Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
04-06-2024 04:54
Behavioral task
behavioral1
Sample
2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe
-
Size
156KB
-
MD5
2f5ded0bf0199b0108ad2fbf8f281240
-
SHA1
f488f640abbada9faffb5527fc34ccc3f3ec6380
-
SHA256
bf6f734459c29605b927370cbc471ee810f033dd6883f84e01442d7a2df6db24
-
SHA512
d7d86fcb7c814ddf390e274e8d29b279d13d3e7ee6894a27c3c3174b04236512a8638c819a4c91c71d7feb8486525eb2f8b46173b5cf1f1a15a7df6371a8c760
-
SSDEEP
3072:LGbHwx3GsAFyQbXO0kwXmFRqAh+7QouCv8BATTy+zL9GwqRlcBapeEdmIMyXBr:LG7u6jrkwvKaXR0cyYLF6lcBapBddR
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2504-2-0x0000000000400000-0x000000000046F000-memory.dmp modiloader_stage2 -
Processes:
resource yara_rule behavioral2/memory/2504-0-0x0000000000400000-0x000000000046F000-memory.dmp upx behavioral2/memory/2504-2-0x0000000000400000-0x000000000046F000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe" 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exepid process 2504 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2504 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2504 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2504 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2504 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2504 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2504 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2504 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2504 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2504 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2504 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2504 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2504 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2504 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2504 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2504 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2504 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2504 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2504 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2504 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2504 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2504 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2504 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2504 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2504 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2504 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2504 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2504 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2504 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2504 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2504 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2504 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2504 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2504 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2504 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2504 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2504 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2504 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2504 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2504 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2504 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2504 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2504 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2504 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2504 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2504 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2504 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2504 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2504 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2504 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2504 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2504 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2504 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2504 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2504 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2504 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2504 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2504 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2504 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2504 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2504 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2504 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2504 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe 2504 2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2f5ded0bf0199b0108ad2fbf8f281240_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\explorer.exeexplorer.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2504-0-0x0000000000400000-0x000000000046F000-memory.dmpFilesize
444KB
-
memory/2504-1-0x00000000021F0000-0x00000000021F1000-memory.dmpFilesize
4KB
-
memory/2504-2-0x0000000000400000-0x000000000046F000-memory.dmpFilesize
444KB
-
memory/2504-4-0x00000000021F0000-0x00000000021F1000-memory.dmpFilesize
4KB