Malware Analysis Report

2024-11-30 05:57

Sample ID 240614-g24frsyang
Target a8dc6851c06f18040f1278948f905bc0_NeikiAnalytics.exe
SHA256 75313cd2850f63d2df310201b9d58286393246ea719d27fe6157b1cd03290792
Tags
persistence spyware stealer
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

75313cd2850f63d2df310201b9d58286393246ea719d27fe6157b1cd03290792

Threat Level: Shows suspicious behavior

The file a8dc6851c06f18040f1278948f905bc0_NeikiAnalytics.exe was found to be: Shows suspicious behavior.

Malicious Activity Summary

persistence spyware stealer

Checks computer location settings

Executes dropped EXE

Reads user/profile data of web browsers

Loads dropped DLL

Adds Run key to start application

Enumerates physical storage devices

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Gathers network information

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-14 06:18

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-14 06:18

Reported

2024-06-14 06:21

Platform

win7-20240508-en

Max time kernel

149s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a8dc6851c06f18040f1278948f905bc0_NeikiAnalytics.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbecadob.exe N/A
N/A N/A C:\IntelprocG2\devdobec.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\IntelprocG2\\devdobec.exe" C:\Users\Admin\AppData\Local\Temp\a8dc6851c06f18040f1278948f905bc0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\LabZ72\\bodxsys.exe" C:\Users\Admin\AppData\Local\Temp\a8dc6851c06f18040f1278948f905bc0_NeikiAnalytics.exe N/A

Enumerates physical storage devices

Gathers network information

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\ipconfig.exe N/A
N/A N/A C:\Windows\SysWOW64\NETSTAT.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a8dc6851c06f18040f1278948f905bc0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a8dc6851c06f18040f1278948f905bc0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbecadob.exe N/A
N/A N/A C:\IntelprocG2\devdobec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a8dc6851c06f18040f1278948f905bc0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbecadob.exe N/A
N/A N/A C:\IntelprocG2\devdobec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a8dc6851c06f18040f1278948f905bc0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbecadob.exe N/A
N/A N/A C:\IntelprocG2\devdobec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a8dc6851c06f18040f1278948f905bc0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbecadob.exe N/A
N/A N/A C:\IntelprocG2\devdobec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a8dc6851c06f18040f1278948f905bc0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbecadob.exe N/A
N/A N/A C:\IntelprocG2\devdobec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a8dc6851c06f18040f1278948f905bc0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbecadob.exe N/A
N/A N/A C:\IntelprocG2\devdobec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a8dc6851c06f18040f1278948f905bc0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbecadob.exe N/A
N/A N/A C:\IntelprocG2\devdobec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a8dc6851c06f18040f1278948f905bc0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbecadob.exe N/A
N/A N/A C:\IntelprocG2\devdobec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a8dc6851c06f18040f1278948f905bc0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbecadob.exe N/A
N/A N/A C:\IntelprocG2\devdobec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a8dc6851c06f18040f1278948f905bc0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbecadob.exe N/A
N/A N/A C:\IntelprocG2\devdobec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a8dc6851c06f18040f1278948f905bc0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbecadob.exe N/A
N/A N/A C:\IntelprocG2\devdobec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a8dc6851c06f18040f1278948f905bc0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbecadob.exe N/A
N/A N/A C:\IntelprocG2\devdobec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a8dc6851c06f18040f1278948f905bc0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbecadob.exe N/A
N/A N/A C:\IntelprocG2\devdobec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a8dc6851c06f18040f1278948f905bc0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbecadob.exe N/A
N/A N/A C:\IntelprocG2\devdobec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a8dc6851c06f18040f1278948f905bc0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbecadob.exe N/A
N/A N/A C:\IntelprocG2\devdobec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a8dc6851c06f18040f1278948f905bc0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbecadob.exe N/A
N/A N/A C:\IntelprocG2\devdobec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a8dc6851c06f18040f1278948f905bc0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbecadob.exe N/A
N/A N/A C:\IntelprocG2\devdobec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a8dc6851c06f18040f1278948f905bc0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbecadob.exe N/A
N/A N/A C:\IntelprocG2\devdobec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a8dc6851c06f18040f1278948f905bc0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbecadob.exe N/A
N/A N/A C:\IntelprocG2\devdobec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a8dc6851c06f18040f1278948f905bc0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbecadob.exe N/A
N/A N/A C:\IntelprocG2\devdobec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a8dc6851c06f18040f1278948f905bc0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbecadob.exe N/A
N/A N/A C:\IntelprocG2\devdobec.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\NETSTAT.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2132 wrote to memory of 1816 N/A C:\Users\Admin\AppData\Local\Temp\a8dc6851c06f18040f1278948f905bc0_NeikiAnalytics.exe C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbecadob.exe
PID 2132 wrote to memory of 1816 N/A C:\Users\Admin\AppData\Local\Temp\a8dc6851c06f18040f1278948f905bc0_NeikiAnalytics.exe C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbecadob.exe
PID 2132 wrote to memory of 1816 N/A C:\Users\Admin\AppData\Local\Temp\a8dc6851c06f18040f1278948f905bc0_NeikiAnalytics.exe C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbecadob.exe
PID 2132 wrote to memory of 1816 N/A C:\Users\Admin\AppData\Local\Temp\a8dc6851c06f18040f1278948f905bc0_NeikiAnalytics.exe C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbecadob.exe
PID 2132 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\a8dc6851c06f18040f1278948f905bc0_NeikiAnalytics.exe C:\IntelprocG2\devdobec.exe
PID 2132 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\a8dc6851c06f18040f1278948f905bc0_NeikiAnalytics.exe C:\IntelprocG2\devdobec.exe
PID 2132 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\a8dc6851c06f18040f1278948f905bc0_NeikiAnalytics.exe C:\IntelprocG2\devdobec.exe
PID 2132 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\a8dc6851c06f18040f1278948f905bc0_NeikiAnalytics.exe C:\IntelprocG2\devdobec.exe
PID 1816 wrote to memory of 1752 N/A C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbecadob.exe C:\Windows\SysWOW64\cmd.exe
PID 1816 wrote to memory of 1752 N/A C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbecadob.exe C:\Windows\SysWOW64\cmd.exe
PID 1816 wrote to memory of 1752 N/A C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbecadob.exe C:\Windows\SysWOW64\cmd.exe
PID 1816 wrote to memory of 1752 N/A C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbecadob.exe C:\Windows\SysWOW64\cmd.exe
PID 1816 wrote to memory of 1808 N/A C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbecadob.exe C:\Windows\SysWOW64\cmd.exe
PID 1816 wrote to memory of 1808 N/A C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbecadob.exe C:\Windows\SysWOW64\cmd.exe
PID 1816 wrote to memory of 1808 N/A C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbecadob.exe C:\Windows\SysWOW64\cmd.exe
PID 1816 wrote to memory of 1808 N/A C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbecadob.exe C:\Windows\SysWOW64\cmd.exe
PID 1816 wrote to memory of 1972 N/A C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbecadob.exe C:\Windows\SysWOW64\cmd.exe
PID 1816 wrote to memory of 1972 N/A C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbecadob.exe C:\Windows\SysWOW64\cmd.exe
PID 1816 wrote to memory of 1972 N/A C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbecadob.exe C:\Windows\SysWOW64\cmd.exe
PID 1816 wrote to memory of 1972 N/A C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbecadob.exe C:\Windows\SysWOW64\cmd.exe
PID 1752 wrote to memory of 1980 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\ipconfig.exe
PID 1752 wrote to memory of 1980 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\ipconfig.exe
PID 1752 wrote to memory of 1980 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\ipconfig.exe
PID 1752 wrote to memory of 1980 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\ipconfig.exe
PID 1808 wrote to memory of 2440 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\NETSTAT.EXE
PID 1808 wrote to memory of 2440 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\NETSTAT.EXE
PID 1808 wrote to memory of 2440 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\NETSTAT.EXE
PID 1808 wrote to memory of 2440 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\NETSTAT.EXE
PID 1816 wrote to memory of 2968 N/A C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbecadob.exe C:\Windows\SysWOW64\cmd.exe
PID 1816 wrote to memory of 2968 N/A C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbecadob.exe C:\Windows\SysWOW64\cmd.exe
PID 1816 wrote to memory of 2968 N/A C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbecadob.exe C:\Windows\SysWOW64\cmd.exe
PID 1816 wrote to memory of 2968 N/A C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbecadob.exe C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\a8dc6851c06f18040f1278948f905bc0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\a8dc6851c06f18040f1278948f905bc0_NeikiAnalytics.exe"

C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbecadob.exe

C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbecadob.exe

C:\IntelprocG2\devdobec.exe

C:\IntelprocG2\devdobec.exe

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c ipconfig > C:\Users\Admin\ipconfig.txt

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c netstat -a > C:\Users\Admin\netstat.txt

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c dir C:\*.txt /b /s >> C:\Users\Admin\grubb.list

C:\Windows\SysWOW64\ipconfig.exe

ipconfig

C:\Windows\SysWOW64\NETSTAT.EXE

netstat -a

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c dir C:\*.doc /b /s >> C:\Users\Admin\grubb.list

Network

Country Destination Domain Proto
US 8.8.8.8:53 1.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 1.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 1.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 1.0.127.10.in-addr.arpa udp

Files

\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbecadob.exe

MD5 df49ade8224ecf11b005d4bb1569b29a
SHA1 7d5d9f602eee99067b64d45856c2d2c3e7997d87
SHA256 152eb2f67fe6ad3c3d4b72e503584f929290f5fc2a1d9613dddbcb1880ae5e5c
SHA512 f861520ef6052874b547ed2edc8cea2529caad9617a75c0865fe6ed3f51ce2eefe5d6627fc8c59acd3179f4ca58c23bea67d796fa6f881de2887a0af408834a5

C:\Users\Admin\253086396416_6.1_Admin.ini

MD5 e09b240b1196b8ccab87245852f41dee
SHA1 0e1519a7d4379dfe5d87bbdc95c6aae9bbca70e7
SHA256 3beb9cba31cecb822a99eb056ac8b575561e6983c1f1088d0d160477d56d4145
SHA512 d8833ca567d004f87d6faafc86b939160f93a7d4f826fca8a8ae574a2b1f48640f47accb64a6e960ec7f33ac308434d066d5ed5bb0d7b9fb0aa3d1a8d3e413ce

C:\IntelprocG2\devdobec.exe

MD5 7ff749cd8f878cc64f8f6a03ce72d440
SHA1 52316eeef23c23fd6cfe260d3850cf0884cb33fc
SHA256 ef3aaf59b5f2bcb6d3c58f9dbd2eff79f420b4ce9e4bb6fb0c1dbb78c8892613
SHA512 25cc1422b9bf63f8c4128d594ff900a28f0e00f02fbb93288b3e3c2bec2723cd9baec25b756d575ead94d0b4c118be3067e3eee902acf0c11f8175b1cef5f525

C:\LabZ72\bodxsys.exe

MD5 e2c8fe312109d36445228ff16cb16f9b
SHA1 01e2de315510b83cc3ae65bb8fe90def2dc5b5ca
SHA256 4bce6c07d93d0f481bc94d8dd7ecc270823b31cc5e2abaf63ddd64debcdf1954
SHA512 1acbd48af1fc5ab9017920a0ef36769dfd90ddc4a13cf88a5349f6cde274f5d9b2bede384088de5a16671228e4652ff170b5c972bd32b424fe2771f21f91e8f2

C:\Users\Admin\253086396416_6.1_Admin.ini

MD5 8107f36ee8bcc210ba6524745f69c9db
SHA1 e16aaf2bb4f092342b96089dc9e33dc6afbbbb7b
SHA256 be79d7a217e9f95acf17cf21232b0ded895da976d2097df838a93bb6abc47fb8
SHA512 ebc4e88f93c11e9848d10dfcddb57368035844c84a55e33fcc5e6d787fca303a3c63f8b85d133b07c38dfd9f02f235d7af3c5b13461eb2c9f3b2947305c9e3d7

C:\LabZ72\bodxsys.exe

MD5 a6fe4576994bf1cc31e6256dc322e429
SHA1 e259d5d7f22274706d8aab65b4cdb59ab7faec6b
SHA256 486b20b66053a167bee7de7827501fb8ee5ab56c0403e13e2f1740ba252d20f4
SHA512 fd00eab241f97cb242ba8d2f4b7eac9357f4b5bdb784f9fb843173ccc47c2462201d5a7874955a5d39a3ddd4f4133610156257783c692f70bd49b1b698f684d4

C:\Users\Admin\grubb.list

MD5 40473af942e43b43003be7ab77332cd8
SHA1 894645cb3c976beb7fe22d4f81d1d78b7a6520d4
SHA256 981322f234a9cce8666e5def384cdbc2b88ea674aba39f3848a9401aef13e74d
SHA512 c497b640e3dcbf5fe33520febe4fff85c8d24c5fa2f74bc7ab9b7f967cdecd70e5ed048bfebcfcd718d538a7cbf3c6d9aab453efbe13f814046ba4361518045a

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-14 06:18

Reported

2024-06-14 06:21

Platform

win10v2004-20240611-en

Max time kernel

150s

Max time network

127s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a8dc6851c06f18040f1278948f905bc0_NeikiAnalytics.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbsysxopti.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbsysxopti.exe N/A
N/A N/A C:\IntelprocJ3\xbodec.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\IntelprocJ3\\xbodec.exe" C:\Users\Admin\AppData\Local\Temp\a8dc6851c06f18040f1278948f905bc0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\GalaxQZ\\bodaec.exe" C:\Users\Admin\AppData\Local\Temp\a8dc6851c06f18040f1278948f905bc0_NeikiAnalytics.exe N/A

Enumerates physical storage devices

Gathers network information

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\NETSTAT.EXE N/A
N/A N/A C:\Windows\SysWOW64\ipconfig.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a8dc6851c06f18040f1278948f905bc0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a8dc6851c06f18040f1278948f905bc0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a8dc6851c06f18040f1278948f905bc0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a8dc6851c06f18040f1278948f905bc0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbsysxopti.exe N/A
N/A N/A C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbsysxopti.exe N/A
N/A N/A C:\IntelprocJ3\xbodec.exe N/A
N/A N/A C:\IntelprocJ3\xbodec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a8dc6851c06f18040f1278948f905bc0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a8dc6851c06f18040f1278948f905bc0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbsysxopti.exe N/A
N/A N/A C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbsysxopti.exe N/A
N/A N/A C:\IntelprocJ3\xbodec.exe N/A
N/A N/A C:\IntelprocJ3\xbodec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a8dc6851c06f18040f1278948f905bc0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a8dc6851c06f18040f1278948f905bc0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbsysxopti.exe N/A
N/A N/A C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbsysxopti.exe N/A
N/A N/A C:\IntelprocJ3\xbodec.exe N/A
N/A N/A C:\IntelprocJ3\xbodec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a8dc6851c06f18040f1278948f905bc0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a8dc6851c06f18040f1278948f905bc0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbsysxopti.exe N/A
N/A N/A C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbsysxopti.exe N/A
N/A N/A C:\IntelprocJ3\xbodec.exe N/A
N/A N/A C:\IntelprocJ3\xbodec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a8dc6851c06f18040f1278948f905bc0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a8dc6851c06f18040f1278948f905bc0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbsysxopti.exe N/A
N/A N/A C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbsysxopti.exe N/A
N/A N/A C:\IntelprocJ3\xbodec.exe N/A
N/A N/A C:\IntelprocJ3\xbodec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a8dc6851c06f18040f1278948f905bc0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a8dc6851c06f18040f1278948f905bc0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbsysxopti.exe N/A
N/A N/A C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbsysxopti.exe N/A
N/A N/A C:\IntelprocJ3\xbodec.exe N/A
N/A N/A C:\IntelprocJ3\xbodec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a8dc6851c06f18040f1278948f905bc0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a8dc6851c06f18040f1278948f905bc0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbsysxopti.exe N/A
N/A N/A C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbsysxopti.exe N/A
N/A N/A C:\IntelprocJ3\xbodec.exe N/A
N/A N/A C:\IntelprocJ3\xbodec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a8dc6851c06f18040f1278948f905bc0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a8dc6851c06f18040f1278948f905bc0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbsysxopti.exe N/A
N/A N/A C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbsysxopti.exe N/A
N/A N/A C:\IntelprocJ3\xbodec.exe N/A
N/A N/A C:\IntelprocJ3\xbodec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a8dc6851c06f18040f1278948f905bc0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a8dc6851c06f18040f1278948f905bc0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbsysxopti.exe N/A
N/A N/A C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbsysxopti.exe N/A
N/A N/A C:\IntelprocJ3\xbodec.exe N/A
N/A N/A C:\IntelprocJ3\xbodec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a8dc6851c06f18040f1278948f905bc0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a8dc6851c06f18040f1278948f905bc0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbsysxopti.exe N/A
N/A N/A C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbsysxopti.exe N/A
N/A N/A C:\IntelprocJ3\xbodec.exe N/A
N/A N/A C:\IntelprocJ3\xbodec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a8dc6851c06f18040f1278948f905bc0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a8dc6851c06f18040f1278948f905bc0_NeikiAnalytics.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\NETSTAT.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2028 wrote to memory of 3228 N/A C:\Users\Admin\AppData\Local\Temp\a8dc6851c06f18040f1278948f905bc0_NeikiAnalytics.exe C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbsysxopti.exe
PID 2028 wrote to memory of 3228 N/A C:\Users\Admin\AppData\Local\Temp\a8dc6851c06f18040f1278948f905bc0_NeikiAnalytics.exe C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbsysxopti.exe
PID 2028 wrote to memory of 3228 N/A C:\Users\Admin\AppData\Local\Temp\a8dc6851c06f18040f1278948f905bc0_NeikiAnalytics.exe C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbsysxopti.exe
PID 2028 wrote to memory of 4692 N/A C:\Users\Admin\AppData\Local\Temp\a8dc6851c06f18040f1278948f905bc0_NeikiAnalytics.exe C:\IntelprocJ3\xbodec.exe
PID 2028 wrote to memory of 4692 N/A C:\Users\Admin\AppData\Local\Temp\a8dc6851c06f18040f1278948f905bc0_NeikiAnalytics.exe C:\IntelprocJ3\xbodec.exe
PID 2028 wrote to memory of 4692 N/A C:\Users\Admin\AppData\Local\Temp\a8dc6851c06f18040f1278948f905bc0_NeikiAnalytics.exe C:\IntelprocJ3\xbodec.exe
PID 3228 wrote to memory of 2200 N/A C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbsysxopti.exe C:\Windows\SysWOW64\cmd.exe
PID 3228 wrote to memory of 2200 N/A C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbsysxopti.exe C:\Windows\SysWOW64\cmd.exe
PID 3228 wrote to memory of 2200 N/A C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbsysxopti.exe C:\Windows\SysWOW64\cmd.exe
PID 3228 wrote to memory of 2316 N/A C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbsysxopti.exe C:\Windows\SysWOW64\cmd.exe
PID 3228 wrote to memory of 2316 N/A C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbsysxopti.exe C:\Windows\SysWOW64\cmd.exe
PID 3228 wrote to memory of 2316 N/A C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbsysxopti.exe C:\Windows\SysWOW64\cmd.exe
PID 3228 wrote to memory of 2052 N/A C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbsysxopti.exe C:\Windows\SysWOW64\cmd.exe
PID 3228 wrote to memory of 2052 N/A C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbsysxopti.exe C:\Windows\SysWOW64\cmd.exe
PID 3228 wrote to memory of 2052 N/A C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbsysxopti.exe C:\Windows\SysWOW64\cmd.exe
PID 2200 wrote to memory of 3816 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\ipconfig.exe
PID 2200 wrote to memory of 3816 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\ipconfig.exe
PID 2200 wrote to memory of 3816 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\ipconfig.exe
PID 2316 wrote to memory of 4404 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\NETSTAT.EXE
PID 2316 wrote to memory of 4404 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\NETSTAT.EXE
PID 2316 wrote to memory of 4404 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\NETSTAT.EXE
PID 3228 wrote to memory of 4392 N/A C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbsysxopti.exe C:\Windows\SysWOW64\cmd.exe
PID 3228 wrote to memory of 4392 N/A C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbsysxopti.exe C:\Windows\SysWOW64\cmd.exe
PID 3228 wrote to memory of 4392 N/A C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbsysxopti.exe C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\a8dc6851c06f18040f1278948f905bc0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\a8dc6851c06f18040f1278948f905bc0_NeikiAnalytics.exe"

C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbsysxopti.exe

C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbsysxopti.exe

C:\IntelprocJ3\xbodec.exe

C:\IntelprocJ3\xbodec.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4256,i,1236064252342462940,13180713657498721890,262144 --variations-seed-version --mojo-platform-channel-handle=2808 /prefetch:8

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c ipconfig > C:\Users\Admin\ipconfig.txt

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c netstat -a > C:\Users\Admin\netstat.txt

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c dir C:\*.txt /b /s >> C:\Users\Admin\grubb.list

C:\Windows\SysWOW64\ipconfig.exe

ipconfig

C:\Windows\SysWOW64\NETSTAT.EXE

netstat -a

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c dir C:\*.doc /b /s >> C:\Users\Admin\grubb.list

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 10.24.18.2.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 1.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 1.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp

Files

C:\Users\AdminbGvvJgzgbXugsotmbSoixuyulzb]otju}ybYzgxz&Skt{bVxumxgsybYzgxz{vbsysxopti.exe

MD5 e4b6df33ed01817e68a2a538e3021333
SHA1 58fe3eab6cc6ed7f9c7bcfcffe10250cb5d88636
SHA256 77b8d19a47fdf6fd57eb26d65a6bbe3185e5aa56ebb6dab63dc6530c188fb141
SHA512 b71f1b28e97c8777f49dc4df981cc8ad08b9d0242e03938f618a0890de045689b6c5730355f81ee5345899cd06db0499f5254f070179bf09150720b97075de5a

C:\Users\Admin\253086396416_10.0_Admin.ini

MD5 76cb4deafa489f3dd7df84a04d374c51
SHA1 14964f136203d491380953d37c6bc57921fab97a
SHA256 1da5a427db2a25790d2723e8e93105e66461a5fd2c7fe6176f680f249188d60c
SHA512 f4cf74ca06a65cbefe1d9183e4595318043f405954726a132a47c8caa4788294cdef86f023a5d7c20589bb1907d7ef2d43fe5263fdc558681c1642d26a44ef31

C:\IntelprocJ3\xbodec.exe

MD5 1e4e07d93c09959c08eafdc8e4520339
SHA1 046ce2b80d9489c124b81ef38a5e67ca0169c5af
SHA256 0afa23aa832d367751ff97707ac4d610caf2446e5edc99a1625a576601c1f8f4
SHA512 7050d658c17afa97880f92a1ec4383df81bf2ab27f4cbbcd9dcee5266c56c5c4774d06f5036ac0c4dee5bb9bfa7c1073ea657d602dd83c4ba971254a4dc574bd

C:\GalaxQZ\bodaec.exe

MD5 72c3005357f9bfc321ff1589fba7e8dc
SHA1 f7bb1d6856364fee59c8e20aaea03029b8f8b04e
SHA256 b5fdfe4da4b42958b0149cff7900a0beeb06c96a5721eea66fa0818dfeab9501
SHA512 0e965acc80fc0948c9aa72d406ae7fc9fff585b06a45cd701592ededaf7ad8eafc0b96fdf0d396c7d9b420381decfd498b828cf54e86e7105119fab427518b4e

C:\Users\Admin\253086396416_10.0_Admin.ini

MD5 c6744c6455a6aec82b031e8259eb7edd
SHA1 e5d3c0e1f4f1c4e54edee7d643595adf2e240989
SHA256 4d7d0bb16bac8da2efb96183f89967c6d5fb9c662d53e40e1535697a42970015
SHA512 506e5eb48f526da90ebabdcea3797a1a4bc5f56793e87a46849f27ab85237a47eed799fe5dddbf0aa04acfb0bf60e2d39e443de0f8f7df6348558888c75ab8ee

C:\GalaxQZ\bodaec.exe

MD5 035e0165b6d215351b9bc8a6eb41ae33
SHA1 0494e6dc6bcdd6126d3054da20cf04203747bf30
SHA256 a8656f05bd7c7c681cbcf596283f2ab8ba9d08bdb7371bcc748d2c8e78f4dcf9
SHA512 c4c5f435d57634f47747ab7a8b850f2fdf7564f0c844a5ba18417007e6aee2fce3b976d1aa1fe5cf252e7c1aa0af7f169df9e3cc571859dea1b200665bf72b20

C:\Users\Admin\grubb.list

MD5 1912adb40d2ecc926acff2640156c1ab
SHA1 7a3b466ae34af10e516943a8d5b8044dc86c2b92
SHA256 ace00b57f8463901489cb680e15e9773a6b5041130aee9acb93db2454818f08b
SHA512 08c759ef3dd2b9c1d3d9a57639227e6eb012c57525a66ca1165224fb7466c0576cb3a2d8586cba58eba1547ad0133e9646f72ac8d40b050fd257a999caf867d9