Analysis
- max time kernel
149s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 15:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1d69888d75d90d450a84e62471c98b90_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
1d69888d75d90d450a84e62471c98b90_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 1d69888d75d90d450a84e62471c98b90_NeikiAnalytics.exe
- Size 2.7MB
- Sample240603-sr14fabh44
- SHA256 6b2e57914ad8b00c89bfe3193b0b6898145be7042a6ed44d5e708543ccf4e536
- MD5 1d69888d75d90d450a84e62471c98b90
- SHA1 d96e9e2e89c3e4082c960dad834b23400f8021c5
- SHA512 b5a36acd02e6785efd4a5016440e0ed08311f6cb7122a85b9758fe8eccf21e9607f5f0e230f5f745b3ea0fdd4fc23a31ad128278d1deb420d98a6fbdfc00cac6
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBJ9w4Sx:+R0pI/IQlUoMPdmpSpd4
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3024 adobec.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\SysDrvA5\\adobec.exe" 1d69888d75d90d450a84e62471c98b90_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\Galax41\\dobasys.exe" 1d69888d75d90d450a84e62471c98b90_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 868 1d69888d75d90d450a84e62471c98b90_NeikiAnalytics.exe 868 1d69888d75d90d450a84e62471c98b90_NeikiAnalytics.exe 868 1d69888d75d90d450a84e62471c98b90_NeikiAnalytics.exe 868 1d69888d75d90d450a84e62471c98b90_NeikiAnalytics.exe 3024 adobec.exe 3024 adobec.exe 868 1d69888d75d90d450a84e62471c98b90_NeikiAnalytics.exe 868 1d69888d75d90d450a84e62471c98b90_NeikiAnalytics.exe 3024 adobec.exe 3024 adobec.exe 868 1d69888d75d90d450a84e62471c98b90_NeikiAnalytics.exe 868 1d69888d75d90d450a84e62471c98b90_NeikiAnalytics.exe 3024 adobec.exe 3024 adobec.exe 868 1d69888d75d90d450a84e62471c98b90_NeikiAnalytics.exe 868 1d69888d75d90d450a84e62471c98b90_NeikiAnalytics.exe 3024 adobec.exe 3024 adobec.exe 868 1d69888d75d90d450a84e62471c98b90_NeikiAnalytics.exe 868 1d69888d75d90d450a84e62471c98b90_NeikiAnalytics.exe 3024 adobec.exe 3024 adobec.exe 868 1d69888d75d90d450a84e62471c98b90_NeikiAnalytics.exe 868 1d69888d75d90d450a84e62471c98b90_NeikiAnalytics.exe 3024 adobec.exe 3024 adobec.exe 868 1d69888d75d90d450a84e62471c98b90_NeikiAnalytics.exe 868 1d69888d75d90d450a84e62471c98b90_NeikiAnalytics.exe 3024 adobec.exe 3024 adobec.exe 868 1d69888d75d90d450a84e62471c98b90_NeikiAnalytics.exe 868 1d69888d75d90d450a84e62471c98b90_NeikiAnalytics.exe 3024 adobec.exe 3024 adobec.exe 868 1d69888d75d90d450a84e62471c98b90_NeikiAnalytics.exe 868 1d69888d75d90d450a84e62471c98b90_NeikiAnalytics.exe 3024 adobec.exe 3024 adobec.exe 868 1d69888d75d90d450a84e62471c98b90_NeikiAnalytics.exe 868 1d69888d75d90d450a84e62471c98b90_NeikiAnalytics.exe 3024 adobec.exe 3024 adobec.exe 868 1d69888d75d90d450a84e62471c98b90_NeikiAnalytics.exe 868 1d69888d75d90d450a84e62471c98b90_NeikiAnalytics.exe 3024 adobec.exe 3024 adobec.exe 868 1d69888d75d90d450a84e62471c98b90_NeikiAnalytics.exe 868 1d69888d75d90d450a84e62471c98b90_NeikiAnalytics.exe 3024 adobec.exe 3024 adobec.exe 868 1d69888d75d90d450a84e62471c98b90_NeikiAnalytics.exe 868 1d69888d75d90d450a84e62471c98b90_NeikiAnalytics.exe 3024 adobec.exe 3024 adobec.exe 868 1d69888d75d90d450a84e62471c98b90_NeikiAnalytics.exe 868 1d69888d75d90d450a84e62471c98b90_NeikiAnalytics.exe 3024 adobec.exe 3024 adobec.exe 868 1d69888d75d90d450a84e62471c98b90_NeikiAnalytics.exe 868 1d69888d75d90d450a84e62471c98b90_NeikiAnalytics.exe 3024 adobec.exe 3024 adobec.exe 868 1d69888d75d90d450a84e62471c98b90_NeikiAnalytics.exe 868 1d69888d75d90d450a84e62471c98b90_NeikiAnalytics.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 868 wrote to memory of 3024 868 1d69888d75d90d450a84e62471c98b90_NeikiAnalytics.exe 87 PID 868 wrote to memory of 3024 868 1d69888d75d90d450a84e62471c98b90_NeikiAnalytics.exe 87 PID 868 wrote to memory of 3024 868 1d69888d75d90d450a84e62471c98b90_NeikiAnalytics.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\1d69888d75d90d450a84e62471c98b90_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1d69888d75d90d450a84e62471c98b90_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:868 -
C:\SysDrvA5\adobec.exeC:\SysDrvA5\adobec.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3024
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Galax41\dobasys.exe
- Size 2.7MB
- SHA256 fe33d5e935640548c437340a99c2d3eef30dcb9c1ee0e0023a19ce0948c88dab
- MD5 6c914b8f5bfe0f8d44c33a8b04992f22
- SHA1 a40e6010f272c8fe9dc946aeb114e9fa1641b59d
- SHA512 2a62165df52d6a88111105ac2b186d15449e32824bfe25633013b3b9a0b06d1f0a1b01c659042d1cc908e87f56307b7d638cafc2a1e1ed6f38cc40ea45d739a9
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBj9w4Sx:+R0pI/IQlUoMPdmpSpr4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\SysDrvA5\adobec.exe
- Size 2.7MB
- SHA256 e3792b637c2ae91ad60523dd2a87c5fe2d150d10690016eeaedef20193d56856
- MD5 bdd5b221fb12ca71e18b666250703436
- SHA1 6c09b04218ed0d933cbe5f61de20319361dd34cc
- SHA512 3a48c7d6488f895f4fd8d4fd52e785bd11f3ca01a09e946b338471df92219fdb33df0a4a49c1f98bcef309dbfa67783b80b610c5fdf610f3e370a68144e17517
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBH9w4Sx:+R0pI/IQlUoMPdmpSpH4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 202B
- SHA256 0141e71cb5419d929d69216241db48c523f0b7d98aecc605f8b01f712ba247ea
- MD5 3bde41fb81914aa916c0d6ca6026f383
- SHA1 644c69abe17dcf034f27f26d14cfe60a2c7b44c1
- SHA512 479b9edd2e88300e0e5d73f86a0b4b4858b61b93285976c35592d68439f1f40a67f83426c46fbadd400ef27a7c839536ba2bbfd475b9285af04e7ca1d0e32679
- MD5 SHA1 SHA512