Analysis
-
max time kernel
138s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
-
submitted
08/05/2024, 01:00
General
-
Target
861b951119928b8134a4f449a4e4c3d0_NEIKI.exe
-
Size
160KB
-
MD5
861b951119928b8134a4f449a4e4c3d0
-
SHA1
cd3ec3e6ef3041b879f095148ff0a61bdb42efa4
-
SHA256
aa12a4115a8be8bf7fc6843e437ecce46155af93ef656f1370704b27c7f87ad8
-
SHA512
bf9ac4699b4eb7ea95dbeeb1ee0c3ab2fb78a5f55689457598d83521a05113dc11dd0dfa3c235dbcfa7061c5e0744a94eba49ca5675efa73e777c537d4179709
-
SSDEEP
1536:UH1kPkZccmK9OM1q6wYV6nBRiOW+bUciXDyeAvX0J7M6QG9wIa82U6q:YAM3ERioem9G9wlxu
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\861b951119928b8134a4f449a4e4c3d0_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\861b951119928b8134a4f449a4e4c3d0_NEIKI.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\winver.exewinver3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2752 -s 6364⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2752 -ip 27521⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
444KB
-
Filesize
12KB
-
Filesize
20KB
-
Filesize
444KB
-
Filesize
444KB
-
Filesize
18KB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
28KB