Overview

overview

8

Static

static

3

7b7562a664...cs.exe

windows7-x64

7

7b7562a664...cs.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    140s
  • max time network
    105s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/05/2024, 12:14

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    7b7562a664b649992abd421217f33770_NeikiAnalytics.exe
  • Size 3.9MB
  • Sample240526-pea5psbd4w
  • SHA256 211237395a4e8bc5b9638f7322316705dfff012c7b65a50f214a384e7e1b6345
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
upx

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 7 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7b7562a664b649992abd421217f33770_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\7b7562a664b649992abd421217f33770_NeikiAnalytics.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:224
    • C:\Users\Admin\AppData\Local\Temp\zDosa\zDosa.exe
      "C:\Users\Admin\AppData\Local\Temp\zDosa\zDosa.exe"
      2⤵
      • Drops file in Drivers directory
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious use of SetWindowsHookEx
      PID:372

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        symsrv.dll
        • Path C:\Program Files\Common Files\System\symsrv.dll
        • Size 67KB
        • SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ZMODEM32.dll
        • Path C:\Users\Admin\AppData\Local\Temp\zDosa\ZMODEM32.dll
        • Size 25KB
        • SHA256 a677baf331fd906dccbad1554fc62e08b8899d2bd73ddb06922d1201040e2ac2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        RED33.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\zDosa\audio\acid\RED33.tmp
        • Size 12B
        • SHA256 259ee41304ffe5b974f4006295fc532ec9c5a6fb4dd5ad1d1344f82c09b2be45
        • MD5 SHA1 SHA512
        Submit Download

        dosa.cfg
        • Path C:\Users\Admin\AppData\Local\Temp\zDosa\dosa.cfg
        • Size 20B
        • SHA256 29d291f23504b018cd1e40ceda2d8ad67d0c88636beb181352972675845eb214
        • MD5 SHA1 SHA512
        Submit Download

        dream1.dol
        • Path C:\Users\Admin\AppData\Local\Temp\zDosa\dream1.dol
        • Size 56KB
        • SHA256 4936fa546d7b3fde17b72cb585625d4159e755efeb16167947c0d4cad6bc6edc
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        dream2.dol
        • Path C:\Users\Admin\AppData\Local\Temp\zDosa\dream2.dol
        • Size 508KB
        • SHA256 eb4ce1f57895e90bdfa7391b50a169bae06027ae13c5ebb3483ca966675269d4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        dream3.dol
        • Path C:\Users\Admin\AppData\Local\Temp\zDosa\dream3.dol
        • Size 1.7MB
        • SHA256 d24c48176775937c68301ac36b708938348daa791cdc6345e4790d77c79043d3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        hangul1.fnt
        • Path C:\Users\Admin\AppData\Local\Temp\zDosa\hangul1.fnt
        • Size 11KB
        • SHA256 883f9ac74c48f483bfe0508a71e59d9d2fb8c7a55a9adf2a0a8390650d4a10e3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        zDosa.DB
        • Path C:\Users\Admin\AppData\Local\Temp\zDosa\zDosa.DB
        • Size 2B
        • SHA256 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7
        • MD5 SHA1 SHA512
        Submit Download

        zDosa.exe
        • Path C:\Users\Admin\AppData\Local\Temp\zDosa\zDosa.exe
        • Size 360KB
        • SHA256 96bce6f4d980a47b2bf8c7f0b9372fd790be4713d445411388fa981d6b00778f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        STBMOL.SYS
        • Path C:\Windows\SysWOW64\drivers\STBMOL.SYS
        • Size 32KB
        • SHA256 3542df4a2d3d78307c3ec273ece42f24f026773c8228a7384ed8970f57be81a5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/224-6-0x0000000000401000-0x0000000000405000-memory.dmp
        Download

        memory/224-4-0x0000000010000000-0x0000000010030000-memory.dmp
        Download

        memory/224-191-0x0000000010000000-0x0000000010030000-memory.dmp
        Download