368e5fd0e1d62e7e1737dc76973bce95ddd380e9b5901b8ba5e47608971bf2ea

Analysis

max time kernel
149s
max time network
118s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
06/06/2024, 17:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e62a02c3997cb250303daca093c63660_NeikiAnalytics.exe
Size

2.7MB
MD5

e62a02c3997cb250303daca093c63660
SHA1

06553a6a686b914268efb174cdaa74fe6a9d0cab
SHA256

368e5fd0e1d62e7e1737dc76973bce95ddd380e9b5901b8ba5e47608971bf2ea
SHA512

ff6caa609e8568c9b51bb3549fe1efb777b868253d929d0712f4cdb5db78b9b5a3e8e2af21057e7d569669b6d801b8c53e75209ff352905358d5858e4c094e60
SSDEEP

49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LB09w4Sx:+R0pI/IQlUoMPdmpSpe4

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2212	xbodloc.exe

Loads dropped DLL 1 IoCs

pid	Process
2832	e62a02c3997cb250303daca093c63660_NeikiAnalytics.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\IntelprocTY\\xbodloc.exe"	e62a02c3997cb250303daca093c63660_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\Mint7B\\bodxloc.exe"	e62a02c3997cb250303daca093c63660_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2832	e62a02c3997cb250303daca093c63660_NeikiAnalytics.exe
2832	e62a02c3997cb250303daca093c63660_NeikiAnalytics.exe
2212	xbodloc.exe
2832	e62a02c3997cb250303daca093c63660_NeikiAnalytics.exe
2212	xbodloc.exe
2832	e62a02c3997cb250303daca093c63660_NeikiAnalytics.exe
2212	xbodloc.exe
2832	e62a02c3997cb250303daca093c63660_NeikiAnalytics.exe
2212	xbodloc.exe
2832	e62a02c3997cb250303daca093c63660_NeikiAnalytics.exe
2212	xbodloc.exe
2832	e62a02c3997cb250303daca093c63660_NeikiAnalytics.exe
2212	xbodloc.exe
2832	e62a02c3997cb250303daca093c63660_NeikiAnalytics.exe
2212	xbodloc.exe
2832	e62a02c3997cb250303daca093c63660_NeikiAnalytics.exe
2212	xbodloc.exe
2832	e62a02c3997cb250303daca093c63660_NeikiAnalytics.exe
2212	xbodloc.exe
2832	e62a02c3997cb250303daca093c63660_NeikiAnalytics.exe
2212	xbodloc.exe
2832	e62a02c3997cb250303daca093c63660_NeikiAnalytics.exe
2212	xbodloc.exe
2832	e62a02c3997cb250303daca093c63660_NeikiAnalytics.exe
2212	xbodloc.exe
2832	e62a02c3997cb250303daca093c63660_NeikiAnalytics.exe
2212	xbodloc.exe
2832	e62a02c3997cb250303daca093c63660_NeikiAnalytics.exe
2212	xbodloc.exe
2832	e62a02c3997cb250303daca093c63660_NeikiAnalytics.exe
2212	xbodloc.exe
2832	e62a02c3997cb250303daca093c63660_NeikiAnalytics.exe
2212	xbodloc.exe
2832	e62a02c3997cb250303daca093c63660_NeikiAnalytics.exe
2212	xbodloc.exe
2832	e62a02c3997cb250303daca093c63660_NeikiAnalytics.exe
2212	xbodloc.exe
2832	e62a02c3997cb250303daca093c63660_NeikiAnalytics.exe
2212	xbodloc.exe
2832	e62a02c3997cb250303daca093c63660_NeikiAnalytics.exe
2212	xbodloc.exe
2832	e62a02c3997cb250303daca093c63660_NeikiAnalytics.exe
2212	xbodloc.exe
2832	e62a02c3997cb250303daca093c63660_NeikiAnalytics.exe
2212	xbodloc.exe
2832	e62a02c3997cb250303daca093c63660_NeikiAnalytics.exe
2212	xbodloc.exe
2832	e62a02c3997cb250303daca093c63660_NeikiAnalytics.exe
2212	xbodloc.exe
2832	e62a02c3997cb250303daca093c63660_NeikiAnalytics.exe
2212	xbodloc.exe
2832	e62a02c3997cb250303daca093c63660_NeikiAnalytics.exe
2212	xbodloc.exe
2832	e62a02c3997cb250303daca093c63660_NeikiAnalytics.exe
2212	xbodloc.exe
2832	e62a02c3997cb250303daca093c63660_NeikiAnalytics.exe
2212	xbodloc.exe
2832	e62a02c3997cb250303daca093c63660_NeikiAnalytics.exe
2212	xbodloc.exe
2832	e62a02c3997cb250303daca093c63660_NeikiAnalytics.exe
2212	xbodloc.exe
2832	e62a02c3997cb250303daca093c63660_NeikiAnalytics.exe
2212	xbodloc.exe
2832	e62a02c3997cb250303daca093c63660_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2832 wrote to memory of 2212	2832	e62a02c3997cb250303daca093c63660_NeikiAnalytics.exe	28
PID 2832 wrote to memory of 2212	2832	e62a02c3997cb250303daca093c63660_NeikiAnalytics.exe	28
PID 2832 wrote to memory of 2212	2832	e62a02c3997cb250303daca093c63660_NeikiAnalytics.exe	28
PID 2832 wrote to memory of 2212	2832	e62a02c3997cb250303daca093c63660_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\e62a02c3997cb250303daca093c63660_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\e62a02c3997cb250303daca093c63660_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2832
- C:\IntelprocTY\xbodloc.exe
  C:\IntelprocTY\xbodloc.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Mint7B\bodxloc.exe

Filesize
2.7MB

MD5
612b4f0d56286fe999313568dd4424de

SHA1
53cee52a23bce61fce2675aa3878d28d118943a3

SHA256
7340a8cec88722303bea2e52e7cb676c1aca3b109cf1de044d24efdbe342b408

SHA512
a98bcd8f7d4588c8353a800af57b83625332ae8b57aedd4626c58dd6264c4ed57406bd6ef09a43e42c40bafd08a69588fdaafd246a03e3a624a9a563c98f1877

Download Submit
C:\Users\Admin\253086396416_6.1_Admin.ini

Filesize
204B

MD5
73273f15f085f47a5cc7e780c53123cf

SHA1
36b60cad5eda035b5d9e7e615bb56d5c7c9a3868

SHA256
760a480863f0cd69947e08aa617eabcc3d2e299b2b4d7157fc8ac2617710b26d

SHA512
27882881cd48cd91754a3c654cc42c7ae943319a7e2b583356583ecbca8d544855faa4f725087f04c2fff65fa17d912664cedcf6e72eb5ebc681208e71d62202

Download Submit
\IntelprocTY\xbodloc.exe

Filesize
2.7MB

MD5
ab688d7693d34fce6d35ac166d9a7c4a

SHA1
53593c3fd401f37273967a4f64a005586a333413

SHA256
695b166267f9b86b0cf269dd06055b4c47747bfbfc1e597f24b987d7eab1a54a

SHA512
be68ebfa711f13798deb1483fb137f42d9a0738fd56aa8a1ef7ef449128cab363fe0ff36395da84d4b24968331f8e7bf4841bae56de22edabc945de69f7ff78f

Download Submit