Analysis
- max time kernel
149s - max time network
122s - platform
windows7_x64 - resource
win7-20240220-en - resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system - submitted
30/05/2024, 03:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
62045b45bfdecbad21681ffd4d7d92a0_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
62045b45bfdecbad21681ffd4d7d92a0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 62045b45bfdecbad21681ffd4d7d92a0_NeikiAnalytics.exe
- Size 4.1MB
- Sample240530-dp8ceadc94
- SHA256 cb54b97edbb4a806f6bdd92f7f3b5ebf17304e72d5a00360facf25ad4ea58c91
- MD5 62045b45bfdecbad21681ffd4d7d92a0
- SHA1 7685d14a7c8b56b845e01802a5b2b25f2b8453e4
- SHA512 667f2e217fdf9126460d1915bb1d1e5a189328d700f7d2eae63b4715483843b596279a6f2a3a5b42fe733a0821d4786b0e176bb10df58179d8f60011f741b106
- SSDEEP 98304:+R0pI/IQlUoMPdmpSpc4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdmP5n9klRKN41v
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2476 devdobloc.exe - Loads dropped DLL 1 IoCs
pid Process 2184 62045b45bfdecbad21681ffd4d7d92a0_NeikiAnalytics.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\Adobe3M\\devdobloc.exe" 62045b45bfdecbad21681ffd4d7d92a0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\LabZKV\\dobaloc.exe" 62045b45bfdecbad21681ffd4d7d92a0_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2184 62045b45bfdecbad21681ffd4d7d92a0_NeikiAnalytics.exe 2184 62045b45bfdecbad21681ffd4d7d92a0_NeikiAnalytics.exe 2476 devdobloc.exe 2184 62045b45bfdecbad21681ffd4d7d92a0_NeikiAnalytics.exe 2476 devdobloc.exe 2184 62045b45bfdecbad21681ffd4d7d92a0_NeikiAnalytics.exe 2476 devdobloc.exe 2184 62045b45bfdecbad21681ffd4d7d92a0_NeikiAnalytics.exe 2476 devdobloc.exe 2184 62045b45bfdecbad21681ffd4d7d92a0_NeikiAnalytics.exe 2476 devdobloc.exe 2184 62045b45bfdecbad21681ffd4d7d92a0_NeikiAnalytics.exe 2476 devdobloc.exe 2184 62045b45bfdecbad21681ffd4d7d92a0_NeikiAnalytics.exe 2476 devdobloc.exe 2184 62045b45bfdecbad21681ffd4d7d92a0_NeikiAnalytics.exe 2476 devdobloc.exe 2184 62045b45bfdecbad21681ffd4d7d92a0_NeikiAnalytics.exe 2476 devdobloc.exe 2184 62045b45bfdecbad21681ffd4d7d92a0_NeikiAnalytics.exe 2476 devdobloc.exe 2184 62045b45bfdecbad21681ffd4d7d92a0_NeikiAnalytics.exe 2476 devdobloc.exe 2184 62045b45bfdecbad21681ffd4d7d92a0_NeikiAnalytics.exe 2476 devdobloc.exe 2184 62045b45bfdecbad21681ffd4d7d92a0_NeikiAnalytics.exe 2476 devdobloc.exe 2184 62045b45bfdecbad21681ffd4d7d92a0_NeikiAnalytics.exe 2476 devdobloc.exe 2184 62045b45bfdecbad21681ffd4d7d92a0_NeikiAnalytics.exe 2476 devdobloc.exe 2184 62045b45bfdecbad21681ffd4d7d92a0_NeikiAnalytics.exe 2476 devdobloc.exe 2184 62045b45bfdecbad21681ffd4d7d92a0_NeikiAnalytics.exe 2476 devdobloc.exe 2184 62045b45bfdecbad21681ffd4d7d92a0_NeikiAnalytics.exe 2476 devdobloc.exe 2184 62045b45bfdecbad21681ffd4d7d92a0_NeikiAnalytics.exe 2476 devdobloc.exe 2184 62045b45bfdecbad21681ffd4d7d92a0_NeikiAnalytics.exe 2476 devdobloc.exe 2184 62045b45bfdecbad21681ffd4d7d92a0_NeikiAnalytics.exe 2476 devdobloc.exe 2184 62045b45bfdecbad21681ffd4d7d92a0_NeikiAnalytics.exe 2476 devdobloc.exe 2184 62045b45bfdecbad21681ffd4d7d92a0_NeikiAnalytics.exe 2476 devdobloc.exe 2184 62045b45bfdecbad21681ffd4d7d92a0_NeikiAnalytics.exe 2476 devdobloc.exe 2184 62045b45bfdecbad21681ffd4d7d92a0_NeikiAnalytics.exe 2476 devdobloc.exe 2184 62045b45bfdecbad21681ffd4d7d92a0_NeikiAnalytics.exe 2476 devdobloc.exe 2184 62045b45bfdecbad21681ffd4d7d92a0_NeikiAnalytics.exe 2476 devdobloc.exe 2184 62045b45bfdecbad21681ffd4d7d92a0_NeikiAnalytics.exe 2476 devdobloc.exe 2184 62045b45bfdecbad21681ffd4d7d92a0_NeikiAnalytics.exe 2476 devdobloc.exe 2184 62045b45bfdecbad21681ffd4d7d92a0_NeikiAnalytics.exe 2476 devdobloc.exe 2184 62045b45bfdecbad21681ffd4d7d92a0_NeikiAnalytics.exe 2476 devdobloc.exe 2184 62045b45bfdecbad21681ffd4d7d92a0_NeikiAnalytics.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2184 wrote to memory of 2476 2184 62045b45bfdecbad21681ffd4d7d92a0_NeikiAnalytics.exe 28 PID 2184 wrote to memory of 2476 2184 62045b45bfdecbad21681ffd4d7d92a0_NeikiAnalytics.exe 28 PID 2184 wrote to memory of 2476 2184 62045b45bfdecbad21681ffd4d7d92a0_NeikiAnalytics.exe 28 PID 2184 wrote to memory of 2476 2184 62045b45bfdecbad21681ffd4d7d92a0_NeikiAnalytics.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\62045b45bfdecbad21681ffd4d7d92a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\62045b45bfdecbad21681ffd4d7d92a0_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Adobe3M\devdobloc.exeC:\Adobe3M\devdobloc.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2476
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Adobe3M\devdobloc.exe
- Size 4.1MB
- SHA256 4ad535d6c61a7065b49f836c89d7e15d01e537c7fbc61e2f2e229e52db6d60a7
- MD5 a66d7975d58fc8ba65101732d07e25fa
- SHA1 8ea810379b43293f6900f4abe4883c68956b84ca
- SHA512 8412abf23b52d1cc72efc33598da0c4b1798531d2779ab2fd2b042c9b38e20c18e4e959b72b61be3696aceccf42a40a83f2265b9163fe838a4440657ff377a4a
- SSDEEP 98304:+R0pI/IQlUoMPdmpSpo4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdmv5n9klRKN41v
- MD5 SHA1 SHA512 SSDEEP
- Path C:\LabZKV\dobaloc.exe
- Size 4.1MB
- SHA256 07a39682eebaef3f7c65bdc98843c0063fcf0f8877db6763d827b8cd8fb1af75
- MD5 fe0d2440726e3e3c5db54420f96f3cf3
- SHA1 0dccf539dba6609f9aea3db205104d6acb0c69df
- SHA512 6bb7a2c6f498026b866a24ca6c52dc7c9deeb3ca3dcde49c1e72b241cfd3d64c75b5be4191b9bd947520caaa2a9da93a73e3f63274e43df532d77d94a71233c9
- SSDEEP 98304:+R0pI/IQlUoMPdmpSps4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdm35n9klRKN41v
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_6.1_Admin.ini
- Size 204B
- SHA256 f7d7dfc3a75b9abe7f23c69535b0e198ce07b34207abc536ae5b2c84e03d95d7
- MD5 d02b2536a80df7361c1076202638a4fb
- SHA1 1a17ed4dd987e046e51b14de86e90cebdb77c647
- SHA512 9e9d98111734f1b4532ff9f542564a7926f7c29ffe6a5d564a02b820c4f824979f1ac118fc689207650c37f1d41564a8c3b261ff443a8362f69126ee810da2a3
- MD5 SHA1 SHA512