939b169c15fee5b794daaf91b050371712c6b6160f75e71a05c4ac9f0c0d96dd

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 00:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

76eed18bfd7644c6430096c648ee8a70_NEIKI.exe
Size

960KB
MD5

76eed18bfd7644c6430096c648ee8a70
SHA1

45e333c5015d2e99ae2a5aa5dc07ed4cd7e06b76
SHA256

939b169c15fee5b794daaf91b050371712c6b6160f75e71a05c4ac9f0c0d96dd
SHA512

fbb7d3d007e1ec27eab295cf1f8e890a7341c8fb16ab23f3957042a6d4795fc6f7f580c4fd5bb42bb2c29a67dfd5fd18504ed8dffa5837ccd0a39e0c561223c3
SSDEEP

24576:59S5eyTJXcg2dftoQMKgHCKSY8a/ZSbH77Lh:m5DKg24Fj8g4Hbh

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2456	76eed18bfd7644c6430096c648ee8a70_NEIKI.exe

Executes dropped EXE 1 IoCs

pid	Process
2456	76eed18bfd7644c6430096c648ee8a70_NEIKI.exe

Loads dropped DLL 1 IoCs

pid	Process
1904	76eed18bfd7644c6430096c648ee8a70_NEIKI.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	pastebin.com
3	pastebin.com

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2456	76eed18bfd7644c6430096c648ee8a70_NEIKI.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1904	76eed18bfd7644c6430096c648ee8a70_NEIKI.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2456	76eed18bfd7644c6430096c648ee8a70_NEIKI.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 2456	1904	76eed18bfd7644c6430096c648ee8a70_NEIKI.exe	29
PID 1904 wrote to memory of 2456	1904	76eed18bfd7644c6430096c648ee8a70_NEIKI.exe	29
PID 1904 wrote to memory of 2456	1904	76eed18bfd7644c6430096c648ee8a70_NEIKI.exe	29
PID 1904 wrote to memory of 2456	1904	76eed18bfd7644c6430096c648ee8a70_NEIKI.exe	29

C:\Users\Admin\AppData\Local\Temp\76eed18bfd7644c6430096c648ee8a70_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\76eed18bfd7644c6430096c648ee8a70_NEIKI.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Users\Admin\AppData\Local\Temp\76eed18bfd7644c6430096c648ee8a70_NEIKI.exe
  C:\Users\Admin\AppData\Local\Temp\76eed18bfd7644c6430096c648ee8a70_NEIKI.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:2456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\76eed18bfd7644c6430096c648ee8a70_NEIKI.exe

Filesize
960KB

MD5
2e06db76ecc85493f64d23cd98017697

SHA1
e7cfb378dd8c065f48d070e6173d91967544358a

SHA256
8bc63fccaa80513797920c4884d48b2e50c4bf5a172b1ef1a612a812d73ae412

SHA512
33660569eca21a4e02e5f4e64a4767b4d6589abbfdc69d6532b523436fe9f1b6918ab169e68bb8351ca69ed02cd32c2255e4beda7be6202002ce68eee6bce056

Download Submit
memory/1904-0-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/1904-8-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/2456-16-0x0000000002E20000-0x0000000002F0D000-memory.dmp

Filesize
948KB

Download
memory/2456-10-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2456-9-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/2456-32-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2456-38-0x000000000D7E0000-0x000000000D883000-memory.dmp

Filesize
652KB

Download