Analysis
- max time kernel
152s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 03:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5bd88544380abfbe34e47e5f0b7cab10_NeikiAnalytics.exe
Resource
win7-20240611-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
5bd88544380abfbe34e47e5f0b7cab10_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 5bd88544380abfbe34e47e5f0b7cab10_NeikiAnalytics.exe
- Size 2.7MB
- Sample240613-ebfkxatarc
- SHA256 62d64c391ebb4e69dea121130229c4c2a03117738ba9a6b31f90a8fe01a25efa
- MD5 5bd88544380abfbe34e47e5f0b7cab10
- SHA1 5248681f1f1114fb218245ec347d53f89c4423a9
- SHA512 6d6a240863ddb9509078dc9bb7fa41b90904d7b8107f6572709c8443c8c3c84f688c867fd8ae4a0d36461462a2b5669d16e3a44c86f392d9f955f85915392961
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBA9w4Sx:+R0pI/IQlUoMPdmpSpW4
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3608 abodloc.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\AdobeVZ\\abodloc.exe" 5bd88544380abfbe34e47e5f0b7cab10_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\MintAC\\optidevec.exe" 5bd88544380abfbe34e47e5f0b7cab10_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4544 5bd88544380abfbe34e47e5f0b7cab10_NeikiAnalytics.exe 4544 5bd88544380abfbe34e47e5f0b7cab10_NeikiAnalytics.exe 4544 5bd88544380abfbe34e47e5f0b7cab10_NeikiAnalytics.exe 4544 5bd88544380abfbe34e47e5f0b7cab10_NeikiAnalytics.exe 3608 abodloc.exe 3608 abodloc.exe 4544 5bd88544380abfbe34e47e5f0b7cab10_NeikiAnalytics.exe 4544 5bd88544380abfbe34e47e5f0b7cab10_NeikiAnalytics.exe 3608 abodloc.exe 3608 abodloc.exe 4544 5bd88544380abfbe34e47e5f0b7cab10_NeikiAnalytics.exe 4544 5bd88544380abfbe34e47e5f0b7cab10_NeikiAnalytics.exe 3608 abodloc.exe 3608 abodloc.exe 4544 5bd88544380abfbe34e47e5f0b7cab10_NeikiAnalytics.exe 4544 5bd88544380abfbe34e47e5f0b7cab10_NeikiAnalytics.exe 3608 abodloc.exe 3608 abodloc.exe 4544 5bd88544380abfbe34e47e5f0b7cab10_NeikiAnalytics.exe 4544 5bd88544380abfbe34e47e5f0b7cab10_NeikiAnalytics.exe 3608 abodloc.exe 3608 abodloc.exe 4544 5bd88544380abfbe34e47e5f0b7cab10_NeikiAnalytics.exe 4544 5bd88544380abfbe34e47e5f0b7cab10_NeikiAnalytics.exe 3608 abodloc.exe 3608 abodloc.exe 4544 5bd88544380abfbe34e47e5f0b7cab10_NeikiAnalytics.exe 4544 5bd88544380abfbe34e47e5f0b7cab10_NeikiAnalytics.exe 3608 abodloc.exe 3608 abodloc.exe 4544 5bd88544380abfbe34e47e5f0b7cab10_NeikiAnalytics.exe 4544 5bd88544380abfbe34e47e5f0b7cab10_NeikiAnalytics.exe 3608 abodloc.exe 3608 abodloc.exe 4544 5bd88544380abfbe34e47e5f0b7cab10_NeikiAnalytics.exe 4544 5bd88544380abfbe34e47e5f0b7cab10_NeikiAnalytics.exe 3608 abodloc.exe 3608 abodloc.exe 4544 5bd88544380abfbe34e47e5f0b7cab10_NeikiAnalytics.exe 4544 5bd88544380abfbe34e47e5f0b7cab10_NeikiAnalytics.exe 3608 abodloc.exe 3608 abodloc.exe 4544 5bd88544380abfbe34e47e5f0b7cab10_NeikiAnalytics.exe 4544 5bd88544380abfbe34e47e5f0b7cab10_NeikiAnalytics.exe 3608 abodloc.exe 3608 abodloc.exe 4544 5bd88544380abfbe34e47e5f0b7cab10_NeikiAnalytics.exe 4544 5bd88544380abfbe34e47e5f0b7cab10_NeikiAnalytics.exe 3608 abodloc.exe 3608 abodloc.exe 4544 5bd88544380abfbe34e47e5f0b7cab10_NeikiAnalytics.exe 4544 5bd88544380abfbe34e47e5f0b7cab10_NeikiAnalytics.exe 3608 abodloc.exe 3608 abodloc.exe 4544 5bd88544380abfbe34e47e5f0b7cab10_NeikiAnalytics.exe 4544 5bd88544380abfbe34e47e5f0b7cab10_NeikiAnalytics.exe 3608 abodloc.exe 3608 abodloc.exe 4544 5bd88544380abfbe34e47e5f0b7cab10_NeikiAnalytics.exe 4544 5bd88544380abfbe34e47e5f0b7cab10_NeikiAnalytics.exe 3608 abodloc.exe 3608 abodloc.exe 4544 5bd88544380abfbe34e47e5f0b7cab10_NeikiAnalytics.exe 4544 5bd88544380abfbe34e47e5f0b7cab10_NeikiAnalytics.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4544 wrote to memory of 3608 4544 5bd88544380abfbe34e47e5f0b7cab10_NeikiAnalytics.exe 93 PID 4544 wrote to memory of 3608 4544 5bd88544380abfbe34e47e5f0b7cab10_NeikiAnalytics.exe 93 PID 4544 wrote to memory of 3608 4544 5bd88544380abfbe34e47e5f0b7cab10_NeikiAnalytics.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\5bd88544380abfbe34e47e5f0b7cab10_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5bd88544380abfbe34e47e5f0b7cab10_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\AdobeVZ\abodloc.exeC:\AdobeVZ\abodloc.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3608
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4024 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:81⤵PID:2340
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\AdobeVZ\abodloc.exe
- Size 2.7MB
- SHA256 edd659fe877662659bb17f3931b51b89004c1e039807460c08f0dbab4135e2ac
- MD5 42c3d1b8bf7fd2ca20326b8cd31116cc
- SHA1 427e5fb49bef56d2bf18c4363d013aa6edef9ab0
- SHA512 31038fb206ef676eb3e65f0bb14d61c2bc571af770f9b172fc58bb7bbc1f3c2374f0ea67df2f995797aceecc5c8bc03afb534b5e55d1ba59f087156691aa5790
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBM9w4Sx:+R0pI/IQlUoMPdmpSpK4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MintAC\optidevec.exe
- Size 2.7MB
- SHA256 05926ba4ca21d690a84802d0ade63fa1348877ccce18834879da2d52f30bb22c
- MD5 e3e44655a4164e4522dc6819db22f5df
- SHA1 5cc3e88c79cc1a7089cd660cfde69bc840180127
- SHA512 9e8101e56dda2915f914e67d5cfc69528ade8d0eb154a7c6c4946bca65582daef392ee4cbff16e024efe5c13726e3112a1406ede53314c1c00f77634e31ebbc8
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBD9w4Sx:+R0pI/IQlUoMPdmpSpX4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 201B
- SHA256 8b0c303bd4027d4fb741f2192636817b1c8f45e4169d15de33834ef356ba2cf2
- MD5 56a4ff650bf5e67a583b3adf657894a2
- SHA1 6d6355cdf2f81fe537484ff2be62cf291f802183
- SHA512 457a319b8dad6ecf3ae02bd5bf585d991fbdc2ffcef344328441e8b8afa7885c1762cf9e20f40d8d718e09c791d2ebcb9ed2014d1025175cca05511f74c7b39e
- MD5 SHA1 SHA512