Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 11:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe
- Size 4.1MB
- Sample240603-nc52mace3x
- SHA256 57645e5c4eac18fcde734472b6aee446b3f129c51b00bb061b2f5efe99e9f90c
- MD5 a176d55c9f27b0c573cfa9ea42391bf0
- SHA1 ad0a266a7fe148c666ec46aae29e19c41f5fd775
- SHA512 6a4fd61ba80edb032e4acf4d98640968627d173c569cc7b0b608896995183111e8fb7e2db72670571aef8b37bec62703e8b7c017a800b234a0db85176dc133ac
- SSDEEP 98304:+R0pI/IQlUoMPdmpSpS4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdmp5n9klRKN41v
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5072 abodec.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\UserDotBI\\abodec.exe" a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\KaVBHM\\bodxec.exe" a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2636 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe 2636 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe 2636 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe 2636 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe 5072 abodec.exe 5072 abodec.exe 2636 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe 2636 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe 5072 abodec.exe 5072 abodec.exe 2636 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe 2636 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe 5072 abodec.exe 5072 abodec.exe 2636 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe 2636 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe 5072 abodec.exe 5072 abodec.exe 2636 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe 2636 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe 5072 abodec.exe 5072 abodec.exe 2636 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe 2636 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe 5072 abodec.exe 5072 abodec.exe 2636 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe 2636 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe 5072 abodec.exe 5072 abodec.exe 2636 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe 2636 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe 5072 abodec.exe 5072 abodec.exe 2636 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe 2636 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe 5072 abodec.exe 5072 abodec.exe 2636 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe 2636 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe 5072 abodec.exe 5072 abodec.exe 2636 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe 2636 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe 5072 abodec.exe 5072 abodec.exe 2636 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe 2636 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe 5072 abodec.exe 5072 abodec.exe 2636 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe 2636 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe 5072 abodec.exe 5072 abodec.exe 2636 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe 2636 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe 5072 abodec.exe 5072 abodec.exe 2636 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe 2636 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe 5072 abodec.exe 5072 abodec.exe 2636 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe 2636 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2636 wrote to memory of 5072 2636 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe 85 PID 2636 wrote to memory of 5072 2636 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe 85 PID 2636 wrote to memory of 5072 2636 a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a176d55c9f27b0c573cfa9ea42391bf0_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\UserDotBI\abodec.exeC:\UserDotBI\abodec.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5072
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\KaVBHM\bodxec.exe
- Size 4.1MB
- SHA256 a90c759e919ff70251dd0d3970fa467f5c0038d7feb935a0e4f9b6ccf1d7431f
- MD5 d2a505f6c07b2ec80111518e2164b9d1
- SHA1 dae26a31b63669a06859d767efe4d495ea37613a
- SHA512 904fa2bfea21688793b5ff4b0f50dd051c0df3f9e013ea1f65e178bdb9a55030597555005cc6219658776e883a37f0b2e7390d37aaff897c8c6948e00ae09b24
- SSDEEP 98304:+R0pI/IQlUoMPdmpSpq4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdm95n9klRKN41v
- MD5 SHA1 SHA512 SSDEEP
- Path C:\UserDotBI\abodec.exe
- Size 4.1MB
- SHA256 8b21b2d4c47c07c1fcea6e4843add5b4af1c530d41961560b65de96240344498
- MD5 0ea1c68edd2881698ee149f409225a22
- SHA1 ebbfdad5e764a09b568c3e263fb2623fc13d9dd8
- SHA512 5ec15badeacd518be0d7e067f2f7e902de70095244a187f7df93b96d6af40ccad10c171220240f64d2fbe7ab747c267959247de16eeea52b8ad25337f114978e
- SSDEEP 98304:+R0pI/IQlUoMPdmpSp84ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdmH5n9klRKN41v
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 202B
- SHA256 68bd9c632be4c609a2f5bf894d771aef3f4b322f8dd8a79a58c6e334357fe7d9
- MD5 d230275e76a606620303de79f6a488a6
- SHA1 518353ffe40222b78f4d28b02b534b58e1681af3
- SHA512 b09db921156dd914e8f949334b55c4af835ce5befa05422ca7848bf945e4b45243a7a79eea0288cab99e4199b10939f8efbea15ac22f7222946845f002f02720
- MD5 SHA1 SHA512