Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
02/06/2024, 01:39
Static task
static1
Behavioral task
behavioral1
Sample
1dc8ee51bc2ea2dedbdebaa13f155160_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
1dc8ee51bc2ea2dedbdebaa13f155160_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
1dc8ee51bc2ea2dedbdebaa13f155160_NeikiAnalytics.exe
-
Size
3.9MB
-
MD5
1dc8ee51bc2ea2dedbdebaa13f155160
-
SHA1
353342a43a29fe2c309e0ae6fc94c597fcc96bc9
-
SHA256
c03c26b58140e15af25e6f1354e61f87f1e2b55c60b7480617fae2149942fc67
-
SHA512
ad83814f67e42188d6f6a951f7ab20a083d07553af03bb0303ea958d0cce9a518373b64d7e249ab697b109ea43ef5ebf366f1acc86b6704f57188de03fac067d
-
SSDEEP
49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBnB/bSqz8:sxX7QnxrloE5dpUpQbVz8
Malware Config
Signatures
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecxdob.exe 1dc8ee51bc2ea2dedbdebaa13f155160_NeikiAnalytics.exe -
Executes dropped EXE 2 IoCs
pid Process 4812 ecxdob.exe 4360 xbodloc.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\Mint5X\\dobxsys.exe" 1dc8ee51bc2ea2dedbdebaa13f155160_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\UserDotX7\\xbodloc.exe" 1dc8ee51bc2ea2dedbdebaa13f155160_NeikiAnalytics.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4788 1dc8ee51bc2ea2dedbdebaa13f155160_NeikiAnalytics.exe 4788 1dc8ee51bc2ea2dedbdebaa13f155160_NeikiAnalytics.exe 4788 1dc8ee51bc2ea2dedbdebaa13f155160_NeikiAnalytics.exe 4788 1dc8ee51bc2ea2dedbdebaa13f155160_NeikiAnalytics.exe 4812 ecxdob.exe 4812 ecxdob.exe 4360 xbodloc.exe 4360 xbodloc.exe 4812 ecxdob.exe 4812 ecxdob.exe 4360 xbodloc.exe 4360 xbodloc.exe 4812 ecxdob.exe 4812 ecxdob.exe 4360 xbodloc.exe 4360 xbodloc.exe 4812 ecxdob.exe 4812 ecxdob.exe 4360 xbodloc.exe 4360 xbodloc.exe 4812 ecxdob.exe 4812 ecxdob.exe 4360 xbodloc.exe 4360 xbodloc.exe 4812 ecxdob.exe 4812 ecxdob.exe 4360 xbodloc.exe 4360 xbodloc.exe 4812 ecxdob.exe 4812 ecxdob.exe 4360 xbodloc.exe 4360 xbodloc.exe 4812 ecxdob.exe 4812 ecxdob.exe 4360 xbodloc.exe 4360 xbodloc.exe 4812 ecxdob.exe 4812 ecxdob.exe 4360 xbodloc.exe 4360 xbodloc.exe 4812 ecxdob.exe 4812 ecxdob.exe 4360 xbodloc.exe 4360 xbodloc.exe 4812 ecxdob.exe 4812 ecxdob.exe 4360 xbodloc.exe 4360 xbodloc.exe 4812 ecxdob.exe 4812 ecxdob.exe 4360 xbodloc.exe 4360 xbodloc.exe 4812 ecxdob.exe 4812 ecxdob.exe 4360 xbodloc.exe 4360 xbodloc.exe 4812 ecxdob.exe 4812 ecxdob.exe 4360 xbodloc.exe 4360 xbodloc.exe 4812 ecxdob.exe 4812 ecxdob.exe 4360 xbodloc.exe 4360 xbodloc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4788 wrote to memory of 4812 4788 1dc8ee51bc2ea2dedbdebaa13f155160_NeikiAnalytics.exe 89 PID 4788 wrote to memory of 4812 4788 1dc8ee51bc2ea2dedbdebaa13f155160_NeikiAnalytics.exe 89 PID 4788 wrote to memory of 4812 4788 1dc8ee51bc2ea2dedbdebaa13f155160_NeikiAnalytics.exe 89 PID 4788 wrote to memory of 4360 4788 1dc8ee51bc2ea2dedbdebaa13f155160_NeikiAnalytics.exe 92 PID 4788 wrote to memory of 4360 4788 1dc8ee51bc2ea2dedbdebaa13f155160_NeikiAnalytics.exe 92 PID 4788 wrote to memory of 4360 4788 1dc8ee51bc2ea2dedbdebaa13f155160_NeikiAnalytics.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\1dc8ee51bc2ea2dedbdebaa13f155160_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1dc8ee51bc2ea2dedbdebaa13f155160_NeikiAnalytics.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecxdob.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecxdob.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4812
-
-
C:\UserDotX7\xbodloc.exeC:\UserDotX7\xbodloc.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4360
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.9MB
MD54ab1617f6384487fefd4f267d6dd514b
SHA1a1181215394cbf7a442c44d0ec42e4812fbffd3f
SHA25660d8ee8adece0b266d87fbeb59fbaadf35324a0e4cb1bf879035dad99a85a2d0
SHA51224b33c25742524d2eb5bf54207ec36bc2931110497aab599636d9148419cea88690de5cf35ee990be28ade07992560e428265ece577044a895ac94c149171eef
-
Filesize
282KB
MD5474e813e61c6aa0fadb5dcd242dc4743
SHA10d35606140fc0b84c6e24e54a605ae45cd096c42
SHA256f0ba49b3b32532b70c1a3ad65437c6ee09d0580c39cc279f1c51d3669a16b3b1
SHA512d97831249202dc33968e50defb6086459bae4ed7b3bbdc4d9a565f26cdf9bbaf65b55ec83fb075f15437cc05d869d4a52ae1123bfd38cc486813e75cf62ee931
-
Filesize
1.7MB
MD59144eb248bd8c9e02abcd2e4b31085cc
SHA1898df30a81947bafba526677fa2002de09f7f738
SHA2567cffdd9e8279fd1a64d94a1a48fd0c4300127a2e8b442abe2c432aceb6fb9da2
SHA512a9274d7c0d3f43491174585361217a920ae45a912b67b783edf8f95110e2b0c680006f4bf8b6fca3792e76c9bfdfb544ed31b57a95d9f94c71d9b7ded5c4395f
-
Filesize
3.9MB
MD5aa1febc73bfa0efc4c4043f06aa6630a
SHA17f8cddd68581b340c4865145f4292bae161747f2
SHA25662e963e5a763f0763e92197413445526a593fe5a2bee8fec2d10b5b090c07361
SHA5122ef64b2c5a6d9b9f04a70eb8de3001307b52c4699986bf406e589e0c9bde88f2132b9449882e2eb0937814c31694fae3e94f63a696efc98358cabe4361e251b4
-
Filesize
201B
MD5189df933c9479fb6a2ad5d900b304c1d
SHA1277049bb0ee37941cde4f81afa16ef53a27a682b
SHA25631d320972d293e32cf22807c22d6f0592670086480d9468f09beea33c7227b42
SHA5126411b5c69ba3cfc94388c3ab1bdfe1e1578963f7004368d43ad21881f345b4a5669fecf008c90fc5bb6790cc1ac5622ab6684eaa9c167e3b5238bde189f58d85
-
Filesize
169B
MD58d433c1d6567631fa6fb3a0052a9a062
SHA19c1528c8426cf5ab24bc7380c10e1d316f07210c
SHA256670911d13e3ca28087217fbfb0f0ff6a030b27001fc79ff0b8aa49dace3e9d9b
SHA512e2f7d44507a5c60ac3494ca47b556dfcac0d76d5cca13362724fd3f581caa8d18399127557e957d5509a69d1859c71a99df2fdd7f8a50dd379b9251114801c81
-
Filesize
3.9MB
MD5b4e5700f7e5ccd89e179700c58331ca5
SHA1ca35b2560e2c127c3909cea033561d3f2d55af11
SHA25625cbcb7acf1184ec9fa7d7e733309647ee6690e5d126e936f91a0d584c036aa0
SHA512ec1f9d85ba5bf483f106cf3c369c14d1f17b2cd277d5cf638b859470d2ab7d6c9271f5d1d2dc337f8ce6f8f3cd474d03189a701c7a77fe3d74cb4df61117831b