d7e982702b213cc9b903da0262c3103a4de3a97513b9e522f711ff1ac594d741

Analysis

max time kernel
149s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
31/05/2024, 04:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

76f247d1a2639b38fdf17b95c8fe2cb0_NeikiAnalytics.exe
Size

2.7MB
MD5

76f247d1a2639b38fdf17b95c8fe2cb0
SHA1

8aa61dd1f1bccdf3ae95d7f953050700c7bbccab
SHA256

d7e982702b213cc9b903da0262c3103a4de3a97513b9e522f711ff1ac594d741
SHA512

6ebff3c85bb992309df26c5c47cebac25eff9b11ef438a09c499d7d05c4a90253d9e42c43c3a9020632cfacc76f3a3df19a8fc5037456f7d155f8e9a6848d53f
SSDEEP

49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBy9w4Sx:+R0pI/IQlUoMPdmpSpQ4

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2064	xdobec.exe

Loads dropped DLL 1 IoCs

pid	Process
2424	76f247d1a2639b38fdf17b95c8fe2cb0_NeikiAnalytics.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\IntelprocEL\\xdobec.exe"	76f247d1a2639b38fdf17b95c8fe2cb0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\MintUV\\dobasys.exe"	76f247d1a2639b38fdf17b95c8fe2cb0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2424	76f247d1a2639b38fdf17b95c8fe2cb0_NeikiAnalytics.exe
2424	76f247d1a2639b38fdf17b95c8fe2cb0_NeikiAnalytics.exe
2064	xdobec.exe
2424	76f247d1a2639b38fdf17b95c8fe2cb0_NeikiAnalytics.exe
2064	xdobec.exe
2424	76f247d1a2639b38fdf17b95c8fe2cb0_NeikiAnalytics.exe
2064	xdobec.exe
2424	76f247d1a2639b38fdf17b95c8fe2cb0_NeikiAnalytics.exe
2064	xdobec.exe
2424	76f247d1a2639b38fdf17b95c8fe2cb0_NeikiAnalytics.exe
2064	xdobec.exe
2424	76f247d1a2639b38fdf17b95c8fe2cb0_NeikiAnalytics.exe
2064	xdobec.exe
2424	76f247d1a2639b38fdf17b95c8fe2cb0_NeikiAnalytics.exe
2064	xdobec.exe
2424	76f247d1a2639b38fdf17b95c8fe2cb0_NeikiAnalytics.exe
2064	xdobec.exe
2424	76f247d1a2639b38fdf17b95c8fe2cb0_NeikiAnalytics.exe
2064	xdobec.exe
2424	76f247d1a2639b38fdf17b95c8fe2cb0_NeikiAnalytics.exe
2064	xdobec.exe
2424	76f247d1a2639b38fdf17b95c8fe2cb0_NeikiAnalytics.exe
2064	xdobec.exe
2424	76f247d1a2639b38fdf17b95c8fe2cb0_NeikiAnalytics.exe
2064	xdobec.exe
2424	76f247d1a2639b38fdf17b95c8fe2cb0_NeikiAnalytics.exe
2064	xdobec.exe
2424	76f247d1a2639b38fdf17b95c8fe2cb0_NeikiAnalytics.exe
2064	xdobec.exe
2424	76f247d1a2639b38fdf17b95c8fe2cb0_NeikiAnalytics.exe
2064	xdobec.exe
2424	76f247d1a2639b38fdf17b95c8fe2cb0_NeikiAnalytics.exe
2064	xdobec.exe
2424	76f247d1a2639b38fdf17b95c8fe2cb0_NeikiAnalytics.exe
2064	xdobec.exe
2424	76f247d1a2639b38fdf17b95c8fe2cb0_NeikiAnalytics.exe
2064	xdobec.exe
2424	76f247d1a2639b38fdf17b95c8fe2cb0_NeikiAnalytics.exe
2064	xdobec.exe
2424	76f247d1a2639b38fdf17b95c8fe2cb0_NeikiAnalytics.exe
2064	xdobec.exe
2424	76f247d1a2639b38fdf17b95c8fe2cb0_NeikiAnalytics.exe
2064	xdobec.exe
2424	76f247d1a2639b38fdf17b95c8fe2cb0_NeikiAnalytics.exe
2064	xdobec.exe
2424	76f247d1a2639b38fdf17b95c8fe2cb0_NeikiAnalytics.exe
2064	xdobec.exe
2424	76f247d1a2639b38fdf17b95c8fe2cb0_NeikiAnalytics.exe
2064	xdobec.exe
2424	76f247d1a2639b38fdf17b95c8fe2cb0_NeikiAnalytics.exe
2064	xdobec.exe
2424	76f247d1a2639b38fdf17b95c8fe2cb0_NeikiAnalytics.exe
2064	xdobec.exe
2424	76f247d1a2639b38fdf17b95c8fe2cb0_NeikiAnalytics.exe
2064	xdobec.exe
2424	76f247d1a2639b38fdf17b95c8fe2cb0_NeikiAnalytics.exe
2064	xdobec.exe
2424	76f247d1a2639b38fdf17b95c8fe2cb0_NeikiAnalytics.exe
2064	xdobec.exe
2424	76f247d1a2639b38fdf17b95c8fe2cb0_NeikiAnalytics.exe
2064	xdobec.exe
2424	76f247d1a2639b38fdf17b95c8fe2cb0_NeikiAnalytics.exe
2064	xdobec.exe
2424	76f247d1a2639b38fdf17b95c8fe2cb0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 2064	2424	76f247d1a2639b38fdf17b95c8fe2cb0_NeikiAnalytics.exe	28
PID 2424 wrote to memory of 2064	2424	76f247d1a2639b38fdf17b95c8fe2cb0_NeikiAnalytics.exe	28
PID 2424 wrote to memory of 2064	2424	76f247d1a2639b38fdf17b95c8fe2cb0_NeikiAnalytics.exe	28
PID 2424 wrote to memory of 2064	2424	76f247d1a2639b38fdf17b95c8fe2cb0_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\76f247d1a2639b38fdf17b95c8fe2cb0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\76f247d1a2639b38fdf17b95c8fe2cb0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2424
- C:\IntelprocEL\xdobec.exe
  C:\IntelprocEL\xdobec.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MintUV\dobasys.exe

Filesize
2.7MB

MD5
6d4c591c28b2340fe0b57cfa1a99ab2e

SHA1
a2081ff5b247685ca3e2edba638e2f80bbe25ac0

SHA256
930d74fa29e099ed1c1a3a1a85f1db2f2a717c1f4d3fe4185bb6a9d30f893eca

SHA512
fbf909ae6033ac859b680730ef6c4c1176bf374bbc1242028b40629c8f4e57cab86f2671c1d349ff25f81dd3de27cd6ed31a49bf766d377cc8e9fd9a5b7683d3

Download Submit
C:\Users\Admin\253086396416_6.1_Admin.ini

Filesize
204B

MD5
2a5d4c0a461addfd3809d6b03cf7baff

SHA1
0c3ba97f603dcf607fb26d2743c4e60e66bfcd47

SHA256
882623454d50db24e319df0a594b96656d066941cbad5017ba1ffac61ae26e57

SHA512
06c740d46bc40cdc05e0e8d537897b553ecd470c168fd05e6785b94703e44fce67a8116c937ec6b570125101e8cee515bf195d4a5f1350fa6ae5702d5799d500

Download Submit
\IntelprocEL\xdobec.exe

Filesize
2.7MB

MD5
56586dd0dd294c7c701d4226ab16be08

SHA1
8e3bd124f1b9c1d655594fa594f645090ce38ed2

SHA256
b219e95870586b1fc6c361fd6c18a17f1aed56bd6211c72ce5cea1c4f500aeda

SHA512
d6f2b92d43881467626c0e63ad1e19cc678aafefeb7e1c88d1a5cb58c817644fcb592a76267a4d8c2d620fe666753cab404dde5f10e90d4270a28104062b62b2

Download Submit