51dc4de21dee9b57876e31ee00f2375d287fbca01da7d8c3a3d1e6bb36398def

Analysis

max time kernel
149s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 01:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1ab50275a97495b6f4a6f6c683bbc5e0_NeikiAnalytics.exe
Size

2.7MB
MD5

1ab50275a97495b6f4a6f6c683bbc5e0
SHA1

f2a6c2a922804b61d228b0e518d2ed47499f6659
SHA256

51dc4de21dee9b57876e31ee00f2375d287fbca01da7d8c3a3d1e6bb36398def
SHA512

d2ac63c1fe327a34b18c35489c5bc1e4d469a2965b782887f5001785714877795f12873c4a414f2985bdf1ffd8678d92e065cbc3db8aec0395ec2b74876bc14b
SSDEEP

49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBa9w4Sx:+R0pI/IQlUoMPdmpSps4

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4772	devbodloc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\IntelprocW9\\devbodloc.exe"	1ab50275a97495b6f4a6f6c683bbc5e0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\MintGS\\dobdevsys.exe"	1ab50275a97495b6f4a6f6c683bbc5e0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
736	1ab50275a97495b6f4a6f6c683bbc5e0_NeikiAnalytics.exe
736	1ab50275a97495b6f4a6f6c683bbc5e0_NeikiAnalytics.exe
736	1ab50275a97495b6f4a6f6c683bbc5e0_NeikiAnalytics.exe
736	1ab50275a97495b6f4a6f6c683bbc5e0_NeikiAnalytics.exe
4772	devbodloc.exe
4772	devbodloc.exe
736	1ab50275a97495b6f4a6f6c683bbc5e0_NeikiAnalytics.exe
736	1ab50275a97495b6f4a6f6c683bbc5e0_NeikiAnalytics.exe
4772	devbodloc.exe
4772	devbodloc.exe
736	1ab50275a97495b6f4a6f6c683bbc5e0_NeikiAnalytics.exe
736	1ab50275a97495b6f4a6f6c683bbc5e0_NeikiAnalytics.exe
4772	devbodloc.exe
4772	devbodloc.exe
736	1ab50275a97495b6f4a6f6c683bbc5e0_NeikiAnalytics.exe
736	1ab50275a97495b6f4a6f6c683bbc5e0_NeikiAnalytics.exe
4772	devbodloc.exe
4772	devbodloc.exe
736	1ab50275a97495b6f4a6f6c683bbc5e0_NeikiAnalytics.exe
736	1ab50275a97495b6f4a6f6c683bbc5e0_NeikiAnalytics.exe
4772	devbodloc.exe
4772	devbodloc.exe
736	1ab50275a97495b6f4a6f6c683bbc5e0_NeikiAnalytics.exe
736	1ab50275a97495b6f4a6f6c683bbc5e0_NeikiAnalytics.exe
4772	devbodloc.exe
4772	devbodloc.exe
736	1ab50275a97495b6f4a6f6c683bbc5e0_NeikiAnalytics.exe
736	1ab50275a97495b6f4a6f6c683bbc5e0_NeikiAnalytics.exe
4772	devbodloc.exe
4772	devbodloc.exe
736	1ab50275a97495b6f4a6f6c683bbc5e0_NeikiAnalytics.exe
736	1ab50275a97495b6f4a6f6c683bbc5e0_NeikiAnalytics.exe
4772	devbodloc.exe
4772	devbodloc.exe
736	1ab50275a97495b6f4a6f6c683bbc5e0_NeikiAnalytics.exe
736	1ab50275a97495b6f4a6f6c683bbc5e0_NeikiAnalytics.exe
4772	devbodloc.exe
4772	devbodloc.exe
736	1ab50275a97495b6f4a6f6c683bbc5e0_NeikiAnalytics.exe
736	1ab50275a97495b6f4a6f6c683bbc5e0_NeikiAnalytics.exe
4772	devbodloc.exe
4772	devbodloc.exe
736	1ab50275a97495b6f4a6f6c683bbc5e0_NeikiAnalytics.exe
736	1ab50275a97495b6f4a6f6c683bbc5e0_NeikiAnalytics.exe
4772	devbodloc.exe
4772	devbodloc.exe
736	1ab50275a97495b6f4a6f6c683bbc5e0_NeikiAnalytics.exe
736	1ab50275a97495b6f4a6f6c683bbc5e0_NeikiAnalytics.exe
4772	devbodloc.exe
4772	devbodloc.exe
736	1ab50275a97495b6f4a6f6c683bbc5e0_NeikiAnalytics.exe
736	1ab50275a97495b6f4a6f6c683bbc5e0_NeikiAnalytics.exe
4772	devbodloc.exe
4772	devbodloc.exe
736	1ab50275a97495b6f4a6f6c683bbc5e0_NeikiAnalytics.exe
736	1ab50275a97495b6f4a6f6c683bbc5e0_NeikiAnalytics.exe
4772	devbodloc.exe
4772	devbodloc.exe
736	1ab50275a97495b6f4a6f6c683bbc5e0_NeikiAnalytics.exe
736	1ab50275a97495b6f4a6f6c683bbc5e0_NeikiAnalytics.exe
4772	devbodloc.exe
4772	devbodloc.exe
736	1ab50275a97495b6f4a6f6c683bbc5e0_NeikiAnalytics.exe
736	1ab50275a97495b6f4a6f6c683bbc5e0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 736 wrote to memory of 4772	736	1ab50275a97495b6f4a6f6c683bbc5e0_NeikiAnalytics.exe	88
PID 736 wrote to memory of 4772	736	1ab50275a97495b6f4a6f6c683bbc5e0_NeikiAnalytics.exe	88
PID 736 wrote to memory of 4772	736	1ab50275a97495b6f4a6f6c683bbc5e0_NeikiAnalytics.exe	88

C:\Users\Admin\AppData\Local\Temp\1ab50275a97495b6f4a6f6c683bbc5e0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\1ab50275a97495b6f4a6f6c683bbc5e0_NeikiAnalytics.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:736
- C:\IntelprocW9\devbodloc.exe
  C:\IntelprocW9\devbodloc.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:4772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\IntelprocW9\devbodloc.exe

Filesize
2.7MB

MD5
176e486a50ded44f37b4782cdf08eb62

SHA1
099e8730e22300460eba55d70e1481b5c7dbdeb7

SHA256
59f83a8221787eed8e1150a8bf8c0740911706aa5059eddbc82e173d369b99a0

SHA512
fd7493a1f9413b6892a85b83b080aa453578da80065271808b6d1126ecc1d8dccb3063ccad2f2f75898a5e731f53689d787ef634c8d41551b53ab6b0f133c962

Download Submit
C:\MintGS\dobdevsys.exe

Filesize
2.7MB

MD5
4257e5db22bc9df944889f491ad2a654

SHA1
ab1dec632e748a420e5030e87ce005b7d6194f82

SHA256
b1bc77069067d3ef5f6943cf8fb7175cf7b32875b1ead917870e207c7496981d

SHA512
df6142d86592486faf8c8688c02b3c3ab81c66eac49bb587cead4415d5b39ec4565ba0ea424b2498ee6b86bdb68d37d48497ad7035c8da96d01426889660d1be

Download Submit
C:\Users\Admin\253086396416_10.0_Admin.ini

Filesize
210B

MD5
de65d55dbe63ac0f46d3e9f758a2fa42

SHA1
f64e9059d92585e35a9d453dcb236877484a4512

SHA256
9f9a1668729e767aca04ba35bc0831d789c2b7ea622d83ff7062c482f2a9ccf6

SHA512
78cc05beef5764b2a4145bd4c234cd40822aa3786f6bd29e3737285fabf1ee8991d2259263fddbc625bf08c05598986985b02923e900b9045ecf863c749ffa76

Download Submit