Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
02/06/2024, 01:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
202e0c16f38e39bb1d8c4268cae09e80_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
202e0c16f38e39bb1d8c4268cae09e80_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 202e0c16f38e39bb1d8c4268cae09e80_NeikiAnalytics.exe
- Size 2.7MB
- Sample240602-cbazbafe35
- SHA256 e2fdb32667b13912e79232a26a9ac72246b91212ed8c482706b56a7570591a77
- MD5 202e0c16f38e39bb1d8c4268cae09e80
- SHA1 26251ebd4de6a2a9954db39eeef89d260ab0c32d
- SHA512 268c8719b5a0eb172932759c7dfcc0f15e3a73570b108b081b7db4227ad94de9616e7c8612ee9a49f7f662e538f02441d443c18733dc1a5957add08fea057e6e
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBe9w4Sx:+R0pI/IQlUoMPdmpSpQ4
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1608 xbodsys.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\SysDrvYN\\xbodsys.exe" 202e0c16f38e39bb1d8c4268cae09e80_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\MintLQ\\optixsys.exe" 202e0c16f38e39bb1d8c4268cae09e80_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3136 202e0c16f38e39bb1d8c4268cae09e80_NeikiAnalytics.exe 3136 202e0c16f38e39bb1d8c4268cae09e80_NeikiAnalytics.exe 3136 202e0c16f38e39bb1d8c4268cae09e80_NeikiAnalytics.exe 3136 202e0c16f38e39bb1d8c4268cae09e80_NeikiAnalytics.exe 1608 xbodsys.exe 1608 xbodsys.exe 3136 202e0c16f38e39bb1d8c4268cae09e80_NeikiAnalytics.exe 3136 202e0c16f38e39bb1d8c4268cae09e80_NeikiAnalytics.exe 1608 xbodsys.exe 1608 xbodsys.exe 3136 202e0c16f38e39bb1d8c4268cae09e80_NeikiAnalytics.exe 3136 202e0c16f38e39bb1d8c4268cae09e80_NeikiAnalytics.exe 1608 xbodsys.exe 1608 xbodsys.exe 3136 202e0c16f38e39bb1d8c4268cae09e80_NeikiAnalytics.exe 3136 202e0c16f38e39bb1d8c4268cae09e80_NeikiAnalytics.exe 1608 xbodsys.exe 1608 xbodsys.exe 3136 202e0c16f38e39bb1d8c4268cae09e80_NeikiAnalytics.exe 3136 202e0c16f38e39bb1d8c4268cae09e80_NeikiAnalytics.exe 1608 xbodsys.exe 1608 xbodsys.exe 3136 202e0c16f38e39bb1d8c4268cae09e80_NeikiAnalytics.exe 3136 202e0c16f38e39bb1d8c4268cae09e80_NeikiAnalytics.exe 1608 xbodsys.exe 1608 xbodsys.exe 3136 202e0c16f38e39bb1d8c4268cae09e80_NeikiAnalytics.exe 3136 202e0c16f38e39bb1d8c4268cae09e80_NeikiAnalytics.exe 1608 xbodsys.exe 1608 xbodsys.exe 3136 202e0c16f38e39bb1d8c4268cae09e80_NeikiAnalytics.exe 3136 202e0c16f38e39bb1d8c4268cae09e80_NeikiAnalytics.exe 1608 xbodsys.exe 1608 xbodsys.exe 3136 202e0c16f38e39bb1d8c4268cae09e80_NeikiAnalytics.exe 3136 202e0c16f38e39bb1d8c4268cae09e80_NeikiAnalytics.exe 1608 xbodsys.exe 1608 xbodsys.exe 3136 202e0c16f38e39bb1d8c4268cae09e80_NeikiAnalytics.exe 3136 202e0c16f38e39bb1d8c4268cae09e80_NeikiAnalytics.exe 1608 xbodsys.exe 1608 xbodsys.exe 3136 202e0c16f38e39bb1d8c4268cae09e80_NeikiAnalytics.exe 3136 202e0c16f38e39bb1d8c4268cae09e80_NeikiAnalytics.exe 1608 xbodsys.exe 1608 xbodsys.exe 3136 202e0c16f38e39bb1d8c4268cae09e80_NeikiAnalytics.exe 3136 202e0c16f38e39bb1d8c4268cae09e80_NeikiAnalytics.exe 1608 xbodsys.exe 1608 xbodsys.exe 3136 202e0c16f38e39bb1d8c4268cae09e80_NeikiAnalytics.exe 3136 202e0c16f38e39bb1d8c4268cae09e80_NeikiAnalytics.exe 1608 xbodsys.exe 1608 xbodsys.exe 3136 202e0c16f38e39bb1d8c4268cae09e80_NeikiAnalytics.exe 3136 202e0c16f38e39bb1d8c4268cae09e80_NeikiAnalytics.exe 1608 xbodsys.exe 1608 xbodsys.exe 3136 202e0c16f38e39bb1d8c4268cae09e80_NeikiAnalytics.exe 3136 202e0c16f38e39bb1d8c4268cae09e80_NeikiAnalytics.exe 1608 xbodsys.exe 1608 xbodsys.exe 3136 202e0c16f38e39bb1d8c4268cae09e80_NeikiAnalytics.exe 3136 202e0c16f38e39bb1d8c4268cae09e80_NeikiAnalytics.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3136 wrote to memory of 1608 3136 202e0c16f38e39bb1d8c4268cae09e80_NeikiAnalytics.exe 85 PID 3136 wrote to memory of 1608 3136 202e0c16f38e39bb1d8c4268cae09e80_NeikiAnalytics.exe 85 PID 3136 wrote to memory of 1608 3136 202e0c16f38e39bb1d8c4268cae09e80_NeikiAnalytics.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\202e0c16f38e39bb1d8c4268cae09e80_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\202e0c16f38e39bb1d8c4268cae09e80_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\SysDrvYN\xbodsys.exeC:\SysDrvYN\xbodsys.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1608
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\MintLQ\optixsys.exe
- Size 2.7MB
- SHA256 043cda108d30bca2855a3bb81a1c7b781f5a0d7587b6e01a836be0a3920a92af
- MD5 cdc6d9b97f5922474c42615c46e8f941
- SHA1 26c60fa7d7458338058314155158786f6506c6e5
- SHA512 a6a8467cbe565f6051b562a24282d2dc73a1ce1d3a14fee061c5e5ae694e97fe4be1c7664c423bdd399d203c183ff17ad2a3913c844fcb447e36444f1ca61b8a
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBJ9w4Sx:+R0pI/IQlUoMPdmpSpF4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\SysDrvYN\xbodsys.exe
- Size 2.7MB
- SHA256 a2e690b22b79b239d42a809b1154a6cca0de813c7b0199660c24803226854097
- MD5 6c4e1cb8cba69c4695ad8bf101d5f0e8
- SHA1 b00204c401c4554e3d5fa0f37f9bd0ffed765933
- SHA512 78b6cf186722d3a8575a295272c31db1c34234e6e7147e273638a917f1daab57a886fb80ecd676ef30fc1fb8496589e65c6c446d9d13d2c456d10c6e61f3c1e2
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LB99w4Sx:+R0pI/IQlUoMPdmpSpl4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 204B
- SHA256 900c5c29d598de99364e22966be8245e716a5fac921b7c6433a6c39749efdda1
- MD5 2b8e55bd15bd61f806fa3a65a582909c
- SHA1 c75aa42b1e641abecdd26245700633d0cad38188
- SHA512 55d4bcfa49fba306c2db4fd43c28df857b910c15073f12ea81ac4bb937a49fd9cb2aa749d6ef31792407229cd2fa06b8c647380bf87cb2fa8db788ae751cc79b
- MD5 SHA1 SHA512