Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
30/05/2024, 01:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5f508d9d49b2747c0b1152a70da3a2b0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
5f508d9d49b2747c0b1152a70da3a2b0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 5f508d9d49b2747c0b1152a70da3a2b0_NeikiAnalytics.exe
- Size 2.7MB
- Sample240530-b8hvrabb74
- SHA256 16fd0cee353006bbf7000281bf335bad347207adaba23433ecdcfe5edaa7bd78
- MD5 5f508d9d49b2747c0b1152a70da3a2b0
- SHA1 f76acd99087977d782b25b96b683c43dc2bdbd0c
- SHA512 a10addbff21a1e9bcf1fa0e9db4811d3deec5712e7b6354e15d5b758665bb0fa7cbfbb6bf1535031705153760327e0810843b0fc1c6a554df52685cfcf12b34a
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBe9w4Sx:+R0pI/IQlUoMPdmpSp04
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3056 abodsys.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\UserDotV2\\abodsys.exe" 5f508d9d49b2747c0b1152a70da3a2b0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\MintOT\\bodaloc.exe" 5f508d9d49b2747c0b1152a70da3a2b0_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1428 5f508d9d49b2747c0b1152a70da3a2b0_NeikiAnalytics.exe 1428 5f508d9d49b2747c0b1152a70da3a2b0_NeikiAnalytics.exe 1428 5f508d9d49b2747c0b1152a70da3a2b0_NeikiAnalytics.exe 1428 5f508d9d49b2747c0b1152a70da3a2b0_NeikiAnalytics.exe 3056 abodsys.exe 3056 abodsys.exe 1428 5f508d9d49b2747c0b1152a70da3a2b0_NeikiAnalytics.exe 1428 5f508d9d49b2747c0b1152a70da3a2b0_NeikiAnalytics.exe 3056 abodsys.exe 3056 abodsys.exe 1428 5f508d9d49b2747c0b1152a70da3a2b0_NeikiAnalytics.exe 1428 5f508d9d49b2747c0b1152a70da3a2b0_NeikiAnalytics.exe 3056 abodsys.exe 3056 abodsys.exe 1428 5f508d9d49b2747c0b1152a70da3a2b0_NeikiAnalytics.exe 1428 5f508d9d49b2747c0b1152a70da3a2b0_NeikiAnalytics.exe 3056 abodsys.exe 3056 abodsys.exe 1428 5f508d9d49b2747c0b1152a70da3a2b0_NeikiAnalytics.exe 1428 5f508d9d49b2747c0b1152a70da3a2b0_NeikiAnalytics.exe 3056 abodsys.exe 3056 abodsys.exe 1428 5f508d9d49b2747c0b1152a70da3a2b0_NeikiAnalytics.exe 1428 5f508d9d49b2747c0b1152a70da3a2b0_NeikiAnalytics.exe 3056 abodsys.exe 3056 abodsys.exe 1428 5f508d9d49b2747c0b1152a70da3a2b0_NeikiAnalytics.exe 1428 5f508d9d49b2747c0b1152a70da3a2b0_NeikiAnalytics.exe 3056 abodsys.exe 3056 abodsys.exe 1428 5f508d9d49b2747c0b1152a70da3a2b0_NeikiAnalytics.exe 1428 5f508d9d49b2747c0b1152a70da3a2b0_NeikiAnalytics.exe 3056 abodsys.exe 3056 abodsys.exe 1428 5f508d9d49b2747c0b1152a70da3a2b0_NeikiAnalytics.exe 1428 5f508d9d49b2747c0b1152a70da3a2b0_NeikiAnalytics.exe 3056 abodsys.exe 3056 abodsys.exe 1428 5f508d9d49b2747c0b1152a70da3a2b0_NeikiAnalytics.exe 1428 5f508d9d49b2747c0b1152a70da3a2b0_NeikiAnalytics.exe 3056 abodsys.exe 3056 abodsys.exe 1428 5f508d9d49b2747c0b1152a70da3a2b0_NeikiAnalytics.exe 1428 5f508d9d49b2747c0b1152a70da3a2b0_NeikiAnalytics.exe 3056 abodsys.exe 3056 abodsys.exe 1428 5f508d9d49b2747c0b1152a70da3a2b0_NeikiAnalytics.exe 1428 5f508d9d49b2747c0b1152a70da3a2b0_NeikiAnalytics.exe 3056 abodsys.exe 3056 abodsys.exe 1428 5f508d9d49b2747c0b1152a70da3a2b0_NeikiAnalytics.exe 1428 5f508d9d49b2747c0b1152a70da3a2b0_NeikiAnalytics.exe 3056 abodsys.exe 3056 abodsys.exe 1428 5f508d9d49b2747c0b1152a70da3a2b0_NeikiAnalytics.exe 1428 5f508d9d49b2747c0b1152a70da3a2b0_NeikiAnalytics.exe 3056 abodsys.exe 3056 abodsys.exe 1428 5f508d9d49b2747c0b1152a70da3a2b0_NeikiAnalytics.exe 1428 5f508d9d49b2747c0b1152a70da3a2b0_NeikiAnalytics.exe 3056 abodsys.exe 3056 abodsys.exe 1428 5f508d9d49b2747c0b1152a70da3a2b0_NeikiAnalytics.exe 1428 5f508d9d49b2747c0b1152a70da3a2b0_NeikiAnalytics.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1428 wrote to memory of 3056 1428 5f508d9d49b2747c0b1152a70da3a2b0_NeikiAnalytics.exe 87 PID 1428 wrote to memory of 3056 1428 5f508d9d49b2747c0b1152a70da3a2b0_NeikiAnalytics.exe 87 PID 1428 wrote to memory of 3056 1428 5f508d9d49b2747c0b1152a70da3a2b0_NeikiAnalytics.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f508d9d49b2747c0b1152a70da3a2b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5f508d9d49b2747c0b1152a70da3a2b0_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\UserDotV2\abodsys.exeC:\UserDotV2\abodsys.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3056
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\MintOT\bodaloc.exe
- Size 25KB
- SHA256 49c3175f676bfb91b578d248b72386d1238bd37e982918c02dfe6e10dc376777
- MD5 c7029369c014b701af5519cf91eec60b
- SHA1 f90f11ecbb69f11bdee61486d016cb5434d31f48
- SHA512 7c3b07bea20568ba916d8e2d68b9bd4d5ee97e72f00cda271e84ef59944b2562e31249c84511027af6d1f3d6e725a86c6524a3264e9bc72a0a895c3cbc1b0f2e
- SSDEEP 384:PLT5lDnYcy/ES70S7Tq6xRVtLiD1APk/7zJRKahcO8oRZz:PLT5ZRHUj7TRxRVED1bHKFO33
- MD5 SHA1 SHA512 SSDEEP
- Path C:\UserDotV2\abodsys.exe
- Size 2.7MB
- SHA256 6d68ffe741e5adf23d86bb68942cd68d72afd568bb1bd9ec1d674e3e378789ca
- MD5 c3e43f78a04420a3a77f1028b81176b3
- SHA1 9783b0064394b1e0439e4bcd891f81fc4c2451e0
- SHA512 f8e1036955d603ff7c35fb1ff7bbfb0b09ad0182544234bb6629922a2f31446a86083660f9f1ec91eed5d7f5ac4f9a29b632f133bbd19c94dafa040cc502ca65
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBq9w4Sx:+R0pI/IQlUoMPdmpSpY4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 201B
- SHA256 a7b98f8cc2e58b423d93b02a4db008fa228ba3767314364beb71a4efc965aee6
- MD5 f8870877f23abddfd488631100fb1d3b
- SHA1 b61d112d2fded880506ebdc154d3040324cbc84e
- SHA512 2f56aed13ab4874a0a8f11edbd91ac04d277f20207464642437fe74774921d632b00efb9e2f78b6c4b0685fe1aa233ac6387373be588a7064148fa80f37f8365
- MD5 SHA1 SHA512