Analysis

  • max time kernel
    6s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    07-05-2024 21:26

General

  • Target

    3b37b39e97b479ca5d286ff4d1d1c200_NEIKI.exe

  • Size

    112KB

  • MD5

    3b37b39e97b479ca5d286ff4d1d1c200

  • SHA1

    c1858f16f5b1855fc1e402a7a10a9840fb8cb663

  • SHA256

    675e8d73939dddbaecae6e947051c26973f6c3e2243f2db520be1f4ec1c0d473

  • SHA512

    7c0eb1276f37ddb6e1955a80d6738ff54862c6d5311a9fd5f2f006939c32242f1254d8cd8e3a47db509dfe7877553bf5f76026c41c58dfd5f0d805c1f3f88bf2

  • SSDEEP

    1536:t2ovIa47CqIf2f3w41p7sDcX7juR/JSJw8EeNshUDGXJ:tVIr7zI+fAceoGxSKKo5

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • ModiLoader Second Stage 2 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 5 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 56 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3b37b39e97b479ca5d286ff4d1d1c200_NEIKI.exe
    "C:\Users\Admin\AppData\Local\Temp\3b37b39e97b479ca5d286ff4d1d1c200_NEIKI.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1780
    • C:\Windows\SysWOW64\svchost.exe
      "C:\Windows\system32\svchost.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:2668
    • C:\Users\Admin\AppData\Local\Temp\3b37b39e97b479ca5d286ff4d1d1c200_NEIKI.exe
      "C:\Users\Admin\AppData\Local\Temp\3b37b39e97b479ca5d286ff4d1d1c200_NEIKI.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1016
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\GLYHI.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1648
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows WA" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe" /f
          4⤵
          • Adds Run key to start application
          PID:1800
      • C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1820
        • C:\Windows\SysWOW64\svchost.exe
          "C:\Windows\system32\svchost.exe"
          4⤵
          • Suspicious use of SetWindowsHookEx
          PID:1708
        • C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:696
        • C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"
          4⤵
          • Executes dropped EXE
          PID:836

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\GLYHI.bat

    Filesize

    148B

    MD5

    3a4614705555abb049c3298e61170b7f

    SHA1

    c8686410756f346d9551256a5b878b04770950ba

    SHA256

    cff0663c8cfadf83b80583a871c313ffc5d950cb503809cb4a482f400c5d846b

    SHA512

    65ce6fec00e6934f21635e7ccd74757f31ed4b0ddb52bd80d3ea9abeba56340128d23151ef7d9f5daacb5d61e4a4cca50dbb3a43132e350522311ee06e829007

  • \Users\Admin\AppData\Roaming\Microsoft\WAMain.exe

    Filesize

    112KB

    MD5

    3b37b39e97b479ca5d286ff4d1d1c200

    SHA1

    c1858f16f5b1855fc1e402a7a10a9840fb8cb663

    SHA256

    675e8d73939dddbaecae6e947051c26973f6c3e2243f2db520be1f4ec1c0d473

    SHA512

    7c0eb1276f37ddb6e1955a80d6738ff54862c6d5311a9fd5f2f006939c32242f1254d8cd8e3a47db509dfe7877553bf5f76026c41c58dfd5f0d805c1f3f88bf2

  • memory/696-276-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/696-294-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/836-283-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/836-297-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/1016-286-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/1016-116-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/1016-108-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/1016-110-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/1016-112-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/1016-114-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/1016-127-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/1780-38-0x0000000001BE0000-0x0000000001BE2000-memory.dmp

    Filesize

    8KB

  • memory/1780-20-0x0000000000430000-0x0000000000431000-memory.dmp

    Filesize

    4KB

  • memory/1780-87-0x0000000002360000-0x0000000002362000-memory.dmp

    Filesize

    8KB

  • memory/1780-88-0x0000000002390000-0x0000000002392000-memory.dmp

    Filesize

    8KB

  • memory/1780-79-0x0000000002370000-0x0000000002371000-memory.dmp

    Filesize

    4KB

  • memory/1780-50-0x0000000001BF0000-0x0000000001BF2000-memory.dmp

    Filesize

    8KB

  • memory/1780-8-0x00000000003D0000-0x00000000003D1000-memory.dmp

    Filesize

    4KB

  • memory/1780-2-0x00000000003B0000-0x00000000003B1000-memory.dmp

    Filesize

    4KB

  • memory/1780-14-0x00000000003F0000-0x00000000003F1000-memory.dmp

    Filesize

    4KB

  • memory/1780-28-0x0000000000470000-0x0000000000471000-memory.dmp

    Filesize

    4KB

  • memory/1780-4-0x00000000003B0000-0x00000000003B1000-memory.dmp

    Filesize

    4KB

  • memory/1780-32-0x0000000001BC0000-0x0000000001BC1000-memory.dmp

    Filesize

    4KB

  • memory/2668-128-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/2668-118-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/2668-89-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/2668-293-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/2668-106-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/2668-107-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB