Analysis
- max time kernel
149s - max time network
97s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 12:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a40a745927bf3d6883c337595e23e830_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
a40a745927bf3d6883c337595e23e830_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target a40a745927bf3d6883c337595e23e830_NeikiAnalytics.exe
- Size 3.6MB
- Sample240603-p29lsagd68
- SHA256 b1f8d123101205d3a10380f9b6abb9c6c3f12fbba30e8da9d8fd91564049f259
- MD5 a40a745927bf3d6883c337595e23e830
- SHA1 0d6ed2072db43bd0f1bb349c9fae0e1b49c3792f
- SHA512 458c27cdd0269bbe3c3ad3038a11771d9494af7b6eb11036239f2f939b30c4a7735ee752be22f445c746f632d12958c7edee0548760a44b66db4e95552006f65
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LByB/bSqz8:sxX7QnxrloE5dpUpJbVz8
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysadob.exe a40a745927bf3d6883c337595e23e830_NeikiAnalytics.exe - Executes dropped EXE 2 IoCs
pid Process 4912 sysadob.exe 3736 devbodloc.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\SysDrvOT\\devbodloc.exe" a40a745927bf3d6883c337595e23e830_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\Vid3G\\dobaec.exe" a40a745927bf3d6883c337595e23e830_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2144 a40a745927bf3d6883c337595e23e830_NeikiAnalytics.exe 2144 a40a745927bf3d6883c337595e23e830_NeikiAnalytics.exe 2144 a40a745927bf3d6883c337595e23e830_NeikiAnalytics.exe 2144 a40a745927bf3d6883c337595e23e830_NeikiAnalytics.exe 4912 sysadob.exe 4912 sysadob.exe 3736 devbodloc.exe 3736 devbodloc.exe 4912 sysadob.exe 4912 sysadob.exe 3736 devbodloc.exe 3736 devbodloc.exe 4912 sysadob.exe 4912 sysadob.exe 3736 devbodloc.exe 3736 devbodloc.exe 4912 sysadob.exe 4912 sysadob.exe 3736 devbodloc.exe 3736 devbodloc.exe 4912 sysadob.exe 4912 sysadob.exe 3736 devbodloc.exe 3736 devbodloc.exe 4912 sysadob.exe 4912 sysadob.exe 3736 devbodloc.exe 3736 devbodloc.exe 4912 sysadob.exe 4912 sysadob.exe 3736 devbodloc.exe 3736 devbodloc.exe 4912 sysadob.exe 4912 sysadob.exe 3736 devbodloc.exe 3736 devbodloc.exe 4912 sysadob.exe 4912 sysadob.exe 3736 devbodloc.exe 3736 devbodloc.exe 4912 sysadob.exe 4912 sysadob.exe 3736 devbodloc.exe 3736 devbodloc.exe 4912 sysadob.exe 4912 sysadob.exe 3736 devbodloc.exe 3736 devbodloc.exe 4912 sysadob.exe 4912 sysadob.exe 3736 devbodloc.exe 3736 devbodloc.exe 4912 sysadob.exe 4912 sysadob.exe 3736 devbodloc.exe 3736 devbodloc.exe 4912 sysadob.exe 4912 sysadob.exe 3736 devbodloc.exe 3736 devbodloc.exe 4912 sysadob.exe 4912 sysadob.exe 3736 devbodloc.exe 3736 devbodloc.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2144 wrote to memory of 4912 2144 a40a745927bf3d6883c337595e23e830_NeikiAnalytics.exe 81 PID 2144 wrote to memory of 4912 2144 a40a745927bf3d6883c337595e23e830_NeikiAnalytics.exe 81 PID 2144 wrote to memory of 4912 2144 a40a745927bf3d6883c337595e23e830_NeikiAnalytics.exe 81 PID 2144 wrote to memory of 3736 2144 a40a745927bf3d6883c337595e23e830_NeikiAnalytics.exe 84 PID 2144 wrote to memory of 3736 2144 a40a745927bf3d6883c337595e23e830_NeikiAnalytics.exe 84 PID 2144 wrote to memory of 3736 2144 a40a745927bf3d6883c337595e23e830_NeikiAnalytics.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\a40a745927bf3d6883c337595e23e830_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a40a745927bf3d6883c337595e23e830_NeikiAnalytics.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysadob.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysadob.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4912
-
-
C:\SysDrvOT\devbodloc.exeC:\SysDrvOT\devbodloc.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3736
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\SysDrvOT\devbodloc.exe
- Size 565KB
- SHA256 aea7be2d63166c55fbfd7055dd969b5e2f968354532070e4a752c50a7d346fee
- MD5 a70f19f43f96aba1a235b1432b5f0e0f
- SHA1 cd8f9c0c705552c9972427875831e61914c1523b
- SHA512 f6d8ecdcd4febd7d6048f7041bdcb84bc7c32166691e375047dfbc56a7ba640d0498fe1eff7bd3b2c05b4bb9caf1f86457c4b0174103674ec4484c34c003f12b
- SSDEEP 12288:6ne3n0DmAm67YEjAyu6qJ/+WS5axBdSqpcVdSxL5XOEVpQ1:6nxDZV7xMyu6qJ2WSYxBdSqpcVdm5XRu
- MD5 SHA1 SHA512 SSDEEP
- Path C:\SysDrvOT\devbodloc.exe
- Size 3.6MB
- SHA256 fbc693a4f1c3cb557beb02f1b144a37253b6195523eaaa4df929a3c3a552f5f5
- MD5 56389512ef9deac41f5b16f8100b50c2
- SHA1 49d1558963b5b9f148f76edf2b45a399e2aa1ab3
- SHA512 ea19324f3009a73afa80236b6feec7d2d9cde9de98eaebdc837bdec7d5440b77105f54bdc77c5d6faca0b3ad3cb23e0cc8205da71782f9ea674fd0a5978bdb89
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBXB/bSqz8:sxX7QnxrloE5dpUpobVz8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 201B
- SHA256 29aa07dc759339af2b573b2fd8961321c49e92cd08bc3178564523c4192a2d69
- MD5 4b9579a6568f282733f9fa9e6b5039a7
- SHA1 034f895a3cad492c71e0bfa17dc5048ad0b9745f
- SHA512 706a469c3e25af9925922b2552f4facace813385527a8805b567c8cf41e4af53bc41eb6bd04f487d1168d380fc3eae62619ae016d35f85739f359e71b2888432
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 169B
- SHA256 9c1090887e7e40d8cb35f92ec748089a5cb0f9f99d7dbd88a7135bd3489fc774
- MD5 bd0c77e3ddb34e07f6090fe1c37c6553
- SHA1 1784898fa166dfee7669aa0a75eca62eb7d55d55
- SHA512 243f8b87dea8bb056a98039df6adcff4f5ffedcfdcca848886a080994adf9221fc7a5ab17e5bd029a72bfa998abafd9c05f6d73eabe14f460595a6323061c62a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysadob.exe
- Size 3.6MB
- SHA256 c1f5d38ea38c0608adfdb2a7ddee6727f17a41c045ee1aee78d9563bae06ee81
- MD5 bc9838768c1da1763a6b0537982d3e31
- SHA1 e7d580ce4872bb0e38e2e99658d4483e685a0b3b
- SHA512 7e554feeace7cbd82f5d428ce6f87421476232f4f3186dc3b9d840aec8c6941bdd28e64513d9274ac2ce11cdcf024080e060952267af1ddf0d064b6252e459a3
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBSB/bSqz8:sxX7QnxrloE5dpUphbVz8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Vid3G\dobaec.exe
- Size 3.6MB
- SHA256 f1f7899c60ecb60b9798078505545ac05b9459087fbed542a664affe6802d627
- MD5 8870791898bbfa1baadb95a37d33afb8
- SHA1 0cb7f188fb8271ea9d3eda53ea423aa348183092
- SHA512 23ddccedfc4c3c9cf8cce9fe5bbb5c34c280584568a6092f7406fab8f9dd9a48c9b11cbee32b04dd7e9d1f448ea2db4fce518f9a31e47d5fd068bc454b2d7191
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB+B/bSqz8:sxX7QnxrloE5dpUpNbVz8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Vid3G\dobaec.exe
- Size 3.6MB
- SHA256 7701d7a637c747738f9c7a06a12de209abf95651e1554b4384b56b283c923b14
- MD5 afe8926a80e1e31d19091194f5e0e0fa
- SHA1 1751e36a98cb215ba909f7530e530e4f382973f4
- SHA512 cfdc4c4e5ce459db4d8bece9a251724e0759598df5c0357b3f676bfdb3ec503f4cb9e74a9c74305af9b312a7eec4ecabd1c17ccd49996e58e2fd4201e44b7059
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBpB/bSqz8:sxX7QnxrloE5dpUp2bVz8
- MD5 SHA1 SHA512 SSDEEP