Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
07/05/2024, 23:39
Static task
static1
Behavioral task
behavioral1
Sample
6937467e14670108689bac86ab16a860_NEIKI.exe
Resource
win7-20231129-en
General
-
Target
6937467e14670108689bac86ab16a860_NEIKI.exe
-
Size
282KB
-
MD5
6937467e14670108689bac86ab16a860
-
SHA1
5ddbc97009889b7d00e8ec4270020720302462d1
-
SHA256
f6425cd63f7eabc1e7c0c2ffb1292dc560fe3c587066b622b75114bf2c12bc98
-
SHA512
9107ef8b0d39dc1d3671d5461d0a114a63063f881296a17bc4103ef8cab3116dee71544ed86acdecbeecaaf269105362c90dbc3148dcdc1788139481639598da
-
SSDEEP
6144:1SlkN5PabueGGGGGGGGHGGGGGGGGGGGGGGGGGGGGGGGGGGGGYnp1Ld0Y9Db6abfe:I/unnLCYV6aLqWj82nd5JomIz+M
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1468 1278.tmp -
Loads dropped DLL 2 IoCs
pid Process 2040 6937467e14670108689bac86ab16a860_NEIKI.exe 2040 6937467e14670108689bac86ab16a860_NEIKI.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\FileRepository\igdlh.inf_amd64_neutral_54a12b57f547d08e\igdumd32.dll 1278.tmp File created C:\Windows\SysWOW64\d3dim700.dll 1278.tmp File created C:\Windows\SysWOW64\dmscript.dll 1278.tmp File opened for modification C:\Windows\SysWOW64\MSCOMCTL.OCX 1278.tmp File created C:\Windows\SysWOW64\msorcl32.dll 1278.tmp File created C:\Windows\SysWOW64\msvcrt20.dll 1278.tmp File created C:\Windows\SysWOW64\msxbde40.dll 1278.tmp File created C:\Windows\System32\DriverStore\FileRepository\atiilhag.inf_amd64_neutral_0a660e899f5038a2\atiumdva.dll 1278.tmp File created C:\Windows\SysWOW64\InstallShield\_isdel.exe 1278.tmp File opened for modification C:\Windows\SysWOW64\atl110.dll 1278.tmp File created C:\Windows\SysWOW64\d3dim.dll 1278.tmp File created C:\Windows\SysWOW64\mspbde40.dll 1278.tmp File created C:\Windows\SysWOW64\msrepl40.dll 1278.tmp File created C:\Windows\SysWOW64\mstext40.dll 1278.tmp File created C:\Windows\SysWOW64\mswdat10.dll 1278.tmp File opened for modification C:\Windows\SysWOW64\FM20.DLL 1278.tmp File created C:\Windows\SysWOW64\msjtes40.dll 1278.tmp File created C:\Windows\SysWOW64\mfc40.dll 1278.tmp File created C:\Windows\SysWOW64\msexch40.dll 1278.tmp File opened for modification C:\Windows\SysWOW64\msvcr110.dll 1278.tmp File created C:\Windows\SysWOW64\odbcjt32.dll 1278.tmp File created C:\Windows\SysWOW64\dpwsockx.dll 1278.tmp File created C:\Windows\SysWOW64\explorer.exe 1278.tmp File created C:\Windows\SysWOW64\mfc40u.dll 1278.tmp File created C:\Windows\SysWOW64\mswstr10.dll 1278.tmp File created C:\Windows\SysWOW64\ir32_32.dll 1278.tmp File opened for modification C:\Windows\SysWOW64\mfc100.dll 1278.tmp File opened for modification C:\Windows\SysWOW64\msvcr120.dll 1278.tmp File opened for modification C:\Windows\SysWOW64\msvcr120_clr0400.dll 1278.tmp File opened for modification C:\Windows\SysWOW64\mfc110.dll 1278.tmp File created C:\Windows\SysWOW64\msrd2x40.dll 1278.tmp File created C:\Windows\SysWOW64\iac25_32.ax 1278.tmp File created C:\Windows\SysWOW64\regedit.exe 1278.tmp File created C:\Windows\SysWOW64\sqlwoa.dll 1278.tmp File opened for modification C:\Windows\SysWOW64\concrt140.dll 1278.tmp File created C:\Windows\SysWOW64\crtdll.dll 1278.tmp File opened for modification C:\Windows\SysWOW64\vccorlib120.dll 1278.tmp File created C:\Windows\System32\DriverStore\FileRepository\atiilhag.inf_amd64_neutral_0a660e899f5038a2\amdpcom32.dll 1278.tmp File created C:\Windows\SysWOW64\FXSXP32.dll 1278.tmp File created C:\Windows\SysWOW64\msltus40.dll 1278.tmp File opened for modification C:\Windows\SysWOW64\mfc110u.dll 1278.tmp File created C:\Windows\SysWOW64\msjet40.dll 1278.tmp File created C:\Windows\SysWOW64\rdvgumd32.dll 1278.tmp File created C:\Windows\SysWOW64\InstallShield\setup.exe 1278.tmp File created C:\Windows\System32\DriverStore\FileRepository\atiilhag.inf_amd64_neutral_0a660e899f5038a2\atidxx32.dll 1278.tmp File created C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-MediaPlayer\MediaPlayer-DLMigPlugin.dll 1278.tmp File created C:\Windows\SysWOW64\dplayx.dll 1278.tmp File created C:\Windows\SysWOW64\ir41_32.ax 1278.tmp File created C:\Windows\System32\DriverStore\FileRepository\atiilhag.inf_amd64_neutral_0a660e899f5038a2\atiumdag.dll 1278.tmp File opened for modification C:\Windows\SysWOW64\mfc140u.dll 1278.tmp File opened for modification C:\Windows\SysWOW64\msvcr100.dll 1278.tmp File opened for modification C:\Windows\SysWOW64\vcomp140.dll 1278.tmp File created C:\Windows\System32\DriverStore\FileRepository\nv_lh.inf_amd64_neutral_bc69f20e3115af59\nvd3dum.dll 1278.tmp File created C:\Windows\SysWOW64\migration\MediaPlayer-DLMigPlugin.dll 1278.tmp File created C:\Windows\SysWOW64\ir50_32.dll 1278.tmp File created C:\Windows\SysWOW64\olecli32.dll 1278.tmp File created C:\Windows\SysWOW64\expsrv.dll 1278.tmp File created C:\Windows\SysWOW64\ivfsrc.ax 1278.tmp File opened for modification C:\Windows\SysWOW64\mfc120.dll 1278.tmp File created C:\Windows\SysWOW64\msrd3x40.dll 1278.tmp File created C:\Windows\SysWOW64\msvbvm60.dll 1278.tmp File created C:\Windows\SysWOW64\sqlunirl.dll 1278.tmp File opened for modification C:\Windows\SysWOW64\atl100.dll 1278.tmp File created C:\Windows\SysWOW64\d3dxof.dll 1278.tmp -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 1278.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\DLGSETP.DLL 1278.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\WWLIB.DLL 1278.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MAPIPH.DLL 1278.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\oisctrl.dll 1278.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\IA32.api 1278.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api 1278.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEREP.DLL 1278.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Csi.dll 1278.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FREN\MSB1FREN.DLL 1278.tmp File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\goopdate.dll 1278.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSTH7ES.DLL 1278.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe 1278.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPREARM.EXE 1278.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSTORES.DLL 1278.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\RM.DLL 1278.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\EntityPicker.dll 1278.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\IEContentService.exe 1278.tmp File opened for modification C:\Program Files\7-Zip\7zCon.sfx 1278.tmp File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AXSLE.dll 1278.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Updater.api 1278.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Oarpmany.exe 1278.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\FPSRVUTL.DLL 1278.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ContactPicker.dll 1278.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBCONV.DLL 1278.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Search.api 1278.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACER3X.DLL 1278.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTO\vstoee.dll 1278.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE 1278.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSODCW.DLL 1278.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia.api 1278.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\FPERSON.DLL 1278.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOCFUIUTILITIESDLL.DLL 1278.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\VVIEWDWG.DLL 1278.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\OLADD.FAE 1278.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OSETUP.DLL 1278.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONBttnOL.dll 1278.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\OLJRNL.FAE 1278.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PROOF\1033\MSGR3EN.DLL 1278.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OSetupPS.dll 1278.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OART.DLL 1278.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SOA.DLL 1278.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\XPAGE3C.DLL 1278.tmp File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\WebKit.dll 1278.tmp File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe 1278.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\ACT3.SAM 1278.tmp File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 1278.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Filters\odffilt.dll 1278.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEES.DLL 1278.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\RICHED20.DLL 1278.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\MSB1CORE.DLL 1278.tmp File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\msmgdsrv.dll 1278.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OLKFSTUB.DLL 1278.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\TWCUTCHR.DLL 1278.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\ACE.dll 1278.tmp File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\atl.dll 1278.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annots.api 1278.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEEXCH.DLL 1278.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CLVIEW.EXE 1278.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OISGRAPH.DLL 1278.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\FSTOCK.DLL 1278.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ogalegit.dll 1278.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SSGEN.DLL 1278.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSSP7FR.DLL 1278.tmp -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\winsxs\x86_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7601.17514_none_0b66cb34258c936f\OEMHelpIns.dll 1278.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-mediaplayer-drm_31bf3856ad364e35_6.1.7601.17514_none_d6a8cb040fcd3a85\msnetobj.dll 1278.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-w..mediadeliveryengine_31bf3856ad364e35_6.1.7601.17514_none_85ead099a8942341\wmpmde.dll 1278.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-wow64_31bf3856ad364e35_6.1.7600.16385_none_ce6f64032560fa6b\acwow64.dll 1278.tmp File created C:\Windows\winsxs\x86_microsoft-windows-atl_31bf3856ad364e35_6.1.7600.16385_none_aaf695e9bb060258\atl.dll 1278.tmp File created C:\Windows\winsxs\x86_microsoft-windows-object-picker_31bf3856ad364e35_6.1.7600.16385_none_0f6c30b96de81257\objsel.dll 1278.tmp File created C:\Windows\winsxs\x86_microsoft-windows-rasrtutils_31bf3856ad364e35_6.1.7601.17514_none_0f1cfdfc48bca8a8\rtutils.dll 1278.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-iis-legacysnapin_31bf3856ad364e35_6.1.7601.17514_none_e99b83c8fd064a06\uihelper.dll 1278.tmp File created C:\Windows\winsxs\x86_microsoft-windows-m..b-odbc-provider-dll_31bf3856ad364e35_6.1.7601.17514_none_25b6ad6b6f64d102\msdasql.dll 1278.tmp File created C:\Windows\winsxs\x86_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7600.16385_none_0935b76c289e0fd5\smiengine.dll 1278.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscordacwks.dll 1278.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-mediaplayer-drm_31bf3856ad364e35_6.1.7601.17514_none_d6a8cb040fcd3a85\msscp.dll 1278.tmp File created C:\Windows\winsxs\x86_microsoft-windows-i..eoptionalcomponents_31bf3856ad364e35_8.0.7601.17514_none_1e7b93842c84c912\ConfigureIEOptionalComponents.exe 1278.tmp File created C:\Windows\winsxs\x86_microsoft.vc90.mfc_1fc8b3b9a1e18e3b_9.0.30729.6161_none_4bf7e3e2bf9ada4c\mfc90u.dll 1278.tmp File created C:\Windows\winsxs\Backup\x86_microsoft-windows-cryptui-dll_31bf3856ad364e35_6.1.7601.17514_none_87f5c549f6656c22_cryptui.dll_af347940 1278.tmp File created C:\Windows\winsxs\x86_microsoft-windows-com-legacyole-olecli32_31bf3856ad364e35_6.1.7600.16385_none_673f800d98f1faf8\olecli32.dll 1278.tmp File created C:\Windows\winsxs\x86_microsoft-windows-s..on-wizard-framework_31bf3856ad364e35_6.1.7601.17514_none_b85a4f21afbb528a\spwizeng.dll 1278.tmp File created C:\Windows\winsxs\x86_system.data.oracleclient_b77a5c561934e089_6.1.7601.17514_none_c79237cc99cb8865\System.Data.OracleClient.dll 1278.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7601.17514_none_96780994e42bbfd5\mshtml.dll 1278.tmp File created C:\Windows\winsxs\x86_microsoft-windows-ie-iexpress_31bf3856ad364e35_11.2.9600.16428_none_eab4546b9b62b250\iexpress.exe 1278.tmp File created C:\Windows\winsxs\x86_microsoft-windows-m..ss-components-jetes_31bf3856ad364e35_6.1.7600.16385_none_36886cdd2e3bf7e4\msjtes40.dll 1278.tmp File created C:\Windows\winsxs\x86_microsoft-windows-winrsplugins_31bf3856ad364e35_6.1.7600.16385_none_160ccc8a92fae520\winrs.exe 1278.tmp File created C:\Windows\winsxs\x86_microsoft-windows-wusa_31bf3856ad364e35_6.1.7601.17514_none_af07fb6876def437\wusa.exe 1278.tmp File created C:\Windows\winsxs\Backup\wow64_microsoft-windows-uiribbon_31bf3856ad364e35_6.1.7601.17514_none_db578bdb5e3559c6_uiribbon.dll_8a707982 1278.tmp File created C:\Windows\winsxs\x86_microsoft-windows-directx-directdraw_31bf3856ad364e35_6.1.7600.16385_none_04dbf9102154d42e\ddraw.dll 1278.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-b..sscanning-smcnative_31bf3856ad364e35_6.1.7600.16385_none_e6ccfcfcd8f1f934\SMCNative.dll 1278.tmp File created C:\Windows\winsxs\x86_microsoft-windows-c..us-runtime-stclient_31bf3856ad364e35_6.1.7600.16385_none_a9649d04c661942c\stclient.dll 1278.tmp File created C:\Windows\winsxs\x86_microsoft-windows-ie-sysprep_31bf3856ad364e35_8.0.7601.17514_none_3853caf38f4097bb\iesysprep.dll 1278.tmp File created C:\Windows\winsxs\x86_microsoft-windows-newdev_31bf3856ad364e35_6.1.7600.16385_none_114ca177b1fcad24\newdev.dll 1278.tmp File created C:\Windows\winsxs\x86_microsoft-windows-sxs_31bf3856ad364e35_6.1.7601.17514_none_b0540607b5e5d445\SxsMigPlugin.dll 1278.tmp File created C:\Windows\winsxs\x86_microsoft-windows-usp_31bf3856ad364e35_6.1.7601.17514_none_af01e2f9b6be7939\usp10.dll 1278.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\FileTracker.dll 1278.tmp File created C:\Windows\winsxs\x86_microsoft-windows-c..dtc-runtime-cluster_31bf3856ad364e35_6.1.7601.17514_none_988fb91deaf45afe\mtxclu.dll 1278.tmp File created C:\Windows\winsxs\x86_microsoft-windows-directx-warp10_31bf3856ad364e35_7.1.7601.16492_none_dd831f034017b66d\d3d10warp.dll 1278.tmp File created C:\Windows\winsxs\x86_microsoft-windows-mail-core_31bf3856ad364e35_6.1.7601.17514_none_eb2fd71ce868a93e\msoert2.dll 1278.tmp File created C:\Windows\winsxs\x86_microsoft-windows-wmcodecdspps_31bf3856ad364e35_6.1.7600.16385_none_e344e0de5741a951\wmcodecdspps.dll 1278.tmp File created C:\Windows\winsxs\x86_netfx-shfusion_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_2f34ae7288e22ae3\shfusion.dll 1278.tmp File created C:\Windows\Installer\$PatchCache$\Managed\E8EBCC90469BFE03EA485673BA14799F\4.7.3062\system_data_dll_gac_x86 1278.tmp File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll 1278.tmp File created C:\Windows\winsxs\Backup\x86_microsoft-windows-cryptnet-dll_31bf3856ad364e35_6.1.7600.16385_none_16ef973d5d294eb5_cryptnet.dll_e44c577b 1278.tmp File created C:\Windows\winsxs\Backup\wow64_microsoft-windows-htmlhelp_31bf3856ad364e35_6.1.7600.16385_none_2e9f92abd2ce43b6_hhctrl.ocx_38c869db 1278.tmp File created C:\Windows\winsxs\Backup\x86_microsoft-windows-unimodem-config_31bf3856ad364e35_6.1.7600.16385_none_f4d7f7b17ffe522a_modemui.dll_a2c099ac 1278.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrenderingmedia_31bf3856ad364e35_11.2.9600.16428_none_ab2c6886a2bafa09\mshtmlmedia.dll 1278.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_79642285ffd2a388\iissetup.exe 1278.tmp File created C:\Windows\winsxs\x86_microsoft-windows-ie-gc-registeriepkeys_31bf3856ad364e35_8.0.7601.17514_none_44aa873ff9136c27\RegisterIEPKEYs.exe 1278.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-imapiv2-base_31bf3856ad364e35_6.1.7601.17514_none_2b851fa75da204a8\imapi2.dll 1278.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-tcpip_31bf3856ad364e35_6.1.7601.17514_none_ca00459dda59f6f4\tcpipcfg.dll 1278.tmp File created C:\Windows\winsxs\x86_microsoft-windows-r..ement-client-v1-api_31bf3856ad364e35_6.1.7601.17514_none_ea0506c3f186aaf1\msdrm.dll 1278.tmp File created C:\Windows\winsxs\x86_microsoft-windows-winlogon-sas_31bf3856ad364e35_6.1.7600.16385_none_794ca3c3dba3387a\sas.dll 1278.tmp File created C:\Windows\winsxs\Backup\x86_microsoft-windows-s..configurationengine_31bf3856ad364e35_6.1.7601.17514_none_bb2c4d9ee6dcc35c_scesrv.dll_07b1e224 1278.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-i..lified-chinese-core_31bf3856ad364e35_6.1.7601.17514_none_808c0da292f3ca46\IMSCPROP.exe 1278.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-mediaplayer-wmvsdk_31bf3856ad364e35_6.1.7601.17514_none_0ea5f72371a1658e\wmdrmnet.dll 1278.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-synchost_31bf3856ad364e35_6.1.7600.16385_none_cfcaa9124aa42f85\SyncHost.exe 1278.tmp File created C:\Windows\winsxs\x86_microsoft-windows-healthcenter_31bf3856ad364e35_6.1.7601.17514_none_ad648c1ec21694b8\ActionCenter.dll 1278.tmp File created C:\Windows\winsxs\x86_microsoft-windows-m..-downlevelmanifests_31bf3856ad364e35_6.1.7601.17514_none_04801f69e1dbd8e6\NlbMigPlugin.dll 1278.tmp File created C:\Windows\winsxs\x86_microsoft-windows-directwrite_31bf3856ad364e35_7.1.7601.16492_none_c5bcea40e8da67a0\DWrite.dll 1278.tmp File created C:\Windows\winsxs\x86_microsoft-windows-makecab_31bf3856ad364e35_6.1.7600.16385_none_f0a5d809ca926e4f\makecab.exe 1278.tmp File created C:\Windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_50916076bcb9a742\msvcr90.dll 1278.tmp File created C:\Windows\winsxs\x86_netfx-debugging_msdia70_b03f5f7f11d50a3a_6.1.7601.17514_none_a53a9a0bd158f869\diasymreader.dll 1278.tmp File created C:\Windows\winsxs\x86_netfx-mscorsec_dll_b03f5f7f11d50a3a_6.1.7600.16385_none_e638a346b112adf9\mscorsec.dll 1278.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_11.2.9600.16428_none_856219b9f734bb75\iexplore.exe 1278.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-tapisetup_31bf3856ad364e35_6.1.7600.16385_none_d03cc6bce93bce83\TapiMigPlugin.dll 1278.tmp File created C:\Windows\winsxs\x86_microsoft-windows-mp43decd_31bf3856ad364e35_6.1.7600.16385_none_b40981b05284b367\MP43DECD.DLL 1278.tmp File created C:\Windows\winsxs\x86_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_6.1.7601.17514_none_632ae4bc5d173763\tracerpt.exe 1278.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2040 wrote to memory of 1468 2040 6937467e14670108689bac86ab16a860_NEIKI.exe 28 PID 2040 wrote to memory of 1468 2040 6937467e14670108689bac86ab16a860_NEIKI.exe 28 PID 2040 wrote to memory of 1468 2040 6937467e14670108689bac86ab16a860_NEIKI.exe 28 PID 2040 wrote to memory of 1468 2040 6937467e14670108689bac86ab16a860_NEIKI.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\6937467e14670108689bac86ab16a860_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\6937467e14670108689bac86ab16a860_NEIKI.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\1278.tmpC:\Users\Admin\AppData\Local\Temp\1278.tmp2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:1468
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
145KB
MD5c610e7ccd6859872c585b2a85d7dc992
SHA1362b3d4b72e3add687c209c79b500b7c6a246d46
SHA25614063fc61dc71b9881d75e93a587c27a6daf8779ff5255a24a042beace541041
SHA5128570aad2ae8b5dcba00fc5ebf3dc0ea117e96cc88a83febd820c5811bf617a6431c1367b3eb88332f43f80b30ebe2c298c22dcc44860a075f7b41bf350236666