Analysis
- max time kernel
149s - max time network
51s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 04:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5d9227563d9084c244ee570ff0a5a260_NeikiAnalytics.exe
Resource
win7-20240611-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
5d9227563d9084c244ee570ff0a5a260_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 5d9227563d9084c244ee570ff0a5a260_NeikiAnalytics.exe
- Size 2.7MB
- Sample240613-evg8vatfmb
- SHA256 1ae17ba99d27d1921436920f0b9f2e7078f00579b9590cb36e390106641687be
- MD5 5d9227563d9084c244ee570ff0a5a260
- SHA1 3cf9a8e4f7ba05d9f747ebc917d621cdb5d58d32
- SHA512 75e794195d3f76ff3171498460e5c47b1b4e6a999c77f0a15b1b8f45ca2ad55b2764b290a067cc4edfd4d4b43c14bca110308c06fef5442fb86d4bc5e41e7601
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LB09w4Sx:+R0pI/IQlUoMPdmpSp+4
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1608 devbodsys.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\UserDotZ7\\devbodsys.exe" 5d9227563d9084c244ee570ff0a5a260_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\Vid8J\\bodaloc.exe" 5d9227563d9084c244ee570ff0a5a260_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 376 5d9227563d9084c244ee570ff0a5a260_NeikiAnalytics.exe 376 5d9227563d9084c244ee570ff0a5a260_NeikiAnalytics.exe 376 5d9227563d9084c244ee570ff0a5a260_NeikiAnalytics.exe 376 5d9227563d9084c244ee570ff0a5a260_NeikiAnalytics.exe 1608 devbodsys.exe 1608 devbodsys.exe 376 5d9227563d9084c244ee570ff0a5a260_NeikiAnalytics.exe 376 5d9227563d9084c244ee570ff0a5a260_NeikiAnalytics.exe 1608 devbodsys.exe 1608 devbodsys.exe 376 5d9227563d9084c244ee570ff0a5a260_NeikiAnalytics.exe 376 5d9227563d9084c244ee570ff0a5a260_NeikiAnalytics.exe 1608 devbodsys.exe 1608 devbodsys.exe 376 5d9227563d9084c244ee570ff0a5a260_NeikiAnalytics.exe 376 5d9227563d9084c244ee570ff0a5a260_NeikiAnalytics.exe 1608 devbodsys.exe 1608 devbodsys.exe 376 5d9227563d9084c244ee570ff0a5a260_NeikiAnalytics.exe 376 5d9227563d9084c244ee570ff0a5a260_NeikiAnalytics.exe 1608 devbodsys.exe 1608 devbodsys.exe 376 5d9227563d9084c244ee570ff0a5a260_NeikiAnalytics.exe 376 5d9227563d9084c244ee570ff0a5a260_NeikiAnalytics.exe 1608 devbodsys.exe 1608 devbodsys.exe 376 5d9227563d9084c244ee570ff0a5a260_NeikiAnalytics.exe 376 5d9227563d9084c244ee570ff0a5a260_NeikiAnalytics.exe 1608 devbodsys.exe 1608 devbodsys.exe 376 5d9227563d9084c244ee570ff0a5a260_NeikiAnalytics.exe 376 5d9227563d9084c244ee570ff0a5a260_NeikiAnalytics.exe 1608 devbodsys.exe 1608 devbodsys.exe 376 5d9227563d9084c244ee570ff0a5a260_NeikiAnalytics.exe 376 5d9227563d9084c244ee570ff0a5a260_NeikiAnalytics.exe 1608 devbodsys.exe 1608 devbodsys.exe 376 5d9227563d9084c244ee570ff0a5a260_NeikiAnalytics.exe 376 5d9227563d9084c244ee570ff0a5a260_NeikiAnalytics.exe 1608 devbodsys.exe 1608 devbodsys.exe 376 5d9227563d9084c244ee570ff0a5a260_NeikiAnalytics.exe 376 5d9227563d9084c244ee570ff0a5a260_NeikiAnalytics.exe 1608 devbodsys.exe 1608 devbodsys.exe 376 5d9227563d9084c244ee570ff0a5a260_NeikiAnalytics.exe 376 5d9227563d9084c244ee570ff0a5a260_NeikiAnalytics.exe 1608 devbodsys.exe 1608 devbodsys.exe 376 5d9227563d9084c244ee570ff0a5a260_NeikiAnalytics.exe 376 5d9227563d9084c244ee570ff0a5a260_NeikiAnalytics.exe 1608 devbodsys.exe 1608 devbodsys.exe 376 5d9227563d9084c244ee570ff0a5a260_NeikiAnalytics.exe 376 5d9227563d9084c244ee570ff0a5a260_NeikiAnalytics.exe 1608 devbodsys.exe 1608 devbodsys.exe 376 5d9227563d9084c244ee570ff0a5a260_NeikiAnalytics.exe 376 5d9227563d9084c244ee570ff0a5a260_NeikiAnalytics.exe 1608 devbodsys.exe 1608 devbodsys.exe 376 5d9227563d9084c244ee570ff0a5a260_NeikiAnalytics.exe 376 5d9227563d9084c244ee570ff0a5a260_NeikiAnalytics.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 376 wrote to memory of 1608 376 5d9227563d9084c244ee570ff0a5a260_NeikiAnalytics.exe 86 PID 376 wrote to memory of 1608 376 5d9227563d9084c244ee570ff0a5a260_NeikiAnalytics.exe 86 PID 376 wrote to memory of 1608 376 5d9227563d9084c244ee570ff0a5a260_NeikiAnalytics.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d9227563d9084c244ee570ff0a5a260_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5d9227563d9084c244ee570ff0a5a260_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:376 -
C:\UserDotZ7\devbodsys.exeC:\UserDotZ7\devbodsys.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1608
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\UserDotZ7\devbodsys.exe
- Size 2.7MB
- SHA256 e250ac2548a9309c187b1e6f35b73e871241d60bd9f7843617953041f33d27ff
- MD5 1a1c952ad65912b276a272a8c3521dc4
- SHA1 f18a675f76264b53190b1b2653beba8bf93f948b
- SHA512 99f3b7df80e39594a7f4c270e85241f6530dd2fb83bc10f1b6c33229b8ac45599bf35bbcc4093c531052d12471664df40b49b9510177606a5277df9adeefe067
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBn9w4Sx:+R0pI/IQlUoMPdmpSpr4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 202B
- SHA256 c7e2db51ff5565fcd743a4a66dc310af2efd98748dc8829897b8658f424b1a15
- MD5 aedfb9bfb4fc74197f5456bf2ee62b5e
- SHA1 e708ff34f6d8c7c052190c2270bf8437fc7b04ba
- SHA512 cf6ac0778dfe6b5d62b806216480bff7fe0ae042660a30764410e5f83cc137d0eb40b1bb30490adf1e4967bb78cc0cb9bb9c311adc80dda7c2cd85da0ebbd6a4
- MD5 SHA1 SHA512
- Path C:\Vid8J\bodaloc.exe
- Size 2.7MB
- SHA256 96044a0f7cdcbb36b1bf5695b5669f8d2637c32dfecd1912d2bd0ce8d2d905af
- MD5 b24546582b72da764bd5833f1e00592c
- SHA1 07188c004dc306a877ddd154b9213cb066954b47
- SHA512 34271a0a1aa970acc558e5e2d24a4bc3bc8ba6e54057cab1ea7d3a86a5d59a428c54034e8970cad2f9f7b0c6031b020620b6ebc6b79bf8e8f7f75c9e09049045
- SSDEEP 49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBe9w4Sx:+R0pI/IQlUoMPdmpSpk4
- MD5 SHA1 SHA512 SSDEEP