Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
25/05/2024, 14:27
Static task
static1
Behavioral task
behavioral1
Sample
ae977b1ddc2cff1496ef09a2162bf3b0_NeikiAnalytics.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
ae977b1ddc2cff1496ef09a2162bf3b0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
ae977b1ddc2cff1496ef09a2162bf3b0_NeikiAnalytics.exe
-
Size
2.7MB
-
MD5
ae977b1ddc2cff1496ef09a2162bf3b0
-
SHA1
225209ba538a57a610f111de7828baa17d304d67
-
SHA256
76c696ea0e60fc04571004b198b36a2ad6d5dd22fe8bf40110de13863b430ab9
-
SHA512
bf5ab3d4862704b81c7de23a590f678ced8ce5c0b0b87509d90958734eb7476460c0c5ed0ecbd2d823cee7a9a04f320af59ead5a1635a9ce5e9bf37ff6cd2755
-
SSDEEP
49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LB19w4Sx:+R0pI/IQlUoMPdmpSp14
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 848 devbodloc.exe -
Loads dropped DLL 1 IoCs
pid Process 2356 ae977b1ddc2cff1496ef09a2162bf3b0_NeikiAnalytics.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\SysDrv61\\devbodloc.exe" ae977b1ddc2cff1496ef09a2162bf3b0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\LabZ4T\\optiasys.exe" ae977b1ddc2cff1496ef09a2162bf3b0_NeikiAnalytics.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2356 ae977b1ddc2cff1496ef09a2162bf3b0_NeikiAnalytics.exe 2356 ae977b1ddc2cff1496ef09a2162bf3b0_NeikiAnalytics.exe 848 devbodloc.exe 2356 ae977b1ddc2cff1496ef09a2162bf3b0_NeikiAnalytics.exe 848 devbodloc.exe 2356 ae977b1ddc2cff1496ef09a2162bf3b0_NeikiAnalytics.exe 848 devbodloc.exe 2356 ae977b1ddc2cff1496ef09a2162bf3b0_NeikiAnalytics.exe 848 devbodloc.exe 2356 ae977b1ddc2cff1496ef09a2162bf3b0_NeikiAnalytics.exe 848 devbodloc.exe 2356 ae977b1ddc2cff1496ef09a2162bf3b0_NeikiAnalytics.exe 848 devbodloc.exe 2356 ae977b1ddc2cff1496ef09a2162bf3b0_NeikiAnalytics.exe 848 devbodloc.exe 2356 ae977b1ddc2cff1496ef09a2162bf3b0_NeikiAnalytics.exe 848 devbodloc.exe 2356 ae977b1ddc2cff1496ef09a2162bf3b0_NeikiAnalytics.exe 848 devbodloc.exe 2356 ae977b1ddc2cff1496ef09a2162bf3b0_NeikiAnalytics.exe 848 devbodloc.exe 2356 ae977b1ddc2cff1496ef09a2162bf3b0_NeikiAnalytics.exe 848 devbodloc.exe 2356 ae977b1ddc2cff1496ef09a2162bf3b0_NeikiAnalytics.exe 848 devbodloc.exe 2356 ae977b1ddc2cff1496ef09a2162bf3b0_NeikiAnalytics.exe 848 devbodloc.exe 2356 ae977b1ddc2cff1496ef09a2162bf3b0_NeikiAnalytics.exe 848 devbodloc.exe 2356 ae977b1ddc2cff1496ef09a2162bf3b0_NeikiAnalytics.exe 848 devbodloc.exe 2356 ae977b1ddc2cff1496ef09a2162bf3b0_NeikiAnalytics.exe 848 devbodloc.exe 2356 ae977b1ddc2cff1496ef09a2162bf3b0_NeikiAnalytics.exe 848 devbodloc.exe 2356 ae977b1ddc2cff1496ef09a2162bf3b0_NeikiAnalytics.exe 848 devbodloc.exe 2356 ae977b1ddc2cff1496ef09a2162bf3b0_NeikiAnalytics.exe 848 devbodloc.exe 2356 ae977b1ddc2cff1496ef09a2162bf3b0_NeikiAnalytics.exe 848 devbodloc.exe 2356 ae977b1ddc2cff1496ef09a2162bf3b0_NeikiAnalytics.exe 848 devbodloc.exe 2356 ae977b1ddc2cff1496ef09a2162bf3b0_NeikiAnalytics.exe 848 devbodloc.exe 2356 ae977b1ddc2cff1496ef09a2162bf3b0_NeikiAnalytics.exe 848 devbodloc.exe 2356 ae977b1ddc2cff1496ef09a2162bf3b0_NeikiAnalytics.exe 848 devbodloc.exe 2356 ae977b1ddc2cff1496ef09a2162bf3b0_NeikiAnalytics.exe 848 devbodloc.exe 2356 ae977b1ddc2cff1496ef09a2162bf3b0_NeikiAnalytics.exe 848 devbodloc.exe 2356 ae977b1ddc2cff1496ef09a2162bf3b0_NeikiAnalytics.exe 848 devbodloc.exe 2356 ae977b1ddc2cff1496ef09a2162bf3b0_NeikiAnalytics.exe 848 devbodloc.exe 2356 ae977b1ddc2cff1496ef09a2162bf3b0_NeikiAnalytics.exe 848 devbodloc.exe 2356 ae977b1ddc2cff1496ef09a2162bf3b0_NeikiAnalytics.exe 848 devbodloc.exe 2356 ae977b1ddc2cff1496ef09a2162bf3b0_NeikiAnalytics.exe 848 devbodloc.exe 2356 ae977b1ddc2cff1496ef09a2162bf3b0_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2356 wrote to memory of 848 2356 ae977b1ddc2cff1496ef09a2162bf3b0_NeikiAnalytics.exe 28 PID 2356 wrote to memory of 848 2356 ae977b1ddc2cff1496ef09a2162bf3b0_NeikiAnalytics.exe 28 PID 2356 wrote to memory of 848 2356 ae977b1ddc2cff1496ef09a2162bf3b0_NeikiAnalytics.exe 28 PID 2356 wrote to memory of 848 2356 ae977b1ddc2cff1496ef09a2162bf3b0_NeikiAnalytics.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\ae977b1ddc2cff1496ef09a2162bf3b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\ae977b1ddc2cff1496ef09a2162bf3b0_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\SysDrv61\devbodloc.exeC:\SysDrv61\devbodloc.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:848
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD5bb9ceb88dd17248cbab7372fd1c93f61
SHA171305bd691812789a1115dffc31bba836df6f46b
SHA256d20cf59b1bebf1a4741fdb9e6e2cf1bbc2c905199abfe05c9f0879fecf3bb5f2
SHA512351ab5bcd0dbdd7060135bf1faa8d94108508dbff92a8797b8a21545629af3a59b70943259a64941b85131c1fba0932003eec6e4a8e428983f8f684fa8dff783
-
Filesize
204B
MD526232e47c4b55a5584d3c6b964cd551b
SHA12963ee1139fb88506559904f9ccd5bffa9333a00
SHA25670778b4b34e84f83a57ee051c09ed9a34b2bdfdab7106bc45d9352960b283303
SHA5123d1ef8333a1103c158bbfc382653a69fd0b560f85b7f7123f95130f44265d3b86df660c04f2fbccecf7e06732848886206c44a5953093d68d90ac7cebaefedc5
-
Filesize
2.7MB
MD5f793a4c2eaaae9976cdb0f59df4cf997
SHA1c6ba39f2675ef18c80a4296171898a9f428a8af3
SHA2564bd1bde472269fb5eef10848270d99c1558cac11bc2e06864ff5b14da57dbd3e
SHA5120819a640926f377534bb860fbdb8df96ed794b467b67f57b48051cdf4240b44d80bb13512cfc8829372a6d474055b79898ff44172210d75858a5d42916ecf112