Analysis
- max time kernel
149s - max time network
130s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
06/06/2024, 21:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1bbbd0a2a5557dec8fe64d73fef40fe0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
1bbbd0a2a5557dec8fe64d73fef40fe0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 1bbbd0a2a5557dec8fe64d73fef40fe0_NeikiAnalytics.exe
- Size 2.7MB
- Sample240606-z76gesdc74
- SHA256 5aa7123c31b452b3dd7e349576908a50dd4b27608f45c960e0d0e8925d5be1bf
- MD5 1bbbd0a2a5557dec8fe64d73fef40fe0
- SHA1 5f400ab8e514c9274bbe3799e0854599f1d1525a
- SHA512 36781579c4cb4503f135f3b64e4dd5b2278d3bb97dca113cbf571aa98b6e41a30b9b00ab9549458e770692aed1431e4d61016d0fa7e6db31583597b4d15d22b8
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBS9w4Sx:+R0pI/IQlUoMPdmpSpg4
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4480 xdobec.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\AdobeDC\\xdobec.exe" 1bbbd0a2a5557dec8fe64d73fef40fe0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\MintFS\\optixloc.exe" 1bbbd0a2a5557dec8fe64d73fef40fe0_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2492 1bbbd0a2a5557dec8fe64d73fef40fe0_NeikiAnalytics.exe 2492 1bbbd0a2a5557dec8fe64d73fef40fe0_NeikiAnalytics.exe 2492 1bbbd0a2a5557dec8fe64d73fef40fe0_NeikiAnalytics.exe 2492 1bbbd0a2a5557dec8fe64d73fef40fe0_NeikiAnalytics.exe 4480 xdobec.exe 4480 xdobec.exe 2492 1bbbd0a2a5557dec8fe64d73fef40fe0_NeikiAnalytics.exe 2492 1bbbd0a2a5557dec8fe64d73fef40fe0_NeikiAnalytics.exe 4480 xdobec.exe 4480 xdobec.exe 2492 1bbbd0a2a5557dec8fe64d73fef40fe0_NeikiAnalytics.exe 2492 1bbbd0a2a5557dec8fe64d73fef40fe0_NeikiAnalytics.exe 4480 xdobec.exe 4480 xdobec.exe 2492 1bbbd0a2a5557dec8fe64d73fef40fe0_NeikiAnalytics.exe 2492 1bbbd0a2a5557dec8fe64d73fef40fe0_NeikiAnalytics.exe 4480 xdobec.exe 4480 xdobec.exe 2492 1bbbd0a2a5557dec8fe64d73fef40fe0_NeikiAnalytics.exe 2492 1bbbd0a2a5557dec8fe64d73fef40fe0_NeikiAnalytics.exe 4480 xdobec.exe 4480 xdobec.exe 2492 1bbbd0a2a5557dec8fe64d73fef40fe0_NeikiAnalytics.exe 2492 1bbbd0a2a5557dec8fe64d73fef40fe0_NeikiAnalytics.exe 4480 xdobec.exe 4480 xdobec.exe 2492 1bbbd0a2a5557dec8fe64d73fef40fe0_NeikiAnalytics.exe 2492 1bbbd0a2a5557dec8fe64d73fef40fe0_NeikiAnalytics.exe 4480 xdobec.exe 4480 xdobec.exe 2492 1bbbd0a2a5557dec8fe64d73fef40fe0_NeikiAnalytics.exe 2492 1bbbd0a2a5557dec8fe64d73fef40fe0_NeikiAnalytics.exe 4480 xdobec.exe 4480 xdobec.exe 2492 1bbbd0a2a5557dec8fe64d73fef40fe0_NeikiAnalytics.exe 2492 1bbbd0a2a5557dec8fe64d73fef40fe0_NeikiAnalytics.exe 4480 xdobec.exe 4480 xdobec.exe 2492 1bbbd0a2a5557dec8fe64d73fef40fe0_NeikiAnalytics.exe 2492 1bbbd0a2a5557dec8fe64d73fef40fe0_NeikiAnalytics.exe 4480 xdobec.exe 4480 xdobec.exe 2492 1bbbd0a2a5557dec8fe64d73fef40fe0_NeikiAnalytics.exe 2492 1bbbd0a2a5557dec8fe64d73fef40fe0_NeikiAnalytics.exe 4480 xdobec.exe 4480 xdobec.exe 2492 1bbbd0a2a5557dec8fe64d73fef40fe0_NeikiAnalytics.exe 2492 1bbbd0a2a5557dec8fe64d73fef40fe0_NeikiAnalytics.exe 4480 xdobec.exe 4480 xdobec.exe 2492 1bbbd0a2a5557dec8fe64d73fef40fe0_NeikiAnalytics.exe 2492 1bbbd0a2a5557dec8fe64d73fef40fe0_NeikiAnalytics.exe 4480 xdobec.exe 4480 xdobec.exe 2492 1bbbd0a2a5557dec8fe64d73fef40fe0_NeikiAnalytics.exe 2492 1bbbd0a2a5557dec8fe64d73fef40fe0_NeikiAnalytics.exe 4480 xdobec.exe 4480 xdobec.exe 2492 1bbbd0a2a5557dec8fe64d73fef40fe0_NeikiAnalytics.exe 2492 1bbbd0a2a5557dec8fe64d73fef40fe0_NeikiAnalytics.exe 4480 xdobec.exe 4480 xdobec.exe 2492 1bbbd0a2a5557dec8fe64d73fef40fe0_NeikiAnalytics.exe 2492 1bbbd0a2a5557dec8fe64d73fef40fe0_NeikiAnalytics.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2492 wrote to memory of 4480 2492 1bbbd0a2a5557dec8fe64d73fef40fe0_NeikiAnalytics.exe 88 PID 2492 wrote to memory of 4480 2492 1bbbd0a2a5557dec8fe64d73fef40fe0_NeikiAnalytics.exe 88 PID 2492 wrote to memory of 4480 2492 1bbbd0a2a5557dec8fe64d73fef40fe0_NeikiAnalytics.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\1bbbd0a2a5557dec8fe64d73fef40fe0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1bbbd0a2a5557dec8fe64d73fef40fe0_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\AdobeDC\xdobec.exeC:\AdobeDC\xdobec.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4480
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\AdobeDC\xdobec.exe
- Size 2.7MB
- SHA256 5a982ad8dbfe20d4fdf10ec090f9f0c70a3a1c5b764157e4082908b4dbe0f3ac
- MD5 3a1ac02ec5f579678de902c4efeaa8b9
- SHA1 a9c796a1ed797ab08ac5ffadf9f6b1c7d86ae25a
- SHA512 8e5b97e94637de6d28cb0804e38fac736b0b9142112cfbb90cc53f3b7260cba9f7dc7c2f135d3bdfb52b20aa11a97043cb4953efd2396312c9bbbfd420dcc69a
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBw9w4Sx:+R0pI/IQlUoMPdmpSpG4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MintFS\optixloc.exe
- Size 2.7MB
- SHA256 63de4777424257d2b684958ca3583a1309fd1a9238b91b5a16a923e805475ad2
- MD5 d7043cbb49bbccf964e64900838ea57d
- SHA1 37a13d521066b5bf18186c72bf4fbf9f3236794b
- SHA512 26a423a823c26c45142704dc875af9d68a063fd079749c5f05d9216dd9174267b590bcbd7e2dd84f8db61f0203bf37e4180ecfd31f3e94c1a1f3d0e2923889a5
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LB89w4Sx:+R0pI/IQlUoMPdmpSpm4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 201B
- SHA256 ee3ec4c08f0b3032262235372cdf540dd43860b34a051a7bc0f7b30efec43511
- MD5 5327d5c959a2e398449bb591c15c0537
- SHA1 1bc225093e5e2ae995074d0e9da6925cb686aeff
- SHA512 150f09424931563145df8974807449feffa88d7bcdc7d8c48f99551872e299a00d9e82997822dc4274c67f3263237eca171ef6a34aed1c2a8a0596d3194fc475
- MD5 SHA1 SHA512