Analysis
- max time kernel
149s - max time network
121s - platform
windows7_x64 - resource
win7-20231129-en - resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system - submitted
03/06/2024, 11:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe
- Size 4.1MB
- Sample240603-nc52mace3x
- SHA256 57645e5c4eac18fcde734472b6aee446b3f129c51b00bb061b2f5efe99e9f90c
- MD5 a176d55c9f27b0c573cfa9ea42391bf0
- SHA1 ad0a266a7fe148c666ec46aae29e19c41f5fd775
- SHA512 6a4fd61ba80edb032e4acf4d98640968627d173c569cc7b0b608896995183111e8fb7e2db72670571aef8b37bec62703e8b7c017a800b234a0db85176dc133ac
- SSDEEP 98304:+R0pI/IQlUoMPdmpSpS4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdmp5n9klRKN41v
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1964 devbodloc.exe - Loads dropped DLL 1 IoCs
pid Process 2380 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\Files3M\\devbodloc.exe" a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\LabZK6\\dobasys.exe" a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2380 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe 2380 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe 1964 devbodloc.exe 2380 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe 1964 devbodloc.exe 2380 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe 1964 devbodloc.exe 2380 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe 1964 devbodloc.exe 2380 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe 1964 devbodloc.exe 2380 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe 1964 devbodloc.exe 2380 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe 1964 devbodloc.exe 2380 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe 1964 devbodloc.exe 2380 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe 1964 devbodloc.exe 2380 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe 1964 devbodloc.exe 2380 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe 1964 devbodloc.exe 2380 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe 1964 devbodloc.exe 2380 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe 1964 devbodloc.exe 2380 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe 1964 devbodloc.exe 2380 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe 1964 devbodloc.exe 2380 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe 1964 devbodloc.exe 2380 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe 1964 devbodloc.exe 2380 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe 1964 devbodloc.exe 2380 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe 1964 devbodloc.exe 2380 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe 1964 devbodloc.exe 2380 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe 1964 devbodloc.exe 2380 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe 1964 devbodloc.exe 2380 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe 1964 devbodloc.exe 2380 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe 1964 devbodloc.exe 2380 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe 1964 devbodloc.exe 2380 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe 1964 devbodloc.exe 2380 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe 1964 devbodloc.exe 2380 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe 1964 devbodloc.exe 2380 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe 1964 devbodloc.exe 2380 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe 1964 devbodloc.exe 2380 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe 1964 devbodloc.exe 2380 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2380 wrote to memory of 1964 2380 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe 28 PID 2380 wrote to memory of 1964 2380 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe 28 PID 2380 wrote to memory of 1964 2380 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe 28 PID 2380 wrote to memory of 1964 2380 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Files3M\devbodloc.exeC:\Files3M\devbodloc.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1964
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\LabZK6\dobasys.exe
- Size 4.1MB
- SHA256 e74ece5d38a2031fad4601621c225b02f40714d8340dc8c09af64aac23bc479d
- MD5 208eb6eb826ee804faebd7c1a34a4e35
- SHA1 8ce8afd6796a3018c41cee4378c6f7e0730cb76a
- SHA512 60ce0718edc8ebf7c17234fcfe531adfae9d10f3556304e50735534965fba0fcaac6f296ec011aadb19c393c8ab8979581ee52210e2ce772cea233bd2af3760a
- SSDEEP 98304:+R0pI/IQlUoMPdmpSpe4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdmJ5n9klRKN41v
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_6.1_Admin.ini
- Size 202B
- SHA256 f0bf80c8d7027f9dd3a4b08c7af28b91cf9b43f3141f8e45615be734c582e677
- MD5 49265a5f8bd7b5406400d4bfcd0a873b
- SHA1 fc30b49889d55374c635be0e4048b763b961e6c4
- SHA512 22ccc7ffe6f598f97a51fb257107b59749195b74e7822b86ed592482847969c8d5c8fd4ef0c389741dd824286f46a92cfbb286c1b4184b3098ea4c59460e01e2
- MD5 SHA1 SHA512
- Path \Files3M\devbodloc.exe
- Size 4.1MB
- SHA256 5f5d3f45ba6dd8f9cc44024bbca71baf52d0c614e4c70c50c7d149702dc0177b
- MD5 61da07fe70ff13aa429d4fb6618cba88
- SHA1 398d07cfafca231de727e02b0b7ecb8d3bc3dec0
- SHA512 81b18532d4236a7359d32fd2e7a4a8200bbff0fa8e8163d62445ffee5114088709fd51e3b59ab882829bac8d1cde44fd9ac3b1a2203005e868a7a6db7733917c
- SSDEEP 98304:+R0pI/IQlUoMPdmpSpt4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdme5n9klRKN41v
- MD5 SHA1 SHA512 SSDEEP