aa12a4115a8be8bf7fc6843e437ecce46155af93ef656f1370704b27c7f87ad8

Analysis

max time kernel
138s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 01:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
861b951119928b8134a4f449a4e4c3d0_NEIKI.exe
Size 160KB
Sample240508-bcwrqscf53
SHA256 aa12a4115a8be8bf7fc6843e437ecce46155af93ef656f1370704b27c7f87ad8
MD5 861b951119928b8134a4f449a4e4c3d0
SHA1 cd3ec3e6ef3041b879f095148ff0a61bdb42efa4
SHA512 bf9ac4699b4eb7ea95dbeeb1ee0c3ab2fb78a5f55689457598d83521a05113dc11dd0dfa3c235dbcfa7061c5e0744a94eba49ca5675efa73e777c537d4179709
SSDEEP 1536:UH1kPkZccmK9OM1q6wYV6nBRiOW+bUciXDyeAvX0J7M6QG9wIa82U6q:YAM3ERioem9G9wlxu
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4624	2752	WerFault.exe	87

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2752	winver.exe
2752	winver.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3460	Explorer.EXE
Token: SeCreatePagefilePrivilege	3460	Explorer.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2752	winver.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3460	Explorer.EXE

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 2752	1204	861b951119928b8134a4f449a4e4c3d0_NEIKI.exe	87
PID 1204 wrote to memory of 2752	1204	861b951119928b8134a4f449a4e4c3d0_NEIKI.exe	87
PID 1204 wrote to memory of 2752	1204	861b951119928b8134a4f449a4e4c3d0_NEIKI.exe	87
PID 1204 wrote to memory of 2752	1204	861b951119928b8134a4f449a4e4c3d0_NEIKI.exe	87
PID 2752 wrote to memory of 3460	2752	winver.exe	56
PID 2752 wrote to memory of 2940	2752	winver.exe	49

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2940

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:3460
- C:\Users\Admin\AppData\Local\Temp\861b951119928b8134a4f449a4e4c3d0_NEIKI.exe
  "C:\Users\Admin\AppData\Local\Temp\861b951119928b8134a4f449a4e4c3d0_NEIKI.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1204
- - C:\Windows\SysWOW64\winver.exe
    winver
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2752
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2752 -s 636
      4⤵
      Program crash
      PID:4624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2752 -ip 2752
1⤵
PID:844

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1204-0-0x0000000000400000-0x000000000046F000-memory.dmp

Download

memory/1204-1-0x0000000000410000-0x0000000000413000-memory.dmp

Download

memory/1204-2-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/1204-4-0x0000000000400000-0x000000000046F000-memory.dmp

Download

memory/1204-3-0x0000000000400000-0x000000000046F000-memory.dmp

Download

memory/1204-12-0x0000000000400000-0x0000000000404A00-memory.dmp

Download

memory/2752-9-0x0000000077C42000-0x0000000077C43000-memory.dmp

Download

memory/2752-6-0x00000000012D0000-0x00000000012D7000-memory.dmp

Download

memory/2752-17-0x00000000012D0000-0x00000000012D7000-memory.dmp

Download

memory/2940-13-0x0000000000430000-0x0000000000437000-memory.dmp

Download

memory/2940-14-0x0000000000430000-0x0000000000437000-memory.dmp

Download

memory/3460-5-0x0000000000AD0000-0x0000000000AD7000-memory.dmp

Download

memory/3460-10-0x00007FFFCE40D000-0x00007FFFCE40E000-memory.dmp

Download

memory/3460-8-0x0000000000AD0000-0x0000000000AD7000-memory.dmp

Download