Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 02:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
58b5c2dff5718dafdb97ca12ccaf0cd0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
58b5c2dff5718dafdb97ca12ccaf0cd0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 58b5c2dff5718dafdb97ca12ccaf0cd0_NeikiAnalytics.exe
- Size 2.7MB
- Sample240613-ddfg9asanc
- SHA256 25f0912fb3c2e7eebec949223e8afafb3f623188b5d72e08990bd664a4bebc00
- MD5 58b5c2dff5718dafdb97ca12ccaf0cd0
- SHA1 b810f41a0b97773dac4cc81576ee9751d0ea0922
- SHA512 0c4b4d6bc7552d7157e73f02a8502f3a5defbc2c2799cef5471a9ffe69329e6b35e9c2cadc615978080f1e396dc1de0e230e24c3856d76bfe1defec507336c4c
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBc9w4Sx:+R0pI/IQlUoMPdmpSpy4
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5088 abodsys.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\GalaxVH\\dobaloc.exe" 58b5c2dff5718dafdb97ca12ccaf0cd0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\Intelproc6P\\abodsys.exe" 58b5c2dff5718dafdb97ca12ccaf0cd0_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3932 58b5c2dff5718dafdb97ca12ccaf0cd0_NeikiAnalytics.exe 3932 58b5c2dff5718dafdb97ca12ccaf0cd0_NeikiAnalytics.exe 3932 58b5c2dff5718dafdb97ca12ccaf0cd0_NeikiAnalytics.exe 3932 58b5c2dff5718dafdb97ca12ccaf0cd0_NeikiAnalytics.exe 5088 abodsys.exe 5088 abodsys.exe 3932 58b5c2dff5718dafdb97ca12ccaf0cd0_NeikiAnalytics.exe 3932 58b5c2dff5718dafdb97ca12ccaf0cd0_NeikiAnalytics.exe 5088 abodsys.exe 5088 abodsys.exe 3932 58b5c2dff5718dafdb97ca12ccaf0cd0_NeikiAnalytics.exe 3932 58b5c2dff5718dafdb97ca12ccaf0cd0_NeikiAnalytics.exe 5088 abodsys.exe 5088 abodsys.exe 3932 58b5c2dff5718dafdb97ca12ccaf0cd0_NeikiAnalytics.exe 3932 58b5c2dff5718dafdb97ca12ccaf0cd0_NeikiAnalytics.exe 5088 abodsys.exe 5088 abodsys.exe 3932 58b5c2dff5718dafdb97ca12ccaf0cd0_NeikiAnalytics.exe 3932 58b5c2dff5718dafdb97ca12ccaf0cd0_NeikiAnalytics.exe 5088 abodsys.exe 5088 abodsys.exe 3932 58b5c2dff5718dafdb97ca12ccaf0cd0_NeikiAnalytics.exe 3932 58b5c2dff5718dafdb97ca12ccaf0cd0_NeikiAnalytics.exe 5088 abodsys.exe 5088 abodsys.exe 3932 58b5c2dff5718dafdb97ca12ccaf0cd0_NeikiAnalytics.exe 3932 58b5c2dff5718dafdb97ca12ccaf0cd0_NeikiAnalytics.exe 5088 abodsys.exe 5088 abodsys.exe 3932 58b5c2dff5718dafdb97ca12ccaf0cd0_NeikiAnalytics.exe 3932 58b5c2dff5718dafdb97ca12ccaf0cd0_NeikiAnalytics.exe 5088 abodsys.exe 5088 abodsys.exe 3932 58b5c2dff5718dafdb97ca12ccaf0cd0_NeikiAnalytics.exe 3932 58b5c2dff5718dafdb97ca12ccaf0cd0_NeikiAnalytics.exe 5088 abodsys.exe 5088 abodsys.exe 3932 58b5c2dff5718dafdb97ca12ccaf0cd0_NeikiAnalytics.exe 3932 58b5c2dff5718dafdb97ca12ccaf0cd0_NeikiAnalytics.exe 5088 abodsys.exe 5088 abodsys.exe 3932 58b5c2dff5718dafdb97ca12ccaf0cd0_NeikiAnalytics.exe 3932 58b5c2dff5718dafdb97ca12ccaf0cd0_NeikiAnalytics.exe 5088 abodsys.exe 5088 abodsys.exe 3932 58b5c2dff5718dafdb97ca12ccaf0cd0_NeikiAnalytics.exe 3932 58b5c2dff5718dafdb97ca12ccaf0cd0_NeikiAnalytics.exe 5088 abodsys.exe 5088 abodsys.exe 3932 58b5c2dff5718dafdb97ca12ccaf0cd0_NeikiAnalytics.exe 3932 58b5c2dff5718dafdb97ca12ccaf0cd0_NeikiAnalytics.exe 5088 abodsys.exe 5088 abodsys.exe 3932 58b5c2dff5718dafdb97ca12ccaf0cd0_NeikiAnalytics.exe 3932 58b5c2dff5718dafdb97ca12ccaf0cd0_NeikiAnalytics.exe 5088 abodsys.exe 5088 abodsys.exe 3932 58b5c2dff5718dafdb97ca12ccaf0cd0_NeikiAnalytics.exe 3932 58b5c2dff5718dafdb97ca12ccaf0cd0_NeikiAnalytics.exe 5088 abodsys.exe 5088 abodsys.exe 3932 58b5c2dff5718dafdb97ca12ccaf0cd0_NeikiAnalytics.exe 3932 58b5c2dff5718dafdb97ca12ccaf0cd0_NeikiAnalytics.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3932 wrote to memory of 5088 3932 58b5c2dff5718dafdb97ca12ccaf0cd0_NeikiAnalytics.exe 85 PID 3932 wrote to memory of 5088 3932 58b5c2dff5718dafdb97ca12ccaf0cd0_NeikiAnalytics.exe 85 PID 3932 wrote to memory of 5088 3932 58b5c2dff5718dafdb97ca12ccaf0cd0_NeikiAnalytics.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\58b5c2dff5718dafdb97ca12ccaf0cd0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\58b5c2dff5718dafdb97ca12ccaf0cd0_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Intelproc6P\abodsys.exeC:\Intelproc6P\abodsys.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5088
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\GalaxVH\dobaloc.exe
- Size 2.7MB
- SHA256 422a7413db91601924009a1440ee41a3489723c243956cfff47187eb19236655
- MD5 6b0f7781e0f4addfd2c025a5439c4d7a
- SHA1 0691ae5af56d5c8e310d667489839b059d099cba
- SHA512 0273ce9b97b2ab8f498c573ac4036bf9659f620f03ae577d4fe5e1c8de333bc46370d654fc3e1498463f3bfc24397a67c459f992856bc56c08b0772861fb7966
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBL9w4Sx:+R0pI/IQlUoMPdmpSpz4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Intelproc6P\abodsys.exe
- Size 2.7MB
- SHA256 eb53b5c5cba944493aa091eef61e40368a762796e29897a63a3148562218d440
- MD5 c33fb3c46d3d2763d9cab9fcb0ceb5b9
- SHA1 1d66cdd985917643d145b8198f8d2657fb379362
- SHA512 3394387a1588aef53afe2e044c6fcff7383424d23d407b892ef472f1af35d6fe17d9bbfbea3c02c96c1be6a891cf5e8923a4c279736cdbf2d67687362dcd309f
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBq9w4Sx:+R0pI/IQlUoMPdmpSpo4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 208B
- SHA256 726aec153f01ffce1b1b5ce53c4e9cdbc7535436fe4b86d8bb5ad1a8f2dbb35a
- MD5 bcec6c488d6c2511e6d9f022ec607113
- SHA1 f8f9ed997403a976024e89c7986d6e5a53272fef
- SHA512 602b75f443f21522d48a930fe071a9848a71e769d33324ad8dc6f067695db2d589eb3769e0a65564d48dcd421af7606edf7d47a1e2e1416e5f790a5c2e505929
- MD5 SHA1 SHA512