Overview

overview

7

Static

static

3

264d010570...cs.exe

windows7-x64

7

264d010570...cs.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/06/2024, 03:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    264d010570554db75b2b519f062ffec0_NeikiAnalytics.exe

  • Size

    4.1MB

  • MD5

    264d010570554db75b2b519f062ffec0

  • SHA1

    6818abf27eef02c8abce5ec79965fde0e0307092

  • SHA256

    b81b5d1b92dce7ed81fc3e909e95bd75ad517d68de1e4d9fe1d865e91170ddb7

  • SHA512

    d2c07f595b3c26f1fa410019496319d54abac5392c5b03ff729342eeabebc54f0e0ab33fc49668707b1f01b05332a0e7c6b7ff7389831a20730c94300fb5a3f7

  • SSDEEP

    98304:+R0pI/IQlUoMPdmpSpv4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdmY5n9klRKN41v

Score
7/10
persistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\264d010570554db75b2b519f062ffec0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\264d010570554db75b2b519f062ffec0_NeikiAnalytics.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4012
    • C:\IntelprocI4\xbodec.exe
      C:\IntelprocI4\xbodec.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:3348

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\IntelprocI4\xbodec.exe
    Filesize

    4.1MB

    MD5

    dd3e91981aaf29dc6da1d19a6bb219b8

    SHA1

    3e73731d433097836d6a1d6b97ea3e69fdbb1708

    SHA256

    7111245f6afd6893b0447c61b23c351aa7ed795f8a17c09096db439cfbdf9379

    SHA512

    b9b378cb807ffcfa48c27f01cad2cc73c3df133af053ef11a5fc07045a6353d6b28caa1f19f153e7d44b570338611e34041eae8a319b7cc09f179578380517d8

    Download Submit

  • C:\Users\Admin\253086396416_10.0_Admin.ini
    Filesize

    204B

    MD5

    d5b654f76ada7f6e81f0f71a0ae48cb0

    SHA1

    67148932a7ebd436dfe72bb2c8212547ef7a0919

    SHA256

    68edefa6ea0b0655dfd91d5677976aeafaeae17c8a2d3e7b49ef2684a43c668d

    SHA512

    c0212a6f3f17e63247e903432a7a7bd525e9f3be18058344b663171e47f12540afc4c987a84e7dd1a52ac0bcb0954f2dd430ba38514f4844a2a6058b47a1fed1

    Download Submit

  • C:\VidZW\dobdevsys.exe
    Filesize

    4.1MB

    MD5

    3a8ca88607f8884d8efece5f6efd0018

    SHA1

    609b7fa8edf14e6ac90bb11864ddd20f95ccfc87

    SHA256

    59dd042c1d9776bae2b3ee7607a5d1be29c0902bd28b7f68e2709d67f3023451

    SHA512

    90f7f5cd18a5649a5b5316901d00f3a4348c8c4033a905d45bab937d06b94cf06528929ea2872761c83f564e31e94fa2bb585b8bb18ee4e405dc2a7415036ae5

    Download Submit