Analysis
- max time kernel
149s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
02/06/2024, 02:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
21c115a066cef9650111425aa2b96320_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
21c115a066cef9650111425aa2b96320_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 21c115a066cef9650111425aa2b96320_NeikiAnalytics.exe
- Size 2.7MB
- Sample240602-cghlcaff69
- SHA256 b05e8bec0773b3e8ec3811b04c1ceb87b3179b6dd002a0d9291ae05cee7bf718
- MD5 21c115a066cef9650111425aa2b96320
- SHA1 61475f7fdf8b962d7ac6bc8353b05a8fca1633fc
- SHA512 dfe1faf5251ccabaf51451d29224846c575b65edb0a3089597deb903d3096ec8cc804d500024ff18f16b9f1aa0f4ef98fa6f4f8d38917fe9e45f71395c7f4b24
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBe9w4Sx:+R0pI/IQlUoMPdmpSp84
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3920 devdobsys.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\UserDot55\\devdobsys.exe" 21c115a066cef9650111425aa2b96320_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\LabZ7U\\dobxsys.exe" 21c115a066cef9650111425aa2b96320_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4336 21c115a066cef9650111425aa2b96320_NeikiAnalytics.exe 4336 21c115a066cef9650111425aa2b96320_NeikiAnalytics.exe 4336 21c115a066cef9650111425aa2b96320_NeikiAnalytics.exe 4336 21c115a066cef9650111425aa2b96320_NeikiAnalytics.exe 3920 devdobsys.exe 3920 devdobsys.exe 4336 21c115a066cef9650111425aa2b96320_NeikiAnalytics.exe 4336 21c115a066cef9650111425aa2b96320_NeikiAnalytics.exe 3920 devdobsys.exe 3920 devdobsys.exe 4336 21c115a066cef9650111425aa2b96320_NeikiAnalytics.exe 4336 21c115a066cef9650111425aa2b96320_NeikiAnalytics.exe 3920 devdobsys.exe 3920 devdobsys.exe 4336 21c115a066cef9650111425aa2b96320_NeikiAnalytics.exe 4336 21c115a066cef9650111425aa2b96320_NeikiAnalytics.exe 3920 devdobsys.exe 3920 devdobsys.exe 4336 21c115a066cef9650111425aa2b96320_NeikiAnalytics.exe 4336 21c115a066cef9650111425aa2b96320_NeikiAnalytics.exe 3920 devdobsys.exe 3920 devdobsys.exe 4336 21c115a066cef9650111425aa2b96320_NeikiAnalytics.exe 4336 21c115a066cef9650111425aa2b96320_NeikiAnalytics.exe 3920 devdobsys.exe 3920 devdobsys.exe 4336 21c115a066cef9650111425aa2b96320_NeikiAnalytics.exe 4336 21c115a066cef9650111425aa2b96320_NeikiAnalytics.exe 3920 devdobsys.exe 3920 devdobsys.exe 4336 21c115a066cef9650111425aa2b96320_NeikiAnalytics.exe 4336 21c115a066cef9650111425aa2b96320_NeikiAnalytics.exe 3920 devdobsys.exe 3920 devdobsys.exe 4336 21c115a066cef9650111425aa2b96320_NeikiAnalytics.exe 4336 21c115a066cef9650111425aa2b96320_NeikiAnalytics.exe 3920 devdobsys.exe 3920 devdobsys.exe 4336 21c115a066cef9650111425aa2b96320_NeikiAnalytics.exe 4336 21c115a066cef9650111425aa2b96320_NeikiAnalytics.exe 3920 devdobsys.exe 3920 devdobsys.exe 4336 21c115a066cef9650111425aa2b96320_NeikiAnalytics.exe 4336 21c115a066cef9650111425aa2b96320_NeikiAnalytics.exe 3920 devdobsys.exe 3920 devdobsys.exe 4336 21c115a066cef9650111425aa2b96320_NeikiAnalytics.exe 4336 21c115a066cef9650111425aa2b96320_NeikiAnalytics.exe 3920 devdobsys.exe 3920 devdobsys.exe 4336 21c115a066cef9650111425aa2b96320_NeikiAnalytics.exe 4336 21c115a066cef9650111425aa2b96320_NeikiAnalytics.exe 3920 devdobsys.exe 3920 devdobsys.exe 4336 21c115a066cef9650111425aa2b96320_NeikiAnalytics.exe 4336 21c115a066cef9650111425aa2b96320_NeikiAnalytics.exe 3920 devdobsys.exe 3920 devdobsys.exe 4336 21c115a066cef9650111425aa2b96320_NeikiAnalytics.exe 4336 21c115a066cef9650111425aa2b96320_NeikiAnalytics.exe 3920 devdobsys.exe 3920 devdobsys.exe 4336 21c115a066cef9650111425aa2b96320_NeikiAnalytics.exe 4336 21c115a066cef9650111425aa2b96320_NeikiAnalytics.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4336 wrote to memory of 3920 4336 21c115a066cef9650111425aa2b96320_NeikiAnalytics.exe 87 PID 4336 wrote to memory of 3920 4336 21c115a066cef9650111425aa2b96320_NeikiAnalytics.exe 87 PID 4336 wrote to memory of 3920 4336 21c115a066cef9650111425aa2b96320_NeikiAnalytics.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\21c115a066cef9650111425aa2b96320_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\21c115a066cef9650111425aa2b96320_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\UserDot55\devdobsys.exeC:\UserDot55\devdobsys.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3920
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\LabZ7U\dobxsys.exe
- Size 2.7MB
- SHA256 2fa9acee4b2c42cdac2cf87033dba3fb7e993dd4cd0930866993c6bdff8752ca
- MD5 c422e0c73cdf91d3e739822491f23065
- SHA1 2b17ebe245f041456595d631fd5ed61740ca5428
- SHA512 1d40b20d3050a89b54eaaee7e70612b43b304becd41d3e042bb73d20d6cd65f7afe8c9dcb45dfee184bde2cf7425a88118df3e9c1f2272dd1387121c66a19914
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBt9w4Sx:+R0pI/IQlUoMPdmpSpJ4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\UserDot55\devdobsys.exe
- Size 2.7MB
- SHA256 2f090cc9d807e8519fe6b008848d088e3c9ded316a48e2c8047c58b2051a9c2a
- MD5 b389b3ce5a8f41977eb499a4fbf5ac14
- SHA1 83408731754fa073b705865f1a6dd34dcd2fd85b
- SHA512 55459889a3f16557f5212efcdc48c53f1131b8f9a92dcace374dab5a974f5308cb2e49e009f34a8d875c5d42cf90490f278cdf29a0d5c8b4c85c090da119d831
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBr9w4Sx:+R0pI/IQlUoMPdmpSpn4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 203B
- SHA256 f351bd20ab74949a5acad672157e8b83dbf1c4878686cec92612f40210ebfa4d
- MD5 54c7b296e22f623ae78e71f8ee04fc33
- SHA1 9c4eea2992799e9fd502baf2c7f839b7fd1126e9
- SHA512 e1456487daf202669dd6f9884a559efd581e57ad2a9b6fcd99a2f80e8219eedca749de5134e5dcda854582c4887245f12295bf5908ba71870454fc10e6974994
- MD5 SHA1 SHA512