9b59fa4ea4eeb4b90944822d5cfdfb2c2fd87adb0b3030bc995d0ef9508cb70f

Analysis

max time kernel
149s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
04-06-2024 11:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d9e2b8f72f7f971ac677fa19297a8af0_NeikiAnalytics.exe
Size

2.7MB
MD5

d9e2b8f72f7f971ac677fa19297a8af0
SHA1

99af21fc74da044381d4775984b04d000f9f4d5c
SHA256

9b59fa4ea4eeb4b90944822d5cfdfb2c2fd87adb0b3030bc995d0ef9508cb70f
SHA512

8baee689f1c3e9687e959d83316cc0ee24c548f46e165f2e4d54214cca4125022ccb90cc77270d1e784190c2cbe2717e6a4c7a574afce98ab82f0eef71b084b6
SSDEEP

49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LB+9w4Sx:+R0pI/IQlUoMPdmpSpg4

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3864	abodsys.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\Intelproc6D\\abodsys.exe"	d9e2b8f72f7f971ac677fa19297a8af0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\VidIY\\bodxloc.exe"	d9e2b8f72f7f971ac677fa19297a8af0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4640	d9e2b8f72f7f971ac677fa19297a8af0_NeikiAnalytics.exe
4640	d9e2b8f72f7f971ac677fa19297a8af0_NeikiAnalytics.exe
4640	d9e2b8f72f7f971ac677fa19297a8af0_NeikiAnalytics.exe
4640	d9e2b8f72f7f971ac677fa19297a8af0_NeikiAnalytics.exe
3864	abodsys.exe
3864	abodsys.exe
4640	d9e2b8f72f7f971ac677fa19297a8af0_NeikiAnalytics.exe
4640	d9e2b8f72f7f971ac677fa19297a8af0_NeikiAnalytics.exe
3864	abodsys.exe
3864	abodsys.exe
4640	d9e2b8f72f7f971ac677fa19297a8af0_NeikiAnalytics.exe
4640	d9e2b8f72f7f971ac677fa19297a8af0_NeikiAnalytics.exe
3864	abodsys.exe
3864	abodsys.exe
4640	d9e2b8f72f7f971ac677fa19297a8af0_NeikiAnalytics.exe
4640	d9e2b8f72f7f971ac677fa19297a8af0_NeikiAnalytics.exe
3864	abodsys.exe
3864	abodsys.exe
4640	d9e2b8f72f7f971ac677fa19297a8af0_NeikiAnalytics.exe
4640	d9e2b8f72f7f971ac677fa19297a8af0_NeikiAnalytics.exe
3864	abodsys.exe
3864	abodsys.exe
4640	d9e2b8f72f7f971ac677fa19297a8af0_NeikiAnalytics.exe
4640	d9e2b8f72f7f971ac677fa19297a8af0_NeikiAnalytics.exe
3864	abodsys.exe
3864	abodsys.exe
4640	d9e2b8f72f7f971ac677fa19297a8af0_NeikiAnalytics.exe
4640	d9e2b8f72f7f971ac677fa19297a8af0_NeikiAnalytics.exe
3864	abodsys.exe
3864	abodsys.exe
4640	d9e2b8f72f7f971ac677fa19297a8af0_NeikiAnalytics.exe
4640	d9e2b8f72f7f971ac677fa19297a8af0_NeikiAnalytics.exe
3864	abodsys.exe
3864	abodsys.exe
4640	d9e2b8f72f7f971ac677fa19297a8af0_NeikiAnalytics.exe
4640	d9e2b8f72f7f971ac677fa19297a8af0_NeikiAnalytics.exe
3864	abodsys.exe
3864	abodsys.exe
4640	d9e2b8f72f7f971ac677fa19297a8af0_NeikiAnalytics.exe
4640	d9e2b8f72f7f971ac677fa19297a8af0_NeikiAnalytics.exe
3864	abodsys.exe
3864	abodsys.exe
4640	d9e2b8f72f7f971ac677fa19297a8af0_NeikiAnalytics.exe
4640	d9e2b8f72f7f971ac677fa19297a8af0_NeikiAnalytics.exe
3864	abodsys.exe
3864	abodsys.exe
4640	d9e2b8f72f7f971ac677fa19297a8af0_NeikiAnalytics.exe
4640	d9e2b8f72f7f971ac677fa19297a8af0_NeikiAnalytics.exe
3864	abodsys.exe
3864	abodsys.exe
4640	d9e2b8f72f7f971ac677fa19297a8af0_NeikiAnalytics.exe
4640	d9e2b8f72f7f971ac677fa19297a8af0_NeikiAnalytics.exe
3864	abodsys.exe
3864	abodsys.exe
4640	d9e2b8f72f7f971ac677fa19297a8af0_NeikiAnalytics.exe
4640	d9e2b8f72f7f971ac677fa19297a8af0_NeikiAnalytics.exe
3864	abodsys.exe
3864	abodsys.exe
4640	d9e2b8f72f7f971ac677fa19297a8af0_NeikiAnalytics.exe
4640	d9e2b8f72f7f971ac677fa19297a8af0_NeikiAnalytics.exe
3864	abodsys.exe
3864	abodsys.exe
4640	d9e2b8f72f7f971ac677fa19297a8af0_NeikiAnalytics.exe
4640	d9e2b8f72f7f971ac677fa19297a8af0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4640 wrote to memory of 3864	4640	d9e2b8f72f7f971ac677fa19297a8af0_NeikiAnalytics.exe	84
PID 4640 wrote to memory of 3864	4640	d9e2b8f72f7f971ac677fa19297a8af0_NeikiAnalytics.exe	84
PID 4640 wrote to memory of 3864	4640	d9e2b8f72f7f971ac677fa19297a8af0_NeikiAnalytics.exe	84

C:\Users\Admin\AppData\Local\Temp\d9e2b8f72f7f971ac677fa19297a8af0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\d9e2b8f72f7f971ac677fa19297a8af0_NeikiAnalytics.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Intelproc6D\abodsys.exe
  C:\Intelproc6D\abodsys.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:3864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Intelproc6D\abodsys.exe

Filesize
2.7MB

MD5
14b4f76ac803c22df3cf5f0d27f43a29

SHA1
01d1946a2f799315690f0ea52da6c5206efeb6db

SHA256
abcd41a9c3daba07d4a3778a6145c16913e621ae7d4dcba77182af6868dc2025

SHA512
33a50a45f59f168b4562d7fc2fda9e5b12356a029547ef3fc9b8bc08089197fac40438f6b3e6c4719aeae13d2c96ca7bee4c656859bfc760c07fe99b6eb9fbef

Download Submit
C:\Users\Admin\253086396416_10.0_Admin.ini

Filesize
205B

MD5
3562124b445747fa489c7fbbe7ded416

SHA1
41a1d932fc30489d18324453657704c46242880c

SHA256
c8aa860591bc992ac7048444d674d7dfb21b2e3ba613c0f8d69a144aff3665fc

SHA512
432ca9ed37ddb9292aee6b04a16d8391b709fbdb5558c7f81be7f86276b4114b87299f2261fd2bf8f416cbc91ee499b8d91e894f40607291ff646a95cceabfaa

Download Submit
C:\VidIY\bodxloc.exe

Filesize
332KB

MD5
33c1dd1903b6ab9128c0aa66c61d93ff

SHA1
556326d20c0f6488c0180d639bb60e2fb2341133

SHA256
a33d196113808b53e92a9f3f30fd36b24e89d7561bb5be3dcecc3cee2336809e

SHA512
b9b82fa41a0da55bb1a0da20e9e95786ea3f3aead86824dcc17ba2ecad0a792f9264490f608c3d1393b4ac97b9728d09fe44a7d8bd899dc9815cad5ae74ab8b1

Download Submit