Analysis

  • max time kernel
    141s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    08-05-2024 22:46

General

  • Target

    84a0ef6284a972507f1954bccb2ba280_NEIKI.exe

  • Size

    4.2MB

  • MD5

    84a0ef6284a972507f1954bccb2ba280

  • SHA1

    cbafce7d19ab6c6db7c3973d669d7573ed959e5e

  • SHA256

    f29820e552e38a55315df845e594b2bd778ff5054911e88d76606df26719808f

  • SHA512

    0f14d22e4f6eb5ab70d8c9c1c044db50191e4c054175c8ed87ec79397952592c87d6076c41195018aef20681c65a3a687ec10cd594ee984d41070cd9084dc2ed

  • SSDEEP

    49152:LY3buzMu0IY3buzM30IY3buzMn0IY3buzM80IY3buzMA0IY3buzM40:LY3uY3PY3PY3IY3EY3

Malware Config

Signatures

  • FakeAV, RogueAntivirus

    FakeAV or Rogue AntiVirus is a class of malware that displays false alert messages.

  • FakeAV payload 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\84a0ef6284a972507f1954bccb2ba280_NEIKI.exe
    "C:\Users\Admin\AppData\Local\Temp\84a0ef6284a972507f1954bccb2ba280_NEIKI.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Windows directory
    PID:1196

Network

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1196-0-0x0000000000190000-0x0000000000191000-memory.dmp
    Filesize

    4KB

  • memory/1196-5-0x0000000000400000-0x00000000004BD000-memory.dmp
    Filesize

    756KB

  • memory/1196-7-0x0000000000190000-0x0000000000191000-memory.dmp
    Filesize

    4KB