Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
08/06/2024, 13:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f875a852f9554f4f5f572923a781e0e0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
f875a852f9554f4f5f572923a781e0e0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target f875a852f9554f4f5f572923a781e0e0_NeikiAnalytics.exe
- Size 4.1MB
- Sample240608-p8zedscg35
- SHA256 d63ffef648717676fc9e25a5700eb1435de7a5029efaaecf5870855a6957ebf5
- MD5 f875a852f9554f4f5f572923a781e0e0
- SHA1 c8bd6c199c48c86f14bc6924e90eef1a12de2309
- SHA512 fbaf6250a8ef0551f94749cdab1438368b34af128d612fc105f8e402ab5ae4ed0edff20635878a3d5b623b310e74d69ad6f48b9168bf804bbb47b207126f4b86
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBgB/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUp7bVz8eLFcz
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysxbod.exe f875a852f9554f4f5f572923a781e0e0_NeikiAnalytics.exe - Executes dropped EXE 2 IoCs
pid Process 5080 sysxbod.exe 3864 devbodloc.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\SysDrvZ9\\devbodloc.exe" f875a852f9554f4f5f572923a781e0e0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\VidJO\\dobdevsys.exe" f875a852f9554f4f5f572923a781e0e0_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2812 f875a852f9554f4f5f572923a781e0e0_NeikiAnalytics.exe 2812 f875a852f9554f4f5f572923a781e0e0_NeikiAnalytics.exe 2812 f875a852f9554f4f5f572923a781e0e0_NeikiAnalytics.exe 2812 f875a852f9554f4f5f572923a781e0e0_NeikiAnalytics.exe 5080 sysxbod.exe 5080 sysxbod.exe 3864 devbodloc.exe 3864 devbodloc.exe 5080 sysxbod.exe 5080 sysxbod.exe 3864 devbodloc.exe 3864 devbodloc.exe 5080 sysxbod.exe 5080 sysxbod.exe 3864 devbodloc.exe 3864 devbodloc.exe 5080 sysxbod.exe 5080 sysxbod.exe 3864 devbodloc.exe 3864 devbodloc.exe 5080 sysxbod.exe 5080 sysxbod.exe 3864 devbodloc.exe 3864 devbodloc.exe 5080 sysxbod.exe 5080 sysxbod.exe 3864 devbodloc.exe 3864 devbodloc.exe 5080 sysxbod.exe 5080 sysxbod.exe 3864 devbodloc.exe 3864 devbodloc.exe 5080 sysxbod.exe 5080 sysxbod.exe 3864 devbodloc.exe 3864 devbodloc.exe 5080 sysxbod.exe 5080 sysxbod.exe 3864 devbodloc.exe 3864 devbodloc.exe 5080 sysxbod.exe 5080 sysxbod.exe 3864 devbodloc.exe 3864 devbodloc.exe 5080 sysxbod.exe 5080 sysxbod.exe 3864 devbodloc.exe 3864 devbodloc.exe 5080 sysxbod.exe 5080 sysxbod.exe 3864 devbodloc.exe 3864 devbodloc.exe 5080 sysxbod.exe 5080 sysxbod.exe 3864 devbodloc.exe 3864 devbodloc.exe 5080 sysxbod.exe 5080 sysxbod.exe 3864 devbodloc.exe 3864 devbodloc.exe 5080 sysxbod.exe 5080 sysxbod.exe 3864 devbodloc.exe 3864 devbodloc.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2812 wrote to memory of 5080 2812 f875a852f9554f4f5f572923a781e0e0_NeikiAnalytics.exe 87 PID 2812 wrote to memory of 5080 2812 f875a852f9554f4f5f572923a781e0e0_NeikiAnalytics.exe 87 PID 2812 wrote to memory of 5080 2812 f875a852f9554f4f5f572923a781e0e0_NeikiAnalytics.exe 87 PID 2812 wrote to memory of 3864 2812 f875a852f9554f4f5f572923a781e0e0_NeikiAnalytics.exe 88 PID 2812 wrote to memory of 3864 2812 f875a852f9554f4f5f572923a781e0e0_NeikiAnalytics.exe 88 PID 2812 wrote to memory of 3864 2812 f875a852f9554f4f5f572923a781e0e0_NeikiAnalytics.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\f875a852f9554f4f5f572923a781e0e0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\f875a852f9554f4f5f572923a781e0e0_NeikiAnalytics.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysxbod.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysxbod.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5080
-
-
C:\SysDrvZ9\devbodloc.exeC:\SysDrvZ9\devbodloc.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3864
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\SysDrvZ9\devbodloc.exe
- Size 47KB
- SHA256 6eb1a87af8ac5230a217aacd34de88c59e06268b719fc264c44e62dfa12e7709
- MD5 703298e1938b94b8a048722589106182
- SHA1 76cf69965dbd2c3eac9313fdd3019ef346fbd507
- SHA512 3516ce6ea8807a3fb6c010e95d8450210cb156137ce1b2c7eabc8864fd53cdf8eb31a79323092e9a8ee41dc76c1f14b645b91fb0be2ee13197dbbd875e68fc09
- SSDEEP 768:xezkk/DUj7TlODVED17nKFO3nq/KjsDZe+pxsjqsXQJ+YWNn6q8/oIovypoRMkf8:ABalOBo1TKFO3n0KkZHqX7+g2lW+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\SysDrvZ9\devbodloc.exe
- Size 4.1MB
- SHA256 8b18647473ee227018a6674ab93cfaec618063be68e3cb78b26c3e098840f3d0
- MD5 1b94a0e4c079cee8b8060f8fbdf68306
- SHA1 b08be9976e7a2c1bfae33cd9df7ac6e7b99ed479
- SHA512 1110530979d951df6e9e18a6b27d2c3b78cfa1a1dbfc78fbf321a83a3c5a298a9c20bcff1d63aff34f672399bc8c7d3e0eb16ead691761c757bfc6a747a5968c
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB4B/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUpDbVz8eLFcz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 204B
- SHA256 f05cfb04744d81850cf3e61e0da70e7006d7479649e4137e40848e666ea289f0
- MD5 69795384447e6b27e4246eb07ea431ad
- SHA1 374806c55f94609153f533206ab82621afedb24c
- SHA512 36b7ba5985b4274d6349e9fecef1361b285bcf9cb70f592bd2403b0488f573a99e9eeae1a00fad9f6b6a208cd6280ec0412ef4d0b740bde4724d1a3080b043eb
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 172B
- SHA256 220c6b4e491ebbe3e813a17fa724ca1cf1e35161b17b69629967472793d63487
- MD5 cd77c1ebbeb77f1dddb53e11ea0e69e9
- SHA1 436f4013a92a6b9758691ebe344be27af97abce4
- SHA512 6d029c54cc8ffb260fa0536f26013cebcbdb147d8d1952e6e9fd1d9c7c2db78f692147263d5be08de66209b545596a3431166e59e794d015ddd490fa71a13088
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysxbod.exe
- Size 4.1MB
- SHA256 ea0b259fba6e9ea332ba1721c41178dab118a050d448373dc711ef5f424628b7
- MD5 274cb147cc274a9c8959ed875820b496
- SHA1 6bf607747ab2822594c3ab693ab626b92bc9e8b8
- SHA512 63f41d924b698303f8bc9b5ef75a10b21d84633484fadf63a7c6bd89a0de59cad229528a0db2228d6c4c17c07391a02df57b7af6bb7ad69b8add91eb249d73e5
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBJB/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUpybVz8eLFcz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\VidJO\dobdevsys.exe
- Size 516KB
- SHA256 206e4986e00debdcd08ac7b3772afddf1b3e6673aefa3a88ef3f9d14828001ce
- MD5 de478de6caf996b396d6694e8ce2bd73
- SHA1 8a7dbddf15e7595700187eb76b422db69b005087
- SHA512 d0d2abcb42e690fbc3f5e70679d7d88db1e7c3f4e7701d844b21a6a72ce771aa0827147086666155c4d3a83b5a760f3dc960fedb63737db03986c1ce035a6dd9
- SSDEEP 12288:6ne3n0DmAm67YEjAyu6qJ/+WS5axBdSqpcVdSxL5XOEVpQX:6nxDZV7xMyu6qJ2WSYxBdSqpcVdm5XRQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\VidJO\dobdevsys.exe
- Size 4.1MB
- SHA256 b6b3689daa1a5532d60b31c525dd20fbe63a19d251f394da2658fb1879531845
- MD5 c7117c4b67b866598d0640d02d9ab4c5
- SHA1 b9549d95034d0f8eb4a445ef08234d88641e1039
- SHA512 c61b70979805f64819dc2e3e9605faa8aec056ad1fd72fc5f67c57c841fdcdf499b95887ea404f0e914176ac6bd37b98ed539afccc887112e7d9ac490cef440f
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBgB/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUp3bVz8eLFcz
- MD5 SHA1 SHA512 SSDEEP