Overview

overview

7

Static

static

3

bacef79baf...cs.exe

windows7-x64

7

bacef79baf...cs.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/05/2024, 13:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    bacef79bafcc6dfe4524cda655940c90_NeikiAnalytics.exe

  • Size

    2.7MB

  • MD5

    bacef79bafcc6dfe4524cda655940c90

  • SHA1

    6f6c59be71348f2f89582994c06797f130652547

  • SHA256

    9d5d9166f8a63dc0f491d6471282f69e53daae48594de4cd3c40a7fa67fc1daa

  • SHA512

    a2c40b3a281de8f012ab0102801ab4391c350e7183d2704dc8d178ccb6775efd3f40eb3f948da36e0c7320f1b37ca0a474ce59b8b8a72ab86f63330f744ddbf9

  • SSDEEP

    49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LB79w4Sx:+R0pI/IQlUoMPdmpSpD4

Score
7/10
persistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bacef79bafcc6dfe4524cda655940c90_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\bacef79bafcc6dfe4524cda655940c90_NeikiAnalytics.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1772
    • C:\SysDrvHC\adobec.exe
      C:\SysDrvHC\adobec.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:2096

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\KaVB2O\boddevsys.exe
          Filesize

          478KB

          MD5

          be47343b902632f65b063ca0b5649075

          SHA1

          419315104c32d78f4bc423701d569f3ac462f699

          SHA256

          4fc635c0be969c9c07d50e9e3acab99752655283b7aaa991f2826dcd8cce8087

          SHA512

          5471a0890e931f042536f59ff17e966e4772a8e28f48c2e65ab8a56d7d4d3d91bb056e954cf767ed7da742c1df751a29c187fa76f94ac8a807f632bc0d7b5ea5

          Download Submit

        • C:\KaVB2O\boddevsys.exe
          Filesize

          2.7MB

          MD5

          29e8c97edc0f3e2002453dc88eab25db

          SHA1

          0679be7cce02852aa8fdd6bb95ff9a9413b40320

          SHA256

          e318709813ae544d347a2011c07e7e3e95ce90c74971fcde448cb15da947458d

          SHA512

          d1377d329cba64d23f2596c7cb52c4dd1b9dc7aa2622df81a8132167e1fd2be8dc44d77b79b1cf90272561dca77b712a08b484ffa3fd7361f40bbeb2174521a4

          Download Submit

        • C:\SysDrvHC\adobec.exe
          Filesize

          2.7MB

          MD5

          f7566fd86aeef46dbc013669e2234e5f

          SHA1

          39b6be0d8fd751cdef27de8386bc1182db332c2d

          SHA256

          2696ada7639d21b05c42047ba4a1632acaa3da34407ed1f528230181855c819e

          SHA512

          100989bb7f3b86db3df756e890865ed532bffbdc84304953a69b75d17eee8783b2182259e3ce2539ad2b419b1837fc3e078a7be093c216c56f6c3ba45043e69f

          Download Submit

        • C:\Users\Admin\253086396416_10.0_Admin.ini
          Filesize

          203B

          MD5

          26ac334b3939d287b96bc63852481fac

          SHA1

          c815f5773bd3876f1ceaabf9ad3df11970982611

          SHA256

          4a1ab00c75b5c7a213bc02ddb133ee1f20260538c6aa65ea5368c8aec6b7d7f7

          SHA512

          dd6af10250950b222d5e87cb2feb48daac5b19ca7e415317f64f421ef12bdef093b4fb2612b5be21a6ddbda6b1900808bfce4fe9ba17c8081cf760ef39a2c775

          Download Submit