Overview

overview

7

Static

static

3

6d71d9e9d4...cs.exe

windows7-x64

7

6d71d9e9d4...cs.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    02/06/2024, 21:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    6d71d9e9d4c266116727e26a42ba2d60_NeikiAnalytics.exe

  • Size

    2.7MB

  • MD5

    6d71d9e9d4c266116727e26a42ba2d60

  • SHA1

    41de3b9d7d4e0486ec88dacaf606eb9eadfbf824

  • SHA256

    7e1deba9fdd26e206df58e6bb27bff53e2cf39ae0c0069ac405d7af86643a5c7

  • SHA512

    0d7370921743f6a0929bbd4338ff2e5bdccb8e852a5d4e32ebc61ba575ac5f66d23f70edeb3997234deb38c831f5f36220f19b0e588f571fa0556d112ad8decf

  • SSDEEP

    49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBA9w4Sx:+R0pI/IQlUoMPdmpSpy4

Score
7/10
persistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6d71d9e9d4c266116727e26a42ba2d60_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\6d71d9e9d4c266116727e26a42ba2d60_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1824
    • C:\Files4B\devdobec.exe
      C:\Files4B\devdobec.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:2436

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\MintMA\dobxec.exe
          Filesize

          2.7MB

          MD5

          61b714867e5c93665cd0741a82b9302f

          SHA1

          fea31882dd71dc2dcfd39f55939cf54b580d6384

          SHA256

          a2253fa58a0c531faea4122eec633064d4069da8ebae28ebe64e44a4cda100fa

          SHA512

          09e7bee16521ceb110eff2caaae1694678424dd70211a03780d7ff99e3f6bef71766d2c66a874389075c0a75ad9dad7a15bea6cd44be7703b03f1dbd00157bf7

          Download Submit

        • C:\Users\Admin\253086396416_6.1_Admin.ini
          Filesize

          209B

          MD5

          d6dd38963c7078553439a3e9de1125de

          SHA1

          c6405b2abfdc8e4c904a4f4f6a77981672658715

          SHA256

          eb5241423446d71b7a0a6bedcd6c1eeea29fc132482d69ac03e896d07c5ef909

          SHA512

          387c362c092a124b5dbe856b3c53890492d5f8008c2dcc71d0145f92bebea0f82334ff7f65f312312ecdf87d6936d6dac40b34c6c8e949b0ef948c102ad9d48b

          Download Submit

        • \Files4B\devdobec.exe
          Filesize

          2.7MB

          MD5

          13b1c8fb8cea0f117d7b1c5beea3131b

          SHA1

          8158fe80cede68c7c50f1a991c53a984434a880a

          SHA256

          3e985fd22958b544e64223f6b5313ce35dd8ac1d034563e375ac979ab672f401

          SHA512

          bb9fabda3f4941cee86c4ee178f3dfaf386a24186025d79e593ecda92735d35fffa07cd8da0a8d6c6c4f55760ad6cf25c19550391848e48dac320108234e8712

          Download Submit