Analysis
- max time kernel
149s - max time network
51s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 10:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
74b5a45b99b8f393f4b3f24ddc45b7b0_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
74b5a45b99b8f393f4b3f24ddc45b7b0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 74b5a45b99b8f393f4b3f24ddc45b7b0_NeikiAnalytics.exe
- Size 4.0MB
- Sample240613-mkm1cavdrd
- SHA256 f8077ab24a6129cfad73da8dc4029feceb0861261a4dde3fdf2b045d0925c429
- MD5 74b5a45b99b8f393f4b3f24ddc45b7b0
- SHA1 32e0a9fa426ea86651bfa9fbcfb9bfaa0c900186
- SHA512 de2e30b8d643306bf1a0f1abb75ea8159ac7896d4ce9b57a1b315d9ccbcceb92411fdb49035ab66970e689dd1f1f1f54330eca4839f5ba141818e135f6a8543e
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBvB/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUpwbVz8eLFcz
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysadob.exe 74b5a45b99b8f393f4b3f24ddc45b7b0_NeikiAnalytics.exe - Executes dropped EXE 2 IoCs
pid Process 4512 sysadob.exe 868 abodloc.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\FilesZ4\\abodloc.exe" 74b5a45b99b8f393f4b3f24ddc45b7b0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\MintJG\\boddevloc.exe" 74b5a45b99b8f393f4b3f24ddc45b7b0_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4268 74b5a45b99b8f393f4b3f24ddc45b7b0_NeikiAnalytics.exe 4268 74b5a45b99b8f393f4b3f24ddc45b7b0_NeikiAnalytics.exe 4268 74b5a45b99b8f393f4b3f24ddc45b7b0_NeikiAnalytics.exe 4268 74b5a45b99b8f393f4b3f24ddc45b7b0_NeikiAnalytics.exe 4512 sysadob.exe 4512 sysadob.exe 868 abodloc.exe 868 abodloc.exe 4512 sysadob.exe 4512 sysadob.exe 868 abodloc.exe 868 abodloc.exe 4512 sysadob.exe 4512 sysadob.exe 868 abodloc.exe 868 abodloc.exe 4512 sysadob.exe 4512 sysadob.exe 868 abodloc.exe 868 abodloc.exe 4512 sysadob.exe 4512 sysadob.exe 868 abodloc.exe 868 abodloc.exe 4512 sysadob.exe 4512 sysadob.exe 868 abodloc.exe 868 abodloc.exe 4512 sysadob.exe 4512 sysadob.exe 868 abodloc.exe 868 abodloc.exe 4512 sysadob.exe 4512 sysadob.exe 868 abodloc.exe 868 abodloc.exe 4512 sysadob.exe 4512 sysadob.exe 868 abodloc.exe 868 abodloc.exe 4512 sysadob.exe 4512 sysadob.exe 868 abodloc.exe 868 abodloc.exe 4512 sysadob.exe 4512 sysadob.exe 868 abodloc.exe 868 abodloc.exe 4512 sysadob.exe 4512 sysadob.exe 868 abodloc.exe 868 abodloc.exe 4512 sysadob.exe 4512 sysadob.exe 868 abodloc.exe 868 abodloc.exe 4512 sysadob.exe 4512 sysadob.exe 868 abodloc.exe 868 abodloc.exe 4512 sysadob.exe 4512 sysadob.exe 868 abodloc.exe 868 abodloc.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4268 wrote to memory of 4512 4268 74b5a45b99b8f393f4b3f24ddc45b7b0_NeikiAnalytics.exe 86 PID 4268 wrote to memory of 4512 4268 74b5a45b99b8f393f4b3f24ddc45b7b0_NeikiAnalytics.exe 86 PID 4268 wrote to memory of 4512 4268 74b5a45b99b8f393f4b3f24ddc45b7b0_NeikiAnalytics.exe 86 PID 4268 wrote to memory of 868 4268 74b5a45b99b8f393f4b3f24ddc45b7b0_NeikiAnalytics.exe 87 PID 4268 wrote to memory of 868 4268 74b5a45b99b8f393f4b3f24ddc45b7b0_NeikiAnalytics.exe 87 PID 4268 wrote to memory of 868 4268 74b5a45b99b8f393f4b3f24ddc45b7b0_NeikiAnalytics.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\74b5a45b99b8f393f4b3f24ddc45b7b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\74b5a45b99b8f393f4b3f24ddc45b7b0_NeikiAnalytics.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysadob.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysadob.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4512
-
-
C:\FilesZ4\abodloc.exeC:\FilesZ4\abodloc.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:868
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\FilesZ4\abodloc.exe
- Size 4.0MB
- SHA256 989e73647c8221d292e4c1ccb0313323c538cd028dbfe50daa1198ec54715178
- MD5 46716a737495607de345537827f4f6f2
- SHA1 a445982f318af14f45bbbe96ca7ea8a42ba60bc0
- SHA512 41f2d7a7d2e526ad37e83c4af4475e8a7b8ea31b05c66bcd98018e21e2f41f5bc827754f60fdba6c46f597cbf6653e514ca8c3646ec3aa2846b115f47e7f8ec0
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBgB/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUp7bVz8eLFcz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MintJG\boddevloc.exe
- Size 4.0MB
- SHA256 1a023e41c3992ef20e1a9b245c7cf36ffe1e8ebd7a7f20be761a9b148cb617be
- MD5 ab51523670d85ee23bb1550709797840
- SHA1 456b6368123b9f9cdfc9b288d52413673b48fb5f
- SHA512 9c83fa729d6cf69522074fecd9db192002b906f30630106eeb003d19dc5baae49b88f560e0f5098af9ad6a5280d3a225396508e42a4f9966f84e47d32b90fe2f
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB5B/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUpObVz8eLFcz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MintJG\boddevloc.exe
- Size 411KB
- SHA256 cbc355a88da046ef8c7ccb5f5c49b81f9d0c82915142a2543dca615ccee79209
- MD5 8800c39e3a42c44e69eee41380c69de5
- SHA1 bf2a82497e695e202e8c5be5fe14e09773d4dc8f
- SHA512 354f09f787cbda314d947c49f730fec1f09fdb0c873d1ad6f0e3ed2d3f2c61587967ac86ffce43bb9bd7da64741ded58e94e22cf9c1a14be5f3c5c71edb4ed91
- SSDEEP 12288:6ne3n0DmAm67YEjAyu6qJ/+WS5axBdSqpcVdSxE:6nxDZV7xMyu6qJ2WSYxBdSqpcVdH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 202B
- SHA256 737fbb560a2317682bb7597e7d98a232456fe0f71083643a23aa746b50f88b1a
- MD5 38a0de30a2e9675d1c5d0791822c51ed
- SHA1 ea3c988aac677a417390f49ee1e4207de03bfe46
- SHA512 70b2ec123accf9369346c17d2cb837dc7d5889e6ba4545e5a4c015c80202beb58955a93cd87671f66d56bf733a33020509df4f98663b161740ca8d181df94828
- MD5 SHA1 SHA512
- Path C:\Users\Admin\253086396416_10.0_Admin.ini
- Size 170B
- SHA256 f21a82dbc91baf536297c133893068c08ddc165e7fc8ffbbe193133fc43d69f1
- MD5 d0b049f4aec1ef95b4dd3c75a4193d3d
- SHA1 09ddd8f90c043b05a439529017d1c4f30b9e3202
- SHA512 3efc193d35bd14322efcd3df1166e8855fe4d571b445c78baa606db208aeac7f61e8e8855064ff7908b8de9af8fcd82c217655e1506cb86599f520c382fc301d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysadob.exe
- Size 4.0MB
- SHA256 8d4c7cf6710c91555fdb6ca1164b03a3979847c3de4d27ed3f2476f7e5e3ecf0
- MD5 b22a8f32ae5fa31e7e47b950deb2b6cf
- SHA1 1b73c35cdb1e840f99331d03ef6a3f917d66ca24
- SHA512 43f11eb23ab5c12a72886718c45385045752af62aa7e948ea4c5c4fe79d01228c1c8efb4e8c05f29085356110b76028e7701c3361c49d5ce5465d762b89ce9f7
- SSDEEP 49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBlB/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUpibVz8eLFcz
- MD5 SHA1 SHA512 SSDEEP