Overview

overview

7

Static

static

3

5e015fea71...cs.exe

windows7-x64

7

5e015fea71...cs.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-05-2024 00:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5e015fea71657c4bdaf5af6fcd20d5c0_NeikiAnalytics.exe

  • Size

    4.1MB

  • MD5

    5e015fea71657c4bdaf5af6fcd20d5c0

  • SHA1

    d88f66f0f1b9e8c13a21b6f8614e48b0eecc9797

  • SHA256

    e9d2e2be264478dc2fd8716dd302a4239351d9499f6b659c091746bf13ebbfc6

  • SHA512

    c6b02e3b5b3ed236e0d4bccc1aba0f6cd5914e12ae8e7e94c16b3361db76e6b92658e4eb265722ea58ff477039c75f8e5187731e92a5fc5aeaa36939658396ad

  • SSDEEP

    98304:+R0pI/IQlUoMPdmpSpN4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdmC5n9klRKN41v

Score
7/10
persistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5e015fea71657c4bdaf5af6fcd20d5c0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\5e015fea71657c4bdaf5af6fcd20d5c0_NeikiAnalytics.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2792
    • C:\AdobeVB\xbodsys.exe
      C:\AdobeVB\xbodsys.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:4220

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\AdobeVB\xbodsys.exe
    Filesize

    4.1MB

    MD5

    d629a58011435c7a3f6e31b59699ebe0

    SHA1

    2ebc337e92eb655e47597b43f82ba0f1226f86ca

    SHA256

    100b39da92cdefd76497b9d84c8d415d60a98846b481c4715d9111848d8313fb

    SHA512

    7091326932f934ec247f6201eef77563fc64e2a8136d859f7153401618064ee0e8b95996e5a39d89d8e0c9b9826c9b0c2d74240444c7cc219edfc36ca62c420d

    Download Submit

  • C:\KaVB6J\optidevec.exe
    Filesize

    9KB

    MD5

    f24e8ebe2134fb9105f767ac6a5b13d6

    SHA1

    d87bd5250acbcd27e4ac07ca739fedccef4a7ee1

    SHA256

    6448e46123698d117ae1f2cc2ce1754ec43e0f78dc07011770f5412ae8e09e0e

    SHA512

    22e754e2594bfee3cd7ff1f9288818db280a23d53652603c522cb85c04643b6c9c9725b59dc003037dc80a66b6ac004a61e127276dccc8d1c5122d850af2ff32

    Download Submit

  • C:\Users\Admin\253086396416_10.0_Admin.ini
    Filesize

    202B

    MD5

    e4cbf4ae7a6dd78c9e9cebd8a02d0cbd

    SHA1

    42f380f6ff555e6a98b0ec8df52156e8a9a14bf4

    SHA256

    b1d933f60e17df8dc5560c19720d42ab593d201551c88b91d3bea14c481f7753

    SHA512

    ea33e97cb048499107164d7ba2331a9708f9c740adcbfc13d2dcbd70f627bc9ff7ec8bcdf13dcf7a568a874a2c9da687a591e653969db60264ad33aef693a3c9

    Download Submit