0_NeikiAnalytics.exe 1496 devbodec.exe 2812 16c07fd307b37d086158199966bdc2b0_NeikiAnalytics.exe 1496 devbodec.exe 2812 16c07fd307b37d086158199966bdc2b0_NeikiAnalytics.exe 1496 devbodec.exe 2812 16c07fd307b37d086158199966bdc2b0_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
16c07fd307b37d086158199966bdc2b0_NeikiAnalytics.exedescription pid process target process PID 2812 wrote to memory of 1496 2812 16c07fd307b37d086158199966bdc2b0_NeikiAnalytics.exe devbodec.exe PID 2812 wrote to memory of 1496 2812 16c07fd307b37d086158199966bdc2b0_NeikiAnalytics.exe devbodec.exe PID 2812 wrote to memory of 1496 2812 16c07fd307b37d086158199966bdc2b0_NeikiAnalytics.exe devbodec.exe PID 2812 wrote to memory of 1496 2812 16c07fd307b37d086158199966bdc2b0_NeikiAnalytics.exe devbodec.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\16c07fd307b37d086158199966bdc2b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\16c07fd307b37d086158199966bdc2b0_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\SysDrv4F\devbodec.exeC:\SysDrv4F\devbodec.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Galax2F\bodxloc.exeFilesize
4.1MB
MD507cdb0c2425497a4036a4f063c1d7593
SHA1ade26ad7c682d0a14064306507d8900909c3e66c
SHA256d6c87308a6a41f9e5126ab63811e4ef17153c85d28dce6f6b2cc4db1f985c276
SHA512f556255b9133697b1857c00ea3c893a7a9e2832dcb1552548a7d1339a960fefe0b055f4e0bbb677ac98101e4f1b1ce11ccd46f914e39abdefe632ca42288ca8d
-
C:\Users\Admin\253086396416_6.1_Admin.iniFilesize
205B
MD59871a233e6f069206bb6b7e18835026c
SHA1293f8d2d9bee92bd45aaf6675045441fa5004d6a
SHA2565d828ae71ba8cdb80b3141b1013c08f39bbe0a72ad68e2b325f28be4a2fd548e
SHA512f1d0d5f10c2e3755841ba584de5a3a97d0ac4a991652fc0f877b1c28d6a6eb696b5594c065ff31ac71387726600370c2ec466f8ab5773fa8f9c2417b2bf9cab6
-
\SysDrv4F\devbodec.exeFilesize
4.1MB
MD5a075d48b61546508bd998a495931ef6c
SHA1a3c1c46244487473a9bb04bd8615a25a97fe88c3
SHA25600ce194bddc731740f260e77f52e99f50f6ea35d986758156b8137b037154e2e
SHA5120317afde04f4d914794e14fa8d61cc6e2ec25ce577c303a35411bea36a546e5f3fd81bce35efa3274408c15dccefc5f7b24e062f440705ceaf243cc8e8975c0e