Analysis
- max time kernel
149s - max time network
123s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
01/06/2024, 05:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8fa949dcb91e413780154f64556298c0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
8fa949dcb91e413780154f64556298c0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 8fa949dcb91e413780154f64556298c0_NeikiAnalytics.exe
- Size 2.7MB
- Sample240601-gffgtace34
- SHA256 ae6c0a1cc556218224738c306843a16684c1cd8f1f4cfc5bbe5140a68fa17729
- MD5 8fa949dcb91e413780154f64556298c0
- SHA1 fc98c5aa440e2709b6f412cfab1414d3a58e6848
- SHA512 9af09c241bf2a2fd2eb28ba68ebb9a34cb9654992daefa634d1ab915988af00947374d8ae256c097346cf92653f662beecb6bdba1ff0c2332f2710db979e0da0
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBG9w4Sx:+R0pI/IQlUoMPdmpSpY4
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5092 xbodsys.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\SysDrvFI\\xbodsys.exe" 8fa949dcb91e413780154f64556298c0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\KaVB17\\dobxec.exe" 8fa949dcb91e413780154f64556298c0_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2356 8fa949dcb91e413780154f64556298c0_NeikiAnalytics.exe 2356 8fa949dcb91e413780154f64556298c0_NeikiAnalytics.exe 2356 8fa949dcb91e413780154f64556298c0_NeikiAnalytics.exe 2356 8fa949dcb91e413780154f64556298c0_NeikiAnalytics.exe 5092 xbodsys.exe 5092 xbodsys.exe 2356 8fa949dcb91e413780154f64556298c0_NeikiAnalytics.exe 2356 8fa949dcb91e413780154f64556298c0_NeikiAnalytics.exe 5092 xbodsys.exe 5092 xbodsys.exe 2356 8fa949dcb91e413780154f64556298c0_NeikiAnalytics.exe 2356 8fa949dcb91e413780154f64556298c0_NeikiAnalytics.exe 5092 xbodsys.exe 5092 xbodsys.exe 2356 8fa949dcb91e413780154f64556298c0_NeikiAnalytics.exe 2356 8fa949dcb91e413780154f64556298c0_NeikiAnalytics.exe 5092 xbodsys.exe 5092 xbodsys.exe 2356 8fa949dcb91e413780154f64556298c0_NeikiAnalytics.exe 2356 8fa949dcb91e413780154f64556298c0_NeikiAnalytics.exe 5092 xbodsys.exe 5092 xbodsys.exe 2356 8fa949dcb91e413780154f64556298c0_NeikiAnalytics.exe 2356 8fa949dcb91e413780154f64556298c0_NeikiAnalytics.exe 5092 xbodsys.exe 5092 xbodsys.exe 2356 8fa949dcb91e413780154f64556298c0_NeikiAnalytics.exe 2356 8fa949dcb91e413780154f64556298c0_NeikiAnalytics.exe 5092 xbodsys.exe 5092 xbodsys.exe 2356 8fa949dcb91e413780154f64556298c0_NeikiAnalytics.exe 2356 8fa949dcb91e413780154f64556298c0_NeikiAnalytics.exe 5092 xbodsys.exe 5092 xbodsys.exe 2356 8fa949dcb91e413780154f64556298c0_NeikiAnalytics.exe 2356 8fa949dcb91e413780154f64556298c0_NeikiAnalytics.exe 5092 xbodsys.exe 5092 xbodsys.exe 2356 8fa949dcb91e413780154f64556298c0_NeikiAnalytics.exe 2356 8fa949dcb91e413780154f64556298c0_NeikiAnalytics.exe 5092 xbodsys.exe 5092 xbodsys.exe 2356 8fa949dcb91e413780154f64556298c0_NeikiAnalytics.exe 2356 8fa949dcb91e413780154f64556298c0_NeikiAnalytics.exe 5092 xbodsys.exe 5092 xbodsys.exe 2356 8fa949dcb91e413780154f64556298c0_NeikiAnalytics.exe 2356 8fa949dcb91e413780154f64556298c0_NeikiAnalytics.exe 5092 xbodsys.exe 5092 xbodsys.exe 2356 8fa949dcb91e413780154f64556298c0_NeikiAnalytics.exe 2356 8fa949dcb91e413780154f64556298c0_NeikiAnalytics.exe 5092 xbodsys.exe 5092 xbodsys.exe 2356 8fa949dcb91e413780154f64556298c0_NeikiAnalytics.exe 2356 8fa949dcb91e413780154f64556298c0_NeikiAnalytics.exe 5092 xbodsys.exe 5092 xbodsys.exe 2356 8fa949dcb91e413780154f64556298c0_NeikiAnalytics.exe 2356 8fa949dcb91e413780154f64556298c0_NeikiAnalytics.exe 5092 xbodsys.exe 5092 xbodsys.exe 2356 8fa949dcb91e413780154f64556298c0_NeikiAnalytics.exe 2356 8fa949dcb91e413780154f64556298c0_NeikiAnalytics.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2356 wrote to memory of 5092 2356 8fa949dcb91e413780154f64556298c0_NeikiAnalytics.exe 86 PID 2356 wrote to memory of 5092 2356 8fa949dcb91e413780154f64556298c0_NeikiAnalytics.exe 86 PID 2356 wrote to memory of 5092 2356 8fa949dcb91e413780154f64556298c0_NeikiAnalytics.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\8fa949dcb91e413780154f64556298c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\8fa949dcb91e413780154f64556298c0_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\SysDrvFI\xbodsys.exeC:\SysDrvFI\xbodsys.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5092
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\KaVB17\dobxec.exe
- Size 2.7MB
- SHA256 723384df0bcb7b93708ee3e3d185b7b755d6c42170c0cd5e744cf0985ddbbc90
- MD5 2b4f315b9578487470c2fec5f54f93ef
- SHA1 9228e29c0feb292db8f0f3cb1b43e9e0d939b9c2
- SHA512 092b780911320cb9e39035e3c69dae24e5f56bfbc31fc6b2bc7a887d55783d31e54ca9fbae0f56f2390a7b4d5bd52d6e261fa3eb93f8bb3698be4f87ac5348fa
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBd9w4Sx:+R0pI/IQlUoMPdmpSp54
- MD5 SHA1 SHA512 SSDEEP
- Path C:\SysDrvFI\xbodsys.exe
- Size 2.7MB
- SHA256 39678ce4ac5cc1c787bc789c54b768defc2944da82640bb8b5c4ecd7031b0a43
- MD5 3666c6939701ac1618d75f3646cb32a2
- SHA1 f7102ec07230d14404b1fa0e28fe2ef05c582cba
- SHA512 6e4bc14edec6ce6660825dd2c7d0b3a0772f3af8cb2810fad08de08bfccb4a1fff891e570e8970e01c57b08d37fa63804ae4879aef280c34581126af508e8c80
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBR9w4Sx:+R0pI/IQlUoMPdmpSp94
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 200B
- SHA256 bccc9993e9406dc0e7983706ea51a0c8d7716a367cf42d9d170a518cf75e0aa0
- MD5 9c9ed8b26dc20aa1dcaa09a94ef7e2a5
- SHA1 120c6dd56cdf263ef3d3bfd163d91e0f24583901
- SHA512 59f9d164dbc131824bead8d2bec9fbaeec6874d7737f24e8ce3bff5b614283151cb3c8da3a7800aa95bf08e11562c5d1e1f5c0670ac82d361e18f28257c412e1
- MD5 SHA1 SHA512