Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04-06-2024 04:54
Behavioral task
behavioral1
Sample
2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe
-
Size
156KB
-
MD5
2f5ded0bf0199b0108ad2fbf8f281240
-
SHA1
f488f640abbada9faffb5527fc34ccc3f3ec6380
-
SHA256
bf6f734459c29605b927370cbc471ee810f033dd6883f84e01442d7a2df6db24
-
SHA512
d7d86fcb7c814ddf390e274e8d29b279d13d3e7ee6894a27c3c3174b04236512a8638c819a4c91c71d7feb8486525eb2f8b46173b5cf1f1a15a7df6371a8c760
-
SSDEEP
3072:LGbHwx3GsAFyQbXO0kwXmFRqAh+7QouCv8BATTy+zL9GwqRlcBapeEdmIMyXBr:LG7u6jrkwvKaXR0cyYLF6lcBapBddR
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 3 IoCs
Processes:
resource yara_rule behavioral1/memory/2292-0-0x0000000000400000-0x000000000046F000-memory.dmp modiloader_stage2 behavioral1/memory/2292-2-0x0000000000400000-0x000000000046F000-memory.dmp modiloader_stage2 behavioral1/memory/2292-3-0x0000000000400000-0x000000000046F000-memory.dmp modiloader_stage2 -
Processes:
resource yara_rule behavioral1/memory/2292-0-0x0000000000400000-0x000000000046F000-memory.dmp upx behavioral1/memory/2292-2-0x0000000000400000-0x000000000046F000-memory.dmp upx behavioral1/memory/2292-3-0x0000000000400000-0x000000000046F000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe" 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exepid process 2292 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2292 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2292 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2292 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2292 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2292 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2292 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2292 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2292 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2292 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2292 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2292 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2292 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2292 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2292 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2292 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2292 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2292 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2292 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2292 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2292 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2292 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2292 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2292 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2292 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2292 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2292 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2292 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2292 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2292 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2292 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2292 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2292 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2292 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2292 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2292 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2292 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2292 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2292 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2292 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2292 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2292 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2292 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2292 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2292 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2292 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2292 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2292 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2292 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2292 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2292 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2292 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2292 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2292 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2292 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2292 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2292 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2292 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2292 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2292 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2292 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2292 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2292 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2292 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exepid process 2292 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\explorer.exeexplorer.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2292-0-0x0000000000400000-0x000000000046F000-memory.dmpFilesize
444KB
-
memory/2292-1-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/2292-2-0x0000000000400000-0x000000000046F000-memory.dmpFilesize
444KB
-
memory/2292-3-0x0000000000400000-0x000000000046F000-memory.dmpFilesize
444KB
-
memory/2292-4-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB