2a8850f3f16ec611d68d80d8d677d9cb23e7eecd08ff6006a0f98445f49cd8e6

Analysis

max time kernel
149s
max time network
120s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 23:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0dc5d6e66d99d3360d8bd0baf50bc8e0_NeikiAnalytics.exe
Size

2.7MB
MD5

0dc5d6e66d99d3360d8bd0baf50bc8e0
SHA1

92de0729f05279b9b67776fbf37ca0a605c217fb
SHA256

2a8850f3f16ec611d68d80d8d677d9cb23e7eecd08ff6006a0f98445f49cd8e6
SHA512

fa0528c4173ca158031d84e5990b29fcc541e2af3d6dae4fe15056c579d21d5741c6237ba53b65df152c533adb43bc2d1cae5f52c607c550eef344b368d791c6
SSDEEP

49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBR9w4Sx:+R0pI/IQlUoMPdmpSpF4

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
108	xdobsys.exe

Loads dropped DLL 1 IoCs

pid	Process
2320	0dc5d6e66d99d3360d8bd0baf50bc8e0_NeikiAnalytics.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\FilesT9\\xdobsys.exe"	0dc5d6e66d99d3360d8bd0baf50bc8e0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\VidCW\\bodxloc.exe"	0dc5d6e66d99d3360d8bd0baf50bc8e0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2320	0dc5d6e66d99d3360d8bd0baf50bc8e0_NeikiAnalytics.exe
2320	0dc5d6e66d99d3360d8bd0baf50bc8e0_NeikiAnalytics.exe
108	xdobsys.exe
2320	0dc5d6e66d99d3360d8bd0baf50bc8e0_NeikiAnalytics.exe
108	xdobsys.exe
2320	0dc5d6e66d99d3360d8bd0baf50bc8e0_NeikiAnalytics.exe
108	xdobsys.exe
2320	0dc5d6e66d99d3360d8bd0baf50bc8e0_NeikiAnalytics.exe
108	xdobsys.exe
2320	0dc5d6e66d99d3360d8bd0baf50bc8e0_NeikiAnalytics.exe
108	xdobsys.exe
2320	0dc5d6e66d99d3360d8bd0baf50bc8e0_NeikiAnalytics.exe
108	xdobsys.exe
2320	0dc5d6e66d99d3360d8bd0baf50bc8e0_NeikiAnalytics.exe
108	xdobsys.exe
2320	0dc5d6e66d99d3360d8bd0baf50bc8e0_NeikiAnalytics.exe
108	xdobsys.exe
2320	0dc5d6e66d99d3360d8bd0baf50bc8e0_NeikiAnalytics.exe
108	xdobsys.exe
2320	0dc5d6e66d99d3360d8bd0baf50bc8e0_NeikiAnalytics.exe
108	xdobsys.exe
2320	0dc5d6e66d99d3360d8bd0baf50bc8e0_NeikiAnalytics.exe
108	xdobsys.exe
2320	0dc5d6e66d99d3360d8bd0baf50bc8e0_NeikiAnalytics.exe
108	xdobsys.exe
2320	0dc5d6e66d99d3360d8bd0baf50bc8e0_NeikiAnalytics.exe
108	xdobsys.exe
2320	0dc5d6e66d99d3360d8bd0baf50bc8e0_NeikiAnalytics.exe
108	xdobsys.exe
2320	0dc5d6e66d99d3360d8bd0baf50bc8e0_NeikiAnalytics.exe
108	xdobsys.exe
2320	0dc5d6e66d99d3360d8bd0baf50bc8e0_NeikiAnalytics.exe
108	xdobsys.exe
2320	0dc5d6e66d99d3360d8bd0baf50bc8e0_NeikiAnalytics.exe
108	xdobsys.exe
2320	0dc5d6e66d99d3360d8bd0baf50bc8e0_NeikiAnalytics.exe
108	xdobsys.exe
2320	0dc5d6e66d99d3360d8bd0baf50bc8e0_NeikiAnalytics.exe
108	xdobsys.exe
2320	0dc5d6e66d99d3360d8bd0baf50bc8e0_NeikiAnalytics.exe
108	xdobsys.exe
2320	0dc5d6e66d99d3360d8bd0baf50bc8e0_NeikiAnalytics.exe
108	xdobsys.exe
2320	0dc5d6e66d99d3360d8bd0baf50bc8e0_NeikiAnalytics.exe
108	xdobsys.exe
2320	0dc5d6e66d99d3360d8bd0baf50bc8e0_NeikiAnalytics.exe
108	xdobsys.exe
2320	0dc5d6e66d99d3360d8bd0baf50bc8e0_NeikiAnalytics.exe
108	xdobsys.exe
2320	0dc5d6e66d99d3360d8bd0baf50bc8e0_NeikiAnalytics.exe
108	xdobsys.exe
2320	0dc5d6e66d99d3360d8bd0baf50bc8e0_NeikiAnalytics.exe
108	xdobsys.exe
2320	0dc5d6e66d99d3360d8bd0baf50bc8e0_NeikiAnalytics.exe
108	xdobsys.exe
2320	0dc5d6e66d99d3360d8bd0baf50bc8e0_NeikiAnalytics.exe
108	xdobsys.exe
2320	0dc5d6e66d99d3360d8bd0baf50bc8e0_NeikiAnalytics.exe
108	xdobsys.exe
2320	0dc5d6e66d99d3360d8bd0baf50bc8e0_NeikiAnalytics.exe
108	xdobsys.exe
2320	0dc5d6e66d99d3360d8bd0baf50bc8e0_NeikiAnalytics.exe
108	xdobsys.exe
2320	0dc5d6e66d99d3360d8bd0baf50bc8e0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 108	2320	0dc5d6e66d99d3360d8bd0baf50bc8e0_NeikiAnalytics.exe	28
PID 2320 wrote to memory of 108	2320	0dc5d6e66d99d3360d8bd0baf50bc8e0_NeikiAnalytics.exe	28
PID 2320 wrote to memory of 108	2320	0dc5d6e66d99d3360d8bd0baf50bc8e0_NeikiAnalytics.exe	28
PID 2320 wrote to memory of 108	2320	0dc5d6e66d99d3360d8bd0baf50bc8e0_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\0dc5d6e66d99d3360d8bd0baf50bc8e0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0dc5d6e66d99d3360d8bd0baf50bc8e0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2320
- C:\FilesT9\xdobsys.exe
  C:\FilesT9\xdobsys.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\253086396416_6.1_Admin.ini

Filesize
198B

MD5
ea6d7414b2e31e50a8356508e27e094e

SHA1
2528d0c4735ed20c31ad31fd2fd99c2185227116

SHA256
a827115a2791704ae9611fc5f12eb106cd8e6cd2191501f6dec9241519252858

SHA512
c6a72cd523a55c75bef5a87ab52d286c92966dc2b7f9710c273385717da89439029a0afedf840c0584fa678f9e24753b5b2f859a88758fea8aaae95fec84af4e

Download Submit
C:\VidCW\bodxloc.exe

Filesize
2.7MB

MD5
993d6064260361834ad640a31dcd89d2

SHA1
4b536d3599f1fb91d88cbd30c405be2cb7495b5a

SHA256
6becd3e3ab09404822caefc05923bd7a6170d942fe9ec57d0517bea243f13999

SHA512
12940e356fc0add511575b65b96695733227b0e390085e854cfdee410216cfef906c325dc95b9d650adff4f20c15922f7dece2cde2b7f1f86a22bf5a6c04089f

Download Submit
\FilesT9\xdobsys.exe

Filesize
2.7MB

MD5
8fd3a1c80e2c23dbdcede26095184766

SHA1
1e934c3e8b94f0029fc09a6dfc8f578d220ee206

SHA256
63160f32c10cc1173a2a91982ac939389fad0c927fac2e7c14cce971013e8a91

SHA512
957996a4ec809c69045df21735ede7a359dad14bd02f74611f5da7938a53498dd38adabbc5e9723b489c9a16eaea81122e66be6840a23f20ee758c32a867ff27

Download Submit