Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/06/2024, 04:35

General

  • Target

    5ee6eacf51a4924425ad85a5794030a0_NeikiAnalytics.exe

  • Size

    4.1MB

  • MD5

    5ee6eacf51a4924425ad85a5794030a0

  • SHA1

    72f4c21eef90e4de1c8c0eb4037b845bf87f56f8

  • SHA256

    9d15659712303302f08a1e4dae295977337db6cde8e0b2e4a1fbb3b1b75319b3

  • SHA512

    bc7b1ee8e111a101ef0a6fdc7fd7c103ff9d9f8adc6d4476f450e15481df9f681554be265cd1209b72f803ff5f093922eb9c9bb6768af0f31c2962b507447600

  • SSDEEP

    98304:+R0pI/IQlUoMPdmpSpj4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdmU5n9klRKN41v

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5ee6eacf51a4924425ad85a5794030a0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\5ee6eacf51a4924425ad85a5794030a0_NeikiAnalytics.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3608
    • C:\UserDotZM\devdobloc.exe
      C:\UserDotZM\devdobloc.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:4016

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\LabZJ7\bodasys.exe

    Filesize

    948KB

    MD5

    7f6902ed96ef1b602488e5fa7ff120b3

    SHA1

    6c7b70c367fae9738a606ba7b311f8cbcbf44359

    SHA256

    9a3efb949ce4863725e8236bf5b62cf2e5bdb1ee9724dd0404933dbd166ce67d

    SHA512

    eb0d2c745774833b983630b9b4d90f59ecba8736e04c74fca455fa0c0f0cc9dc4a2b175fc4e8a07f72894dc215447a5bf5fa78b1a340cf1ba51a10b36d86afc8

  • C:\UserDotZM\devdobloc.exe

    Filesize

    4.1MB

    MD5

    73669b17b91d3c9943fdc0b111996818

    SHA1

    c503bb822adf4cd2720832bb7d3cc593c5bef43f

    SHA256

    021559d35afad86eeb58e5c42a2f65c9c26402c087e5f65170c6614ad16c2d25

    SHA512

    fcdf006462922114465c6b6e05659bcf9e75dcd897148be9adf6eb1be7bc762d99b344d90f988e2d6d8c49fd7cce807deb5e252826bb8adcbcc3da5946437601

  • C:\Users\Admin\253086396416_10.0_Admin.ini

    Filesize

    203B

    MD5

    3adebba4fb2f4b49f26e79ce6bd4515f

    SHA1

    5ee4f45fbf17701e6626948c11704c7e9d125c51

    SHA256

    f2a5a02d946bf6083c3c2b671f2ec2c28f94c400313ba3521c72e4c1a1b36096

    SHA512

    051ae3d087474baf05abb01c84ba2430e62adaee2215216f47ac53f04a4bc90ca7edf491b553aa029148953bee333bd004c5b687de36352461e71acf1fb4cd2c