e39478df1000592ea0c391ed1f15f514b6f72aadb7d20eae058c446980db591b

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 23:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8e0f0eec4dbb5ca6c9789eabfbe176d0_NEIKI.exe
Size

448KB
MD5

8e0f0eec4dbb5ca6c9789eabfbe176d0
SHA1

76b07d162c747451798670a539841135a665c925
SHA256

e39478df1000592ea0c391ed1f15f514b6f72aadb7d20eae058c446980db591b
SHA512

d5392db5d16c6c8bb6ef1720d82594d352e0976390c28892443b0db7921537b97ebf8fce30843c8edf85a369556db56abc5d4c3fd62141937c67b36539b9cad9
SSDEEP

6144:Ack18MipfIUaQYu8tbS6JBEYFW8jb/HVbdsifRe9+HH:AX8Djadu8Jtxr1bBGoH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 2704	2792	8e0f0eec4dbb5ca6c9789eabfbe176d0_NEIKI.exe	28
PID 2792 wrote to memory of 2704	2792	8e0f0eec4dbb5ca6c9789eabfbe176d0_NEIKI.exe	28
PID 2792 wrote to memory of 2704	2792	8e0f0eec4dbb5ca6c9789eabfbe176d0_NEIKI.exe	28
PID 2792 wrote to memory of 2704	2792	8e0f0eec4dbb5ca6c9789eabfbe176d0_NEIKI.exe	28

C:\Users\Admin\AppData\Local\Temp\8e0f0eec4dbb5ca6c9789eabfbe176d0_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\8e0f0eec4dbb5ca6c9789eabfbe176d0_NEIKI.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\bhoF5E3.tmp.bat" "C:\Users\Admin\AppData\Local\Temp\8e0f0eec4dbb5ca6c9789eabfbe176d0_NEIKI.exe""
  2⤵
  PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\bhoF5E3.tmp.bat

Filesize
35B

MD5
4852f5a8401a0686426821ced911d0df

SHA1
a712af9467c2c34ab17a80d1f0ebe25076c59baf

SHA256
bf9f55c261904c54aeb8dc3dadfde9b6af36ab011a2d9e650a58ff4a99a802f8

SHA512
36c7f1c115decbc7d6f4a3007e717cb84dba51739228f4614cefb576a153fb6b6b4e00cfbd07d0ac9be73d3fdaf2fa2d598008bc2f06af2da5e0aa3033e2601e

Download Submit
memory/2792-0-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2792-1-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2792-2-0x000000000045A000-0x000000000045E000-memory.dmp

Filesize
16KB

Download
memory/2792-3-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2792-19-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download