Overview

overview

7

Static

static

3

8eaaccdede...cs.exe

windows7-x64

7

8eaaccdede...cs.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    26/05/2024, 19:52

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    8eaaccdedefe4515e62d4d4aa05e9540_NeikiAnalytics.exe

  • Size

    2.7MB

  • MD5

    8eaaccdedefe4515e62d4d4aa05e9540

  • SHA1

    40d04c8fd7fdc15d808993e9c4db126ffe76a227

  • SHA256

    25e5f457b128f25eb61b35890e14eaedbf30efd040085e360544e485e760aecd

  • SHA512

    230f79baace5267495738a8870a153a56cf6c47afd4729a185a173a84a0761c770e994dfbf051baa1ea96c8a85f53b300aeb60d11cc9aa5aee37a360359df2e9

  • SSDEEP

    49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LB+9w4Sx:+R0pI/IQlUoMPdmpSpk4

Score
7/10
persistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8eaaccdedefe4515e62d4d4aa05e9540_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\8eaaccdedefe4515e62d4d4aa05e9540_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2860
    • C:\Files7E\abodec.exe
      C:\Files7E\abodec.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:1996

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\LabZSJ\bodaec.exe
          Filesize

          2.7MB

          MD5

          7baf05f7dbb7cb6a7f573a62cad27ceb

          SHA1

          76f75fd53cb06aa52f5f37ffea0418bef10f15eb

          SHA256

          52dd0db97e9b53ae9c9e1fba91003de753a4b4548a8f9b396feae43d46887b82

          SHA512

          bc9872f6d1462acde1f38535a77beda081620361aaf5aa623f9dec390fe5a437a6dada66fea0bba2c1a5cb59dcacce3e93df248b37dcf2315000d845ba20a768

          Download Submit

        • C:\Users\Admin\253086396416_6.1_Admin.ini
          Filesize

          197B

          MD5

          bbf5a05386d09b60a6634abded6db3cb

          SHA1

          f3cb2b46277650c79669b6a9e62c7c1cebd7fa22

          SHA256

          00b9dbbffd7bcd3e8b10641e2e8a1a0d6d95e2e9eed2ad95940e0fdf1009ba35

          SHA512

          26b9daad7d6d8b7cd749487952c7775764627d190a94eb290fe46889cf32cbb0ad9ab5c98f6e27a807325861032d04100e289faade1bd3928f7cb60418f58083

          Download Submit

        • \Files7E\abodec.exe
          Filesize

          2.7MB

          MD5

          425c58c044bae8a54f87d6ec7e2400a5

          SHA1

          acbba2b33284662e99302911a1dd53347d95475e

          SHA256

          01236506f340334259517b558d90196affe0df00daae8772d6bffe0c9609f046

          SHA512

          14dcaf527f68f93fc9679ff2078ccc1bb1ba7dc2524924b2fc12e0b61ae77f6ddb2d0ef0cfebd3777f464e8acc5d7e29efd49c56c9d5ae74ed8f4de90a8f4339

          Download Submit