Analysis
- max time kernel
149s - max time network
125s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 18:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ffce3d39dfa3b7a339d816e3b8f2eab0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
ffce3d39dfa3b7a339d816e3b8f2eab0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target ffce3d39dfa3b7a339d816e3b8f2eab0_NeikiAnalytics.exe
- Size 3.9MB
- Sample240603-w494naef7v
- SHA256 00b1658be978eb06dc9414fe06688f816cf99b8590fda5e02d481be3fbfc8cd3
- MD5 ffce3d39dfa3b7a339d816e3b8f2eab0
- SHA1 7a90fc219bb456f815e2eca74ef498914253a711
- SHA512 d227c19805d96086d9093ba821ce8c42dc88ca265dcd8ee3e7575387c625a849230daa296fb9fdbfef22cc9d7f4f1fc5169b9aa3960fa4a40c4b3f79dfd9089b
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBXB/bSqz8:sxX7QnxrloE5dpUpkbVz8
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxbod.exe ffce3d39dfa3b7a339d816e3b8f2eab0_NeikiAnalytics.exe - Executes dropped EXE 2 IoCs
pid Process 1884 locxbod.exe 4472 abodec.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\Adobe8S\\abodec.exe" ffce3d39dfa3b7a339d816e3b8f2eab0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\MintG9\\bodasys.exe" ffce3d39dfa3b7a339d816e3b8f2eab0_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1816 ffce3d39dfa3b7a339d816e3b8f2eab0_NeikiAnalytics.exe 1816 ffce3d39dfa3b7a339d816e3b8f2eab0_NeikiAnalytics.exe 1816 ffce3d39dfa3b7a339d816e3b8f2eab0_NeikiAnalytics.exe 1816 ffce3d39dfa3b7a339d816e3b8f2eab0_NeikiAnalytics.exe 1884 locxbod.exe 1884 locxbod.exe 4472 abodec.exe 4472 abodec.exe 1884 locxbod.exe 1884 locxbod.exe 4472 abodec.exe 4472 abodec.exe 1884 locxbod.exe 1884 locxbod.exe 4472 abodec.exe 4472 abodec.exe 1884 locxbod.exe 1884 locxbod.exe 4472 abodec.exe 4472 abodec.exe 1884 locxbod.exe 1884 locxbod.exe 4472 abodec.exe 4472 abodec.exe 1884 locxbod.exe 1884 locxbod.exe 4472 abodec.exe 4472 abodec.exe 1884 locxbod.exe 1884 locxbod.exe 4472 abodec.exe 4472 abodec.exe 1884 locxbod.exe 1884 locxbod.exe 4472 abodec.exe 4472 abodec.exe 1884 locxbod.exe 1884 locxbod.exe 4472 abodec.exe 4472 abodec.exe 1884 locxbod.exe 1884 locxbod.exe 4472 abodec.exe 4472 abodec.exe 1884 locxbod.exe 1884 locxbod.exe 4472 abodec.exe 4472 abodec.exe 1884 locxbod.exe 1884 locxbod.exe 4472 abodec.exe 4472 abodec.exe 1884 locxbod.exe 1884 locxbod.exe 4472 abodec.exe 4472 abodec.exe 1884 locxbod.exe 1884 locxbod.exe 4472 abodec.exe 4472 abodec.exe 1884 locxbod.exe 1884 locxbod.exe 4472 abodec.exe 4472 abodec.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1816 wrote to memory of 1884 1816 ffce3d39dfa3b7a339d816e3b8f2eab0_NeikiAnalytics.exe 85 PID 1816 wrote to memory of 1884 1816 ffce3d39dfa3b7a339d816e3b8f2eab0_NeikiAnalytics.exe 85 PID 1816 wrote to memory of 1884 1816 ffce3d39dfa3b7a339d816e3b8f2eab0_NeikiAnalytics.exe 85 PID 1816 wrote to memory of 4472 1816 ffce3d39dfa3b7a339d816e3b8f2eab0_NeikiAnalytics.exe 88 PID 1816 wrote to memory of 4472 1816 ffce3d39dfa3b7a339d816e3b8f2eab0_NeikiAnalytics.exe 88 PID 1816 wrote to memory of 4472 1816 ffce3d39dfa3b7a339d816e3b8f2eab0_NeikiAnalytics.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\ffce3d39dfa3b7a339d816e3b8f2eab0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\ffce3d39dfa3b7a339d816e3b8f2eab0_NeikiAnalytics.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxbod.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxbod.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1884
-
-
C:\Adobe8S\abodec.exeC:\Adobe8S\abodec.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4472
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Adobe8S\abodec.exe
- Size 3.9MB
- SHA256 3a00a5ce43a124c87d8c559c235715d6e04b4e643b8cf3e715fd2980f9ddb714
- MD5 ffefd480f18b1cc68e455e58b5528a4e
- SHA1 10f0103ab8a696237dd5198d2b5c12af94981a1f
- SHA512 283a1b3ff077192810293b25cc1a6d2c4afab026cf81e78d83bad4d6741ee3990d8d7ed1dffb4ad53f8b072739ffbcc31704ea94b94515fa290b8ac58d796a73
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBQqB/bSqz8:sxX7QnxrloE5dpUpabVz8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MintG9\bodasys.exe
- Size 3.9MB
- SHA256 a4a25a80ab5b20bad381c4e0bb3e8b8ec7a005a2db3b1077256c9fccc02ad162
- MD5 8164f370935b6cda7dbff91724407538
- SHA1 e1134f4d4ccc409b64201b67e86eaec2b4e65534
- SHA512 de5af77790103d1338aaaa984a08d3f4bca541309103bcc5a3a5cd831abafc5de62dc3a1c77854387cd5dfacc679d69b12cadf6dd613e7bd57a0fcd2aa54bd2b
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB+B/bSqz8:sxX7QnxrloE5dpUpBbVz8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MintG9\bodasys.exe
- Size 19KB
- SHA256 3f18d1d03400c4d710f34982399fe5eeb8c6a1ec26c52f5e60d3fbdbb38a176d
- MD5 5244a0d911bd0209858fb5dd73f185bd
- SHA1 bad354400dd074b1f428dfd77bb1e9d0fa33eae0
- SHA512 bb44dae1f47d312ba70fb07f3f78f118fc54476508654d8c920ccb2764e193de902fd13dcd82f6c9f4e48de5c8921272062cdb118ddd04725d702df7195b6d9d
- SSDEEP 384:04ezXTIk/IxT/ES70S7TqOODVtLiD1APED:xezkk/DUj7TlODVED17D
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 199B
- SHA256 4d7483a0dd5919a4f29a1745a106c3fb1d55679732f2e3e1c7fdab91cdc0edce
- MD5 161cc6a9db68f099de250d4514350969
- SHA1 8d77634c9b935680bb5044581ddaaca4efb1b959
- SHA512 170cf7a3f0aa01d436febd28a3612c52615af7b580e7575ad45e7a7a0787ab0e7c1a162d553d6cbfa6eb1f95e472e206da63ad3f3c2625356e28d8cc32d2d68f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 167B
- SHA256 4856a410b51dc87b3cdfa2d3494d1f3c998f373ffd11ab59642f7b74a2ed7de8
- MD5 3f71f90499197acb290dbd76445ffa8b
- SHA1 93600330624574e7ea0c21815d13284693b8cf20
- SHA512 0dc0f9c0c85d53a120db88d18b57e34a4779b23d5806595cf9b4cec9bfab572ff2b5e0ef61e3ba718a0787d12190b66d358456edbee2f8497dc6c0e4f2064387
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxbod.exe
- Size 3.9MB
- SHA256 450e6ca63d78acbf262f6e5adb1a9b4cea471f3596c3e6c6222b6a9122935107
- MD5 7e95675d34b97cec02cbc67b61dbaa38
- SHA1 1d67b84cca03d94187ed1c3f5e4e701128f0fc96
- SHA512 3622639f054469bf7b2b679a543d2cf9e1e719411a38d80cf9aa75174a15f4687ffda553e785e7bfc5c2d09ec3ff120d966bb71d387825809715cf9d3027bde1
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB4B/bSqz8:sxX7QnxrloE5dpUpvbVz8
- MD5 SHA1 SHA512 SSDEEP