Overview

overview

7

Static

static

3

1bc758fa1e...cs.exe

windows7-x64

7

1bc758fa1e...cs.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/05/2024, 03:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    1bc758fa1ec126076ec15abd63378f80_NeikiAnalytics.exe

  • Size

    4.1MB

  • MD5

    1bc758fa1ec126076ec15abd63378f80

  • SHA1

    b564780725917340c22273cee8e4c16f9c1fab44

  • SHA256

    c45ad9153b79145c5f7932d7269f6b18edceb74e117a87e86caf7336b345d55b

  • SHA512

    b250511820c623eb60fd2ad5d76b2a281b1823358dd9206fb999f276ae16545974ea4e897596fb80e98df1aa8ccc9ba01c705f280246c10552ced507de80aaa5

  • SSDEEP

    98304:+R0pI/IQlUoMPdmpSpn4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdm85n9klRKN41v

Score
7/10
persistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1bc758fa1ec126076ec15abd63378f80_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\1bc758fa1ec126076ec15abd63378f80_NeikiAnalytics.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:824
    • C:\SysDrv2N\devbodec.exe
      C:\SysDrv2N\devbodec.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:3912
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3988 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:3740

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\KaVBM5\boddevec.exe
            Filesize

            4.1MB

            MD5

            1407d84f0b9ada9b277a5748f87f2f54

            SHA1

            040a49d39628cb1165a5fe5401e005fb622b2b6c

            SHA256

            375dd30962508129b0669d71f5da97baf98b5c9a65221425b03bad8f7600284d

            SHA512

            0992bb864939a3de9d1d03fa3bb5a36db77d980a5b6ff69d8b42ea2c5bc980439e43d475fbc5baccf330b8e0f447f694321ddc34638a9046939f09ba397288e1

            Download Submit

          • C:\SysDrv2N\devbodec.exe
            Filesize

            4.1MB

            MD5

            5cf4a725ac8d5460b0e72cf04b44f13a

            SHA1

            628a594e0c067bcfeed140a2829087e8f306e02b

            SHA256

            d3d8506d57831c364100868b857ac4d8135df63a0760fa960f88b080a9524ad7

            SHA512

            506a8f920da650f7345f2fbb2e0192a2caf2c9c5bc6b89ac34489d551ccc8d3371b774ae5fd69fe56fcbeff2bc174d23a330b351eceff104fd19d6985d546f6a

            Download Submit

          • C:\Users\Admin\253086396416_10.0_Admin.ini
            Filesize

            203B

            MD5

            98d79ab2be1ed40839fbc241b546fe62

            SHA1

            030dfb1f0e0aee70535dc73b62add01bddf7ef12

            SHA256

            c9790908d77fadd4d8c98b1d2c7e83f30a9430eb54f4398c5ceb201af3245611

            SHA512

            b9ac2249d5b200e850272cfff9d654b46054eea8c5f5fc76cee349703171fb9c3a041cf0fe92bdf51d7760229b8058633218d666428452d24ac4d7df194f3edc

            Download Submit