Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
26/05/2024, 07:14
Static task
static1
Behavioral task
behavioral1
Sample
85782863a1699d9dba449b7affd51940_NeikiAnalytics.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
85782863a1699d9dba449b7affd51940_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
General
-
Target
85782863a1699d9dba449b7affd51940_NeikiAnalytics.exe
-
Size
4.1MB
-
MD5
85782863a1699d9dba449b7affd51940
-
SHA1
9e7bebb2e5bab28250683d15a6d30c572ee2f0f7
-
SHA256
b1a6c4faf48eb2d00355d976c3314d8cfd16408799c2411cb440d7ffd59f60b7
-
SHA512
f1e228709a95970e48b95bf26499899537e482d300d6193ada57077501615becae8b283c7ee0b192a0dc31b92319a8028f2d84d865bd19b869d50863370d5146
-
SSDEEP
98304:+R0pI/IQlUoMPdmpSp34ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdm05n9klRKN41v
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2216 abodec.exe -
Loads dropped DLL 1 IoCs
pid Process 384 85782863a1699d9dba449b7affd51940_NeikiAnalytics.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\UserDot12\\abodec.exe" 85782863a1699d9dba449b7affd51940_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\GalaxNH\\bodxsys.exe" 85782863a1699d9dba449b7affd51940_NeikiAnalytics.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 384 85782863a1699d9dba449b7affd51940_NeikiAnalytics.exe 384 85782863a1699d9dba449b7affd51940_NeikiAnalytics.exe 2216 abodec.exe 384 85782863a1699d9dba449b7affd51940_NeikiAnalytics.exe 2216 abodec.exe 384 85782863a1699d9dba449b7affd51940_NeikiAnalytics.exe 2216 abodec.exe 384 85782863a1699d9dba449b7affd51940_NeikiAnalytics.exe 2216 abodec.exe 384 85782863a1699d9dba449b7affd51940_NeikiAnalytics.exe 2216 abodec.exe 384 85782863a1699d9dba449b7affd51940_NeikiAnalytics.exe 2216 abodec.exe 384 85782863a1699d9dba449b7affd51940_NeikiAnalytics.exe 2216 abodec.exe 384 85782863a1699d9dba449b7affd51940_NeikiAnalytics.exe 2216 abodec.exe 384 85782863a1699d9dba449b7affd51940_NeikiAnalytics.exe 2216 abodec.exe 384 85782863a1699d9dba449b7affd51940_NeikiAnalytics.exe 2216 abodec.exe 384 85782863a1699d9dba449b7affd51940_NeikiAnalytics.exe 2216 abodec.exe 384 85782863a1699d9dba449b7affd51940_NeikiAnalytics.exe 2216 abodec.exe 384 85782863a1699d9dba449b7affd51940_NeikiAnalytics.exe 2216 abodec.exe 384 85782863a1699d9dba449b7affd51940_NeikiAnalytics.exe 2216 abodec.exe 384 85782863a1699d9dba449b7affd51940_NeikiAnalytics.exe 2216 abodec.exe 384 85782863a1699d9dba449b7affd51940_NeikiAnalytics.exe 2216 abodec.exe 384 85782863a1699d9dba449b7affd51940_NeikiAnalytics.exe 2216 abodec.exe 384 85782863a1699d9dba449b7affd51940_NeikiAnalytics.exe 2216 abodec.exe 384 85782863a1699d9dba449b7affd51940_NeikiAnalytics.exe 2216 abodec.exe 384 85782863a1699d9dba449b7affd51940_NeikiAnalytics.exe 2216 abodec.exe 384 85782863a1699d9dba449b7affd51940_NeikiAnalytics.exe 2216 abodec.exe 384 85782863a1699d9dba449b7affd51940_NeikiAnalytics.exe 2216 abodec.exe 384 85782863a1699d9dba449b7affd51940_NeikiAnalytics.exe 2216 abodec.exe 384 85782863a1699d9dba449b7affd51940_NeikiAnalytics.exe 2216 abodec.exe 384 85782863a1699d9dba449b7affd51940_NeikiAnalytics.exe 2216 abodec.exe 384 85782863a1699d9dba449b7affd51940_NeikiAnalytics.exe 2216 abodec.exe 384 85782863a1699d9dba449b7affd51940_NeikiAnalytics.exe 2216 abodec.exe 384 85782863a1699d9dba449b7affd51940_NeikiAnalytics.exe 2216 abodec.exe 384 85782863a1699d9dba449b7affd51940_NeikiAnalytics.exe 2216 abodec.exe 384 85782863a1699d9dba449b7affd51940_NeikiAnalytics.exe 2216 abodec.exe 384 85782863a1699d9dba449b7affd51940_NeikiAnalytics.exe 2216 abodec.exe 384 85782863a1699d9dba449b7affd51940_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 384 wrote to memory of 2216 384 85782863a1699d9dba449b7affd51940_NeikiAnalytics.exe 28 PID 384 wrote to memory of 2216 384 85782863a1699d9dba449b7affd51940_NeikiAnalytics.exe 28 PID 384 wrote to memory of 2216 384 85782863a1699d9dba449b7affd51940_NeikiAnalytics.exe 28 PID 384 wrote to memory of 2216 384 85782863a1699d9dba449b7affd51940_NeikiAnalytics.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\85782863a1699d9dba449b7affd51940_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\85782863a1699d9dba449b7affd51940_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:384 -
C:\UserDot12\abodec.exeC:\UserDot12\abodec.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2216
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.1MB
MD56bf4ee6ee4a9282c280a6427651c5bc5
SHA132f223c5cc7c4935e3e57ede9d984f35ff02b7a9
SHA256d0dd5fc8962667a9fdf57bc40e4211c30a63641584fa08d37e6d5985a2f514bd
SHA51212f9573119307fe94f9263eb9edd7251902649bd483e1457f5bf6a2084798b14e6be23a58b9821bc37c139d049d43b3a59c638166e0634f6ae8580714bd78c4f
-
Filesize
205B
MD5e8cbd66b5d54201afbfa3e68bd8995f8
SHA1f5cf6fea2d31cd9e2aba1cec434e5b955bb6a0c4
SHA256876147670bd97842f93878e1a2171718dad5bf81c7d041243bcb414fc9906b4c
SHA5123c58f95dbc5805211f5a439915ef642a2d440903c42fc8df1b15a7ad98dfe71e0df67c76a6144491b9fee0491bc80f2a15e2751cdd3b37baf4e7d02ede2f8b90
-
Filesize
4.1MB
MD510981baa74b5c244e44d5066357bb513
SHA1f8a0e5018261cc85df24e812451dd1f484bfe6ff
SHA25620649b73bbf9a20badf79afc109ac3b6a81b585587f690485fe6804d0dafe3df
SHA512b8402cc1a56815d688441670337ea18f744a5db3ebbb83a81c32530d9150cca3e70baf0f27223ea682856d849a29eca36b38c325e3b867eb6ff9a7d94eefb3b9