Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29/05/2024, 07:45
Static task
static1
Behavioral task
behavioral1
Sample
4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe
-
Size
2.7MB
-
MD5
4b49d88054efbff37b189fabd922ccb0
-
SHA1
397d0753f427f2936eb8b19c72de4c3c5976c2b4
-
SHA256
22de283c85e7024d2b7678710d4ac6d533e33cac1aaf896016ff421a0971c67c
-
SHA512
27d3ba61bc22db1830a4eb13273bf3b41c3ceeb8cac1505d1ac2638a2ecf065c89f8484aed4b4fcf8279704756e648b98e56ce959e2b0e7817ea1d625b89976b
-
SSDEEP
49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBp9w4Sx:+R0pI/IQlUoMPdmpSpV4
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2552 adobloc.exe -
Loads dropped DLL 1 IoCs
pid Process 2120 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\IntelprocM8\\adobloc.exe" 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\VidCF\\optidevsys.exe" 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2120 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe 2120 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe 2552 adobloc.exe 2120 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe 2552 adobloc.exe 2120 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe 2552 adobloc.exe 2120 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe 2552 adobloc.exe 2120 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe 2552 adobloc.exe 2120 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe 2552 adobloc.exe 2120 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe 2552 adobloc.exe 2120 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe 2552 adobloc.exe 2120 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe 2552 adobloc.exe 2120 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe 2552 adobloc.exe 2120 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe 2552 adobloc.exe 2120 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe 2552 adobloc.exe 2120 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe 2552 adobloc.exe 2120 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe 2552 adobloc.exe 2120 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe 2552 adobloc.exe 2120 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe 2552 adobloc.exe 2120 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe 2552 adobloc.exe 2120 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe 2552 adobloc.exe 2120 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe 2552 adobloc.exe 2120 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe 2552 adobloc.exe 2120 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe 2552 adobloc.exe 2120 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe 2552 adobloc.exe 2120 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe 2552 adobloc.exe 2120 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe 2552 adobloc.exe 2120 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe 2552 adobloc.exe 2120 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe 2552 adobloc.exe 2120 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe 2552 adobloc.exe 2120 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe 2552 adobloc.exe 2120 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe 2552 adobloc.exe 2120 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe 2552 adobloc.exe 2120 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe 2552 adobloc.exe 2120 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2120 wrote to memory of 2552 2120 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe 28 PID 2120 wrote to memory of 2552 2120 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe 28 PID 2120 wrote to memory of 2552 2120 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe 28 PID 2120 wrote to memory of 2552 2120 4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4b49d88054efbff37b189fabd922ccb0_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\IntelprocM8\adobloc.exeC:\IntelprocM8\adobloc.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2552
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
205B
MD5d57c98f5ca7e79622a199c8bdb4db283
SHA1270a9abb33a94830206f659c5117e868d35daa9f
SHA25616780748bdf1a0f9d5ee2df84088a3e5bc5750c1c9c3f28558dcab21b551e0f3
SHA5121523f3c482f64404c2c27144601116527551375baef9f3a652d48db5fd8db97024d7114de36a2ef2698a63bb1473e996730a8ef4ade2766d45b1f3317f0477c6
-
Filesize
2.7MB
MD5c054f22c6789660b028f0dc5d93becd9
SHA16fe381b18dbce95dfef87c8e587c3df636b585f2
SHA256052b7db70ec910a3b34cb746dba5640a15675fa27b3830ea924007ac3332f16c
SHA512cef1323d87f0d3704f1b380271418ca46a4ca78f3d750aa09ce172a97bc88d1f3d73b210dd93aae1355f9d936635d8e387837758cf2d59a9ceaacbb4fbda2ccc
-
Filesize
2.7MB
MD5e1bded21054965778b830a1fe78ef900
SHA1380a55958d904ccbc7997a3190cdfc506ae75778
SHA2563c32b5dc63d840dddd79d03a10daec26f2a6b44009ab2237b283f571cb023a6f
SHA512608f214f3d474c06b5faf6b63c76130236524c231c44959b372a948218f6e2185df6b7de77c613827dc3f60480485e5c1ceef513bb98c12e7a952802a8ef4183