Analysis
- max time kernel
149s - max time network
100s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 13:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a44c201fdbdd2863f065f98a3b020130_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
a44c201fdbdd2863f065f98a3b020130_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target a44c201fdbdd2863f065f98a3b020130_NeikiAnalytics.exe
- Size 4.1MB
- Sample240603-p86hpsfc31
- SHA256 e5f854b63d23bbad3c80bb289cbd99f136cf8c24f9944fc875a5ca2c4c9e8d10
- MD5 a44c201fdbdd2863f065f98a3b020130
- SHA1 61ad618a89f1a7cbaca2ea6d0df03973ceee016a
- SHA512 f9ae2108d4137456fcc5877511c21400d82becdbe1017cd25b8ddbcfd7e4e034b558f29ccba84806e3367d8d25414cfef619e479bcd743c2ac4e12d730b6af39
- SSDEEP 98304:+R0pI/IQlUoMPdmpSpI4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdmv5n9klRKN41v
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1944 xdobloc.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\AdobeCW\\xdobloc.exe" a44c201fdbdd2863f065f98a3b020130_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\KaVBGC\\optidevloc.exe" a44c201fdbdd2863f065f98a3b020130_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1612 a44c201fdbdd2863f065f98a3b020130_NeikiAnalytics.exe 1612 a44c201fdbdd2863f065f98a3b020130_NeikiAnalytics.exe 1612 a44c201fdbdd2863f065f98a3b020130_NeikiAnalytics.exe 1612 a44c201fdbdd2863f065f98a3b020130_NeikiAnalytics.exe 1944 xdobloc.exe 1944 xdobloc.exe 1612 a44c201fdbdd2863f065f98a3b020130_NeikiAnalytics.exe 1612 a44c201fdbdd2863f065f98a3b020130_NeikiAnalytics.exe 1944 xdobloc.exe 1944 xdobloc.exe 1612 a44c201fdbdd2863f065f98a3b020130_NeikiAnalytics.exe 1612 a44c201fdbdd2863f065f98a3b020130_NeikiAnalytics.exe 1944 xdobloc.exe 1944 xdobloc.exe 1612 a44c201fdbdd2863f065f98a3b020130_NeikiAnalytics.exe 1612 a44c201fdbdd2863f065f98a3b020130_NeikiAnalytics.exe 1944 xdobloc.exe 1944 xdobloc.exe 1612 a44c201fdbdd2863f065f98a3b020130_NeikiAnalytics.exe 1612 a44c201fdbdd2863f065f98a3b020130_NeikiAnalytics.exe 1944 xdobloc.exe 1944 xdobloc.exe 1612 a44c201fdbdd2863f065f98a3b020130_NeikiAnalytics.exe 1612 a44c201fdbdd2863f065f98a3b020130_NeikiAnalytics.exe 1944 xdobloc.exe 1944 xdobloc.exe 1612 a44c201fdbdd2863f065f98a3b020130_NeikiAnalytics.exe 1612 a44c201fdbdd2863f065f98a3b020130_NeikiAnalytics.exe 1944 xdobloc.exe 1944 xdobloc.exe 1612 a44c201fdbdd2863f065f98a3b020130_NeikiAnalytics.exe 1612 a44c201fdbdd2863f065f98a3b020130_NeikiAnalytics.exe 1944 xdobloc.exe 1944 xdobloc.exe 1612 a44c201fdbdd2863f065f98a3b020130_NeikiAnalytics.exe 1612 a44c201fdbdd2863f065f98a3b020130_NeikiAnalytics.exe 1944 xdobloc.exe 1944 xdobloc.exe 1612 a44c201fdbdd2863f065f98a3b020130_NeikiAnalytics.exe 1612 a44c201fdbdd2863f065f98a3b020130_NeikiAnalytics.exe 1944 xdobloc.exe 1944 xdobloc.exe 1612 a44c201fdbdd2863f065f98a3b020130_NeikiAnalytics.exe 1612 a44c201fdbdd2863f065f98a3b020130_NeikiAnalytics.exe 1944 xdobloc.exe 1944 xdobloc.exe 1612 a44c201fdbdd2863f065f98a3b020130_NeikiAnalytics.exe 1612 a44c201fdbdd2863f065f98a3b020130_NeikiAnalytics.exe 1944 xdobloc.exe 1944 xdobloc.exe 1612 a44c201fdbdd2863f065f98a3b020130_NeikiAnalytics.exe 1612 a44c201fdbdd2863f065f98a3b020130_NeikiAnalytics.exe 1944 xdobloc.exe 1944 xdobloc.exe 1612 a44c201fdbdd2863f065f98a3b020130_NeikiAnalytics.exe 1612 a44c201fdbdd2863f065f98a3b020130_NeikiAnalytics.exe 1944 xdobloc.exe 1944 xdobloc.exe 1612 a44c201fdbdd2863f065f98a3b020130_NeikiAnalytics.exe 1612 a44c201fdbdd2863f065f98a3b020130_NeikiAnalytics.exe 1944 xdobloc.exe 1944 xdobloc.exe 1612 a44c201fdbdd2863f065f98a3b020130_NeikiAnalytics.exe 1612 a44c201fdbdd2863f065f98a3b020130_NeikiAnalytics.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1612 wrote to memory of 1944 1612 a44c201fdbdd2863f065f98a3b020130_NeikiAnalytics.exe 90 PID 1612 wrote to memory of 1944 1612 a44c201fdbdd2863f065f98a3b020130_NeikiAnalytics.exe 90 PID 1612 wrote to memory of 1944 1612 a44c201fdbdd2863f065f98a3b020130_NeikiAnalytics.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\a44c201fdbdd2863f065f98a3b020130_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a44c201fdbdd2863f065f98a3b020130_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\AdobeCW\xdobloc.exeC:\AdobeCW\xdobloc.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1944
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\AdobeCW\xdobloc.exe
- Size 4.1MB
- SHA256 7fbf2ae2042210eedea43a85a982b197f402a04bd05b791fef2bb46d655b7396
- MD5 93715fae06c43f1865e22332ca48894b
- SHA1 e538c63344faa8f7ae13ee4fd8890faafe72ab95
- SHA512 68098d73772e3575bd3d2e3779b1029b99bc6a607a6393bb9b20d511b21dbd083265122392e2c8cb7628b2f1bcbe8affe256b1ceb5d8962d04b1acd8d2d12801
- SSDEEP 98304:+R0pI/IQlUoMPdmpSpN4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdmK5n9klRKN41v
- MD5 SHA1 SHA512 SSDEEP
- Path C:\KaVBGC\optidevloc.exe
- Size 4.1MB
- SHA256 53f40d64a9813b4209371e8bced2f0f9a9b5479d99f6e974fb0ad695e302018b
- MD5 cf6720ce45ff6e263682b316e2c9ae14
- SHA1 6be9589a68db1febe525576f11ca67a09d5b92a7
- SHA512 d52d98e554530214c7494485269509fc37e6e48900064639e5c4a90cb75e50b36e9f8449d8b66e8ccb41dcd51637555da1b96e47ba10d925f085d3b85efc8f08
- SSDEEP 98304:+R0pI/IQlUoMPdmpSpl4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdmC5n9klRKN41v
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 202B
- SHA256 ba1109b461456767d53b04f366ec8c858e5952f0ca05ef9df6857cad7b1bfabd
- MD5 2a0b65f1cd9ace4123ac8c72c6932714
- SHA1 510b0322452b5e258ef740e2440252f1ba373eaa
- SHA512 99b551030f7e56591a6e6a3a98c5fb3f9f14aef23261886e26583044f0ee3e45be6a171fee09bfd9a6192ad01d8505eed5ebe71b9a2dd0be98e55d5029002ecd
- MD5 SHA1 SHA512