Analysis
- max time kernel
150s - max time network
128s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 20:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
96d63ef82b779ba12fd93a35d328d530_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
96d63ef82b779ba12fd93a35d328d530_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 96d63ef82b779ba12fd93a35d328d530_NeikiAnalytics.exe
- Size 3.2MB
- Sample240603-yscecsgb4s
- SHA256 b4ac2e9278f3800a42c742c46a4fc44ace8a086e3bb38572647c133c8a458cf6
- MD5 96d63ef82b779ba12fd93a35d328d530
- SHA1 ca648af7841a914135f6f6151f0371ae884e6023
- SHA512 56f66155089cbf388fd65b1ecbed061f12832d4e41ff8c94f828feb327a9a203faf804a837c270529d2c02604b2e620aca5baf0dff37450f756193053472b9a1
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBLB/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUp0bVz8eLFcz
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysxdob.exe 96d63ef82b779ba12fd93a35d328d530_NeikiAnalytics.exe - Executes dropped EXE 2 IoCs
pid Process 336 sysxdob.exe 2492 devbodsys.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\SysDrv44\\devbodsys.exe" 96d63ef82b779ba12fd93a35d328d530_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\VidNZ\\dobxsys.exe" 96d63ef82b779ba12fd93a35d328d530_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2748 96d63ef82b779ba12fd93a35d328d530_NeikiAnalytics.exe 2748 96d63ef82b779ba12fd93a35d328d530_NeikiAnalytics.exe 2748 96d63ef82b779ba12fd93a35d328d530_NeikiAnalytics.exe 2748 96d63ef82b779ba12fd93a35d328d530_NeikiAnalytics.exe 336 sysxdob.exe 336 sysxdob.exe 2492 devbodsys.exe 2492 devbodsys.exe 336 sysxdob.exe 336 sysxdob.exe 2492 devbodsys.exe 2492 devbodsys.exe 336 sysxdob.exe 336 sysxdob.exe 2492 devbodsys.exe 2492 devbodsys.exe 336 sysxdob.exe 336 sysxdob.exe 2492 devbodsys.exe 2492 devbodsys.exe 336 sysxdob.exe 336 sysxdob.exe 2492 devbodsys.exe 2492 devbodsys.exe 336 sysxdob.exe 336 sysxdob.exe 2492 devbodsys.exe 2492 devbodsys.exe 336 sysxdob.exe 336 sysxdob.exe 2492 devbodsys.exe 2492 devbodsys.exe 336 sysxdob.exe 336 sysxdob.exe 2492 devbodsys.exe 2492 devbodsys.exe 336 sysxdob.exe 336 sysxdob.exe 2492 devbodsys.exe 2492 devbodsys.exe 336 sysxdob.exe 336 sysxdob.exe 2492 devbodsys.exe 2492 devbodsys.exe 336 sysxdob.exe 336 sysxdob.exe 2492 devbodsys.exe 2492 devbodsys.exe 336 sysxdob.exe 336 sysxdob.exe 2492 devbodsys.exe 2492 devbodsys.exe 336 sysxdob.exe 336 sysxdob.exe 2492 devbodsys.exe 2492 devbodsys.exe 336 sysxdob.exe 336 sysxdob.exe 2492 devbodsys.exe 2492 devbodsys.exe 336 sysxdob.exe 336 sysxdob.exe 2492 devbodsys.exe 2492 devbodsys.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2748 wrote to memory of 336 2748 96d63ef82b779ba12fd93a35d328d530_NeikiAnalytics.exe 96 PID 2748 wrote to memory of 336 2748 96d63ef82b779ba12fd93a35d328d530_NeikiAnalytics.exe 96 PID 2748 wrote to memory of 336 2748 96d63ef82b779ba12fd93a35d328d530_NeikiAnalytics.exe 96 PID 2748 wrote to memory of 2492 2748 96d63ef82b779ba12fd93a35d328d530_NeikiAnalytics.exe 98 PID 2748 wrote to memory of 2492 2748 96d63ef82b779ba12fd93a35d328d530_NeikiAnalytics.exe 98 PID 2748 wrote to memory of 2492 2748 96d63ef82b779ba12fd93a35d328d530_NeikiAnalytics.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\96d63ef82b779ba12fd93a35d328d530_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\96d63ef82b779ba12fd93a35d328d530_NeikiAnalytics.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysxdob.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysxdob.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:336
-
-
C:\SysDrv44\devbodsys.exeC:\SysDrv44\devbodsys.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2492
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3404,i,1999448010053300448,1112699187621658374,262144 --variations-seed-version --mojo-platform-channel-handle=3976 /prefetch:81⤵PID:1272
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\SysDrv44\devbodsys.exe
- Size 52KB
- SHA256 b1ff5dbfa7ee8014ccc94d7a92b4561a31b334a840746b14a24d22412d05d787
- MD5 69c0b2555663358261c997f6c659f06b
- SHA1 313def4705bf1ef0bdc2e35f27ced0a05f517943
- SHA512 52134c0edddedd0c8adc7176eb281ff11a952f3b251c10ea8d855ce68f222387ab7b406e5d6594d95879d5cd52e28532da6c0d9610fbc0dcd59b943269b82523
- SSDEEP 768:xezkk/DUj7TlODVED17nKFO3nq/KjsDZe+pxsjqsXQJ+YWNn6q8/oIovypoRMkfn:ABalOBo1TKFO3n0KkZHqX7+g2lWXQm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\SysDrv44\devbodsys.exe
- Size 3.2MB
- SHA256 0f2f4b99b28c117795bb0f4670122a88dd9a5e9adad0ac2b1233f3ee5a8fe6c1
- MD5 2ed38fdee683d755d793bc0ad3b2cf85
- SHA1 3a1032963b8cc4ea4e36eb1156d1dd3456e37aea
- SHA512 9e2a574f358cc9aef2fa6669dc79271398d7a9db0ce9d8dac2efa288d3144c4cbe1b4394c87a6ab86631d6151421660c5282b2d56eb33a72d4e8de272ba481e5
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBoB/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUpDbVz8eLFcz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 202B
- SHA256 c0f8c167bf4b3f15806f6b9da0615d6926397ea4c746d024c5d67160583fa037
- MD5 82bcc0df9cfcc6c3deb7a46049b5643a
- SHA1 193bf1d88d2bc49798204327cbbe9527e4610372
- SHA512 0da785d1e0dd239799cefb555f6f45c8002503b0f9923657ac4b320b254a8c8417359d0ad324d369deb2c773e5307d3304b910c80ede9c6cb11e5c4d9d3e607b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 170B
- SHA256 e9b4bea1487270c7fea0155c8abb9b5d2c53f5644c272e489cccd0064f597cae
- MD5 2b987400ab8fad1aee606620acc2e926
- SHA1 290ace65e6beef64f83fad1980889c98e2856a0a
- SHA512 b592062b5ca52e7ce7946947fdffc191f633bd0fcb93eec6ec6c7e21743c3cea58601a1287d0e375e02e81bcc71edfa729764a059ce5aa579a1ca91eaf3a478d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysxdob.exe
- Size 3.2MB
- SHA256 c67ccf0a67a08f3d0d0dd3dd2be0775cdd1182bb8d757e0b50d21282b61fb485
- MD5 1dcc7b20a1e016b07fdb577287badc5e
- SHA1 7eea2b38af305ef5e99c6533646c473c3ffcaeaa
- SHA512 83ffd09c0f50782b852b1839c6b3d39ab743fea589b56529fb6303b18fda8c4df2658da82ad48b221604bf769f1b12233d58ea3b8cfc447dda68f76a8b36c6c6
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB4B/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUpTbVz8eLFcz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\VidNZ\dobxsys.exe
- Size 1.4MB
- SHA256 06dbefaf841a2e024cbe34b12f12c7906b1d1246412e7a5ed0ce973c782af9a0
- MD5 0ffd14a72b79afca0ab15da661b8767a
- SHA1 d8cc7a05d3ae8d2993c521512ef32de4c3267187
- SHA512 682ca5ed854e646dc97533c4211cc926cc8dc5150709d0575803e3c8e9872a7c717fc1f0b77fa583e60ed4cbae570c3450f831a03cdc2e479b53c8d68901e840
- SSDEEP 24576:6nxDZV7xMyu6qJ2WSYxBdSqpcVdm5XRVpQO3chiIcr1RhSKntaxtooblyiuafDDG:sxX7665YxRVplZzSKntlGIiT+Hvv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\VidNZ\dobxsys.exe
- Size 3.2MB
- SHA256 88d1e664f5915cf4dbb83d4c557d57e76e4325dfd01c17002bf9444bccbf104e
- MD5 074537ff15a7543fe2cafe8ce803f736
- SHA1 da4db875d07303bbcabb0e28b5ef687005eaaefc
- SHA512 8093455e08b76959178b3314843fb707580b04b50890e6f813ffa097225e072d46c2bc88aef613863753caf50b96c84b6408762f9d033465aae3c31b27a12e49
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBwB/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUpXbVz8eLFcz
- MD5 SHA1 SHA512 SSDEEP