Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
12/06/2024, 23:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4e0916f979e1eafb8fa70e25f4db8c20_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
4e0916f979e1eafb8fa70e25f4db8c20_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 4e0916f979e1eafb8fa70e25f4db8c20_NeikiAnalytics.exe
- Size 4.1MB
- Sample240612-3wc8aawcjg
- SHA256 0b3641bb31559e198b2f9fe3766486e01fc3f0c0e980fdb1c3170d1742ce8f06
- MD5 4e0916f979e1eafb8fa70e25f4db8c20
- SHA1 e926a8eb7b63e32dd6e7bc2655ec9f8a786c753a
- SHA512 d975b2756df5b8cd853e4cdf4793308495c53d77db534dbd091d87ef12619155a69b782ca531e06745b9e5eb415aad912491a2f7bb0e2347a145acac986408c6
- SSDEEP 98304:+R0pI/IQlUoMPdmpSpt4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdmy5n9klRKN41v
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2120 abodsys.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\IntelprocXA\\abodsys.exe" 4e0916f979e1eafb8fa70e25f4db8c20_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\KaVBYO\\dobaec.exe" 4e0916f979e1eafb8fa70e25f4db8c20_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 992 4e0916f979e1eafb8fa70e25f4db8c20_NeikiAnalytics.exe 992 4e0916f979e1eafb8fa70e25f4db8c20_NeikiAnalytics.exe 992 4e0916f979e1eafb8fa70e25f4db8c20_NeikiAnalytics.exe 992 4e0916f979e1eafb8fa70e25f4db8c20_NeikiAnalytics.exe 2120 abodsys.exe 2120 abodsys.exe 992 4e0916f979e1eafb8fa70e25f4db8c20_NeikiAnalytics.exe 992 4e0916f979e1eafb8fa70e25f4db8c20_NeikiAnalytics.exe 2120 abodsys.exe 2120 abodsys.exe 992 4e0916f979e1eafb8fa70e25f4db8c20_NeikiAnalytics.exe 992 4e0916f979e1eafb8fa70e25f4db8c20_NeikiAnalytics.exe 2120 abodsys.exe 2120 abodsys.exe 992 4e0916f979e1eafb8fa70e25f4db8c20_NeikiAnalytics.exe 992 4e0916f979e1eafb8fa70e25f4db8c20_NeikiAnalytics.exe 2120 abodsys.exe 2120 abodsys.exe 992 4e0916f979e1eafb8fa70e25f4db8c20_NeikiAnalytics.exe 992 4e0916f979e1eafb8fa70e25f4db8c20_NeikiAnalytics.exe 2120 abodsys.exe 2120 abodsys.exe 992 4e0916f979e1eafb8fa70e25f4db8c20_NeikiAnalytics.exe 992 4e0916f979e1eafb8fa70e25f4db8c20_NeikiAnalytics.exe 2120 abodsys.exe 2120 abodsys.exe 992 4e0916f979e1eafb8fa70e25f4db8c20_NeikiAnalytics.exe 992 4e0916f979e1eafb8fa70e25f4db8c20_NeikiAnalytics.exe 2120 abodsys.exe 2120 abodsys.exe 992 4e0916f979e1eafb8fa70e25f4db8c20_NeikiAnalytics.exe 992 4e0916f979e1eafb8fa70e25f4db8c20_NeikiAnalytics.exe 2120 abodsys.exe 2120 abodsys.exe 992 4e0916f979e1eafb8fa70e25f4db8c20_NeikiAnalytics.exe 992 4e0916f979e1eafb8fa70e25f4db8c20_NeikiAnalytics.exe 2120 abodsys.exe 2120 abodsys.exe 992 4e0916f979e1eafb8fa70e25f4db8c20_NeikiAnalytics.exe 992 4e0916f979e1eafb8fa70e25f4db8c20_NeikiAnalytics.exe 2120 abodsys.exe 2120 abodsys.exe 992 4e0916f979e1eafb8fa70e25f4db8c20_NeikiAnalytics.exe 992 4e0916f979e1eafb8fa70e25f4db8c20_NeikiAnalytics.exe 2120 abodsys.exe 2120 abodsys.exe 992 4e0916f979e1eafb8fa70e25f4db8c20_NeikiAnalytics.exe 992 4e0916f979e1eafb8fa70e25f4db8c20_NeikiAnalytics.exe 2120 abodsys.exe 2120 abodsys.exe 992 4e0916f979e1eafb8fa70e25f4db8c20_NeikiAnalytics.exe 992 4e0916f979e1eafb8fa70e25f4db8c20_NeikiAnalytics.exe 2120 abodsys.exe 2120 abodsys.exe 992 4e0916f979e1eafb8fa70e25f4db8c20_NeikiAnalytics.exe 992 4e0916f979e1eafb8fa70e25f4db8c20_NeikiAnalytics.exe 2120 abodsys.exe 2120 abodsys.exe 992 4e0916f979e1eafb8fa70e25f4db8c20_NeikiAnalytics.exe 992 4e0916f979e1eafb8fa70e25f4db8c20_NeikiAnalytics.exe 2120 abodsys.exe 2120 abodsys.exe 992 4e0916f979e1eafb8fa70e25f4db8c20_NeikiAnalytics.exe 992 4e0916f979e1eafb8fa70e25f4db8c20_NeikiAnalytics.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 992 wrote to memory of 2120 992 4e0916f979e1eafb8fa70e25f4db8c20_NeikiAnalytics.exe 84 PID 992 wrote to memory of 2120 992 4e0916f979e1eafb8fa70e25f4db8c20_NeikiAnalytics.exe 84 PID 992 wrote to memory of 2120 992 4e0916f979e1eafb8fa70e25f4db8c20_NeikiAnalytics.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\4e0916f979e1eafb8fa70e25f4db8c20_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4e0916f979e1eafb8fa70e25f4db8c20_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:992 -
C:\IntelprocXA\abodsys.exeC:\IntelprocXA\abodsys.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2120
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\IntelprocXA\abodsys.exe
- Size 4.1MB
- SHA256 1dbc6f8b855e14ee4a941689183749dca55115be05011325eb95abe68bf16b53
- MD5 512331900ca8188793699c6e408e5034
- SHA1 65714c01692aece3bf5040e2cdd8121617fbf0b2
- SHA512 b034d80f0eae496cdab22647ad59b8ee0966a09e53c36de5471357aa3c49bfa688e9e69e173e8326ddb1b6c3ea8ea3e0c148042e6ad3d2770f6fe6c23d1daae4
- SSDEEP 98304:+R0pI/IQlUoMPdmpSp84ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdmf5n9klRKN41v
- MD5 SHA1 SHA512 SSDEEP
- Path C:\KaVBYO\dobaec.exe
- Size 35KB
- SHA256 94714ca7345be3c4fa76119feea57701a76358727dbbcaa80d9a56a56be651ef
- MD5 089bc2e72680dc4da7e030614895e540
- SHA1 0074646aa2e42c3cd8daf8a53228227c4cd2daf4
- SHA512 690b2b2f94d7f46fae8a08d6892177c04ab5dc87e9b1cd1c90765c7490c0d7e6bf583d98c892be6c2eb4097db20dc8d5aafce8d4283e9085905768ebbaee8f9e
- SSDEEP 768:PLT5ZRHUj7TRxRVED1bHKFO3Hq/KDsDZe+exJAqsQQsw4Wwn684:nD8RxTo1TKFO3H0KEZHAAn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\KaVBYO\dobaec.exe
- Size 4.1MB
- SHA256 b3926d2b272511e650beb2b4fab421456a120de85a5cd8bb48d37a08206bcc4d
- MD5 8d41db7093d47f5be301c181820d8433
- SHA1 e2e51e706745992172fcf069bfa32c71d5221f68
- SHA512 0027e636110a2996529eae5e2f4130e9e2597a42b2125ea16d71efa37a7fda625556d232510f5cefaca355c7f7041cf8a5c962c558d4f4f0b7b82d4b86ffe36f
- SSDEEP 98304:+R0pI/IQlUoMPdmpSpm4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdmR5n9klRKN41v
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 203B
- SHA256 8d5c04e85c4b41922b62dac59655d69026c9037b662fc911a2258579537bb594
- MD5 e2a6053873d9867c4d564a2970ceec57
- SHA1 9b043e82b840c28e1ef43ebdd568160fccc2b812
- SHA512 e610ea0e719ce4accb102a35cc9952260a8e0a426ca341675694a22fe0dbd54491375f366bdbd286bf603cbd053dc57ef78df7cc8d86694cf073822afe1eb1c0
- MD5 SHA1 SHA512