e1c4a8f5e7038a5d14d2e3fbcce78d2da1e8b9a5b705bb3a51c93fa7e528f806

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 21:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

027f4ecaa38094f2c1e67bb2764dc990_NeikiAnalytics.exe
Size

2.7MB
MD5

027f4ecaa38094f2c1e67bb2764dc990
SHA1

61acb7a9db73b09c3910596a13d55479485dcd6c
SHA256

e1c4a8f5e7038a5d14d2e3fbcce78d2da1e8b9a5b705bb3a51c93fa7e528f806
SHA512

75dd4d1619ca1289206c63ceb62cb36a66d61fec241c45b52c2eb455198d20d35fb7f4afdf4a9659b8d9dc81040419daad59503a9792756ee50a12880b331069
SSDEEP

49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBb9w4Sx:+R0pI/IQlUoMPdmpSpr4

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5112	xdobloc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\FilesU4\\xdobloc.exe"	027f4ecaa38094f2c1e67bb2764dc990_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\KaVBUR\\dobasys.exe"	027f4ecaa38094f2c1e67bb2764dc990_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4556	027f4ecaa38094f2c1e67bb2764dc990_NeikiAnalytics.exe
4556	027f4ecaa38094f2c1e67bb2764dc990_NeikiAnalytics.exe
4556	027f4ecaa38094f2c1e67bb2764dc990_NeikiAnalytics.exe
4556	027f4ecaa38094f2c1e67bb2764dc990_NeikiAnalytics.exe
5112	xdobloc.exe
5112	xdobloc.exe
4556	027f4ecaa38094f2c1e67bb2764dc990_NeikiAnalytics.exe
4556	027f4ecaa38094f2c1e67bb2764dc990_NeikiAnalytics.exe
5112	xdobloc.exe
5112	xdobloc.exe
4556	027f4ecaa38094f2c1e67bb2764dc990_NeikiAnalytics.exe
4556	027f4ecaa38094f2c1e67bb2764dc990_NeikiAnalytics.exe
5112	xdobloc.exe
5112	xdobloc.exe
4556	027f4ecaa38094f2c1e67bb2764dc990_NeikiAnalytics.exe
4556	027f4ecaa38094f2c1e67bb2764dc990_NeikiAnalytics.exe
5112	xdobloc.exe
5112	xdobloc.exe
4556	027f4ecaa38094f2c1e67bb2764dc990_NeikiAnalytics.exe
4556	027f4ecaa38094f2c1e67bb2764dc990_NeikiAnalytics.exe
5112	xdobloc.exe
5112	xdobloc.exe
4556	027f4ecaa38094f2c1e67bb2764dc990_NeikiAnalytics.exe
4556	027f4ecaa38094f2c1e67bb2764dc990_NeikiAnalytics.exe
5112	xdobloc.exe
5112	xdobloc.exe
4556	027f4ecaa38094f2c1e67bb2764dc990_NeikiAnalytics.exe
4556	027f4ecaa38094f2c1e67bb2764dc990_NeikiAnalytics.exe
5112	xdobloc.exe
5112	xdobloc.exe
4556	027f4ecaa38094f2c1e67bb2764dc990_NeikiAnalytics.exe
4556	027f4ecaa38094f2c1e67bb2764dc990_NeikiAnalytics.exe
5112	xdobloc.exe
5112	xdobloc.exe
4556	027f4ecaa38094f2c1e67bb2764dc990_NeikiAnalytics.exe
4556	027f4ecaa38094f2c1e67bb2764dc990_NeikiAnalytics.exe
5112	xdobloc.exe
5112	xdobloc.exe
4556	027f4ecaa38094f2c1e67bb2764dc990_NeikiAnalytics.exe
4556	027f4ecaa38094f2c1e67bb2764dc990_NeikiAnalytics.exe
5112	xdobloc.exe
5112	xdobloc.exe
4556	027f4ecaa38094f2c1e67bb2764dc990_NeikiAnalytics.exe
4556	027f4ecaa38094f2c1e67bb2764dc990_NeikiAnalytics.exe
5112	xdobloc.exe
5112	xdobloc.exe
4556	027f4ecaa38094f2c1e67bb2764dc990_NeikiAnalytics.exe
4556	027f4ecaa38094f2c1e67bb2764dc990_NeikiAnalytics.exe
5112	xdobloc.exe
5112	xdobloc.exe
4556	027f4ecaa38094f2c1e67bb2764dc990_NeikiAnalytics.exe
4556	027f4ecaa38094f2c1e67bb2764dc990_NeikiAnalytics.exe
5112	xdobloc.exe
5112	xdobloc.exe
4556	027f4ecaa38094f2c1e67bb2764dc990_NeikiAnalytics.exe
4556	027f4ecaa38094f2c1e67bb2764dc990_NeikiAnalytics.exe
5112	xdobloc.exe
5112	xdobloc.exe
4556	027f4ecaa38094f2c1e67bb2764dc990_NeikiAnalytics.exe
4556	027f4ecaa38094f2c1e67bb2764dc990_NeikiAnalytics.exe
5112	xdobloc.exe
5112	xdobloc.exe
4556	027f4ecaa38094f2c1e67bb2764dc990_NeikiAnalytics.exe
4556	027f4ecaa38094f2c1e67bb2764dc990_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4556 wrote to memory of 5112	4556	027f4ecaa38094f2c1e67bb2764dc990_NeikiAnalytics.exe	91
PID 4556 wrote to memory of 5112	4556	027f4ecaa38094f2c1e67bb2764dc990_NeikiAnalytics.exe	91
PID 4556 wrote to memory of 5112	4556	027f4ecaa38094f2c1e67bb2764dc990_NeikiAnalytics.exe	91

C:\Users\Admin\AppData\Local\Temp\027f4ecaa38094f2c1e67bb2764dc990_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\027f4ecaa38094f2c1e67bb2764dc990_NeikiAnalytics.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4556
- C:\FilesU4\xdobloc.exe
  C:\FilesU4\xdobloc.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:5112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\FilesU4\xdobloc.exe

Filesize
2.7MB

MD5
8fbd256a0cae0d6d8e182e52ef14dd81

SHA1
516c48eaaa2162f16cd3719b8c322124b01829ca

SHA256
416154565a9f2e46cde9b0e272ea2799602b567cccf9a88f065fe76e4fb47852

SHA512
9f2510c77179304e1ea6b3e51769351ea99b65cd42bbd43d9b969fe31b4c7bddfe366890bbd6cd7b5ae1e304a02258ab833d3a526ca07e7e7bb19656981e8eb9

Download Submit
C:\KaVBUR\dobasys.exe

Filesize
2.7MB

MD5
4ff97a27c847cf43dc9fd36eb1c033eb

SHA1
ada8a287a7c7d378a71f9d7a385388e38f2ef623

SHA256
fd89ae6fd3f4c254e7eabaaa5b54ca3a577969a58e9c8696ef6950672cc1843a

SHA512
89f7f7538004728155593d4a2e4f6a8240c5511319beed166cafafbd5b4a66826a856e320009eb27aa2f3518d74713c29a1d6182f37617aa449fe3cdf34e41da

Download Submit
C:\Users\Admin\253086396416_10.0_Admin.ini

Filesize
197B

MD5
1eb05bf06b1ac3c2a32143a7433098a3

SHA1
fa8d1e730f1b343371e489cc4cff0d36ecd8db12

SHA256
d00b525cce60e3b6a1363b9f26d803c76594c2b6ca299a7976074c5d6659f58b

SHA512
95f5dfe948f26f09e53795f76d118356654d0488b39e7c4e1a0a138a47f902ead1e46048cc380f5d92fd94dd7a30dafd1e1028a03f973ae5e56d7c9bfcf9ad10

Download Submit