effeeedc63e4fe3b11f548b400de5a37dd36474db2bc4d7ecc135d8ca1f1f2b3

General

Target

14833395ea230080ad5aca2b6da2b710_NEIKI.exe
Size

244KB
MD5

14833395ea230080ad5aca2b6da2b710
SHA1

b8eb74180f867d6754949b03ed2823d00e784833
SHA256

effeeedc63e4fe3b11f548b400de5a37dd36474db2bc4d7ecc135d8ca1f1f2b3
SHA512

bcb1129eb69e736ee3a2db6e5590ef1bb84182bad729e0efa265d04f95e7bca06544f7021d1f92de532d950d9fb8cdf19e09ed9262fcdca917bebeaa0b62d20e
SSDEEP

6144:UEXlSylvFuWaS54hIAv/QhuA7HY8pPZ0FP6BzxM5EmX:hAylvv5YRwh9HYd61xhmX

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\apppatch\\svchost.exe,"	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
3016	svchost.exe

Loads dropped DLL 7 IoCs

pid	Process
2360	14833395ea230080ad5aca2b6da2b710_NEIKI.exe
2360	14833395ea230080ad5aca2b6da2b710_NEIKI.exe
2648	WerFault.exe
2648	WerFault.exe
2648	WerFault.exe
2648	WerFault.exe
2648	WerFault.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\c9614844 = "C:\\Windows\\apppatch\\svchost.exe"	14833395ea230080ad5aca2b6da2b710_NEIKI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\c9614844 = "C:\\Windows\\apppatch\\svchost.exe"	svchost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\apppatch\svchost.exe	14833395ea230080ad5aca2b6da2b710_NEIKI.exe
File created	C:\Windows\apppatch\svchost.exe	14833395ea230080ad5aca2b6da2b710_NEIKI.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2648	3016	WerFault.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3016	svchost.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2360	14833395ea230080ad5aca2b6da2b710_NEIKI.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 3016	2360	14833395ea230080ad5aca2b6da2b710_NEIKI.exe	28
PID 2360 wrote to memory of 3016	2360	14833395ea230080ad5aca2b6da2b710_NEIKI.exe	28
PID 2360 wrote to memory of 3016	2360	14833395ea230080ad5aca2b6da2b710_NEIKI.exe	28
PID 2360 wrote to memory of 3016	2360	14833395ea230080ad5aca2b6da2b710_NEIKI.exe	28
PID 3016 wrote to memory of 2648	3016	svchost.exe	29
PID 3016 wrote to memory of 2648	3016	svchost.exe	29
PID 3016 wrote to memory of 2648	3016	svchost.exe	29
PID 3016 wrote to memory of 2648	3016	svchost.exe	29

C:\Users\Admin\AppData\Local\Temp\14833395ea230080ad5aca2b6da2b710_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\14833395ea230080ad5aca2b6da2b710_NEIKI.exe"
1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\apppatch\svchost.exe
  "C:\Windows\apppatch\svchost.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Modifies WinLogon
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3016
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3016 -s 356
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Winlogon Helper DLL

2

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Winlogon Helper DLL

2

T1547.004

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\AppPatch\svchost.exe

Filesize
244KB

MD5
a59d07fb6a8d4626a34adc2187a3ddce

SHA1
13c65aef86e89a0443c7304ebc35b340349f25c9

SHA256
8c3d261e31487e08c074fa1facb6204493fa5365d21be74e858a3c5b1d35aaba

SHA512
cb1903805217d8214b3a6d37af15e5f47a67aad043185288866ec18dcb561ecf59abe7a01c13ddb2a8e891c9b8613ce1a005f266a8a655464d583b8e25a208d9

Download Submit
memory/2360-17-0x0000000000220000-0x0000000000288000-memory.dmp

Filesize
416KB

Download
memory/2360-1-0x0000000000220000-0x0000000000288000-memory.dmp

Filesize
416KB

Download
memory/2360-3-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2360-0-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2360-18-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/3016-25-0x00000000003A0000-0x00000000003EA000-memory.dmp

Filesize
296KB

Download
memory/3016-20-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/3016-19-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/3016-29-0x00000000003A0000-0x00000000003EA000-memory.dmp

Filesize
296KB

Download
memory/3016-30-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/3016-27-0x00000000003A0000-0x00000000003EA000-memory.dmp

Filesize
296KB

Download
memory/3016-23-0x00000000003A0000-0x00000000003EA000-memory.dmp

Filesize
296KB

Download
memory/3016-21-0x00000000003A0000-0x00000000003EA000-memory.dmp

Filesize
296KB

Download
memory/3016-31-0x00000000004B0000-0x0000000000508000-memory.dmp

Filesize
352KB

Download
memory/3016-33-0x00000000004B0000-0x0000000000508000-memory.dmp

Filesize
352KB

Download
memory/3016-35-0x00000000004B0000-0x0000000000508000-memory.dmp

Filesize
352KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads