Analysis
-
max time kernel
149s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
29/05/2024, 07:45
Static task
static1
Behavioral task
behavioral1
Sample
4b4d7bd12e6298526586bdef7e46c080_NeikiAnalytics.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
4b4d7bd12e6298526586bdef7e46c080_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
4b4d7bd12e6298526586bdef7e46c080_NeikiAnalytics.exe
-
Size
2.7MB
-
MD5
4b4d7bd12e6298526586bdef7e46c080
-
SHA1
88fec9910f5ec51c112eab1a903dd2a4aa0949a6
-
SHA256
96b2e8e02bda2ac3205a6275ff8d0ed6afc70916e829e2a9b5288af96368a0a4
-
SHA512
5d90d6ced039eb8a4ee53e9e75a327a8b9d5daced9e6fab4c29dd7f5fafab9cbf9ddc0077e36c378b226376a40a2933ff9891d87ed977de67189acb730a3aaa5
-
SSDEEP
49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBP9w4Sx:+R0pI/IQlUoMPdmpSpL4
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2240 devdobec.exe -
Loads dropped DLL 1 IoCs
pid Process 2848 4b4d7bd12e6298526586bdef7e46c080_NeikiAnalytics.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\UserDotBP\\devdobec.exe" 4b4d7bd12e6298526586bdef7e46c080_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\VidD5\\optixec.exe" 4b4d7bd12e6298526586bdef7e46c080_NeikiAnalytics.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2848 4b4d7bd12e6298526586bdef7e46c080_NeikiAnalytics.exe 2848 4b4d7bd12e6298526586bdef7e46c080_NeikiAnalytics.exe 2240 devdobec.exe 2848 4b4d7bd12e6298526586bdef7e46c080_NeikiAnalytics.exe 2240 devdobec.exe 2848 4b4d7bd12e6298526586bdef7e46c080_NeikiAnalytics.exe 2240 devdobec.exe 2848 4b4d7bd12e6298526586bdef7e46c080_NeikiAnalytics.exe 2240 devdobec.exe 2848 4b4d7bd12e6298526586bdef7e46c080_NeikiAnalytics.exe 2240 devdobec.exe 2848 4b4d7bd12e6298526586bdef7e46c080_NeikiAnalytics.exe 2240 devdobec.exe 2848 4b4d7bd12e6298526586bdef7e46c080_NeikiAnalytics.exe 2240 devdobec.exe 2848 4b4d7bd12e6298526586bdef7e46c080_NeikiAnalytics.exe 2240 devdobec.exe 2848 4b4d7bd12e6298526586bdef7e46c080_NeikiAnalytics.exe 2240 devdobec.exe 2848 4b4d7bd12e6298526586bdef7e46c080_NeikiAnalytics.exe 2240 devdobec.exe 2848 4b4d7bd12e6298526586bdef7e46c080_NeikiAnalytics.exe 2240 devdobec.exe 2848 4b4d7bd12e6298526586bdef7e46c080_NeikiAnalytics.exe 2240 devdobec.exe 2848 4b4d7bd12e6298526586bdef7e46c080_NeikiAnalytics.exe 2240 devdobec.exe 2848 4b4d7bd12e6298526586bdef7e46c080_NeikiAnalytics.exe 2240 devdobec.exe 2848 4b4d7bd12e6298526586bdef7e46c080_NeikiAnalytics.exe 2240 devdobec.exe 2848 4b4d7bd12e6298526586bdef7e46c080_NeikiAnalytics.exe 2240 devdobec.exe 2848 4b4d7bd12e6298526586bdef7e46c080_NeikiAnalytics.exe 2240 devdobec.exe 2848 4b4d7bd12e6298526586bdef7e46c080_NeikiAnalytics.exe 2240 devdobec.exe 2848 4b4d7bd12e6298526586bdef7e46c080_NeikiAnalytics.exe 2240 devdobec.exe 2848 4b4d7bd12e6298526586bdef7e46c080_NeikiAnalytics.exe 2240 devdobec.exe 2848 4b4d7bd12e6298526586bdef7e46c080_NeikiAnalytics.exe 2240 devdobec.exe 2848 4b4d7bd12e6298526586bdef7e46c080_NeikiAnalytics.exe 2240 devdobec.exe 2848 4b4d7bd12e6298526586bdef7e46c080_NeikiAnalytics.exe 2240 devdobec.exe 2848 4b4d7bd12e6298526586bdef7e46c080_NeikiAnalytics.exe 2240 devdobec.exe 2848 4b4d7bd12e6298526586bdef7e46c080_NeikiAnalytics.exe 2240 devdobec.exe 2848 4b4d7bd12e6298526586bdef7e46c080_NeikiAnalytics.exe 2240 devdobec.exe 2848 4b4d7bd12e6298526586bdef7e46c080_NeikiAnalytics.exe 2240 devdobec.exe 2848 4b4d7bd12e6298526586bdef7e46c080_NeikiAnalytics.exe 2240 devdobec.exe 2848 4b4d7bd12e6298526586bdef7e46c080_NeikiAnalytics.exe 2240 devdobec.exe 2848 4b4d7bd12e6298526586bdef7e46c080_NeikiAnalytics.exe 2240 devdobec.exe 2848 4b4d7bd12e6298526586bdef7e46c080_NeikiAnalytics.exe 2240 devdobec.exe 2848 4b4d7bd12e6298526586bdef7e46c080_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2848 wrote to memory of 2240 2848 4b4d7bd12e6298526586bdef7e46c080_NeikiAnalytics.exe 28 PID 2848 wrote to memory of 2240 2848 4b4d7bd12e6298526586bdef7e46c080_NeikiAnalytics.exe 28 PID 2848 wrote to memory of 2240 2848 4b4d7bd12e6298526586bdef7e46c080_NeikiAnalytics.exe 28 PID 2848 wrote to memory of 2240 2848 4b4d7bd12e6298526586bdef7e46c080_NeikiAnalytics.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\4b4d7bd12e6298526586bdef7e46c080_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4b4d7bd12e6298526586bdef7e46c080_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\UserDotBP\devdobec.exeC:\UserDotBP\devdobec.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2240
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
202B
MD5a0e2d114d8f017c0ba83b5b93dc24995
SHA12b841af345aa3fa81e77d6bead8544c42dca5fe7
SHA256a4a2b290a04a03c1d15e159768d2681bc40127735fcaa15f7101bc615bdce46f
SHA512d6a5b739d35846ce39e4bbc9ef8ae60b2514b78f0575f0a4a6ed3375a78dcd1fc74af1c689651ef5cd8c085d6b5d5f1b6a1532600bd8a3f133c1ea4e7665ec34
-
Filesize
2.7MB
MD55a6d00bbd2f7663173c034fb53b03b0d
SHA1807536ad20b9aa9412db9f1d05119e1331e0bd47
SHA2562ffad4af46ce59249717e89a619a1ee33946a1f6e70cded39b32128719d98299
SHA5123cfff9fb286d3be46b5920435929f0f0cfe777bf53a42ab58b53b7fd01b71ebc21dfa8e4b00638dabccbe330b0dae6f6bbec3fa41c39ca4a85d061839fc54001
-
Filesize
2.7MB
MD53b123f9131d670c0d484fec9c93e4169
SHA13fa55a4bf0ba0739e10d8a09ba07b4594b4f7441
SHA25630e8e394c573f2f5760b446f0997946d957dd30480fda8365f6024d43b794400
SHA51292bcb2ce0123e0918b9e53659846b4e2eba5690f86813f2af840039a057582d65a8336a73ef99b26eb27323925552302f453e106b82d58b8731fe50e7e17985e