Overview

overview

7

Static

static

3

bacef79baf...cs.exe

windows7-x64

7

bacef79baf...cs.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    25/05/2024, 13:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    bacef79bafcc6dfe4524cda655940c90_NeikiAnalytics.exe

  • Size

    2.7MB

  • MD5

    bacef79bafcc6dfe4524cda655940c90

  • SHA1

    6f6c59be71348f2f89582994c06797f130652547

  • SHA256

    9d5d9166f8a63dc0f491d6471282f69e53daae48594de4cd3c40a7fa67fc1daa

  • SHA512

    a2c40b3a281de8f012ab0102801ab4391c350e7183d2704dc8d178ccb6775efd3f40eb3f948da36e0c7320f1b37ca0a474ce59b8b8a72ab86f63330f744ddbf9

  • SSDEEP

    49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LB79w4Sx:+R0pI/IQlUoMPdmpSpD4

Score
7/10
persistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bacef79bafcc6dfe4524cda655940c90_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\bacef79bafcc6dfe4524cda655940c90_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3020
    • C:\AdobeCW\xbodsys.exe
      C:\AdobeCW\xbodsys.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:2160

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\AdobeCW\xbodsys.exe
          Filesize

          2.7MB

          MD5

          14358fc417a5b4c95ed25f09980db04a

          SHA1

          e2a4c6c77bf24653a35c10548c879dc45d5ad368

          SHA256

          4556f5ba6e2524062eb0335784c6174206f753059299ce3b41298f43e2cbea13

          SHA512

          a12f53fa33f153e234e8f219522c95fd05419f89eb9de875e504a95b54e2b9e4687ac44dd1b2a52bea2959c86c7629c799a42385a6fbd0a43facb4b366ebe84c

          Download Submit

        • C:\Users\Admin\253086396416_6.1_Admin.ini
          Filesize

          199B

          MD5

          b20c23ce067a92dbc7ae6c2009bf13fe

          SHA1

          98ec8d0af5048e7cd4123e3e69b895088544a8a2

          SHA256

          655ab3706bd38e902ef9ad0895abfa3b36e20037c25cda8468f5e3842257494e

          SHA512

          2924879de252c158dd2f83b63477a6eb8faaab7f4eb1f74040b8405d18abb931fc3087eb100429f2a389656e7eebd3b9c390f641b32cdc076a6dc2d24ef62d86

          Download Submit

        • C:\VidFN\optixec.exe
          Filesize

          2.7MB

          MD5

          62e2e49a259591c5f0c105eedd709ac5

          SHA1

          a292e84f52bad43d6945e7c77db69c0fd5e9c614

          SHA256

          721f8daa10b87d25f4afc4e71efa45388b4174aeffd89c994fab3664bb72d7ac

          SHA512

          6f4c3a09234bbb9bfc751caddf77d4308f351a59e4b852cbf2d788f66b0df4601ef34e2830742057ce28a0ebaebef9296a162bb1492fb0dc46c9e7c66f34fa5d

          Download Submit