Analysis
- max time kernel
150s - max time network
99s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 09:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
717df2637f48e27247386e33a1020d50_NeikiAnalytics.exe
Resource
win7-20240611-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
717df2637f48e27247386e33a1020d50_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 717df2637f48e27247386e33a1020d50_NeikiAnalytics.exe
- Size 2.7MB
- Sample240613-lp2tmaxdjp
- SHA256 fbd73768db948506093b04d231ecbaf1d3d06ff8a6078c656a78adf28d8a8bb9
- MD5 717df2637f48e27247386e33a1020d50
- SHA1 1bb71c3c9265aef8b8b2cd409aac9601c80939f7
- SHA512 82f445c8217b273fcdc597d2c3c3160daf1b4a060a183aa3db6d62c5759d11b83725dac28b58805930a3b3a2ebc8e8a87986b117d49cadbcb26f1a7e0168a4a9
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBMB/bSq:sxX7QnxrloE5dpUpXbV
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecabod.exe 717df2637f48e27247386e33a1020d50_NeikiAnalytics.exe - Executes dropped EXE 2 IoCs
pid Process 4248 ecabod.exe 1232 abodloc.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\Files0C\\abodloc.exe" 717df2637f48e27247386e33a1020d50_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\MintK4\\bodxsys.exe" 717df2637f48e27247386e33a1020d50_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1328 717df2637f48e27247386e33a1020d50_NeikiAnalytics.exe 1328 717df2637f48e27247386e33a1020d50_NeikiAnalytics.exe 1328 717df2637f48e27247386e33a1020d50_NeikiAnalytics.exe 1328 717df2637f48e27247386e33a1020d50_NeikiAnalytics.exe 4248 ecabod.exe 4248 ecabod.exe 1232 abodloc.exe 1232 abodloc.exe 4248 ecabod.exe 4248 ecabod.exe 1232 abodloc.exe 1232 abodloc.exe 4248 ecabod.exe 4248 ecabod.exe 1232 abodloc.exe 1232 abodloc.exe 4248 ecabod.exe 4248 ecabod.exe 1232 abodloc.exe 1232 abodloc.exe 4248 ecabod.exe 4248 ecabod.exe 1232 abodloc.exe 1232 abodloc.exe 4248 ecabod.exe 4248 ecabod.exe 1232 abodloc.exe 1232 abodloc.exe 4248 ecabod.exe 4248 ecabod.exe 1232 abodloc.exe 1232 abodloc.exe 4248 ecabod.exe 4248 ecabod.exe 1232 abodloc.exe 1232 abodloc.exe 4248 ecabod.exe 4248 ecabod.exe 1232 abodloc.exe 1232 abodloc.exe 4248 ecabod.exe 4248 ecabod.exe 1232 abodloc.exe 1232 abodloc.exe 4248 ecabod.exe 4248 ecabod.exe 1232 abodloc.exe 1232 abodloc.exe 4248 ecabod.exe 4248 ecabod.exe 1232 abodloc.exe 1232 abodloc.exe 4248 ecabod.exe 4248 ecabod.exe 1232 abodloc.exe 1232 abodloc.exe 4248 ecabod.exe 4248 ecabod.exe 1232 abodloc.exe 1232 abodloc.exe 4248 ecabod.exe 4248 ecabod.exe 1232 abodloc.exe 1232 abodloc.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1328 wrote to memory of 4248 1328 717df2637f48e27247386e33a1020d50_NeikiAnalytics.exe 80 PID 1328 wrote to memory of 4248 1328 717df2637f48e27247386e33a1020d50_NeikiAnalytics.exe 80 PID 1328 wrote to memory of 4248 1328 717df2637f48e27247386e33a1020d50_NeikiAnalytics.exe 80 PID 1328 wrote to memory of 1232 1328 717df2637f48e27247386e33a1020d50_NeikiAnalytics.exe 81 PID 1328 wrote to memory of 1232 1328 717df2637f48e27247386e33a1020d50_NeikiAnalytics.exe 81 PID 1328 wrote to memory of 1232 1328 717df2637f48e27247386e33a1020d50_NeikiAnalytics.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\717df2637f48e27247386e33a1020d50_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\717df2637f48e27247386e33a1020d50_NeikiAnalytics.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecabod.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecabod.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4248
-
-
C:\Files0C\abodloc.exeC:\Files0C\abodloc.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1232
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Files0C\abodloc.exe
- Size 2.7MB
- SHA256 b994fd15c35e04cac6cc52d5c5dbd0c17db004efc166517d1258efb20f315cdd
- MD5 691531e81596c06be1c9ece12f12ddb2
- SHA1 93fb4c5ab821f825d3bd5b0d85104c8cbef3b146
- SHA512 6b87d7da3a42d0fe98c5f382efc79c4c960c8fcfb264154af0858fa0237c65abadbb967f3a61ecded93a773eb088e2eba48dd0326ba09c35d4919fab77f648a3
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBxB/bSq:sxX7QnxrloE5dpUpubV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MintK4\bodxsys.exe
- Size 2.7MB
- SHA256 342fb3246cff35de3b3c10bc2ddc94f928f837a727a53789759defa409aecd1e
- MD5 e8799fb62904086fa14a4a3c06ecd85a
- SHA1 649625b7f2cc617a111edcc3b80794ed95db57d9
- SHA512 cb0f814a155e98a55616063d54c72fc31a5e6530d8ea21bc3e892ac0bd923fd8e7876e7df0bc03a3d81f65bafa70c4b1cd21abfeb69ffffe8e65ce9f3823ae7d
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBhB/bSq:sxX7QnxrloE5dpUpKbV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MintK4\bodxsys.exe
- Size 2.7MB
- SHA256 3b1a4ff1222d1c4f52346931e3f3a099f60b84ec251905211649429d8b8b206e
- MD5 128ac2669f53ddcf1413f6a02f29634a
- SHA1 28bb079310e64920b3d7f2d5711c3d2a7b3fbd46
- SHA512 539e0957d466d804cabbc8981e8c0275cf5e79348fd2f83b4d032746b0aea38ffd5d376f6edc0df8dbd089170d4559382ad8e6cf32e9c134d06059c7570f5d44
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBjB/bSq:sxX7QnxrloE5dpUpobV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 199B
- SHA256 b7b9cf470827c5eea2d5f1eb9277d92c172b9bdcd6eaedf91a6d1d10430d3480
- MD5 efcd6e35591744a184b0f4b3b808fafd
- SHA1 e03420d8fa636e495f4fb4830fb10e3622e32663
- SHA512 338e1eb48371f771879de92e86edaf427012351d4e796671f1c950d50743122b53ebc79276f1dcf29f1a80153ca05cf34ef67b4d7b6e0c8ebb0c8929b19493a5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 167B
- SHA256 6c21f939bc1641e3c7c7f9219c448f2371c3c7caa910494331a7e675a2ad51ba
- MD5 25ee4844ce9a5e7ce11f8d6dc820bfce
- SHA1 cc896a84af4a66d8724d9dad5581904a66cb6123
- SHA512 49dd1efb7e033056597b022df9d543d9633c25edec990e79aabbc48bc8111d0b2d3cb111ef513271a48629ca0d04d7086cde645a7a22fd0aeb972038963aa65e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecabod.exe
- Size 2.7MB
- SHA256 ea9659e8899bd71e8f4a6bf4afd7e98fb484631d747977b686ee9d15473fbcb5
- MD5 8d32134219b6a0acc8065df9986c8a0f
- SHA1 0c623f997cd262c8166eb123908aa55ec7758a59
- SHA512 6d3c04c8f2c991f441c294a33dec4ac4c96871242b60332457cfdb5e0c3a19702b3cce307b91d768f759acae95abc74d523678d40f3f23be22ca8a1b604dcd80
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBYB/bSq:sxX7QnxrloE5dpUpjbV
- MD5 SHA1 SHA512 SSDEEP