Analysis
- max time kernel
149s - max time network
57s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 01:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5474daec32eef07c6a4989726683ae20_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
5474daec32eef07c6a4989726683ae20_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 5474daec32eef07c6a4989726683ae20_NeikiAnalytics.exe
- Size 3.1MB
- Sample240613-b6g6fazdkd
- SHA256 5a969a29c236fa3ffac806f6ed126922ca69461b9ec7b4ec4eb2a309518940b7
- MD5 5474daec32eef07c6a4989726683ae20
- SHA1 030e2f4120b2a06b7f9929bd532ec88b2acbd70b
- SHA512 fbeea791ed220ccf26a3e7bc5bd3218797b7a9f05e4cdc1d7753cb62d1b77de67e4ad5761651a1464bbbed27f026e62552cd5475f8d98cd5f7935e20cb019c76
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBDB/bSqz8b6LNXJqI:sxX7QnxrloE5dpUpcbVz8eLFc
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysdevbod.exe 5474daec32eef07c6a4989726683ae20_NeikiAnalytics.exe - Executes dropped EXE 2 IoCs
pid Process 5100 sysdevbod.exe 1644 devbodsys.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\AdobeQ1\\devbodsys.exe" 5474daec32eef07c6a4989726683ae20_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\MintUY\\bodxec.exe" 5474daec32eef07c6a4989726683ae20_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1760 5474daec32eef07c6a4989726683ae20_NeikiAnalytics.exe 1760 5474daec32eef07c6a4989726683ae20_NeikiAnalytics.exe 1760 5474daec32eef07c6a4989726683ae20_NeikiAnalytics.exe 1760 5474daec32eef07c6a4989726683ae20_NeikiAnalytics.exe 5100 sysdevbod.exe 5100 sysdevbod.exe 1644 devbodsys.exe 1644 devbodsys.exe 5100 sysdevbod.exe 5100 sysdevbod.exe 1644 devbodsys.exe 1644 devbodsys.exe 5100 sysdevbod.exe 5100 sysdevbod.exe 1644 devbodsys.exe 1644 devbodsys.exe 5100 sysdevbod.exe 5100 sysdevbod.exe 1644 devbodsys.exe 1644 devbodsys.exe 5100 sysdevbod.exe 5100 sysdevbod.exe 1644 devbodsys.exe 1644 devbodsys.exe 5100 sysdevbod.exe 5100 sysdevbod.exe 1644 devbodsys.exe 1644 devbodsys.exe 5100 sysdevbod.exe 5100 sysdevbod.exe 1644 devbodsys.exe 1644 devbodsys.exe 5100 sysdevbod.exe 5100 sysdevbod.exe 1644 devbodsys.exe 1644 devbodsys.exe 5100 sysdevbod.exe 5100 sysdevbod.exe 1644 devbodsys.exe 1644 devbodsys.exe 5100 sysdevbod.exe 5100 sysdevbod.exe 1644 devbodsys.exe 1644 devbodsys.exe 5100 sysdevbod.exe 5100 sysdevbod.exe 1644 devbodsys.exe 1644 devbodsys.exe 5100 sysdevbod.exe 5100 sysdevbod.exe 1644 devbodsys.exe 1644 devbodsys.exe 5100 sysdevbod.exe 5100 sysdevbod.exe 1644 devbodsys.exe 1644 devbodsys.exe 5100 sysdevbod.exe 5100 sysdevbod.exe 1644 devbodsys.exe 1644 devbodsys.exe 5100 sysdevbod.exe 5100 sysdevbod.exe 1644 devbodsys.exe 1644 devbodsys.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1760 wrote to memory of 5100 1760 5474daec32eef07c6a4989726683ae20_NeikiAnalytics.exe 86 PID 1760 wrote to memory of 5100 1760 5474daec32eef07c6a4989726683ae20_NeikiAnalytics.exe 86 PID 1760 wrote to memory of 5100 1760 5474daec32eef07c6a4989726683ae20_NeikiAnalytics.exe 86 PID 1760 wrote to memory of 1644 1760 5474daec32eef07c6a4989726683ae20_NeikiAnalytics.exe 87 PID 1760 wrote to memory of 1644 1760 5474daec32eef07c6a4989726683ae20_NeikiAnalytics.exe 87 PID 1760 wrote to memory of 1644 1760 5474daec32eef07c6a4989726683ae20_NeikiAnalytics.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\5474daec32eef07c6a4989726683ae20_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5474daec32eef07c6a4989726683ae20_NeikiAnalytics.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysdevbod.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysdevbod.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5100
-
-
C:\AdobeQ1\devbodsys.exeC:\AdobeQ1\devbodsys.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1644
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\AdobeQ1\devbodsys.exe
- Size 933KB
- SHA256 87fda858c46a29c2deda7fb4f3b73bbde37d9baefb12b19166bef5fe3f0d8410
- MD5 f6b0d1d4ea9284b23629141a2d60d26a
- SHA1 86469e028d7718252f808f7d584f3761a23683d7
- SHA512 8a02eca73d3a24f4b49558560e64a24373a3adb458f3cf37c4495794e737c6fecf6bafb1290894ac7bbda28b371066385b0d02ec4fe491d522aa9bddc1a818e1
- SSDEEP 24576:6nxDZV7xMyu6qJ2WSYxBdSqpcVdm5XRVpQO3chiIcr1RhSKntaq:sxX7665YxRVplZzSKntn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\AdobeQ1\devbodsys.exe
- Size 3.1MB
- SHA256 f5e85dfb89632318462e3d97a0d78ecba17c1f8fbaeba453959f130316fd94e2
- MD5 bd96428ce8c263b40c7de7061c5e0a3d
- SHA1 398424b69c4c97940d4b804525b9084ac1e0a446
- SHA512 481521434bc33ebe2f1e49441343a5e1e7746bb8bb7f1411e41d4bc5b03c719f3e9c8f9767edaeef464a669e0080aee5fc81b0db52faeb32b7fe2e179a5dcfb1
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBFB/bSqz8b6LNXJqI:sxX7QnxrloE5dpUpabVz8eLFc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MintUY\bodxec.exe
- Size 53KB
- SHA256 e597c53b5215cf8367feb0dfaf2c8560bb3b69e9a2424e217f96cdd80db5fd1b
- MD5 2e9a66b754b83350b21648f88780d54f
- SHA1 0d11ac5510ab97707d5532f9533436cc60d891c1
- SHA512 b55da4a67482d8ca4e5622815788ef121374058d711b3dd474a7d85db7666d66f92b6112b03619fd07016ba7014d5cbcfab88b6740cd6e4747ceacff96dfa54b
- SSDEEP 768:xezkk/DUj7TlODVED17nKFO3nq/KjsDZe+pxsjqsXQJ+YWNn6q8/oIovypoRMkfY:ABalOBo1TKFO3n0KkZHqX7+g2lWXQF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MintUY\bodxec.exe
- Size 3.1MB
- SHA256 9767a08c474022509ed7d4e04b687ce3c940ce5dcfc722d634fca9be33daf7b2
- MD5 6d1aa9362dbee27306b1b17cd37fff01
- SHA1 ddf9e145cb36847648349dbb661d6bee94387fa9
- SHA512 4ecfdcf736a9e781ec264f3f5c8537dcb3f6b24fa7ffc5be765079142acf893bdc6b82094ef8aa1a19f9b6cfb1c64c9fb2a2d81cdf2573d1fea865f27dc9f777
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBQB/bSqz8b6LNXJqI:sxX7QnxrloE5dpUpjbVz8eLFc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 203B
- SHA256 b4c4c2bc6ea95dbbb0d2ef304191e635a2f2b4e1d491aadbeec5c1e6d3f98d05
- MD5 542c9933d8fa18ea3ca019b0c094fee8
- SHA1 3111cb07b93dbb5f9298aead059e5f616b625740
- SHA512 b1fef082250b4c0fa4f76984a8aedfa7eb32495c8740a3101cf9e7bc7b5a5341222e13c33261a36bfa035b11b852b7fa9fad9d43f7705b97ddfc63e14bc54f94
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 171B
- SHA256 b1ea0a1c226915040ef400aa0a4bfe30aeb0789e1a600376de20e51a5c93514c
- MD5 885ba6207eae5321250641d62dfe48fd
- SHA1 75b9971760ba6bec5a8dd600495fb12a19eb73dc
- SHA512 a2cbc0c3c144aa12aed94a96f350dae882e029a99d0ec0875f39889ea4bad563f110373b6af37af57c970124feea506c5df292661717bca5d0f0461de0f53239
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysdevbod.exe
- Size 3.1MB
- SHA256 64b950faf2f1defcbdfa666af95614f3c42a26d77ee6c7528beaf56c4ca6fa9c
- MD5 ec0b88cc7c2580fa1d26b0fb2dc6b0b5
- SHA1 f4b826728b9c932d472f3643a2786b7287a24968
- SHA512 d2443dbf3a239178715b1a0e81fe8d63befebc072d3da9f49fac26470d31cdc146a60726cf2330094872b2669ea55b137f8135388f9296512bbd832da29f3693
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB/B/bSqz8b6LNXJqI:sxX7QnxrloE5dpUpEbVz8eLFc
- MD5 SHA1 SHA512 SSDEEP