Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    08/05/2024, 03:10

General

  • Target

    b55a2f44e35624f36790cfd46d7b2d30_NEIKI.exe

  • Size

    9.3MB

  • MD5

    b55a2f44e35624f36790cfd46d7b2d30

  • SHA1

    55c5b5b07e7e4405fe8858e7c3559e8303dbf994

  • SHA256

    5cd45e1a0c7a66839e2e0fc46eff8594c39ab669bfc99c9fa6a9088cda81dc41

  • SHA512

    1874e689c4fe9dfdfc57389226e40a9345439e63ff8c2f8d936247416d0f745af3a787bec1c74c69b542d1627ee60b926760a6610abc6c779eb12079ae012b19

  • SSDEEP

    196608:gwdQQd8FC0WemyCvPvEr53+09KPr6TorQVFOnS08Ov7blXzz:1dZ0WrjZPlT7

Score
5/10

Malware Config

Signatures

  • Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b55a2f44e35624f36790cfd46d7b2d30_NEIKI.exe
    "C:\Users\Admin\AppData\Local\Temp\b55a2f44e35624f36790cfd46d7b2d30_NEIKI.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1636

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1636-2-0x00000000778D0000-0x00000000778D2000-memory.dmp

          Filesize

          8KB

        • memory/1636-4-0x00000000778D0000-0x00000000778D2000-memory.dmp

          Filesize

          8KB

        • memory/1636-0-0x00000000778D0000-0x00000000778D2000-memory.dmp

          Filesize

          8KB

        • memory/1636-6-0x000000014003C000-0x0000000140503000-memory.dmp

          Filesize

          4.8MB

        • memory/1636-5-0x0000000140000000-0x0000000140949000-memory.dmp

          Filesize

          9.3MB

        • memory/1636-7-0x0000000140000000-0x0000000140949000-memory.dmp

          Filesize

          9.3MB

        • memory/1636-8-0x000000014003C000-0x0000000140503000-memory.dmp

          Filesize

          4.8MB

        • memory/1636-9-0x0000000140000000-0x0000000140949000-memory.dmp

          Filesize

          9.3MB