Overview

overview

7

Static

static

3

7d0d9daf2e...cs.exe

windows7-x64

7

7d0d9daf2e...cs.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/05/2024, 20:14

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    7d0d9daf2ed32587d41314c8698ed120_NeikiAnalytics.exe

  • Size

    2.7MB

  • MD5

    7d0d9daf2ed32587d41314c8698ed120

  • SHA1

    d237f72b27982cc552b7a966bee8a5315ce9cb49

  • SHA256

    72c08ad5d224771b59b566f4b9ff221946e597613ecaecbf92ede295942c78d6

  • SHA512

    f8ed3619f26bcfdef900f1f9454dab33bdd451db12df9d56d2801966faf7b1978002af169bc25bb58f1adf050ff7c344c31f82ad1d044bbfa11864647bb2556f

  • SSDEEP

    49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBK9w4Sx:+R0pI/IQlUoMPdmpSp84

Score
7/10
persistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7d0d9daf2ed32587d41314c8698ed120_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\7d0d9daf2ed32587d41314c8698ed120_NeikiAnalytics.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4732
    • C:\IntelprocFL\xdobec.exe
      C:\IntelprocFL\xdobec.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:4492

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\IntelprocFL\xdobec.exe
          Filesize

          2.7MB

          MD5

          4136da2bfe29c3a320d272f348ac4386

          SHA1

          0f8f1055282b54c7ca68d56f75025202a25e855f

          SHA256

          491f7d881b6c4dd76a368381db1301034d23da87d77ccd0b377705a387b07a09

          SHA512

          53285dab2ba770cd36b50a4b5d97f305332b2449895341eaed94e5ac13e991d4dd504317abb966f03bf5f0843543d3eaf630b33c0b1d010f086edac98a85112d

          Download Submit

        • C:\KaVBDJ\boddevsys.exe
          Filesize

          348KB

          MD5

          21f4d0196722807aa0ba406de2dd1cab

          SHA1

          3bb1392c5a60a32c6a1ea02b4ce7e30906bff431

          SHA256

          a4a5aec6e21a687598e1f567e96d4e7200f9b8220a98a836baaca6f24fd5c9c1

          SHA512

          75269185b67d73ac25fe372a304a25fb482558c2d6111ff9dd20ebc65ad43f198e0bd5ffb703dc68a239b3a96e64755a658d910347f63c783dfb62712972b3b4

          Download Submit

        • C:\KaVBDJ\boddevsys.exe
          Filesize

          2.7MB

          MD5

          7644645cc4df011333689a201092ec50

          SHA1

          dbafa94a7a73f05fc11e31becce9ac4b3713ff6f

          SHA256

          17b241286226401b065a7c584165a9856fc443054a5ad2fe785c0bb83d349caa

          SHA512

          51f7b959b2e2a29f36001d1dcc321e044f6bf23af6def7dbfbbbe1b15485d52056a046a53fc533904e4ac8e3875404ae7034b07ff325e93c45d216a00e0adc1d

          Download Submit

        • C:\Users\Admin\253086396416_10.0_Admin.ini
          Filesize

          206B

          MD5

          a0b797ba577540c278c250a539d48a31

          SHA1

          479da207640a0529acb6c496307888abaaef0011

          SHA256

          ec4a59551d697bb5c88ea0339a77310a46f90c1010e76a4f8261ea2ad3f137d4

          SHA512

          6decac1df3609791a30c9301644a2d57afaf37713002c989109b16dd35c3a285dbfc6ee367b799a38baf1fdd110c0a40efce7cbb2e288a970d20c57df2597cbb

          Download Submit