c45ad9153b79145c5f7932d7269f6b18edceb74e117a87e86caf7336b345d55b

Analysis

max time kernel
149s
max time network
120s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
27-05-2024 03:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1bc758fa1ec126076ec15abd63378f80_NeikiAnalytics.exe
Size

4.1MB
MD5

1bc758fa1ec126076ec15abd63378f80
SHA1

b564780725917340c22273cee8e4c16f9c1fab44
SHA256

c45ad9153b79145c5f7932d7269f6b18edceb74e117a87e86caf7336b345d55b
SHA512

b250511820c623eb60fd2ad5d76b2a281b1823358dd9206fb999f276ae16545974ea4e897596fb80e98df1aa8ccc9ba01c705f280246c10552ced507de80aaa5
SSDEEP

98304:+R0pI/IQlUoMPdmpSpn4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdm85n9klRKN41v

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1224	xbodsys.exe

Loads dropped DLL 1 IoCs

pid	Process
2180	1bc758fa1ec126076ec15abd63378f80_NeikiAnalytics.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\FilesEP\\xbodsys.exe"	1bc758fa1ec126076ec15abd63378f80_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\LabZIH\\dobdevsys.exe"	1bc758fa1ec126076ec15abd63378f80_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2180	1bc758fa1ec126076ec15abd63378f80_NeikiAnalytics.exe
2180	1bc758fa1ec126076ec15abd63378f80_NeikiAnalytics.exe
1224	xbodsys.exe
2180	1bc758fa1ec126076ec15abd63378f80_NeikiAnalytics.exe
1224	xbodsys.exe
2180	1bc758fa1ec126076ec15abd63378f80_NeikiAnalytics.exe
1224	xbodsys.exe
2180	1bc758fa1ec126076ec15abd63378f80_NeikiAnalytics.exe
1224	xbodsys.exe
2180	1bc758fa1ec126076ec15abd63378f80_NeikiAnalytics.exe
1224	xbodsys.exe
2180	1bc758fa1ec126076ec15abd63378f80_NeikiAnalytics.exe
1224	xbodsys.exe
2180	1bc758fa1ec126076ec15abd63378f80_NeikiAnalytics.exe
1224	xbodsys.exe
2180	1bc758fa1ec126076ec15abd63378f80_NeikiAnalytics.exe
1224	xbodsys.exe
2180	1bc758fa1ec126076ec15abd63378f80_NeikiAnalytics.exe
1224	xbodsys.exe
2180	1bc758fa1ec126076ec15abd63378f80_NeikiAnalytics.exe
1224	xbodsys.exe
2180	1bc758fa1ec126076ec15abd63378f80_NeikiAnalytics.exe
1224	xbodsys.exe
2180	1bc758fa1ec126076ec15abd63378f80_NeikiAnalytics.exe
1224	xbodsys.exe
2180	1bc758fa1ec126076ec15abd63378f80_NeikiAnalytics.exe
1224	xbodsys.exe
2180	1bc758fa1ec126076ec15abd63378f80_NeikiAnalytics.exe
1224	xbodsys.exe
2180	1bc758fa1ec126076ec15abd63378f80_NeikiAnalytics.exe
1224	xbodsys.exe
2180	1bc758fa1ec126076ec15abd63378f80_NeikiAnalytics.exe
1224	xbodsys.exe
2180	1bc758fa1ec126076ec15abd63378f80_NeikiAnalytics.exe
1224	xbodsys.exe
2180	1bc758fa1ec126076ec15abd63378f80_NeikiAnalytics.exe
1224	xbodsys.exe
2180	1bc758fa1ec126076ec15abd63378f80_NeikiAnalytics.exe
1224	xbodsys.exe
2180	1bc758fa1ec126076ec15abd63378f80_NeikiAnalytics.exe
1224	xbodsys.exe
2180	1bc758fa1ec126076ec15abd63378f80_NeikiAnalytics.exe
1224	xbodsys.exe
2180	1bc758fa1ec126076ec15abd63378f80_NeikiAnalytics.exe
1224	xbodsys.exe
2180	1bc758fa1ec126076ec15abd63378f80_NeikiAnalytics.exe
1224	xbodsys.exe
2180	1bc758fa1ec126076ec15abd63378f80_NeikiAnalytics.exe
1224	xbodsys.exe
2180	1bc758fa1ec126076ec15abd63378f80_NeikiAnalytics.exe
1224	xbodsys.exe
2180	1bc758fa1ec126076ec15abd63378f80_NeikiAnalytics.exe
1224	xbodsys.exe
2180	1bc758fa1ec126076ec15abd63378f80_NeikiAnalytics.exe
1224	xbodsys.exe
2180	1bc758fa1ec126076ec15abd63378f80_NeikiAnalytics.exe
1224	xbodsys.exe
2180	1bc758fa1ec126076ec15abd63378f80_NeikiAnalytics.exe
1224	xbodsys.exe
2180	1bc758fa1ec126076ec15abd63378f80_NeikiAnalytics.exe
1224	xbodsys.exe
2180	1bc758fa1ec126076ec15abd63378f80_NeikiAnalytics.exe
1224	xbodsys.exe
2180	1bc758fa1ec126076ec15abd63378f80_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 1224	2180	1bc758fa1ec126076ec15abd63378f80_NeikiAnalytics.exe	28
PID 2180 wrote to memory of 1224	2180	1bc758fa1ec126076ec15abd63378f80_NeikiAnalytics.exe	28
PID 2180 wrote to memory of 1224	2180	1bc758fa1ec126076ec15abd63378f80_NeikiAnalytics.exe	28
PID 2180 wrote to memory of 1224	2180	1bc758fa1ec126076ec15abd63378f80_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\1bc758fa1ec126076ec15abd63378f80_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\1bc758fa1ec126076ec15abd63378f80_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2180
- C:\FilesEP\xbodsys.exe
  C:\FilesEP\xbodsys.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\LabZIH\dobdevsys.exe

Filesize
4.1MB

MD5
abd5b1ffb77adf5987bf78051e025245

SHA1
f2c5ad198e85ed148710ed4ece7e684f94af214e

SHA256
c9c792af068280fa09bd65060b6f2bc9e68b37712356402a376aeec323498bbc

SHA512
7525b3055dc7ce2875a0afafccde85a7266d0bdad8b1b7c880351af23d1628246b168d2d2bc4058ddb18a2e58e7a95cbf605719c97a1c66927f4441b753afb08

Download Submit
C:\Users\Admin\253086396416_6.1_Admin.ini

Filesize
202B

MD5
eaf26a010195af2d7009bbfaf9f539ef

SHA1
93ab84cef63168ada52e91ad2a4a5cdc11ccc07d

SHA256
c22d23a3ff5902c53010b09ace8dbad8320fe22a08bb89b87da14ef8afa26c1f

SHA512
d4853f08f61e4d1735171d79e762061c8bbc88924715afefeba33d4e59ba6f89eac3fc34f8f7443f372ac0563050a6d32769ffd6f1e03829821e34f51d2a8306

Download Submit
\FilesEP\xbodsys.exe

Filesize
4.1MB

MD5
8f80550200a0725c65c94eb7083d4d44

SHA1
b2acddf3f45684ff7bb1d9bda78aac0c2a731820

SHA256
938ca617fd43648b169b9a31dd077a476448c8a489ae77beef7bbf3d33282801

SHA512
a73b70aa5e0ee0621423577adcef3f08b954d2406c7c5e2434346a2b318da2023360fe573f330c0ff1c278d831c225a12b2dd7bf6621d165db213734dadc7066

Download Submit