05b2719a3a87050732bc617e2742055b1e0f74d9785c3106e7fad1e2409192c0

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
05/06/2024, 01:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

27173ef97d9c5c0f416e8fdf01b66f30_NeikiAnalytics.exe
Size

2.7MB
MD5

27173ef97d9c5c0f416e8fdf01b66f30
SHA1

7b46b27ac0a1daa4a906fa841df65ebbf31a0794
SHA256

05b2719a3a87050732bc617e2742055b1e0f74d9785c3106e7fad1e2409192c0
SHA512

dc0aafbbd18ad8ea8e1bcc784ee88f3725b499e9a9e65e4fd60c1033152b20d563831457af963c89cc27ce2d67000f56796dfb06496593cb747392c5324a1042
SSDEEP

49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBf9w4Sx:+R0pI/IQlUoMPdmpSpj4

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4712	devbodec.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\Vid8N\\boddevec.exe"	27173ef97d9c5c0f416e8fdf01b66f30_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\FilesVP\\devbodec.exe"	27173ef97d9c5c0f416e8fdf01b66f30_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3792	27173ef97d9c5c0f416e8fdf01b66f30_NeikiAnalytics.exe
3792	27173ef97d9c5c0f416e8fdf01b66f30_NeikiAnalytics.exe
3792	27173ef97d9c5c0f416e8fdf01b66f30_NeikiAnalytics.exe
3792	27173ef97d9c5c0f416e8fdf01b66f30_NeikiAnalytics.exe
4712	devbodec.exe
4712	devbodec.exe
3792	27173ef97d9c5c0f416e8fdf01b66f30_NeikiAnalytics.exe
3792	27173ef97d9c5c0f416e8fdf01b66f30_NeikiAnalytics.exe
4712	devbodec.exe
4712	devbodec.exe
3792	27173ef97d9c5c0f416e8fdf01b66f30_NeikiAnalytics.exe
3792	27173ef97d9c5c0f416e8fdf01b66f30_NeikiAnalytics.exe
4712	devbodec.exe
4712	devbodec.exe
3792	27173ef97d9c5c0f416e8fdf01b66f30_NeikiAnalytics.exe
3792	27173ef97d9c5c0f416e8fdf01b66f30_NeikiAnalytics.exe
4712	devbodec.exe
4712	devbodec.exe
3792	27173ef97d9c5c0f416e8fdf01b66f30_NeikiAnalytics.exe
3792	27173ef97d9c5c0f416e8fdf01b66f30_NeikiAnalytics.exe
4712	devbodec.exe
4712	devbodec.exe
3792	27173ef97d9c5c0f416e8fdf01b66f30_NeikiAnalytics.exe
3792	27173ef97d9c5c0f416e8fdf01b66f30_NeikiAnalytics.exe
4712	devbodec.exe
4712	devbodec.exe
3792	27173ef97d9c5c0f416e8fdf01b66f30_NeikiAnalytics.exe
3792	27173ef97d9c5c0f416e8fdf01b66f30_NeikiAnalytics.exe
4712	devbodec.exe
4712	devbodec.exe
3792	27173ef97d9c5c0f416e8fdf01b66f30_NeikiAnalytics.exe
3792	27173ef97d9c5c0f416e8fdf01b66f30_NeikiAnalytics.exe
4712	devbodec.exe
4712	devbodec.exe
3792	27173ef97d9c5c0f416e8fdf01b66f30_NeikiAnalytics.exe
3792	27173ef97d9c5c0f416e8fdf01b66f30_NeikiAnalytics.exe
4712	devbodec.exe
4712	devbodec.exe
3792	27173ef97d9c5c0f416e8fdf01b66f30_NeikiAnalytics.exe
3792	27173ef97d9c5c0f416e8fdf01b66f30_NeikiAnalytics.exe
4712	devbodec.exe
4712	devbodec.exe
3792	27173ef97d9c5c0f416e8fdf01b66f30_NeikiAnalytics.exe
3792	27173ef97d9c5c0f416e8fdf01b66f30_NeikiAnalytics.exe
4712	devbodec.exe
4712	devbodec.exe
3792	27173ef97d9c5c0f416e8fdf01b66f30_NeikiAnalytics.exe
3792	27173ef97d9c5c0f416e8fdf01b66f30_NeikiAnalytics.exe
4712	devbodec.exe
4712	devbodec.exe
3792	27173ef97d9c5c0f416e8fdf01b66f30_NeikiAnalytics.exe
3792	27173ef97d9c5c0f416e8fdf01b66f30_NeikiAnalytics.exe
4712	devbodec.exe
4712	devbodec.exe
3792	27173ef97d9c5c0f416e8fdf01b66f30_NeikiAnalytics.exe
3792	27173ef97d9c5c0f416e8fdf01b66f30_NeikiAnalytics.exe
4712	devbodec.exe
4712	devbodec.exe
3792	27173ef97d9c5c0f416e8fdf01b66f30_NeikiAnalytics.exe
3792	27173ef97d9c5c0f416e8fdf01b66f30_NeikiAnalytics.exe
4712	devbodec.exe
4712	devbodec.exe
3792	27173ef97d9c5c0f416e8fdf01b66f30_NeikiAnalytics.exe
3792	27173ef97d9c5c0f416e8fdf01b66f30_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3792 wrote to memory of 4712	3792	27173ef97d9c5c0f416e8fdf01b66f30_NeikiAnalytics.exe	85
PID 3792 wrote to memory of 4712	3792	27173ef97d9c5c0f416e8fdf01b66f30_NeikiAnalytics.exe	85
PID 3792 wrote to memory of 4712	3792	27173ef97d9c5c0f416e8fdf01b66f30_NeikiAnalytics.exe	85

C:\Users\Admin\AppData\Local\Temp\27173ef97d9c5c0f416e8fdf01b66f30_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\27173ef97d9c5c0f416e8fdf01b66f30_NeikiAnalytics.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3792
- C:\FilesVP\devbodec.exe
  C:\FilesVP\devbodec.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:4712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\FilesVP\devbodec.exe

Filesize
2.7MB

MD5
657be19acaffec9ec2d8cf51ca3ce866

SHA1
576beb830c4438a16f4d394461366a3f19baff2a

SHA256
9a683ac88499193230ed03896748009555cf9e15f35370548d65f49faee404a2

SHA512
c3be99a1702f37ec7f4d3237eec261336e62c18d493fe0c98caf0bd351af1058f3c02659bc93091bef3344ace9985a1e3ae080e7e77bd25f079e2880db869797

Download Submit
C:\Users\Admin\253086396416_10.0_Admin.ini

Filesize
204B

MD5
72c38e618a7bc5f4f46926f2936fcdaa

SHA1
dd3e9406448c47abae97800448c85f4944169c9c

SHA256
8f429a4bf9ccb45aaf2a244c9ca696505d8d18188fa9e624fb8d790ec9090586

SHA512
d533591ee01dd19845545c102ec72c49b6c8ea3d573f5ec8ceab0206a4237992e515334fd728dc7f8a7d19c87d39c622b6da6a22cb836c2fa1b40eb044299cdc

Download Submit
C:\Vid8N\boddevec.exe

Filesize
2.7MB

MD5
be2de6cef002fe058277449d37ca0995

SHA1
c669a224ca9483689eb858cb8ca1fb73dada39e1

SHA256
6e9b89da62f4b5a466a6c3d5b2ddcf553529dbb2ad540f3b6ab8aad585c95291

SHA512
35e5a5e1b291c8c385c8a2efcc4ab2572a3df03dfa142bcab96fd660ba76e2d6e8d19514a43e2a8006e30f8fa0a9b8278b58102c91529c518948e82b68bc2271

Download Submit