692faa7d7d7b3ecb54d05b76ee84ba34284c3d087d031866d78dae79dcf9876d

Analysis

max time kernel
150s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02-06-2024 23:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7c7b92cf95864bd65b304dc39a53f960_NeikiAnalytics.exe
Size

4.1MB
MD5

7c7b92cf95864bd65b304dc39a53f960
SHA1

9b1511de36225a6488351e058f763da0fa050d8e
SHA256

692faa7d7d7b3ecb54d05b76ee84ba34284c3d087d031866d78dae79dcf9876d
SHA512

dce0411ded76b57cce0d7d5a45f906d6bc432dd29f414257affd8be04b2b2a4a7974675799ac7e6396f7750d5e747df3b4335ea4fb25d93ec160f07128a1d751
SSDEEP

98304:+R0pI/IQlUoMPdmpSp04ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdmv5n9klRKN41v

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1972	devbodsys.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\FilesBG\\devbodsys.exe"	7c7b92cf95864bd65b304dc39a53f960_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\GalaxZO\\optidevsys.exe"	7c7b92cf95864bd65b304dc39a53f960_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2884	7c7b92cf95864bd65b304dc39a53f960_NeikiAnalytics.exe
2884	7c7b92cf95864bd65b304dc39a53f960_NeikiAnalytics.exe
2884	7c7b92cf95864bd65b304dc39a53f960_NeikiAnalytics.exe
2884	7c7b92cf95864bd65b304dc39a53f960_NeikiAnalytics.exe
1972	devbodsys.exe
1972	devbodsys.exe
2884	7c7b92cf95864bd65b304dc39a53f960_NeikiAnalytics.exe
2884	7c7b92cf95864bd65b304dc39a53f960_NeikiAnalytics.exe
1972	devbodsys.exe
1972	devbodsys.exe
2884	7c7b92cf95864bd65b304dc39a53f960_NeikiAnalytics.exe
2884	7c7b92cf95864bd65b304dc39a53f960_NeikiAnalytics.exe
1972	devbodsys.exe
1972	devbodsys.exe
2884	7c7b92cf95864bd65b304dc39a53f960_NeikiAnalytics.exe
2884	7c7b92cf95864bd65b304dc39a53f960_NeikiAnalytics.exe
1972	devbodsys.exe
1972	devbodsys.exe
2884	7c7b92cf95864bd65b304dc39a53f960_NeikiAnalytics.exe
2884	7c7b92cf95864bd65b304dc39a53f960_NeikiAnalytics.exe
1972	devbodsys.exe
1972	devbodsys.exe
2884	7c7b92cf95864bd65b304dc39a53f960_NeikiAnalytics.exe
2884	7c7b92cf95864bd65b304dc39a53f960_NeikiAnalytics.exe
1972	devbodsys.exe
1972	devbodsys.exe
2884	7c7b92cf95864bd65b304dc39a53f960_NeikiAnalytics.exe
2884	7c7b92cf95864bd65b304dc39a53f960_NeikiAnalytics.exe
1972	devbodsys.exe
1972	devbodsys.exe
2884	7c7b92cf95864bd65b304dc39a53f960_NeikiAnalytics.exe
2884	7c7b92cf95864bd65b304dc39a53f960_NeikiAnalytics.exe
1972	devbodsys.exe
1972	devbodsys.exe
2884	7c7b92cf95864bd65b304dc39a53f960_NeikiAnalytics.exe
2884	7c7b92cf95864bd65b304dc39a53f960_NeikiAnalytics.exe
1972	devbodsys.exe
1972	devbodsys.exe
2884	7c7b92cf95864bd65b304dc39a53f960_NeikiAnalytics.exe
2884	7c7b92cf95864bd65b304dc39a53f960_NeikiAnalytics.exe
1972	devbodsys.exe
1972	devbodsys.exe
2884	7c7b92cf95864bd65b304dc39a53f960_NeikiAnalytics.exe
2884	7c7b92cf95864bd65b304dc39a53f960_NeikiAnalytics.exe
1972	devbodsys.exe
1972	devbodsys.exe
2884	7c7b92cf95864bd65b304dc39a53f960_NeikiAnalytics.exe
2884	7c7b92cf95864bd65b304dc39a53f960_NeikiAnalytics.exe
1972	devbodsys.exe
1972	devbodsys.exe
2884	7c7b92cf95864bd65b304dc39a53f960_NeikiAnalytics.exe
2884	7c7b92cf95864bd65b304dc39a53f960_NeikiAnalytics.exe
1972	devbodsys.exe
1972	devbodsys.exe
2884	7c7b92cf95864bd65b304dc39a53f960_NeikiAnalytics.exe
2884	7c7b92cf95864bd65b304dc39a53f960_NeikiAnalytics.exe
1972	devbodsys.exe
1972	devbodsys.exe
2884	7c7b92cf95864bd65b304dc39a53f960_NeikiAnalytics.exe
2884	7c7b92cf95864bd65b304dc39a53f960_NeikiAnalytics.exe
1972	devbodsys.exe
1972	devbodsys.exe
2884	7c7b92cf95864bd65b304dc39a53f960_NeikiAnalytics.exe
2884	7c7b92cf95864bd65b304dc39a53f960_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 1972	2884	7c7b92cf95864bd65b304dc39a53f960_NeikiAnalytics.exe	86
PID 2884 wrote to memory of 1972	2884	7c7b92cf95864bd65b304dc39a53f960_NeikiAnalytics.exe	86
PID 2884 wrote to memory of 1972	2884	7c7b92cf95864bd65b304dc39a53f960_NeikiAnalytics.exe	86

C:\Users\Admin\AppData\Local\Temp\7c7b92cf95864bd65b304dc39a53f960_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\7c7b92cf95864bd65b304dc39a53f960_NeikiAnalytics.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2884
- C:\FilesBG\devbodsys.exe
  C:\FilesBG\devbodsys.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\FilesBG\devbodsys.exe

Filesize
4.1MB

MD5
304f10a7d9ff0d308e91b64848095da0

SHA1
47f180c4784c987d0c7a4daf1f932cecaa443cfc

SHA256
9187253c1c0750af398304224f0bc4557995ffc3d640f1aec432df6d00ba9851

SHA512
f4ae2e2ea280572dad39a6bbb911e097d0b93e8505fe8f47bb87c0b4ec1d90e5a9c0b68531f1b7686bf5835b5d8589f543cb6030b444debca96c134af845530b

Download Submit
C:\GalaxZO\optidevsys.exe

Filesize
4.1MB

MD5
da3b371d7f31545d7b4fd25336556b96

SHA1
29fbd3ba34d4056063fac3fe22416140c7089e98

SHA256
88afc820d97ae010d20221bc2c3f227ccbe952d84a893bf33adcc47883239bf2

SHA512
d98a45beabd47c5b95bb625d1f8cfe14c1b71cd46e7cb284e099dd08c974f6982ddac0ec1fdbc11bed385bd0db739bd4c4453948f5712adaf7dd52531e823d22

Download Submit
C:\Users\Admin\253086396416_10.0_Admin.ini

Filesize
205B

MD5
fa3c33eece22b4636b7a6cfc991c6120

SHA1
60d484e23a0c0cb7ce5c9066b59ac4df103bbf1d

SHA256
0096a38eaa7e23b7d45764e641bd7954f2fa23cd61d54f84603d4c95960c77e3

SHA512
32cc6ea764e81184adafb252f65c52b6b666d66c220fb2e4f840c5a7b9a3acb56bc4f2de5ba38aae5da5092692e71681bb5dbf095b6758065a8d2c096f1b5a24

Download Submit