6295c6448a431b5417e64b6bf6e1c47a41fa6365df9af3072c83a6d8f7b7fb90

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 10:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6295c6448a431b5417e64b6bf6e1c47a41fa6365df9af3072c83a6d8f7b7fb90_NeikiAnalytics.exe
Size

3.1MB
MD5

00e3e21b6cf3d704d56862e9d0f8d380
SHA1

45301721de511dfda3bf53075f2e568aebe23e45
SHA256

6295c6448a431b5417e64b6bf6e1c47a41fa6365df9af3072c83a6d8f7b7fb90
SHA512

e95de8611b47f4eead1352dfe400e410b229edf5caad16fc308036f0e5006bceee0320ffb404995644200034e7d2c1bc7401b878040a9abc4c79a4dba0691ea2
SSDEEP

49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBs9w4Su+LNfej:+R0pI/IQlUoMPdmpSp+4JkNfej

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1104	devdobloc.exe

Loads dropped DLL 1 IoCs

pid	Process
2192	6295c6448a431b5417e64b6bf6e1c47a41fa6365df9af3072c83a6d8f7b7fb90_NeikiAnalytics.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\AdobeM1\\devdobloc.exe"	6295c6448a431b5417e64b6bf6e1c47a41fa6365df9af3072c83a6d8f7b7fb90_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\Mint2Q\\bodaloc.exe"	6295c6448a431b5417e64b6bf6e1c47a41fa6365df9af3072c83a6d8f7b7fb90_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2192	6295c6448a431b5417e64b6bf6e1c47a41fa6365df9af3072c83a6d8f7b7fb90_NeikiAnalytics.exe
2192	6295c6448a431b5417e64b6bf6e1c47a41fa6365df9af3072c83a6d8f7b7fb90_NeikiAnalytics.exe
1104	devdobloc.exe
2192	6295c6448a431b5417e64b6bf6e1c47a41fa6365df9af3072c83a6d8f7b7fb90_NeikiAnalytics.exe
1104	devdobloc.exe
2192	6295c6448a431b5417e64b6bf6e1c47a41fa6365df9af3072c83a6d8f7b7fb90_NeikiAnalytics.exe
1104	devdobloc.exe
2192	6295c6448a431b5417e64b6bf6e1c47a41fa6365df9af3072c83a6d8f7b7fb90_NeikiAnalytics.exe
1104	devdobloc.exe
2192	6295c6448a431b5417e64b6bf6e1c47a41fa6365df9af3072c83a6d8f7b7fb90_NeikiAnalytics.exe
1104	devdobloc.exe
2192	6295c6448a431b5417e64b6bf6e1c47a41fa6365df9af3072c83a6d8f7b7fb90_NeikiAnalytics.exe
1104	devdobloc.exe
2192	6295c6448a431b5417e64b6bf6e1c47a41fa6365df9af3072c83a6d8f7b7fb90_NeikiAnalytics.exe
1104	devdobloc.exe
2192	6295c6448a431b5417e64b6bf6e1c47a41fa6365df9af3072c83a6d8f7b7fb90_NeikiAnalytics.exe
1104	devdobloc.exe
2192	6295c6448a431b5417e64b6bf6e1c47a41fa6365df9af3072c83a6d8f7b7fb90_NeikiAnalytics.exe
1104	devdobloc.exe
2192	6295c6448a431b5417e64b6bf6e1c47a41fa6365df9af3072c83a6d8f7b7fb90_NeikiAnalytics.exe
1104	devdobloc.exe
2192	6295c6448a431b5417e64b6bf6e1c47a41fa6365df9af3072c83a6d8f7b7fb90_NeikiAnalytics.exe
1104	devdobloc.exe
2192	6295c6448a431b5417e64b6bf6e1c47a41fa6365df9af3072c83a6d8f7b7fb90_NeikiAnalytics.exe
1104	devdobloc.exe
2192	6295c6448a431b5417e64b6bf6e1c47a41fa6365df9af3072c83a6d8f7b7fb90_NeikiAnalytics.exe
1104	devdobloc.exe
2192	6295c6448a431b5417e64b6bf6e1c47a41fa6365df9af3072c83a6d8f7b7fb90_NeikiAnalytics.exe
1104	devdobloc.exe
2192	6295c6448a431b5417e64b6bf6e1c47a41fa6365df9af3072c83a6d8f7b7fb90_NeikiAnalytics.exe
1104	devdobloc.exe
2192	6295c6448a431b5417e64b6bf6e1c47a41fa6365df9af3072c83a6d8f7b7fb90_NeikiAnalytics.exe
1104	devdobloc.exe
2192	6295c6448a431b5417e64b6bf6e1c47a41fa6365df9af3072c83a6d8f7b7fb90_NeikiAnalytics.exe
1104	devdobloc.exe
2192	6295c6448a431b5417e64b6bf6e1c47a41fa6365df9af3072c83a6d8f7b7fb90_NeikiAnalytics.exe
1104	devdobloc.exe
2192	6295c6448a431b5417e64b6bf6e1c47a41fa6365df9af3072c83a6d8f7b7fb90_NeikiAnalytics.exe
1104	devdobloc.exe
2192	6295c6448a431b5417e64b6bf6e1c47a41fa6365df9af3072c83a6d8f7b7fb90_NeikiAnalytics.exe
1104	devdobloc.exe
2192	6295c6448a431b5417e64b6bf6e1c47a41fa6365df9af3072c83a6d8f7b7fb90_NeikiAnalytics.exe
1104	devdobloc.exe
2192	6295c6448a431b5417e64b6bf6e1c47a41fa6365df9af3072c83a6d8f7b7fb90_NeikiAnalytics.exe
1104	devdobloc.exe
2192	6295c6448a431b5417e64b6bf6e1c47a41fa6365df9af3072c83a6d8f7b7fb90_NeikiAnalytics.exe
1104	devdobloc.exe
2192	6295c6448a431b5417e64b6bf6e1c47a41fa6365df9af3072c83a6d8f7b7fb90_NeikiAnalytics.exe
1104	devdobloc.exe
2192	6295c6448a431b5417e64b6bf6e1c47a41fa6365df9af3072c83a6d8f7b7fb90_NeikiAnalytics.exe
1104	devdobloc.exe
2192	6295c6448a431b5417e64b6bf6e1c47a41fa6365df9af3072c83a6d8f7b7fb90_NeikiAnalytics.exe
1104	devdobloc.exe
2192	6295c6448a431b5417e64b6bf6e1c47a41fa6365df9af3072c83a6d8f7b7fb90_NeikiAnalytics.exe
1104	devdobloc.exe
2192	6295c6448a431b5417e64b6bf6e1c47a41fa6365df9af3072c83a6d8f7b7fb90_NeikiAnalytics.exe
1104	devdobloc.exe
2192	6295c6448a431b5417e64b6bf6e1c47a41fa6365df9af3072c83a6d8f7b7fb90_NeikiAnalytics.exe
1104	devdobloc.exe
2192	6295c6448a431b5417e64b6bf6e1c47a41fa6365df9af3072c83a6d8f7b7fb90_NeikiAnalytics.exe
1104	devdobloc.exe
2192	6295c6448a431b5417e64b6bf6e1c47a41fa6365df9af3072c83a6d8f7b7fb90_NeikiAnalytics.exe
1104	devdobloc.exe
2192	6295c6448a431b5417e64b6bf6e1c47a41fa6365df9af3072c83a6d8f7b7fb90_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 1104	2192	6295c6448a431b5417e64b6bf6e1c47a41fa6365df9af3072c83a6d8f7b7fb90_NeikiAnalytics.exe	28
PID 2192 wrote to memory of 1104	2192	6295c6448a431b5417e64b6bf6e1c47a41fa6365df9af3072c83a6d8f7b7fb90_NeikiAnalytics.exe	28
PID 2192 wrote to memory of 1104	2192	6295c6448a431b5417e64b6bf6e1c47a41fa6365df9af3072c83a6d8f7b7fb90_NeikiAnalytics.exe	28
PID 2192 wrote to memory of 1104	2192	6295c6448a431b5417e64b6bf6e1c47a41fa6365df9af3072c83a6d8f7b7fb90_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\6295c6448a431b5417e64b6bf6e1c47a41fa6365df9af3072c83a6d8f7b7fb90_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6295c6448a431b5417e64b6bf6e1c47a41fa6365df9af3072c83a6d8f7b7fb90_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2192
- C:\AdobeM1\devdobloc.exe
  C:\AdobeM1\devdobloc.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Mint2Q\bodaloc.exe

Filesize
464KB

MD5
0a8fe0467f19ed7cb15684d3ccfa7cd2

SHA1
215070a02aa3f666cd5edab20017034e8620b1fc

SHA256
ef423015f062a8412d04c547a20243fc303b79921b39f3f2e67b1c3e125692e9

SHA512
6ca168aa36497b8e35bf65b30fc2d3814daa5a8b2a40f62921870bf27e87f8efbe69fb62c739d8a7c9ffe80959fd0a2be06c99e23b283da01de522f6d5e1dc5c

Download Submit
C:\Mint2Q\bodaloc.exe

Filesize
3.1MB

MD5
1c3fc15092362a34cc102d0d51b2514b

SHA1
41b00104a234be6189ada710a710e1723afe28ad

SHA256
12a1e9a2f0624b0b3855ba40f00e6b2a823f4c50523388591af5da4437eeba02

SHA512
d09756cd07e9b004f1b5c55724f599a836559708b0e8d7cd9ab18dae827d5865f29b52c24e99429bb6036e291a6cb09f9beceea41954526ab3f3c1dcae9f25b1

Download Submit
C:\Users\Admin\253086396416_6.1_Admin.ini

Filesize
204B

MD5
fd200419b15b7816fd86a364f124a04b

SHA1
8b1f72c0eebf43bc14c05e68f800442aa4a5acff

SHA256
7fdc871c261bfe2edcddee34143053ba5e96ec98ce566481eda1ac4ba33bc7b3

SHA512
2f5b70c39f130ab19ad62f273b8cabac8957cf728410c332f2cb9a87908e814ff2ca752de1c754e4298ebf09bb4aeb39b783f05e370eed04b18d3cd8d6032837

Download Submit
\AdobeM1\devdobloc.exe

Filesize
3.1MB

MD5
d681e34e5a9d3a6fafd8d36f939f26d2

SHA1
ead3b375643035f0e2f9910542f4950995a43083

SHA256
e47d0ebdd68486a9fdf3972109c6223891a503a9b32ca226211dfd0364de8e70

SHA512
1c2f45de05e37079b5397b0c583ffb3ae6b3a4187b5cd9f9d0cf13cc69d0d5b7ce9e98f2d77d455908648338a33c600b025a07dbef12cf6edbbc00b6a61a91b7

Download Submit