Analysis
-
max time kernel
138s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
08/05/2024, 01:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
861b951119928b8134a4f449a4e4c3d0_NEIKI.exe
Resource
win7-20240221-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
861b951119928b8134a4f449a4e4c3d0_NEIKI.exe
Resource
win10v2004-20240419-en
6 signatures
150 seconds
General
-
Target
861b951119928b8134a4f449a4e4c3d0_NEIKI.exe
-
Size
160KB
-
MD5
861b951119928b8134a4f449a4e4c3d0
-
SHA1
cd3ec3e6ef3041b879f095148ff0a61bdb42efa4
-
SHA256
aa12a4115a8be8bf7fc6843e437ecce46155af93ef656f1370704b27c7f87ad8
-
SHA512
bf9ac4699b4eb7ea95dbeeb1ee0c3ab2fb78a5f55689457598d83521a05113dc11dd0dfa3c235dbcfa7061c5e0744a94eba49ca5675efa73e777c537d4179709
-
SSDEEP
1536:UH1kPkZccmK9OM1q6wYV6nBRiOW+bUciXDyeAvX0J7M6QG9wIa82U6q:YAM3ERioem9G9wlxu
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4624 2752 WerFault.exe 87 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2752 winver.exe 2752 winver.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 3460 Explorer.EXE Token: SeCreatePagefilePrivilege 3460 Explorer.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2752 winver.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3460 Explorer.EXE -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1204 wrote to memory of 2752 1204 861b951119928b8134a4f449a4e4c3d0_NEIKI.exe 87 PID 1204 wrote to memory of 2752 1204 861b951119928b8134a4f449a4e4c3d0_NEIKI.exe 87 PID 1204 wrote to memory of 2752 1204 861b951119928b8134a4f449a4e4c3d0_NEIKI.exe 87 PID 1204 wrote to memory of 2752 1204 861b951119928b8134a4f449a4e4c3d0_NEIKI.exe 87 PID 2752 wrote to memory of 3460 2752 winver.exe 56 PID 2752 wrote to memory of 2940 2752 winver.exe 49
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2940
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\861b951119928b8134a4f449a4e4c3d0_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\861b951119928b8134a4f449a4e4c3d0_NEIKI.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Windows\SysWOW64\winver.exewinver3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2752 -s 6364⤵
- Program crash
PID:4624
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2752 -ip 27521⤵PID:844