Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 19:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
849d1cf8062649223b09520bac884810_NeikiAnalytics.exe
Resource
win7-20240215-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
849d1cf8062649223b09520bac884810_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 849d1cf8062649223b09520bac884810_NeikiAnalytics.exe
- Size 3.6MB
- Sample240603-xvmsfage83
- SHA256 a46db0ec57ea6070f6f481d9eaa89ec9644e60a9914605e0dd50871f0c8fa589
- MD5 849d1cf8062649223b09520bac884810
- SHA1 a503996029beebea9da5bc2ea5f932c65978bf02
- SHA512 b9368453be4fd2797293e0eba19d3bfb40dfefdd82a78518918488af51b754ac06116787e07403427f0bfc5ee68349761be08a4f8be331a8611f9e9102bcdad8
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB1B/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUpqbVz8eLFcz
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecxbod.exe 849d1cf8062649223b09520bac884810_NeikiAnalytics.exe - Executes dropped EXE 2 IoCs
pid Process 2556 ecxbod.exe 4088 devbodec.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\SysDrvZA\\devbodec.exe" 849d1cf8062649223b09520bac884810_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\KaVBRS\\dobasys.exe" 849d1cf8062649223b09520bac884810_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 904 849d1cf8062649223b09520bac884810_NeikiAnalytics.exe 904 849d1cf8062649223b09520bac884810_NeikiAnalytics.exe 904 849d1cf8062649223b09520bac884810_NeikiAnalytics.exe 904 849d1cf8062649223b09520bac884810_NeikiAnalytics.exe 2556 ecxbod.exe 2556 ecxbod.exe 4088 devbodec.exe 4088 devbodec.exe 2556 ecxbod.exe 2556 ecxbod.exe 4088 devbodec.exe 4088 devbodec.exe 2556 ecxbod.exe 2556 ecxbod.exe 4088 devbodec.exe 4088 devbodec.exe 2556 ecxbod.exe 2556 ecxbod.exe 4088 devbodec.exe 4088 devbodec.exe 2556 ecxbod.exe 2556 ecxbod.exe 4088 devbodec.exe 4088 devbodec.exe 2556 ecxbod.exe 2556 ecxbod.exe 4088 devbodec.exe 4088 devbodec.exe 2556 ecxbod.exe 2556 ecxbod.exe 4088 devbodec.exe 4088 devbodec.exe 2556 ecxbod.exe 2556 ecxbod.exe 4088 devbodec.exe 4088 devbodec.exe 2556 ecxbod.exe 2556 ecxbod.exe 4088 devbodec.exe 4088 devbodec.exe 2556 ecxbod.exe 2556 ecxbod.exe 4088 devbodec.exe 4088 devbodec.exe 2556 ecxbod.exe 2556 ecxbod.exe 4088 devbodec.exe 4088 devbodec.exe 2556 ecxbod.exe 2556 ecxbod.exe 4088 devbodec.exe 4088 devbodec.exe 2556 ecxbod.exe 2556 ecxbod.exe 4088 devbodec.exe 4088 devbodec.exe 2556 ecxbod.exe 2556 ecxbod.exe 4088 devbodec.exe 4088 devbodec.exe 2556 ecxbod.exe 2556 ecxbod.exe 4088 devbodec.exe 4088 devbodec.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 904 wrote to memory of 2556 904 849d1cf8062649223b09520bac884810_NeikiAnalytics.exe 90 PID 904 wrote to memory of 2556 904 849d1cf8062649223b09520bac884810_NeikiAnalytics.exe 90 PID 904 wrote to memory of 2556 904 849d1cf8062649223b09520bac884810_NeikiAnalytics.exe 90 PID 904 wrote to memory of 4088 904 849d1cf8062649223b09520bac884810_NeikiAnalytics.exe 92 PID 904 wrote to memory of 4088 904 849d1cf8062649223b09520bac884810_NeikiAnalytics.exe 92 PID 904 wrote to memory of 4088 904 849d1cf8062649223b09520bac884810_NeikiAnalytics.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\849d1cf8062649223b09520bac884810_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\849d1cf8062649223b09520bac884810_NeikiAnalytics.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:904 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecxbod.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecxbod.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2556
-
-
C:\SysDrvZA\devbodec.exeC:\SysDrvZA\devbodec.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4088
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\KaVBRS\dobasys.exe
- Size 3.6MB
- SHA256 50fde544a0807f0961c5573f1fec6d3f4c184a7b86065cce33f805f57c9db0a8
- MD5 b84791f2c0ccae6920990f0463dc2253
- SHA1 20033b737263f74f5efc681d7c3ee4484cdef6c8
- SHA512 7ee1d21ac1f93c806f8985240e1a585c9dd95ae9f9d92c6259f8d72c243f8cad084c5df8a0a262c9bb24b57d5c369eb13d007d573d64b20b9809f3634d3f0510
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBAB/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUpXbVz8eLFcz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\KaVBRS\dobasys.exe
- Size 3.6MB
- SHA256 68b061becbd1dcf434e6a519601d8fa82d75bb2725e0c01ff1e8eacae8afcbb0
- MD5 fec4e27213de5f58dfd15580596b1a63
- SHA1 2b62dfd0f419f33117393581a2e7ec155d082eac
- SHA512 1011f7c707461201f69aa0ef6b2d7fb06949f68b34df998077259c16c5475519614084855eff303dcccf34367449c2273b8a624f3b6468002e94241a423b509b
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBSB/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUp1bVz8eLFcz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\SysDrvZA\devbodec.exe
- Size 179KB
- SHA256 b3b70e233978391299af18729748c2f75c0778508b2e711a56ff9f55a5dac404
- MD5 46270939adf2eba2bcde1851aedd4f34
- SHA1 4022ffba5766fa2fa7b13dded7d040cb174d4147
- SHA512 50222b74081897a81fd5bbd920a5c8840efd8a3a78c60dfb92a686125c3e7b412d9539c0738eaf3333dec2a5e3372a9d36051754158f8876fe620248e4077ae8
- SSDEEP 3072:6uOByTKI3n0dZHm7+zsMcSgUXwr6a/Ej2vfGm+7s+ndOPtiT7gVU:6nyJ3n0Dm7+zm6wr6YEjAumIaU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\SysDrvZA\devbodec.exe
- Size 3.6MB
- SHA256 219793c1ca83654e644db6f51d99c58b99452b1d7d145eb05d556ee3e7b277ab
- MD5 28cac93725c6ab34f1f9d8e9824ba954
- SHA1 04ba5095f6b1bb2b5c41073c73fdf4b4db565ec4
- SHA512 96e6cdc9192d8f8c1d896aef08d9354bcb3e5531fe8c9bd8cd2192444c8eaf6f6ea900a1279a771a7a7e0250278de3e96f663b5d5aa88f65b13c7c57085b4e0b
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBZB/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUpCbVz8eLFcz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 201B
- SHA256 efe38f473aa22f22a5e1d1733145a68f2848c142efd46b364e25d49069637372
- MD5 6795034521e17a2f6796f978349ab960
- SHA1 fbd63f492878e570bc9a4a71d43d7a41335eab7d
- SHA512 dc6df2f2b2d734f9db0243e64565c9e0e1f7b21010b2bf3b9d38484a7873f858a8d23ebd1c63f45ab90d89366d75b34c41a644a54251098b1c58910c1a32f9c9
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 169B
- SHA256 db64473a7ceac689fd9d44f3699392c261ef37cd7d4b39ca027439d45a500aa7
- MD5 0b1cfb10ab2c6d56638d4974b088d9ff
- SHA1 bdce0ae21a6da8cda6b065336584be0a6636cf2c
- SHA512 0f496eebc45f0fc1384f002e6dba21f172d6c5348a6e857c97c634524dbece37539e88235ef34466a313acbb1afba9c642fe3b87d4fc3fac9c40fb09ec6e7b4e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecxbod.exe
- Size 3.6MB
- SHA256 345c516e58a98d4a4348ed6911360b814794cc4972d83cafb262313345188c58
- MD5 e8e99ab891b1b20c38e7c76e1547f424
- SHA1 a27deef02bb77b4547f935827afc17ad141e9d60
- SHA512 01279ed8d100cdef8e473d0e1e48ae61eb431c5104f6657a3cf3e3f6a619d881eea63711757e5fd6cb9faa67e05466f7a92c0846be6e99a7a34449d155b49a37
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBvB/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUp8bVz8eLFcz
- MD5 SHA1 SHA512 SSDEEP