920552b911beb245c8e7cc23ca77d4934383b7a1553ae8f2ece9940f41052423

Analysis

max time kernel
149s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 22:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f6210b7712a525df09bfb755f53e6b00_NeikiAnalytics.exe
Size

4.1MB
MD5

f6210b7712a525df09bfb755f53e6b00
SHA1

a0aedda897c7a4d31d4ee65debe68af99107488b
SHA256

920552b911beb245c8e7cc23ca77d4934383b7a1553ae8f2ece9940f41052423
SHA512

864758b7499a6ef2eb3b43424af928709d685dcc1fbf520a83fbfaa30a98ca5f6b76814d94460d1f24b58aa8f601a490db8daa4a8ef279843c2da1bf84d1c5a0
SSDEEP

98304:+R0pI/IQlUoMPdmpSp84ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdm35n9klRKN41v

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2088	xbodloc.exe

Loads dropped DLL 1 IoCs

pid	Process
2248	f6210b7712a525df09bfb755f53e6b00_NeikiAnalytics.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\AdobeOQ\\xbodloc.exe"	f6210b7712a525df09bfb755f53e6b00_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\KaVB32\\bodasys.exe"	f6210b7712a525df09bfb755f53e6b00_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2248	f6210b7712a525df09bfb755f53e6b00_NeikiAnalytics.exe
2248	f6210b7712a525df09bfb755f53e6b00_NeikiAnalytics.exe
2088	xbodloc.exe
2248	f6210b7712a525df09bfb755f53e6b00_NeikiAnalytics.exe
2088	xbodloc.exe
2248	f6210b7712a525df09bfb755f53e6b00_NeikiAnalytics.exe
2088	xbodloc.exe
2248	f6210b7712a525df09bfb755f53e6b00_NeikiAnalytics.exe
2088	xbodloc.exe
2248	f6210b7712a525df09bfb755f53e6b00_NeikiAnalytics.exe
2088	xbodloc.exe
2248	f6210b7712a525df09bfb755f53e6b00_NeikiAnalytics.exe
2088	xbodloc.exe
2248	f6210b7712a525df09bfb755f53e6b00_NeikiAnalytics.exe
2088	xbodloc.exe
2248	f6210b7712a525df09bfb755f53e6b00_NeikiAnalytics.exe
2088	xbodloc.exe
2248	f6210b7712a525df09bfb755f53e6b00_NeikiAnalytics.exe
2088	xbodloc.exe
2248	f6210b7712a525df09bfb755f53e6b00_NeikiAnalytics.exe
2088	xbodloc.exe
2248	f6210b7712a525df09bfb755f53e6b00_NeikiAnalytics.exe
2088	xbodloc.exe
2248	f6210b7712a525df09bfb755f53e6b00_NeikiAnalytics.exe
2088	xbodloc.exe
2248	f6210b7712a525df09bfb755f53e6b00_NeikiAnalytics.exe
2088	xbodloc.exe
2248	f6210b7712a525df09bfb755f53e6b00_NeikiAnalytics.exe
2088	xbodloc.exe
2248	f6210b7712a525df09bfb755f53e6b00_NeikiAnalytics.exe
2088	xbodloc.exe
2248	f6210b7712a525df09bfb755f53e6b00_NeikiAnalytics.exe
2088	xbodloc.exe
2248	f6210b7712a525df09bfb755f53e6b00_NeikiAnalytics.exe
2088	xbodloc.exe
2248	f6210b7712a525df09bfb755f53e6b00_NeikiAnalytics.exe
2088	xbodloc.exe
2248	f6210b7712a525df09bfb755f53e6b00_NeikiAnalytics.exe
2088	xbodloc.exe
2248	f6210b7712a525df09bfb755f53e6b00_NeikiAnalytics.exe
2088	xbodloc.exe
2248	f6210b7712a525df09bfb755f53e6b00_NeikiAnalytics.exe
2088	xbodloc.exe
2248	f6210b7712a525df09bfb755f53e6b00_NeikiAnalytics.exe
2088	xbodloc.exe
2248	f6210b7712a525df09bfb755f53e6b00_NeikiAnalytics.exe
2088	xbodloc.exe
2248	f6210b7712a525df09bfb755f53e6b00_NeikiAnalytics.exe
2088	xbodloc.exe
2248	f6210b7712a525df09bfb755f53e6b00_NeikiAnalytics.exe
2088	xbodloc.exe
2248	f6210b7712a525df09bfb755f53e6b00_NeikiAnalytics.exe
2088	xbodloc.exe
2248	f6210b7712a525df09bfb755f53e6b00_NeikiAnalytics.exe
2088	xbodloc.exe
2248	f6210b7712a525df09bfb755f53e6b00_NeikiAnalytics.exe
2088	xbodloc.exe
2248	f6210b7712a525df09bfb755f53e6b00_NeikiAnalytics.exe
2088	xbodloc.exe
2248	f6210b7712a525df09bfb755f53e6b00_NeikiAnalytics.exe
2088	xbodloc.exe
2248	f6210b7712a525df09bfb755f53e6b00_NeikiAnalytics.exe
2088	xbodloc.exe
2248	f6210b7712a525df09bfb755f53e6b00_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 2088	2248	f6210b7712a525df09bfb755f53e6b00_NeikiAnalytics.exe	28
PID 2248 wrote to memory of 2088	2248	f6210b7712a525df09bfb755f53e6b00_NeikiAnalytics.exe	28
PID 2248 wrote to memory of 2088	2248	f6210b7712a525df09bfb755f53e6b00_NeikiAnalytics.exe	28
PID 2248 wrote to memory of 2088	2248	f6210b7712a525df09bfb755f53e6b00_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\f6210b7712a525df09bfb755f53e6b00_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\f6210b7712a525df09bfb755f53e6b00_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2248
- C:\AdobeOQ\xbodloc.exe
  C:\AdobeOQ\xbodloc.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\KaVB32\bodasys.exe

Filesize
4.1MB

MD5
3728c6ac8c128a95fbfe1ab0b0bbc616

SHA1
ffd4844f9c4068c4279d16ff99fd40a88a6d14d8

SHA256
1655bd0b1ebdf43408161729e92baff98fde4c92faf28dab69a9758b697241d8

SHA512
58c9e643dcfd1584066d40f836631bd089f204158f73495c80cad2f8cd302e9582b7c38f4b6506c09e6f852a832cbf13f745e7f5f2140e4c3405f33d1abc0dfa

Download Submit
C:\Users\Admin\253086396416_6.1_Admin.ini

Filesize
200B

MD5
a72d7153c2e9e1704fa2f82c1e840d01

SHA1
a757b2904dcc076e700566110e147b226d5cff2e

SHA256
14b1a636a10a4e33ee919db3b18339d15fb2409e4af029c702ed718b9759af70

SHA512
19bc24b5994f2639a3cff1ae9a2864d56e506091d74973d776c4c4b3ef10b8ecdf9ecfae1808ee4725f3f45d7ab2bf1de947de46b1e445b50299ac54fc097bb2

Download Submit
\AdobeOQ\xbodloc.exe

Filesize
4.1MB

MD5
f63d12728c543633e95b24d6edd80e14

SHA1
a70183ecc3ec0ebdfadd1700221b25bc49e0d370

SHA256
4f25b6e0300a29ca9667d961e146717567256152ce947a6bae7baa7d9684cb21

SHA512
e34b4742dd7396da090ea5d9dcdd53dcf68509c09e859f9dac04226b21b8e38f9cd1e8618ea6e6be30a1721beb3bd602cca590018436e251f07f2cb75d2e47fb

Download Submit