Analysis
- max time kernel
149s - max time network
51s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 03:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5afbd913f475ac928b4cce5a439ed610_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
5afbd913f475ac928b4cce5a439ed610_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 5afbd913f475ac928b4cce5a439ed610_NeikiAnalytics.exe
- Size 4.1MB
- Sample240613-d3fvbawfmj
- SHA256 a60a0ee6fc6ad7dec5a1c6f2ea6823aa7ff4365f7521cd2ae9c547eb7dea9e12
- MD5 5afbd913f475ac928b4cce5a439ed610
- SHA1 d092a9b5edfdf35612e4fdb8add019596f035a4e
- SHA512 57d6835e541b88be993b7a1a39fdebba2f6b618b030c67f1602ef65af15fe78a8d9b471ea48d87476bf4a17974a1c4b99d0c469de336ff370566b1103e660090
- SSDEEP 98304:+R0pI/IQlUoMPdmpSp34ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdmQ5n9klRKN41v
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3520 xdobec.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\UserDotOR\\xdobec.exe" 5afbd913f475ac928b4cce5a439ed610_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\KaVBVD\\boddevsys.exe" 5afbd913f475ac928b4cce5a439ed610_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 392 5afbd913f475ac928b4cce5a439ed610_NeikiAnalytics.exe 392 5afbd913f475ac928b4cce5a439ed610_NeikiAnalytics.exe 392 5afbd913f475ac928b4cce5a439ed610_NeikiAnalytics.exe 392 5afbd913f475ac928b4cce5a439ed610_NeikiAnalytics.exe 3520 xdobec.exe 3520 xdobec.exe 392 5afbd913f475ac928b4cce5a439ed610_NeikiAnalytics.exe 392 5afbd913f475ac928b4cce5a439ed610_NeikiAnalytics.exe 3520 xdobec.exe 3520 xdobec.exe 392 5afbd913f475ac928b4cce5a439ed610_NeikiAnalytics.exe 392 5afbd913f475ac928b4cce5a439ed610_NeikiAnalytics.exe 3520 xdobec.exe 3520 xdobec.exe 392 5afbd913f475ac928b4cce5a439ed610_NeikiAnalytics.exe 392 5afbd913f475ac928b4cce5a439ed610_NeikiAnalytics.exe 3520 xdobec.exe 3520 xdobec.exe 392 5afbd913f475ac928b4cce5a439ed610_NeikiAnalytics.exe 392 5afbd913f475ac928b4cce5a439ed610_NeikiAnalytics.exe 3520 xdobec.exe 3520 xdobec.exe 392 5afbd913f475ac928b4cce5a439ed610_NeikiAnalytics.exe 392 5afbd913f475ac928b4cce5a439ed610_NeikiAnalytics.exe 3520 xdobec.exe 3520 xdobec.exe 392 5afbd913f475ac928b4cce5a439ed610_NeikiAnalytics.exe 392 5afbd913f475ac928b4cce5a439ed610_NeikiAnalytics.exe 3520 xdobec.exe 3520 xdobec.exe 392 5afbd913f475ac928b4cce5a439ed610_NeikiAnalytics.exe 392 5afbd913f475ac928b4cce5a439ed610_NeikiAnalytics.exe 3520 xdobec.exe 3520 xdobec.exe 392 5afbd913f475ac928b4cce5a439ed610_NeikiAnalytics.exe 392 5afbd913f475ac928b4cce5a439ed610_NeikiAnalytics.exe 3520 xdobec.exe 3520 xdobec.exe 392 5afbd913f475ac928b4cce5a439ed610_NeikiAnalytics.exe 392 5afbd913f475ac928b4cce5a439ed610_NeikiAnalytics.exe 3520 xdobec.exe 3520 xdobec.exe 392 5afbd913f475ac928b4cce5a439ed610_NeikiAnalytics.exe 392 5afbd913f475ac928b4cce5a439ed610_NeikiAnalytics.exe 3520 xdobec.exe 3520 xdobec.exe 392 5afbd913f475ac928b4cce5a439ed610_NeikiAnalytics.exe 392 5afbd913f475ac928b4cce5a439ed610_NeikiAnalytics.exe 3520 xdobec.exe 3520 xdobec.exe 392 5afbd913f475ac928b4cce5a439ed610_NeikiAnalytics.exe 392 5afbd913f475ac928b4cce5a439ed610_NeikiAnalytics.exe 3520 xdobec.exe 3520 xdobec.exe 392 5afbd913f475ac928b4cce5a439ed610_NeikiAnalytics.exe 392 5afbd913f475ac928b4cce5a439ed610_NeikiAnalytics.exe 3520 xdobec.exe 3520 xdobec.exe 392 5afbd913f475ac928b4cce5a439ed610_NeikiAnalytics.exe 392 5afbd913f475ac928b4cce5a439ed610_NeikiAnalytics.exe 3520 xdobec.exe 3520 xdobec.exe 392 5afbd913f475ac928b4cce5a439ed610_NeikiAnalytics.exe 392 5afbd913f475ac928b4cce5a439ed610_NeikiAnalytics.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 392 wrote to memory of 3520 392 5afbd913f475ac928b4cce5a439ed610_NeikiAnalytics.exe 86 PID 392 wrote to memory of 3520 392 5afbd913f475ac928b4cce5a439ed610_NeikiAnalytics.exe 86 PID 392 wrote to memory of 3520 392 5afbd913f475ac928b4cce5a439ed610_NeikiAnalytics.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\5afbd913f475ac928b4cce5a439ed610_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5afbd913f475ac928b4cce5a439ed610_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:392 -
C:\UserDotOR\xdobec.exeC:\UserDotOR\xdobec.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3520
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\KaVBVD\boddevsys.exe
- Size 615KB
- SHA256 16e66228a31b4e57ae01a0eb64792f7de1ff885c07091299d69bc8ba5299f532
- MD5 d0e81e266c97ea8fe19fd58bfe82558a
- SHA1 3238ec2ebbb19d85ea21efd4f59baf1deb6b7dd8
- SHA512 03196615e892c5817d2d26fa8dbb715df6ebac8067c054dcfa81469cc8f891f3239871c2b9d5c8dd9d2bb379d8aa59b847cd72d5a6773e793191f96e273869e4
- SSDEEP 12288:n+e3H0j/4cFSakgnCf8xCD/8xmlBLaXPATazr4ekzDlYFWtN7E/N80Y:+RjQgSjgCf8xC78xmlVaXPATazr4eoDx
- MD5 SHA1 SHA512 SSDEEP
- Path C:\UserDotOR\xdobec.exe
- Size 4.1MB
- SHA256 9fa389ee44683e493e2de0156872e87c06f9f3432b48471a65c19b527d0327b7
- MD5 8eefa8c12d5659a3f8766ad9212c24c5
- SHA1 81f4f51d65cdfef1c16ed4179e1251e56272c27d
- SHA512 94ad2454869d3b44ac39a7a929ca21082ae57d4bbeb7eecf75437a8e6e2032f679b6b198725c8bc3f72c03edae9f87f0d98641dfd670b42b7885b8eeaad662d6
- SSDEEP 98304:+R0pI/IQlUoMPdmpSpi4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdm55n9klRKN41v
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 197B
- SHA256 5102632195043688b156bf4f9119a5566b29d4b8f9b73534d86a6f277dd2213a
- MD5 c4652a792a247a4d9dac18d160197383
- SHA1 726a0ecc205e5c50771865f1d08951b8c4791e73
- SHA512 6fe9997dc3d4ebd20c419179ab4a087006d8fef5f77d704cdc979674276f5d2c99c2c92851cf49bdb9f73c88e25098d86d9f35383e2f2abf3885d8d927d4c1df
- MD5 SHA1 SHA512