Analysis
- max time kernel
149s - max time network
97s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 01:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
543bcdca28db88817146e944b5a43320_NeikiAnalytics.exe
Resource
win7-20240611-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
543bcdca28db88817146e944b5a43320_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 543bcdca28db88817146e944b5a43320_NeikiAnalytics.exe
- Size 3.2MB
- Sample240613-b3nttazbre
- SHA256 b4926533b6b68f8d543ff3bee797de5fe563f6b5facad7acd95f87bd488847da
- MD5 543bcdca28db88817146e944b5a43320
- SHA1 090706ea59a033e858b733423988403dd6d9c0f4
- SHA512 257eac682c63d8c028b43a079d34803246279acc75e8d1ff5a869c81eda6ae8035d54cdfe1ef659ffb9799e86ff88b2692f5f31b3d4b189d66602cefa149735a
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBVB/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUpubVz8eLFcz
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locadob.exe 543bcdca28db88817146e944b5a43320_NeikiAnalytics.exe - Executes dropped EXE 2 IoCs
pid Process 3132 locadob.exe 1732 devdobloc.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\UserDot8J\\devdobloc.exe" 543bcdca28db88817146e944b5a43320_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\MintKO\\boddevec.exe" 543bcdca28db88817146e944b5a43320_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2956 543bcdca28db88817146e944b5a43320_NeikiAnalytics.exe 2956 543bcdca28db88817146e944b5a43320_NeikiAnalytics.exe 2956 543bcdca28db88817146e944b5a43320_NeikiAnalytics.exe 2956 543bcdca28db88817146e944b5a43320_NeikiAnalytics.exe 3132 locadob.exe 3132 locadob.exe 1732 devdobloc.exe 1732 devdobloc.exe 3132 locadob.exe 3132 locadob.exe 1732 devdobloc.exe 1732 devdobloc.exe 3132 locadob.exe 3132 locadob.exe 1732 devdobloc.exe 1732 devdobloc.exe 3132 locadob.exe 3132 locadob.exe 1732 devdobloc.exe 1732 devdobloc.exe 3132 locadob.exe 3132 locadob.exe 1732 devdobloc.exe 1732 devdobloc.exe 3132 locadob.exe 3132 locadob.exe 1732 devdobloc.exe 1732 devdobloc.exe 3132 locadob.exe 3132 locadob.exe 1732 devdobloc.exe 1732 devdobloc.exe 3132 locadob.exe 3132 locadob.exe 1732 devdobloc.exe 1732 devdobloc.exe 3132 locadob.exe 3132 locadob.exe 1732 devdobloc.exe 1732 devdobloc.exe 3132 locadob.exe 3132 locadob.exe 1732 devdobloc.exe 1732 devdobloc.exe 3132 locadob.exe 3132 locadob.exe 1732 devdobloc.exe 1732 devdobloc.exe 3132 locadob.exe 3132 locadob.exe 1732 devdobloc.exe 1732 devdobloc.exe 3132 locadob.exe 3132 locadob.exe 1732 devdobloc.exe 1732 devdobloc.exe 3132 locadob.exe 3132 locadob.exe 1732 devdobloc.exe 1732 devdobloc.exe 3132 locadob.exe 3132 locadob.exe 1732 devdobloc.exe 1732 devdobloc.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2956 wrote to memory of 3132 2956 543bcdca28db88817146e944b5a43320_NeikiAnalytics.exe 84 PID 2956 wrote to memory of 3132 2956 543bcdca28db88817146e944b5a43320_NeikiAnalytics.exe 84 PID 2956 wrote to memory of 3132 2956 543bcdca28db88817146e944b5a43320_NeikiAnalytics.exe 84 PID 2956 wrote to memory of 1732 2956 543bcdca28db88817146e944b5a43320_NeikiAnalytics.exe 85 PID 2956 wrote to memory of 1732 2956 543bcdca28db88817146e944b5a43320_NeikiAnalytics.exe 85 PID 2956 wrote to memory of 1732 2956 543bcdca28db88817146e944b5a43320_NeikiAnalytics.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\543bcdca28db88817146e944b5a43320_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\543bcdca28db88817146e944b5a43320_NeikiAnalytics.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locadob.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locadob.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3132
-
-
C:\UserDot8J\devdobloc.exeC:\UserDot8J\devdobloc.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1732
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\MintKO\boddevec.exe
- Size 20KB
- SHA256 33712f6263ec98ae8ff353abc33c5a663b2c766cbe5c8a49229dad2fbfb8f079
- MD5 586dc09d5804dc54d44fbabe2f70a2f5
- SHA1 1b5a9a763950331479ac1c498b03264cda1e5e0e
- SHA512 54a9d8562e63f9b26ca5680b6e9a17abb896ba1d76fd279957335198bab32efc42361d0585349bd615b1859a022b024d4629234b578a41c99310d0b00c64998a
- SSDEEP 384:04ezXTIk/IxT/ES70S7TqOODVtLiD1APE/s:xezkk/DUj7TlODVED17k
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MintKO\boddevec.exe
- Size 294KB
- SHA256 c66fbee9a424918d26868c5bde2d3c7caf28cee25cddbc6e81fe0d26f55ff72c
- MD5 ae11ddf571c80692a0eaa2ade21496e8
- SHA1 7420a9e66b8f87b51b7a967fff2331c86cc757b7
- SHA512 c2a4a43f8dcc39dbfb159ee2b22b71c2c2a269f4f4dcc554116a74a21a11294fbef70ccd93d547eec73142c3b78783e11b478f67a4fc7efceb9e6c8c8f321f7d
- SSDEEP 6144:6nyJ3n0Dm7+zm6wr6YEjAumIann6qJ/mB9D+nnS5ax2SNm9WdF7Uqpm:6ne3n0DmAm67YEjAyu6qJ/+WS5axBdSp
- MD5 SHA1 SHA512 SSDEEP
- Path C:\UserDot8J\devdobloc.exe
- Size 3.2MB
- SHA256 ebf5a0e6974c880d88215d9573ed791b9065130ae885503d600862b442c17edc
- MD5 9723e6b6d606e3945a610bffa7b7fc5e
- SHA1 882bf10e7001e7a08974b847bd1d7eccb701b83b
- SHA512 28b2d1a3ff72407c9f5d2ebe45c5a781226cea4a3f39138d25bdcf52e6de68d8d922ddfe27ead686f7294fbbe03c40000b7d79cfd44f46e5e29d9ff57f12676a
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB9B/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUpGbVz8eLFcz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 205B
- SHA256 843de1a99dc9f16f583b8daa947416ce6e4dd73a56a9e4383d542d7ca46319ac
- MD5 4731e8bba6894ea00b8440c806cea1a4
- SHA1 25e032a8035400c86c42f6fa779ad5accf861362
- SHA512 d62dee095aef7f2f254e97e0e6497e53f53a1390d03717197df453752df1e171a7dbba188f5d9536610b4ce225ac29d550dbec14dfe7f95493dc21966d9a6b1b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 173B
- SHA256 efd1c9a7b5d474c12418edb64c8832f41b04036ce2009c3bd62db61bb9611d43
- MD5 2ecc55747fc925fc8c6d99f1b110d7bc
- SHA1 e4831058d9d11a9f1b17b3e926bc6dc84e8d493c
- SHA512 b718a7d533b2a0f58e664794e8dfa2e58e1cb6d0bded3ea992416681b7abde305797a7ea6dd4f627d2fce022e10e96891f7abbd8c057f911b9f2dda529e21fed
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locadob.exe
- Size 3.2MB
- SHA256 743008631698d4f4a90cf8cff1bb839ed3c7a1a0a3ea80e5968162a9333fc0de
- MD5 c1b3acdd4d1392f8c3b5fcc1becb8eec
- SHA1 b4fb96c6c526abe38e78a9e5b7fb1f6be2940af1
- SHA512 d58a8031018695733fc8336d630b43f8169af9fc6aebb7431af4c8d31038d3f7c9ba8c8899bc526d156ec4228ecb4bd0316b092c852cbda2cf70a7ca82ffd453
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB0B/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUpfbVz8eLFcz
- MD5 SHA1 SHA512 SSDEEP