20f3d908c3b86d4b0f29cc7c51f355e7b903e4b0d0f00d773b61a6a114eb3373

Analysis

max time kernel
149s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 01:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

98b205ebee32992c9a874045b2639440_NEIKI.exe
Size

70KB
MD5

98b205ebee32992c9a874045b2639440
SHA1

dc5dc23cf34f5120d5bb0c2e792b966812d46e43
SHA256

20f3d908c3b86d4b0f29cc7c51f355e7b903e4b0d0f00d773b61a6a114eb3373
SHA512

b10699d469a2a6e6513528ecd57e8341ec8ba775cce407322b939424b11481b68ed5696c912d6cc14c2f1adb51de6e37bf31231ac073b1158a279827cd518ec2
SSDEEP

1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8sln:Olg35GTslA5t3/w8e

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	isbokec-umoas.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	isbokec-umoas.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	isbokec-umoas.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	isbokec-umoas.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{484E4F50-4d4c-5059-484E-4F504D4C5059}	isbokec-umoas.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{484E4F50-4d4c-5059-484E-4F504D4C5059}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a"	isbokec-umoas.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{484E4F50-4d4c-5059-484E-4F504D4C5059}\IsInstalled = "1"	isbokec-umoas.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{484E4F50-4d4c-5059-484E-4F504D4C5059}\StubPath = "C:\\Windows\\system32\\ongeaxid.exe"	isbokec-umoas.exe

Sets file execution options in registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe	isbokec-umoas.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a"	isbokec-umoas.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\arvoovax-oudoas.exe"	isbokec-umoas.exe

Executes dropped EXE 2 IoCs

pid	Process
4544	isbokec-umoas.exe
456	isbokec-umoas.exe

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	isbokec-umoas.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	isbokec-umoas.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	isbokec-umoas.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	isbokec-umoas.exe

Modifies WinLogon 2 TTPs 5 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a"	isbokec-umoas.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\lmakad.dll"	isbokec-umoas.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup"	isbokec-umoas.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}	isbokec-umoas.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	isbokec-umoas.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\isbokec-umoas.exe	98b205ebee32992c9a874045b2639440_NEIKI.exe
File created	C:\Windows\SysWOW64\arvoovax-oudoas.exe	isbokec-umoas.exe
File opened for modification	C:\Windows\SysWOW64\ongeaxid.exe	isbokec-umoas.exe
File opened for modification	C:\Windows\SysWOW64\lmakad.dll	isbokec-umoas.exe
File opened for modification	C:\Windows\SysWOW64\isbokec-umoas.exe	isbokec-umoas.exe
File opened for modification	C:\Windows\SysWOW64\isbokec-umoas.exe	98b205ebee32992c9a874045b2639440_NEIKI.exe
File opened for modification	C:\Windows\SysWOW64\arvoovax-oudoas.exe	isbokec-umoas.exe
File created	C:\Windows\SysWOW64\ongeaxid.exe	isbokec-umoas.exe
File created	C:\Windows\SysWOW64\lmakad.dll	isbokec-umoas.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4544	isbokec-umoas.exe
4544	isbokec-umoas.exe
4544	isbokec-umoas.exe
4544	isbokec-umoas.exe
4544	isbokec-umoas.exe
4544	isbokec-umoas.exe
4544	isbokec-umoas.exe
4544	isbokec-umoas.exe
456	isbokec-umoas.exe
456	isbokec-umoas.exe
4544	isbokec-umoas.exe
4544	isbokec-umoas.exe
4544	isbokec-umoas.exe
4544	isbokec-umoas.exe
4544	isbokec-umoas.exe
4544	isbokec-umoas.exe
4544	isbokec-umoas.exe
4544	isbokec-umoas.exe
4544	isbokec-umoas.exe
4544	isbokec-umoas.exe
4544	isbokec-umoas.exe
4544	isbokec-umoas.exe
4544	isbokec-umoas.exe
4544	isbokec-umoas.exe
4544	isbokec-umoas.exe
4544	isbokec-umoas.exe
4544	isbokec-umoas.exe
4544	isbokec-umoas.exe
4544	isbokec-umoas.exe
4544	isbokec-umoas.exe
4544	isbokec-umoas.exe
4544	isbokec-umoas.exe
4544	isbokec-umoas.exe
4544	isbokec-umoas.exe
4544	isbokec-umoas.exe
4544	isbokec-umoas.exe
4544	isbokec-umoas.exe
4544	isbokec-umoas.exe
4544	isbokec-umoas.exe
4544	isbokec-umoas.exe
4544	isbokec-umoas.exe
4544	isbokec-umoas.exe
4544	isbokec-umoas.exe
4544	isbokec-umoas.exe
4544	isbokec-umoas.exe
4544	isbokec-umoas.exe
4544	isbokec-umoas.exe
4544	isbokec-umoas.exe
4544	isbokec-umoas.exe
4544	isbokec-umoas.exe
4544	isbokec-umoas.exe
4544	isbokec-umoas.exe
4544	isbokec-umoas.exe
4544	isbokec-umoas.exe
4544	isbokec-umoas.exe
4544	isbokec-umoas.exe
4544	isbokec-umoas.exe
4544	isbokec-umoas.exe
4544	isbokec-umoas.exe
4544	isbokec-umoas.exe
4544	isbokec-umoas.exe
4544	isbokec-umoas.exe
4544	isbokec-umoas.exe
4544	isbokec-umoas.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1048	98b205ebee32992c9a874045b2639440_NEIKI.exe
Token: SeDebugPrivilege	4544	isbokec-umoas.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 4544	1048	98b205ebee32992c9a874045b2639440_NEIKI.exe	85
PID 1048 wrote to memory of 4544	1048	98b205ebee32992c9a874045b2639440_NEIKI.exe	85
PID 1048 wrote to memory of 4544	1048	98b205ebee32992c9a874045b2639440_NEIKI.exe	85
PID 4544 wrote to memory of 616	4544	isbokec-umoas.exe	5
PID 4544 wrote to memory of 456	4544	isbokec-umoas.exe	86
PID 4544 wrote to memory of 456	4544	isbokec-umoas.exe	86
PID 4544 wrote to memory of 456	4544	isbokec-umoas.exe	86
PID 4544 wrote to memory of 3472	4544	isbokec-umoas.exe	57
PID 4544 wrote to memory of 3472	4544	isbokec-umoas.exe	57
PID 4544 wrote to memory of 3472	4544	isbokec-umoas.exe	57
PID 4544 wrote to memory of 3472	4544	isbokec-umoas.exe	57
PID 4544 wrote to memory of 3472	4544	isbokec-umoas.exe	57
PID 4544 wrote to memory of 3472	4544	isbokec-umoas.exe	57
PID 4544 wrote to memory of 3472	4544	isbokec-umoas.exe	57
PID 4544 wrote to memory of 3472	4544	isbokec-umoas.exe	57
PID 4544 wrote to memory of 3472	4544	isbokec-umoas.exe	57
PID 4544 wrote to memory of 3472	4544	isbokec-umoas.exe	57
PID 4544 wrote to memory of 3472	4544	isbokec-umoas.exe	57
PID 4544 wrote to memory of 3472	4544	isbokec-umoas.exe	57
PID 4544 wrote to memory of 3472	4544	isbokec-umoas.exe	57
PID 4544 wrote to memory of 3472	4544	isbokec-umoas.exe	57
PID 4544 wrote to memory of 3472	4544	isbokec-umoas.exe	57
PID 4544 wrote to memory of 3472	4544	isbokec-umoas.exe	57
PID 4544 wrote to memory of 3472	4544	isbokec-umoas.exe	57
PID 4544 wrote to memory of 3472	4544	isbokec-umoas.exe	57
PID 4544 wrote to memory of 3472	4544	isbokec-umoas.exe	57
PID 4544 wrote to memory of 3472	4544	isbokec-umoas.exe	57
PID 4544 wrote to memory of 3472	4544	isbokec-umoas.exe	57
PID 4544 wrote to memory of 3472	4544	isbokec-umoas.exe	57
PID 4544 wrote to memory of 3472	4544	isbokec-umoas.exe	57
PID 4544 wrote to memory of 3472	4544	isbokec-umoas.exe	57
PID 4544 wrote to memory of 3472	4544	isbokec-umoas.exe	57
PID 4544 wrote to memory of 3472	4544	isbokec-umoas.exe	57
PID 4544 wrote to memory of 3472	4544	isbokec-umoas.exe	57
PID 4544 wrote to memory of 3472	4544	isbokec-umoas.exe	57
PID 4544 wrote to memory of 3472	4544	isbokec-umoas.exe	57
PID 4544 wrote to memory of 3472	4544	isbokec-umoas.exe	57
PID 4544 wrote to memory of 3472	4544	isbokec-umoas.exe	57
PID 4544 wrote to memory of 3472	4544	isbokec-umoas.exe	57
PID 4544 wrote to memory of 3472	4544	isbokec-umoas.exe	57
PID 4544 wrote to memory of 3472	4544	isbokec-umoas.exe	57
PID 4544 wrote to memory of 3472	4544	isbokec-umoas.exe	57
PID 4544 wrote to memory of 3472	4544	isbokec-umoas.exe	57
PID 4544 wrote to memory of 3472	4544	isbokec-umoas.exe	57
PID 4544 wrote to memory of 3472	4544	isbokec-umoas.exe	57
PID 4544 wrote to memory of 3472	4544	isbokec-umoas.exe	57
PID 4544 wrote to memory of 3472	4544	isbokec-umoas.exe	57
PID 4544 wrote to memory of 3472	4544	isbokec-umoas.exe	57
PID 4544 wrote to memory of 3472	4544	isbokec-umoas.exe	57
PID 4544 wrote to memory of 3472	4544	isbokec-umoas.exe	57
PID 4544 wrote to memory of 3472	4544	isbokec-umoas.exe	57
PID 4544 wrote to memory of 3472	4544	isbokec-umoas.exe	57
PID 4544 wrote to memory of 3472	4544	isbokec-umoas.exe	57
PID 4544 wrote to memory of 3472	4544	isbokec-umoas.exe	57
PID 4544 wrote to memory of 3472	4544	isbokec-umoas.exe	57
PID 4544 wrote to memory of 3472	4544	isbokec-umoas.exe	57
PID 4544 wrote to memory of 3472	4544	isbokec-umoas.exe	57
PID 4544 wrote to memory of 3472	4544	isbokec-umoas.exe	57
PID 4544 wrote to memory of 3472	4544	isbokec-umoas.exe	57
PID 4544 wrote to memory of 3472	4544	isbokec-umoas.exe	57
PID 4544 wrote to memory of 3472	4544	isbokec-umoas.exe	57
PID 4544 wrote to memory of 3472	4544	isbokec-umoas.exe	57
PID 4544 wrote to memory of 3472	4544	isbokec-umoas.exe	57
PID 4544 wrote to memory of 3472	4544	isbokec-umoas.exe	57

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:616

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3472
- C:\Users\Admin\AppData\Local\Temp\98b205ebee32992c9a874045b2639440_NEIKI.exe
  "C:\Users\Admin\AppData\Local\Temp\98b205ebee32992c9a874045b2639440_NEIKI.exe"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1048
- - C:\Windows\SysWOW64\isbokec-umoas.exe
    "C:\Windows\system32\isbokec-umoas.exe"
    3⤵
    - Windows security bypass
    - Modifies Installed Components in the registry
    - Sets file execution options in registry
    - Executes dropped EXE
    - Windows security modification
    - Modifies WinLogon
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4544
  - - C:\Windows\SysWOW64\isbokec-umoas.exe
      --k33p
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\arvoovax-oudoas.exe

Filesize
74KB

MD5
c9731ecb574dc09249855c207ef681d2

SHA1
dfa95bbf84ca2d2c2a82dafd1e63bae741853067

SHA256
1e89b8361fb916aba8cf6bed286d7b070f0b7ef6b2dd7352af1383c34de5a99d

SHA512
5a3d70c5e4ff4a370b6b5e0991a0b75391b0bd4d9fc42106aea2fe2e6e7a4bafb0bada86ba5462481fd88cc20407ed7809d0d631f597ea77c3717017ad930041

Download Submit
C:\Windows\SysWOW64\isbokec-umoas.exe

Filesize
70KB

MD5
98b205ebee32992c9a874045b2639440

SHA1
dc5dc23cf34f5120d5bb0c2e792b966812d46e43

SHA256
20f3d908c3b86d4b0f29cc7c51f355e7b903e4b0d0f00d773b61a6a114eb3373

SHA512
b10699d469a2a6e6513528ecd57e8341ec8ba775cce407322b939424b11481b68ed5696c912d6cc14c2f1adb51de6e37bf31231ac073b1158a279827cd518ec2

Download Submit
C:\Windows\SysWOW64\lmakad.dll

Filesize
5KB

MD5
f37b21c00fd81bd93c89ce741a88f183

SHA1
b2796500597c68e2f5638e1101b46eaf32676c1c

SHA256
76cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0

SHA512
252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4

Download Submit
C:\Windows\SysWOW64\ongeaxid.exe

Filesize
73KB

MD5
936d6ecbd7e1aed654fbe81e0b30665d

SHA1
ab2e5bb88ddaaa5320291a2faa06bed4613987da

SHA256
3281bc300dfa3f013ce6f661a20dec08d635ededf6f65a9ce9c3dbfbe98db9fb

SHA512
b971002f57b821167937a63bb9b92690344d1f5164b24070e96934f8b721e635e99c4fd53b05bdc8791497d3e795b358d5df19f4157d9e296745f8c71ef5fdc5

Download Submit
memory/456-50-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1048-5-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4544-49-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download