Analysis
- max time kernel
149s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 17:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f904dabfce9f25032444a8fa1c61b6e0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
f904dabfce9f25032444a8fa1c61b6e0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target f904dabfce9f25032444a8fa1c61b6e0_NeikiAnalytics.exe
- Size 3.1MB
- Sample240603-vszccadd3t
- SHA256 d5b1eda042dd3db7417daa7f38dd09ca4c1100c73279e5c7ece76eaa70499915
- MD5 f904dabfce9f25032444a8fa1c61b6e0
- SHA1 cc7433ce7b08ba9c06544a4e93e5899c34d07927
- SHA512 f076d98bc30f4301946634ab7b29bc700148aac9f56ba0332b0dcd84fbc8df56240638cb187c144fda57e90fcf1340de0a598fa416c5ce3c59fe2c04d3fcc521
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB8B/bSqz8:sxX7QnxrloE5dpUprbVz8
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecdevdob.exe f904dabfce9f25032444a8fa1c61b6e0_NeikiAnalytics.exe - Executes dropped EXE 2 IoCs
pid Process 4728 ecdevdob.exe 2112 abodec.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\UserDotAQ\\abodec.exe" f904dabfce9f25032444a8fa1c61b6e0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\KaVBWR\\dobxloc.exe" f904dabfce9f25032444a8fa1c61b6e0_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4428 f904dabfce9f25032444a8fa1c61b6e0_NeikiAnalytics.exe 4428 f904dabfce9f25032444a8fa1c61b6e0_NeikiAnalytics.exe 4428 f904dabfce9f25032444a8fa1c61b6e0_NeikiAnalytics.exe 4428 f904dabfce9f25032444a8fa1c61b6e0_NeikiAnalytics.exe 4728 ecdevdob.exe 4728 ecdevdob.exe 2112 abodec.exe 2112 abodec.exe 4728 ecdevdob.exe 4728 ecdevdob.exe 2112 abodec.exe 2112 abodec.exe 4728 ecdevdob.exe 4728 ecdevdob.exe 2112 abodec.exe 2112 abodec.exe 4728 ecdevdob.exe 4728 ecdevdob.exe 2112 abodec.exe 2112 abodec.exe 4728 ecdevdob.exe 4728 ecdevdob.exe 2112 abodec.exe 2112 abodec.exe 4728 ecdevdob.exe 4728 ecdevdob.exe 2112 abodec.exe 2112 abodec.exe 4728 ecdevdob.exe 4728 ecdevdob.exe 2112 abodec.exe 2112 abodec.exe 4728 ecdevdob.exe 4728 ecdevdob.exe 2112 abodec.exe 2112 abodec.exe 4728 ecdevdob.exe 4728 ecdevdob.exe 2112 abodec.exe 2112 abodec.exe 4728 ecdevdob.exe 4728 ecdevdob.exe 2112 abodec.exe 2112 abodec.exe 4728 ecdevdob.exe 4728 ecdevdob.exe 2112 abodec.exe 2112 abodec.exe 4728 ecdevdob.exe 4728 ecdevdob.exe 2112 abodec.exe 2112 abodec.exe 4728 ecdevdob.exe 4728 ecdevdob.exe 2112 abodec.exe 2112 abodec.exe 4728 ecdevdob.exe 4728 ecdevdob.exe 2112 abodec.exe 2112 abodec.exe 4728 ecdevdob.exe 4728 ecdevdob.exe 2112 abodec.exe 2112 abodec.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4428 wrote to memory of 4728 4428 f904dabfce9f25032444a8fa1c61b6e0_NeikiAnalytics.exe 87 PID 4428 wrote to memory of 4728 4428 f904dabfce9f25032444a8fa1c61b6e0_NeikiAnalytics.exe 87 PID 4428 wrote to memory of 4728 4428 f904dabfce9f25032444a8fa1c61b6e0_NeikiAnalytics.exe 87 PID 4428 wrote to memory of 2112 4428 f904dabfce9f25032444a8fa1c61b6e0_NeikiAnalytics.exe 89 PID 4428 wrote to memory of 2112 4428 f904dabfce9f25032444a8fa1c61b6e0_NeikiAnalytics.exe 89 PID 4428 wrote to memory of 2112 4428 f904dabfce9f25032444a8fa1c61b6e0_NeikiAnalytics.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\f904dabfce9f25032444a8fa1c61b6e0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\f904dabfce9f25032444a8fa1c61b6e0_NeikiAnalytics.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecdevdob.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecdevdob.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4728
-
-
C:\UserDotAQ\abodec.exeC:\UserDotAQ\abodec.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2112
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\KaVBWR\dobxloc.exe
- Size 16KB
- SHA256 f5a3c7159ddd1aa082416284e8faf93beb784a00cff9af7f8d9db47fdaf90b07
- MD5 d9314a0638010d5220d99d6790a7b4d7
- SHA1 3ef322cbab7e1211a05a8813f2f26dbf14204dcf
- SHA512 b67d246fcf7c5eddcb56e93fd5b67cf7459d3bf4e950515607d85e1e9d8a47f8fd0dc3d014912203f5f17919165aebaa12e309f6173a790dd48e119671bea430
- SSDEEP 192:0fgezXzDzjUHK9d9/XYxFn8E/ES76xS7BzFqJgjYJjafiVKYLJSlf:04ezXTIk/IxT/ES70S7TqOODVtLif
- MD5 SHA1 SHA512 SSDEEP
- Path C:\KaVBWR\dobxloc.exe
- Size 3.1MB
- SHA256 44132c41c41feaa43ebfe0f2ab65d608e48ed1b49da7a33fcd69e094f231ade6
- MD5 a09cd98802776a23720792cb4299b60e
- SHA1 75369107ab603174376edf17fdce748edab55b44
- SHA512 68db4d7ffd3ccef176265464ec5f9cd52d07257e2c56d522368e7ee9c2a998accffa39aa4318fd073aa337d976df0db2e333de3800f238a6dfb93211faf9a84c
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBLB/bSqz8:sxX7QnxrloE5dpUpkbVz8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\UserDotAQ\abodec.exe
- Size 3.1MB
- SHA256 4337d10ca7210a758d9715401b05a289530423b275f4a20405674cbfe36de467
- MD5 2c32404ce327290cf6ecf672ce961e4d
- SHA1 a985ec0a934bfe6a7f3eb8bc2389723ac3e27511
- SHA512 73a908a951bbc471020a6d029f60a953bf30523189d86747017429052bb1357a79421a7d07eae6a5ce6ba5dfd18c9a613c16f62e287c531acf0071699f486c77
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB+B/bSqz8:sxX7QnxrloE5dpUpFbVz8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 202B
- SHA256 7c41a5921b02da75c35089af17ec74e285f3b0bcf541329d68ff4aae6e6fb451
- MD5 d7620a0dd53600f02db99137224ecdbc
- SHA1 539eab2afdf7732d6f153056e4427da69ad8db4a
- SHA512 39f19c3fe07362d5cd6d52ed156a76e67c7279569f529259a2b259f7e140d5b97fc43d5d28ea95be26da21bfac2def5e72c156ba6f9decd7e1d1150cccecd148
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 170B
- SHA256 b14fbfc8a7714436e17bb6224dc1bd8088aea57bfd7c528fa18a52de6c0d63c4
- MD5 399b8c024633a23f66cf8987667e00d3
- SHA1 c74c14124f05b35b7185674a0e1505f59ee6af7b
- SHA512 c507f38a35905df6e2619fcbc8a11e022b9b5006878adddb091a428a7cff14520c0f8f99e4c9cb97e3d3e87dfc1c970a977165a6ab5982286efd60f3ab9040b6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecdevdob.exe
- Size 3.1MB
- SHA256 8f9a8230e6d85e54fa1306c6c73f5ef4c7b8bab806a609d53375524647776138
- MD5 3572a2a3689b32fc766a1bfce2d32698
- SHA1 6e60ec60e50727ca5666549ea32bd7c4146d09e7
- SHA512 4c76e5e20f07d359641ca609460c703f3bae4b13702ea47293217c21cfe04e729662e63c9ed949315679f000a5955e450febb0c126736bc50a5b7e11178ae407
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB0B/bSqz8:sxX7QnxrloE5dpUpTbVz8
- MD5 SHA1 SHA512 SSDEEP