Analysis
- max time kernel
149s - max time network
103s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 15:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8c71d6a702f313e5c7991d37f9150740_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
8c71d6a702f313e5c7991d37f9150740_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 8c71d6a702f313e5c7991d37f9150740_NeikiAnalytics.exe
- Size 2.7MB
- Sample240603-svf8faca26
- SHA256 c1673b42ba2e25a1506c09b5061c1bf78622db57cb9bc5298536444f972f8202
- MD5 8c71d6a702f313e5c7991d37f9150740
- SHA1 d5a0cf4b171f15e9204dfe1b6f9476c4cf993726
- SHA512 4ecfeb85669079ce0670e5fd0814ed245ba02db55734dfcfdf1d2f0a154a74f4720cc194e3c55183b444a6b87e8325fe81ec865a4b3cf787b89bad2a780bb8c4
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBs9w4Sx:+R0pI/IQlUoMPdmpSpa4
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3528 adobec.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\UserDotR3\\adobec.exe" 8c71d6a702f313e5c7991d37f9150740_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\LabZLM\\dobdevsys.exe" 8c71d6a702f313e5c7991d37f9150740_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1376 8c71d6a702f313e5c7991d37f9150740_NeikiAnalytics.exe 1376 8c71d6a702f313e5c7991d37f9150740_NeikiAnalytics.exe 1376 8c71d6a702f313e5c7991d37f9150740_NeikiAnalytics.exe 1376 8c71d6a702f313e5c7991d37f9150740_NeikiAnalytics.exe 3528 adobec.exe 3528 adobec.exe 1376 8c71d6a702f313e5c7991d37f9150740_NeikiAnalytics.exe 1376 8c71d6a702f313e5c7991d37f9150740_NeikiAnalytics.exe 3528 adobec.exe 3528 adobec.exe 1376 8c71d6a702f313e5c7991d37f9150740_NeikiAnalytics.exe 1376 8c71d6a702f313e5c7991d37f9150740_NeikiAnalytics.exe 3528 adobec.exe 3528 adobec.exe 1376 8c71d6a702f313e5c7991d37f9150740_NeikiAnalytics.exe 1376 8c71d6a702f313e5c7991d37f9150740_NeikiAnalytics.exe 3528 adobec.exe 3528 adobec.exe 1376 8c71d6a702f313e5c7991d37f9150740_NeikiAnalytics.exe 1376 8c71d6a702f313e5c7991d37f9150740_NeikiAnalytics.exe 3528 adobec.exe 3528 adobec.exe 1376 8c71d6a702f313e5c7991d37f9150740_NeikiAnalytics.exe 1376 8c71d6a702f313e5c7991d37f9150740_NeikiAnalytics.exe 3528 adobec.exe 3528 adobec.exe 1376 8c71d6a702f313e5c7991d37f9150740_NeikiAnalytics.exe 1376 8c71d6a702f313e5c7991d37f9150740_NeikiAnalytics.exe 3528 adobec.exe 3528 adobec.exe 1376 8c71d6a702f313e5c7991d37f9150740_NeikiAnalytics.exe 1376 8c71d6a702f313e5c7991d37f9150740_NeikiAnalytics.exe 3528 adobec.exe 3528 adobec.exe 1376 8c71d6a702f313e5c7991d37f9150740_NeikiAnalytics.exe 1376 8c71d6a702f313e5c7991d37f9150740_NeikiAnalytics.exe 3528 adobec.exe 3528 adobec.exe 1376 8c71d6a702f313e5c7991d37f9150740_NeikiAnalytics.exe 1376 8c71d6a702f313e5c7991d37f9150740_NeikiAnalytics.exe 3528 adobec.exe 3528 adobec.exe 1376 8c71d6a702f313e5c7991d37f9150740_NeikiAnalytics.exe 1376 8c71d6a702f313e5c7991d37f9150740_NeikiAnalytics.exe 3528 adobec.exe 3528 adobec.exe 1376 8c71d6a702f313e5c7991d37f9150740_NeikiAnalytics.exe 1376 8c71d6a702f313e5c7991d37f9150740_NeikiAnalytics.exe 3528 adobec.exe 3528 adobec.exe 1376 8c71d6a702f313e5c7991d37f9150740_NeikiAnalytics.exe 1376 8c71d6a702f313e5c7991d37f9150740_NeikiAnalytics.exe 3528 adobec.exe 3528 adobec.exe 1376 8c71d6a702f313e5c7991d37f9150740_NeikiAnalytics.exe 1376 8c71d6a702f313e5c7991d37f9150740_NeikiAnalytics.exe 3528 adobec.exe 3528 adobec.exe 1376 8c71d6a702f313e5c7991d37f9150740_NeikiAnalytics.exe 1376 8c71d6a702f313e5c7991d37f9150740_NeikiAnalytics.exe 3528 adobec.exe 3528 adobec.exe 1376 8c71d6a702f313e5c7991d37f9150740_NeikiAnalytics.exe 1376 8c71d6a702f313e5c7991d37f9150740_NeikiAnalytics.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1376 wrote to memory of 3528 1376 8c71d6a702f313e5c7991d37f9150740_NeikiAnalytics.exe 89 PID 1376 wrote to memory of 3528 1376 8c71d6a702f313e5c7991d37f9150740_NeikiAnalytics.exe 89 PID 1376 wrote to memory of 3528 1376 8c71d6a702f313e5c7991d37f9150740_NeikiAnalytics.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\8c71d6a702f313e5c7991d37f9150740_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\8c71d6a702f313e5c7991d37f9150740_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\UserDotR3\adobec.exeC:\UserDotR3\adobec.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3528
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\LabZLM\dobdevsys.exe
- Size 2.7MB
- SHA256 6ec72b5dfb8e42fc3f74bf3d5c9217b9586ea21e16e9c625810235a74b769988
- MD5 5aa82194af85f47b5fd12d9ec1a2e546
- SHA1 c348449c5b2c0e3ffb5c1045e9f0b2143b9957a3
- SHA512 78cc9bef8f375193d2bd7d54cd4cd456535ffe0ff0c9589334fc207c7f9b95c689b519b53c557f69d91b8ce4bb7cb7636f2d02fa1c513998221c0a55ae76519e
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LB49w4Sx:+R0pI/IQlUoMPdmpSp24
- MD5 SHA1 SHA512 SSDEEP
- Path C:\UserDotR3\adobec.exe
- Size 2.7MB
- SHA256 716dc20b56ea1ca6be166a67fc1f65cc4332c2ccb5a0e534c5039fc2c925cc98
- MD5 1a5516ce8eed0520d8bbe73db0161687
- SHA1 7afc47f8d23f0a44e793fac82d41fe8c3e74d609
- SHA512 d547215e3ba582e277677e6b0569bad5065920d065a20bc15dc7283f1c73084dee7d58f25c676678803e13fa3316999b6e4473cb8b63052cc8d0acc8da068acd
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBb9w4Sx:+R0pI/IQlUoMPdmpSpj4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 203B
- SHA256 74655520cd38974819f442fed1ac0c0ea9bd9eff1397bcc01f937b537a5476b5
- MD5 f1a99d4094c58525a0c17a13e778b653
- SHA1 e6246303a8ada4cbbdb3601ed79d482ae83046d7
- SHA512 c40eb54eb792462175d7fd80479b934b335f93dab573f67c9e0da48ee0a9f522406996bf8489063c2e5e4ab2ace7f7cb223dfdfc39d2189c2c8003e5728461d9
- MD5 SHA1 SHA512