2ef4806a3edfc2399c501e4cecd1843b2adfcd9c44cab6b6911731e12cfa57a6

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14-06-2024 11:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bb8a502203b0e847cd42b05de53dd7b0_NeikiAnalytics.exe
Size

2.7MB
MD5

bb8a502203b0e847cd42b05de53dd7b0
SHA1

8c735806c3e94cce8d5fa0d91aecf904dc62f6f3
SHA256

2ef4806a3edfc2399c501e4cecd1843b2adfcd9c44cab6b6911731e12cfa57a6
SHA512

1c5b678e0e75f27726175ba11b39feab214acb2cd251dbcbe977ecd3d604afe2a98992d3cd32c1848be55ed3da57d41cffd5523a496be446d40f43be14778658
SSDEEP

49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LB79w4Sx:+R0pI/IQlUoMPdmpSpX4

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4892	devoptiloc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\AdobeI0\\devoptiloc.exe"	bb8a502203b0e847cd42b05de53dd7b0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\LabZDB\\bodaec.exe"	bb8a502203b0e847cd42b05de53dd7b0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4640	bb8a502203b0e847cd42b05de53dd7b0_NeikiAnalytics.exe
4640	bb8a502203b0e847cd42b05de53dd7b0_NeikiAnalytics.exe
4640	bb8a502203b0e847cd42b05de53dd7b0_NeikiAnalytics.exe
4640	bb8a502203b0e847cd42b05de53dd7b0_NeikiAnalytics.exe
4892	devoptiloc.exe
4892	devoptiloc.exe
4640	bb8a502203b0e847cd42b05de53dd7b0_NeikiAnalytics.exe
4640	bb8a502203b0e847cd42b05de53dd7b0_NeikiAnalytics.exe
4892	devoptiloc.exe
4892	devoptiloc.exe
4640	bb8a502203b0e847cd42b05de53dd7b0_NeikiAnalytics.exe
4640	bb8a502203b0e847cd42b05de53dd7b0_NeikiAnalytics.exe
4892	devoptiloc.exe
4892	devoptiloc.exe
4640	bb8a502203b0e847cd42b05de53dd7b0_NeikiAnalytics.exe
4640	bb8a502203b0e847cd42b05de53dd7b0_NeikiAnalytics.exe
4892	devoptiloc.exe
4892	devoptiloc.exe
4640	bb8a502203b0e847cd42b05de53dd7b0_NeikiAnalytics.exe
4640	bb8a502203b0e847cd42b05de53dd7b0_NeikiAnalytics.exe
4892	devoptiloc.exe
4892	devoptiloc.exe
4640	bb8a502203b0e847cd42b05de53dd7b0_NeikiAnalytics.exe
4640	bb8a502203b0e847cd42b05de53dd7b0_NeikiAnalytics.exe
4892	devoptiloc.exe
4892	devoptiloc.exe
4640	bb8a502203b0e847cd42b05de53dd7b0_NeikiAnalytics.exe
4640	bb8a502203b0e847cd42b05de53dd7b0_NeikiAnalytics.exe
4892	devoptiloc.exe
4892	devoptiloc.exe
4640	bb8a502203b0e847cd42b05de53dd7b0_NeikiAnalytics.exe
4640	bb8a502203b0e847cd42b05de53dd7b0_NeikiAnalytics.exe
4892	devoptiloc.exe
4892	devoptiloc.exe
4640	bb8a502203b0e847cd42b05de53dd7b0_NeikiAnalytics.exe
4640	bb8a502203b0e847cd42b05de53dd7b0_NeikiAnalytics.exe
4892	devoptiloc.exe
4892	devoptiloc.exe
4640	bb8a502203b0e847cd42b05de53dd7b0_NeikiAnalytics.exe
4640	bb8a502203b0e847cd42b05de53dd7b0_NeikiAnalytics.exe
4892	devoptiloc.exe
4892	devoptiloc.exe
4640	bb8a502203b0e847cd42b05de53dd7b0_NeikiAnalytics.exe
4640	bb8a502203b0e847cd42b05de53dd7b0_NeikiAnalytics.exe
4892	devoptiloc.exe
4892	devoptiloc.exe
4640	bb8a502203b0e847cd42b05de53dd7b0_NeikiAnalytics.exe
4640	bb8a502203b0e847cd42b05de53dd7b0_NeikiAnalytics.exe
4892	devoptiloc.exe
4892	devoptiloc.exe
4640	bb8a502203b0e847cd42b05de53dd7b0_NeikiAnalytics.exe
4640	bb8a502203b0e847cd42b05de53dd7b0_NeikiAnalytics.exe
4892	devoptiloc.exe
4892	devoptiloc.exe
4640	bb8a502203b0e847cd42b05de53dd7b0_NeikiAnalytics.exe
4640	bb8a502203b0e847cd42b05de53dd7b0_NeikiAnalytics.exe
4892	devoptiloc.exe
4892	devoptiloc.exe
4640	bb8a502203b0e847cd42b05de53dd7b0_NeikiAnalytics.exe
4640	bb8a502203b0e847cd42b05de53dd7b0_NeikiAnalytics.exe
4892	devoptiloc.exe
4892	devoptiloc.exe
4640	bb8a502203b0e847cd42b05de53dd7b0_NeikiAnalytics.exe
4640	bb8a502203b0e847cd42b05de53dd7b0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4640 wrote to memory of 4892	4640	bb8a502203b0e847cd42b05de53dd7b0_NeikiAnalytics.exe	86
PID 4640 wrote to memory of 4892	4640	bb8a502203b0e847cd42b05de53dd7b0_NeikiAnalytics.exe	86
PID 4640 wrote to memory of 4892	4640	bb8a502203b0e847cd42b05de53dd7b0_NeikiAnalytics.exe	86

C:\Users\Admin\AppData\Local\Temp\bb8a502203b0e847cd42b05de53dd7b0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\bb8a502203b0e847cd42b05de53dd7b0_NeikiAnalytics.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4640
- C:\AdobeI0\devoptiloc.exe
  C:\AdobeI0\devoptiloc.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:4892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\AdobeI0\devoptiloc.exe

Filesize
2.7MB

MD5
d0fe848161b4023f3cfcb1f005689deb

SHA1
036fc2a876d69f992f832fb2563bdec5719f8721

SHA256
4a1adc718eb778dc97667d088f8fcad7cd11e990a82c67a415ccc6a2cda09c8b

SHA512
4426853169e1d8698e3b5a875834d6f7127a79db8aa8bdc42194c3559c3d77fb4a65e6480b2c8663bbea41e809b61f5019172034606d5e646f0dc9944fb60af1

Download Submit
C:\LabZDB\bodaec.exe

Filesize
398KB

MD5
5777410fbab48631e93b5d6cfc409ab7

SHA1
b07820c571a97a62efd1a9a5fd4e6aa2d8e17afd

SHA256
bf735e33839972d8f7aa8eda95bacb4b41ca15413d242435edc26dd62dc99816

SHA512
e0cf94f6fbbf9040d3d222c59b7220a7db9733e753051186094bf8901774f194d7b49a3c3987082aba20f73bce3eb890cfb57ff11d84485e6848db95bb1e5f85

Download Submit
C:\Users\Admin\253086396416_10.0_Admin.ini

Filesize
202B

MD5
e8877e0a314d28f244aa88185ad8ef4d

SHA1
1bf1306c7c59d8a6c7faf2b43bc70d4a650d82db

SHA256
9357cdb0e48d166ad4eb3ecb7cdcc0e0e261fa8fcac6185dfd3063af370dd5a6

SHA512
2a6c4ef89c6ac3b5f1dc2fe8c64a7f4002c616301cfcf3205a201e11d7439febf4ccb3c5abca726867e5606b4098d6a1f322c3cff6112ae1f4ccaca47df4516a

Download Submit