3346884afbe6adb63ddc9bb41a6c5b766a03ce92b09070a66a63d5cda2724d43

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 21:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

36b2a2e7cc4d7d03294d365e31ad9370_NEIKI.exe
Size

134KB
MD5

36b2a2e7cc4d7d03294d365e31ad9370
SHA1

3cc177b53a3dbe5151bdf37fc7b154e6677d7605
SHA256

3346884afbe6adb63ddc9bb41a6c5b766a03ce92b09070a66a63d5cda2724d43
SHA512

52674cfeaa2ed36818b68f249bec5179b4283843a559eb276ad7870c14015db882bfa9af7862c61fd2de6e257c1294a8d46dfeb71a9036ea0a0604d6f7df3120
SSDEEP

1536:rF0AJELopHG9aa+9qX3apJzAKWYr0v7ioy6paK2AZqMIK7aGZh38QY:riAyLN9aa+9U2rW1ip6pr2At7NZuQY

Score

7^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3052	WwanSvc.exe

Loads dropped DLL 1 IoCs

pid	Process
2972	36b2a2e7cc4d7d03294d365e31ad9370_NEIKI.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2972-1-0x0000000000C30000-0x0000000000C58000-memory.dmp	upx
behavioral1/files/0x0038000000015d6b-2.dat	upx
behavioral1/memory/3052-6-0x0000000000040000-0x0000000000068000-memory.dmp	upx
behavioral1/memory/3052-8-0x0000000000040000-0x0000000000068000-memory.dmp	upx
behavioral1/memory/2972-9-0x0000000000C30000-0x0000000000C58000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Window Update = "\"C:\\ProgramData\\Update\\WwanSvc.exe\" /run"	36b2a2e7cc4d7d03294d365e31ad9370_NEIKI.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 3052	2972	36b2a2e7cc4d7d03294d365e31ad9370_NEIKI.exe	28
PID 2972 wrote to memory of 3052	2972	36b2a2e7cc4d7d03294d365e31ad9370_NEIKI.exe	28
PID 2972 wrote to memory of 3052	2972	36b2a2e7cc4d7d03294d365e31ad9370_NEIKI.exe	28
PID 2972 wrote to memory of 3052	2972	36b2a2e7cc4d7d03294d365e31ad9370_NEIKI.exe	28

C:\Users\Admin\AppData\Local\Temp\36b2a2e7cc4d7d03294d365e31ad9370_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\36b2a2e7cc4d7d03294d365e31ad9370_NEIKI.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2972
- C:\ProgramData\Update\WwanSvc.exe
  "C:\ProgramData\Update\WwanSvc.exe" /run
  2⤵
  - Executes dropped EXE
  PID:3052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\ProgramData\Update\WwanSvc.exe

Filesize
134KB

MD5
08800d5533365b5dfb71b869e0d28fd7

SHA1
6ae565ecb4d0dcd5787035815d309c02c4b221d8

SHA256
28e03bbdf97288dca63c3017c01a4d6199e3becb728571186394e75c3c0090ea

SHA512
9e6d832be2023c569b1e6eacec52ce4c32082a970ba2ec10b240b9cf89ccd2fd1720664dd026c9aba0f4e62a4913b8f77900bde18c87a3d5068f4a58e3f3e6cf

Download Submit
memory/2972-1-0x0000000000C30000-0x0000000000C58000-memory.dmp

Filesize
160KB

Download
memory/2972-7-0x0000000000250000-0x0000000000278000-memory.dmp

Filesize
160KB

Download
memory/2972-9-0x0000000000C30000-0x0000000000C58000-memory.dmp

Filesize
160KB

Download
memory/3052-6-0x0000000000040000-0x0000000000068000-memory.dmp

Filesize
160KB

Download
memory/3052-8-0x0000000000040000-0x0000000000068000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads