Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
13/06/2024, 04:35
Static task
static1
Behavioral task
behavioral1
Sample
5ee6eacf51a4924425ad85a5794030a0_NeikiAnalytics.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
5ee6eacf51a4924425ad85a5794030a0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
5ee6eacf51a4924425ad85a5794030a0_NeikiAnalytics.exe
-
Size
4.1MB
-
MD5
5ee6eacf51a4924425ad85a5794030a0
-
SHA1
72f4c21eef90e4de1c8c0eb4037b845bf87f56f8
-
SHA256
9d15659712303302f08a1e4dae295977337db6cde8e0b2e4a1fbb3b1b75319b3
-
SHA512
bc7b1ee8e111a101ef0a6fdc7fd7c103ff9d9f8adc6d4476f450e15481df9f681554be265cd1209b72f803ff5f093922eb9c9bb6768af0f31c2962b507447600
-
SSDEEP
98304:+R0pI/IQlUoMPdmpSpj4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdmU5n9klRKN41v
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4016 devdobloc.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\UserDotZM\\devdobloc.exe" 5ee6eacf51a4924425ad85a5794030a0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\LabZJ7\\bodasys.exe" 5ee6eacf51a4924425ad85a5794030a0_NeikiAnalytics.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3608 5ee6eacf51a4924425ad85a5794030a0_NeikiAnalytics.exe 3608 5ee6eacf51a4924425ad85a5794030a0_NeikiAnalytics.exe 3608 5ee6eacf51a4924425ad85a5794030a0_NeikiAnalytics.exe 3608 5ee6eacf51a4924425ad85a5794030a0_NeikiAnalytics.exe 4016 devdobloc.exe 4016 devdobloc.exe 3608 5ee6eacf51a4924425ad85a5794030a0_NeikiAnalytics.exe 3608 5ee6eacf51a4924425ad85a5794030a0_NeikiAnalytics.exe 4016 devdobloc.exe 4016 devdobloc.exe 3608 5ee6eacf51a4924425ad85a5794030a0_NeikiAnalytics.exe 3608 5ee6eacf51a4924425ad85a5794030a0_NeikiAnalytics.exe 4016 devdobloc.exe 4016 devdobloc.exe 3608 5ee6eacf51a4924425ad85a5794030a0_NeikiAnalytics.exe 3608 5ee6eacf51a4924425ad85a5794030a0_NeikiAnalytics.exe 4016 devdobloc.exe 4016 devdobloc.exe 3608 5ee6eacf51a4924425ad85a5794030a0_NeikiAnalytics.exe 3608 5ee6eacf51a4924425ad85a5794030a0_NeikiAnalytics.exe 4016 devdobloc.exe 4016 devdobloc.exe 3608 5ee6eacf51a4924425ad85a5794030a0_NeikiAnalytics.exe 3608 5ee6eacf51a4924425ad85a5794030a0_NeikiAnalytics.exe 4016 devdobloc.exe 4016 devdobloc.exe 3608 5ee6eacf51a4924425ad85a5794030a0_NeikiAnalytics.exe 3608 5ee6eacf51a4924425ad85a5794030a0_NeikiAnalytics.exe 4016 devdobloc.exe 4016 devdobloc.exe 3608 5ee6eacf51a4924425ad85a5794030a0_NeikiAnalytics.exe 3608 5ee6eacf51a4924425ad85a5794030a0_NeikiAnalytics.exe 4016 devdobloc.exe 4016 devdobloc.exe 3608 5ee6eacf51a4924425ad85a5794030a0_NeikiAnalytics.exe 3608 5ee6eacf51a4924425ad85a5794030a0_NeikiAnalytics.exe 4016 devdobloc.exe 4016 devdobloc.exe 3608 5ee6eacf51a4924425ad85a5794030a0_NeikiAnalytics.exe 3608 5ee6eacf51a4924425ad85a5794030a0_NeikiAnalytics.exe 4016 devdobloc.exe 4016 devdobloc.exe 3608 5ee6eacf51a4924425ad85a5794030a0_NeikiAnalytics.exe 3608 5ee6eacf51a4924425ad85a5794030a0_NeikiAnalytics.exe 4016 devdobloc.exe 4016 devdobloc.exe 3608 5ee6eacf51a4924425ad85a5794030a0_NeikiAnalytics.exe 3608 5ee6eacf51a4924425ad85a5794030a0_NeikiAnalytics.exe 4016 devdobloc.exe 4016 devdobloc.exe 3608 5ee6eacf51a4924425ad85a5794030a0_NeikiAnalytics.exe 3608 5ee6eacf51a4924425ad85a5794030a0_NeikiAnalytics.exe 4016 devdobloc.exe 4016 devdobloc.exe 3608 5ee6eacf51a4924425ad85a5794030a0_NeikiAnalytics.exe 3608 5ee6eacf51a4924425ad85a5794030a0_NeikiAnalytics.exe 4016 devdobloc.exe 4016 devdobloc.exe 3608 5ee6eacf51a4924425ad85a5794030a0_NeikiAnalytics.exe 3608 5ee6eacf51a4924425ad85a5794030a0_NeikiAnalytics.exe 4016 devdobloc.exe 4016 devdobloc.exe 3608 5ee6eacf51a4924425ad85a5794030a0_NeikiAnalytics.exe 3608 5ee6eacf51a4924425ad85a5794030a0_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3608 wrote to memory of 4016 3608 5ee6eacf51a4924425ad85a5794030a0_NeikiAnalytics.exe 85 PID 3608 wrote to memory of 4016 3608 5ee6eacf51a4924425ad85a5794030a0_NeikiAnalytics.exe 85 PID 3608 wrote to memory of 4016 3608 5ee6eacf51a4924425ad85a5794030a0_NeikiAnalytics.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\5ee6eacf51a4924425ad85a5794030a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5ee6eacf51a4924425ad85a5794030a0_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\UserDotZM\devdobloc.exeC:\UserDotZM\devdobloc.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4016
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
948KB
MD57f6902ed96ef1b602488e5fa7ff120b3
SHA16c7b70c367fae9738a606ba7b311f8cbcbf44359
SHA2569a3efb949ce4863725e8236bf5b62cf2e5bdb1ee9724dd0404933dbd166ce67d
SHA512eb0d2c745774833b983630b9b4d90f59ecba8736e04c74fca455fa0c0f0cc9dc4a2b175fc4e8a07f72894dc215447a5bf5fa78b1a340cf1ba51a10b36d86afc8
-
Filesize
4.1MB
MD573669b17b91d3c9943fdc0b111996818
SHA1c503bb822adf4cd2720832bb7d3cc593c5bef43f
SHA256021559d35afad86eeb58e5c42a2f65c9c26402c087e5f65170c6614ad16c2d25
SHA512fcdf006462922114465c6b6e05659bcf9e75dcd897148be9adf6eb1be7bc762d99b344d90f988e2d6d8c49fd7cce807deb5e252826bb8adcbcc3da5946437601
-
Filesize
203B
MD53adebba4fb2f4b49f26e79ce6bd4515f
SHA15ee4f45fbf17701e6626948c11704c7e9d125c51
SHA256f2a5a02d946bf6083c3c2b671f2ec2c28f94c400313ba3521c72e4c1a1b36096
SHA512051ae3d087474baf05abb01c84ba2430e62adaee2215216f47ac53f04a4bc90ca7edf491b553aa029148953bee333bd004c5b687de36352461e71acf1fb4cd2c