Overview

overview

7

Static

static

3

78805f4b70...cs.exe

windows7-x64

7

78805f4b70...cs.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/05/2024, 05:09

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    78805f4b700044dec4843d0d66d13af0_NeikiAnalytics.exe

  • Size

    2.7MB

  • MD5

    78805f4b700044dec4843d0d66d13af0

  • SHA1

    78c6f6f8bb0a9182bfd3727754ad51e50bda2a1b

  • SHA256

    93efef4f83fa430e798e6059841f56ca0e1ac3afdb29165ab4562c29470d5d70

  • SHA512

    fa8d700203b93560b34e600cef863a982b734f1635be56a97c928296d7f07d8dac98e1484aa029ec8d5c00e087a4919515bb9af62bb615f9bdfaefeb4e0f866f

  • SSDEEP

    49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBR9w4Sx:+R0pI/IQlUoMPdmpSpB4

Score
7/10
persistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\78805f4b700044dec4843d0d66d13af0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\78805f4b700044dec4843d0d66d13af0_NeikiAnalytics.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4664
    • C:\SysDrvGL\abodsys.exe
      C:\SysDrvGL\abodsys.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:3708

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\LabZ2L\optixloc.exe
          Filesize

          2.7MB

          MD5

          b1ac4d2cfb72bd14a232671a3beff338

          SHA1

          2c77d3f237a75e88cc7a8b248c4226e6848c0d89

          SHA256

          f4ce814d05b3f70e49b63a6c95cac288db6732d23e6f31edb251805f5b0e5a10

          SHA512

          401eb6ebeb0ec000729966191e620a68ce1936873ce881fdecfa97257d055e50d90ccfa326b8ea2ebd2845f3e359687caadfddb559ae24e6e124ad91807697ce

          Download Submit

        • C:\SysDrvGL\abodsys.exe
          Filesize

          2.7MB

          MD5

          4eb930e37ca390e40ede4bfa906c6926

          SHA1

          83811175b3c3967391b3874a63af83eeb8cc1b4a

          SHA256

          b4ad161f546ba3d1a584a507b4c7e9e008fe6854be2d0368546026713d551669

          SHA512

          bfad6b8165995c223af28d2c704e0d983f70d704ebaefc9ad0f700d99b2455f183ebd55842ea090b2101fe4119d4ea8b03986ccbecee6184d6126d8230f64082

          Download Submit

        • C:\Users\Admin\253086396416_10.0_Admin.ini
          Filesize

          202B

          MD5

          94b944d93d13c276f12b2d1a0f54e945

          SHA1

          8bf35047c16a76f843774df57368db383ea1c63e

          SHA256

          4daa9961df5d01a69e5dad82dcfbab2633c4a5f83204b9c837591faa78728706

          SHA512

          1e9fcb72074b9cace4cf219b59537c19ee61f4513a0410987d40f238ba08952c1497b003773a9f397c6e2b2afbc3f186a790140b34151d7dac614150970528aa

          Download Submit