Analysis
- max time kernel
149s - max time network
118s - platform
windows7_x64 - resource
win7-20240508-en - resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system - submitted
30/05/2024, 02:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5fb025b7a2a29318e3e16c50e9106930_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
5fb025b7a2a29318e3e16c50e9106930_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 5fb025b7a2a29318e3e16c50e9106930_NeikiAnalytics.exe
- Size 2.7MB
- Sample240530-cf3vwsbe65
- SHA256 a085480ceece7ee9dc149b5e56b184be459de7f13cd59ec1807d0a4f5cf0c323
- MD5 5fb025b7a2a29318e3e16c50e9106930
- SHA1 ec8ab3f413aa9e1a3badfb91d3eda7e2205e0cbc
- SHA512 601f446b0bde6161edb8e76ac848549da68c8a402511be62dfb9647bde9f9ae8f0173c734e54ca9a15672e5f944d75dbae0c7949a02461f0c388caa91aed371c
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBn9w4Sx:+R0pI/IQlUoMPdmpSp/4
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2424 abodec.exe - Loads dropped DLL 1 IoCs
pid Process 1776 5fb025b7a2a29318e3e16c50e9106930_NeikiAnalytics.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\FilesDL\\abodec.exe" 5fb025b7a2a29318e3e16c50e9106930_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\KaVBHE\\bodaec.exe" 5fb025b7a2a29318e3e16c50e9106930_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1776 5fb025b7a2a29318e3e16c50e9106930_NeikiAnalytics.exe 1776 5fb025b7a2a29318e3e16c50e9106930_NeikiAnalytics.exe 2424 abodec.exe 1776 5fb025b7a2a29318e3e16c50e9106930_NeikiAnalytics.exe 2424 abodec.exe 1776 5fb025b7a2a29318e3e16c50e9106930_NeikiAnalytics.exe 2424 abodec.exe 1776 5fb025b7a2a29318e3e16c50e9106930_NeikiAnalytics.exe 2424 abodec.exe 1776 5fb025b7a2a29318e3e16c50e9106930_NeikiAnalytics.exe 2424 abodec.exe 1776 5fb025b7a2a29318e3e16c50e9106930_NeikiAnalytics.exe 2424 abodec.exe 1776 5fb025b7a2a29318e3e16c50e9106930_NeikiAnalytics.exe 2424 abodec.exe 1776 5fb025b7a2a29318e3e16c50e9106930_NeikiAnalytics.exe 2424 abodec.exe 1776 5fb025b7a2a29318e3e16c50e9106930_NeikiAnalytics.exe 2424 abodec.exe 1776 5fb025b7a2a29318e3e16c50e9106930_NeikiAnalytics.exe 2424 abodec.exe 1776 5fb025b7a2a29318e3e16c50e9106930_NeikiAnalytics.exe 2424 abodec.exe 1776 5fb025b7a2a29318e3e16c50e9106930_NeikiAnalytics.exe 2424 abodec.exe 1776 5fb025b7a2a29318e3e16c50e9106930_NeikiAnalytics.exe 2424 abodec.exe 1776 5fb025b7a2a29318e3e16c50e9106930_NeikiAnalytics.exe 2424 abodec.exe 1776 5fb025b7a2a29318e3e16c50e9106930_NeikiAnalytics.exe 2424 abodec.exe 1776 5fb025b7a2a29318e3e16c50e9106930_NeikiAnalytics.exe 2424 abodec.exe 1776 5fb025b7a2a29318e3e16c50e9106930_NeikiAnalytics.exe 2424 abodec.exe 1776 5fb025b7a2a29318e3e16c50e9106930_NeikiAnalytics.exe 2424 abodec.exe 1776 5fb025b7a2a29318e3e16c50e9106930_NeikiAnalytics.exe 2424 abodec.exe 1776 5fb025b7a2a29318e3e16c50e9106930_NeikiAnalytics.exe 2424 abodec.exe 1776 5fb025b7a2a29318e3e16c50e9106930_NeikiAnalytics.exe 2424 abodec.exe 1776 5fb025b7a2a29318e3e16c50e9106930_NeikiAnalytics.exe 2424 abodec.exe 1776 5fb025b7a2a29318e3e16c50e9106930_NeikiAnalytics.exe 2424 abodec.exe 1776 5fb025b7a2a29318e3e16c50e9106930_NeikiAnalytics.exe 2424 abodec.exe 1776 5fb025b7a2a29318e3e16c50e9106930_NeikiAnalytics.exe 2424 abodec.exe 1776 5fb025b7a2a29318e3e16c50e9106930_NeikiAnalytics.exe 2424 abodec.exe 1776 5fb025b7a2a29318e3e16c50e9106930_NeikiAnalytics.exe 2424 abodec.exe 1776 5fb025b7a2a29318e3e16c50e9106930_NeikiAnalytics.exe 2424 abodec.exe 1776 5fb025b7a2a29318e3e16c50e9106930_NeikiAnalytics.exe 2424 abodec.exe 1776 5fb025b7a2a29318e3e16c50e9106930_NeikiAnalytics.exe 2424 abodec.exe 1776 5fb025b7a2a29318e3e16c50e9106930_NeikiAnalytics.exe 2424 abodec.exe 1776 5fb025b7a2a29318e3e16c50e9106930_NeikiAnalytics.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1776 wrote to memory of 2424 1776 5fb025b7a2a29318e3e16c50e9106930_NeikiAnalytics.exe 28 PID 1776 wrote to memory of 2424 1776 5fb025b7a2a29318e3e16c50e9106930_NeikiAnalytics.exe 28 PID 1776 wrote to memory of 2424 1776 5fb025b7a2a29318e3e16c50e9106930_NeikiAnalytics.exe 28 PID 1776 wrote to memory of 2424 1776 5fb025b7a2a29318e3e16c50e9106930_NeikiAnalytics.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\5fb025b7a2a29318e3e16c50e9106930_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5fb025b7a2a29318e3e16c50e9106930_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\FilesDL\abodec.exeC:\FilesDL\abodec.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2424
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\KaVBHE\bodaec.exe
- Size 2.7MB
- SHA256 0aaa709438d93f2bd90af189d7c96c07df174f259764dcdd5264ca9d37b0c13e
- MD5 83394ec7750728f4a36c65e2e9068b6d
- SHA1 cee962665bbc23a5f92a9faab9e8ede163f25be3
- SHA512 ef2474cec8e38f2277eab656bac47df1841f522bafe993e0e937944e761f66bab5cd43dcf42f77efde182079c53d97ac36148e71f029d142839454ad1cf5ada8
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBi9w4Sx:+R0pI/IQlUoMPdmpSp44
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_6.1_Admin.ini
- Size 200B
- SHA256 2b84350dd718ac8cd071ec7c47a471fd08ff46f8eb9c108b7790a59c8d8a04f5
- MD5 6f809f7388bab51c7e887065bafd87eb
- SHA1 3fdd5bd4b624c4fb5085b541fc9131ae068f0293
- SHA512 e0370ab4c796313376b505312e3671ae9c1659f73fb4cbcd868f625e58fc2ee150af79702791484a4afa106bbf9c5a2b800797ec65adc3d46bb65f079b7ece46
- MD5 SHA1 SHA512
- Path \FilesDL\abodec.exe
- Size 2.7MB
- SHA256 7eeac483e8dc1c34195dcf63ce6e3c9771d040a8b7f654dc552bfecc71a719c4
- MD5 a0212f94fc49dbe2d55c690b11ede71f
- SHA1 90382256b59e8941c09725a1e395eff04a4dfa19
- SHA512 ecb46540e253279d0ee26fd495e6d5c9e1e0f57772c321056c7d3b50acf7104eed09be73d1e5822a5a7ac9f316d45065af4ef98d1bcbc3ff78f50ba0d175d9c3
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LB99w4Sx:+R0pI/IQlUoMPdmpSpx4
- MD5 SHA1 SHA512 SSDEEP