Overview

overview

7

Static

static

3

80def66f33...KI.exe

windows7-x64

7

80def66f33...KI.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    08/05/2024, 00:47

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    80def66f33631ff4d4f89e6fd5e93860_NEIKI.exe

  • Size

    2.7MB

  • MD5

    80def66f33631ff4d4f89e6fd5e93860

  • SHA1

    e740ad96f99673b490edcb45d5d4b3409aa7e9fb

  • SHA256

    ac346ad76a3f47f318fad20e3fdf018abeec765a4e0a7891d402975323073c49

  • SHA512

    4dbecce42bb9668679dc8fd1c291c1028016a61ea04f2bb21dd1c8e2682c57e22b42c7d6e025eb487885036d7d67fd3f9e2a0de455ea6639c6230dca94ba502c

  • SSDEEP

    49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LB/9w4Sx:+R0pI/IQlUoMPdmpSpv4

Score
7/10
persistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\80def66f33631ff4d4f89e6fd5e93860_NEIKI.exe
    "C:\Users\Admin\AppData\Local\Temp\80def66f33631ff4d4f89e6fd5e93860_NEIKI.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3068
    • C:\SysDrvHZ\devdobsys.exe
      C:\SysDrvHZ\devdobsys.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:2728

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Mint6G\dobaloc.exe
          Filesize

          2.7MB

          MD5

          76cad65e6cad8e5a655f1619d86d5490

          SHA1

          eb56ae3207ca202656864a9c3cdea57d4cdf284d

          SHA256

          ec31044f0405f60456048d7e926ec1af843fe362a0ce0a3b784a32f240b0a173

          SHA512

          b6bce327b4cf09031a78305b8ea86ff56d5e7fe6c1aade804a6fd237c300cd1acb39ba99036d06814319e6c9f04832765297ddcdd425d3174f219c814c70e9a6

          Download Submit

        • C:\Users\Admin\253086396416_6.1_Admin.ini
          Filesize

          205B

          MD5

          a90b76522f58e149a61f39a5835d853d

          SHA1

          072cd3562712197e6b2ec9b8f7b8523c5966ca76

          SHA256

          e37cf9c3153a1ab21d67156419da38f2be7ce9304b8cac1b0f5ba210718fcc29

          SHA512

          83a6532df0adafc5418deb0175d1bbd9bbb8e4d9949457cf0dad460786ce114c536f9a2f067c81b3e1c320f2aeaa6fe5eaf7f43e83a0bec7852eb16901bf680e

          Download Submit

        • \SysDrvHZ\devdobsys.exe
          Filesize

          2.7MB

          MD5

          1576dae6f98678f5b4ca1731df1751a9

          SHA1

          741ba67c0c49f38ad7b3b00b8b68c9b3e3408b5c

          SHA256

          e0348f4a61235fecc8673081a9fd8cff40e55c8c1bc03923f5a8c61f458f7ac6

          SHA512

          50271c6ca762ef68e191b905b44454b5c62ab5f20c3688bc47e08e6ac4f02727f3eb0d40635b7750b4024e2cf82579d49322a3c85c16f509498d96227d94de61

          Download Submit