07a1eb71ebbbdc0e8752a738c83ac5b9c4fa5a4ad060c8ebbe9ea0851e963811

Analysis

max time kernel
149s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 04:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cecb4324a7e7b2fa5f4cfc07f952b540_NEIKI.exe
Size

70KB
MD5

cecb4324a7e7b2fa5f4cfc07f952b540
SHA1

692e4b175dbee4d47e88c0f58b9db93a6ab2cec6
SHA256

07a1eb71ebbbdc0e8752a738c83ac5b9c4fa5a4ad060c8ebbe9ea0851e963811
SHA512

4aa5816ec6fc0e290b4bfd6a9c6d10f518659a822b47715dc4b03030b942812cae99d8b04d32a34fa4d3a003deb3130bb8bae4465ba0e19efac5cec90cf266d1
SSDEEP

1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8O:Olg35GTslA5t3/w8O

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	atkonoop-edeas.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	atkonoop-edeas.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	atkonoop-edeas.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	atkonoop-edeas.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4748505A-5247-4643-4748-505A52474643}\StubPath = "C:\\Windows\\system32\\evluteab-aseab.exe"	atkonoop-edeas.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4748505A-5247-4643-4748-505A52474643}	atkonoop-edeas.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4748505A-5247-4643-4748-505A52474643}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a"	atkonoop-edeas.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4748505A-5247-4643-4748-505A52474643}\IsInstalled = "1"	atkonoop-edeas.exe

Sets file execution options in registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe	atkonoop-edeas.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a"	atkonoop-edeas.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\ecseanur-outum.exe"	atkonoop-edeas.exe

Executes dropped EXE 2 IoCs

pid	Process
400	atkonoop-edeas.exe
2604	atkonoop-edeas.exe

Loads dropped DLL 3 IoCs

pid	Process
2072	cecb4324a7e7b2fa5f4cfc07f952b540_NEIKI.exe
2072	cecb4324a7e7b2fa5f4cfc07f952b540_NEIKI.exe
400	atkonoop-edeas.exe

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	atkonoop-edeas.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	atkonoop-edeas.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	atkonoop-edeas.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	atkonoop-edeas.exe

Modifies WinLogon 2 TTPs 5 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	atkonoop-edeas.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a"	atkonoop-edeas.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\optamax-imex.dll"	atkonoop-edeas.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup"	atkonoop-edeas.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}	atkonoop-edeas.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\evluteab-aseab.exe	atkonoop-edeas.exe
File created	C:\Windows\SysWOW64\evluteab-aseab.exe	atkonoop-edeas.exe
File opened for modification	C:\Windows\SysWOW64\atkonoop-edeas.exe	atkonoop-edeas.exe
File opened for modification	C:\Windows\SysWOW64\atkonoop-edeas.exe	cecb4324a7e7b2fa5f4cfc07f952b540_NEIKI.exe
File created	C:\Windows\SysWOW64\atkonoop-edeas.exe	cecb4324a7e7b2fa5f4cfc07f952b540_NEIKI.exe
File opened for modification	C:\Windows\SysWOW64\ecseanur-outum.exe	atkonoop-edeas.exe
File created	C:\Windows\SysWOW64\ecseanur-outum.exe	atkonoop-edeas.exe
File opened for modification	C:\Windows\SysWOW64\optamax-imex.dll	atkonoop-edeas.exe
File created	C:\Windows\SysWOW64\optamax-imex.dll	atkonoop-edeas.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
400	atkonoop-edeas.exe
400	atkonoop-edeas.exe
400	atkonoop-edeas.exe
400	atkonoop-edeas.exe
2604	atkonoop-edeas.exe
400	atkonoop-edeas.exe
400	atkonoop-edeas.exe
400	atkonoop-edeas.exe
400	atkonoop-edeas.exe
400	atkonoop-edeas.exe
400	atkonoop-edeas.exe
400	atkonoop-edeas.exe
400	atkonoop-edeas.exe
400	atkonoop-edeas.exe
400	atkonoop-edeas.exe
400	atkonoop-edeas.exe
400	atkonoop-edeas.exe
400	atkonoop-edeas.exe
400	atkonoop-edeas.exe
400	atkonoop-edeas.exe
400	atkonoop-edeas.exe
400	atkonoop-edeas.exe
400	atkonoop-edeas.exe
400	atkonoop-edeas.exe
400	atkonoop-edeas.exe
400	atkonoop-edeas.exe
400	atkonoop-edeas.exe
400	atkonoop-edeas.exe
400	atkonoop-edeas.exe
400	atkonoop-edeas.exe
400	atkonoop-edeas.exe
400	atkonoop-edeas.exe
400	atkonoop-edeas.exe
400	atkonoop-edeas.exe
400	atkonoop-edeas.exe
400	atkonoop-edeas.exe
400	atkonoop-edeas.exe
400	atkonoop-edeas.exe
400	atkonoop-edeas.exe
400	atkonoop-edeas.exe
400	atkonoop-edeas.exe
400	atkonoop-edeas.exe
400	atkonoop-edeas.exe
400	atkonoop-edeas.exe
400	atkonoop-edeas.exe
400	atkonoop-edeas.exe
400	atkonoop-edeas.exe
400	atkonoop-edeas.exe
400	atkonoop-edeas.exe
400	atkonoop-edeas.exe
400	atkonoop-edeas.exe
400	atkonoop-edeas.exe
400	atkonoop-edeas.exe
400	atkonoop-edeas.exe
400	atkonoop-edeas.exe
400	atkonoop-edeas.exe
400	atkonoop-edeas.exe
400	atkonoop-edeas.exe
400	atkonoop-edeas.exe
400	atkonoop-edeas.exe
400	atkonoop-edeas.exe
400	atkonoop-edeas.exe
400	atkonoop-edeas.exe
400	atkonoop-edeas.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2072	cecb4324a7e7b2fa5f4cfc07f952b540_NEIKI.exe
Token: SeDebugPrivilege	400	atkonoop-edeas.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 400	2072	cecb4324a7e7b2fa5f4cfc07f952b540_NEIKI.exe	28
PID 2072 wrote to memory of 400	2072	cecb4324a7e7b2fa5f4cfc07f952b540_NEIKI.exe	28
PID 2072 wrote to memory of 400	2072	cecb4324a7e7b2fa5f4cfc07f952b540_NEIKI.exe	28
PID 2072 wrote to memory of 400	2072	cecb4324a7e7b2fa5f4cfc07f952b540_NEIKI.exe	28
PID 400 wrote to memory of 432	400	atkonoop-edeas.exe	5
PID 400 wrote to memory of 1144	400	atkonoop-edeas.exe	20
PID 400 wrote to memory of 1144	400	atkonoop-edeas.exe	20
PID 400 wrote to memory of 2604	400	atkonoop-edeas.exe	29
PID 400 wrote to memory of 2604	400	atkonoop-edeas.exe	29
PID 400 wrote to memory of 2604	400	atkonoop-edeas.exe	29
PID 400 wrote to memory of 2604	400	atkonoop-edeas.exe	29
PID 400 wrote to memory of 1144	400	atkonoop-edeas.exe	20
PID 400 wrote to memory of 1144	400	atkonoop-edeas.exe	20
PID 400 wrote to memory of 1144	400	atkonoop-edeas.exe	20
PID 400 wrote to memory of 1144	400	atkonoop-edeas.exe	20
PID 400 wrote to memory of 1144	400	atkonoop-edeas.exe	20
PID 400 wrote to memory of 1144	400	atkonoop-edeas.exe	20
PID 400 wrote to memory of 1144	400	atkonoop-edeas.exe	20
PID 400 wrote to memory of 1144	400	atkonoop-edeas.exe	20
PID 400 wrote to memory of 1144	400	atkonoop-edeas.exe	20
PID 400 wrote to memory of 1144	400	atkonoop-edeas.exe	20
PID 400 wrote to memory of 1144	400	atkonoop-edeas.exe	20
PID 400 wrote to memory of 1144	400	atkonoop-edeas.exe	20
PID 400 wrote to memory of 1144	400	atkonoop-edeas.exe	20
PID 400 wrote to memory of 1144	400	atkonoop-edeas.exe	20
PID 400 wrote to memory of 1144	400	atkonoop-edeas.exe	20
PID 400 wrote to memory of 1144	400	atkonoop-edeas.exe	20
PID 400 wrote to memory of 1144	400	atkonoop-edeas.exe	20
PID 400 wrote to memory of 1144	400	atkonoop-edeas.exe	20
PID 400 wrote to memory of 1144	400	atkonoop-edeas.exe	20
PID 400 wrote to memory of 1144	400	atkonoop-edeas.exe	20
PID 400 wrote to memory of 1144	400	atkonoop-edeas.exe	20
PID 400 wrote to memory of 1144	400	atkonoop-edeas.exe	20
PID 400 wrote to memory of 1144	400	atkonoop-edeas.exe	20
PID 400 wrote to memory of 1144	400	atkonoop-edeas.exe	20
PID 400 wrote to memory of 1144	400	atkonoop-edeas.exe	20
PID 400 wrote to memory of 1144	400	atkonoop-edeas.exe	20
PID 400 wrote to memory of 1144	400	atkonoop-edeas.exe	20
PID 400 wrote to memory of 1144	400	atkonoop-edeas.exe	20
PID 400 wrote to memory of 1144	400	atkonoop-edeas.exe	20
PID 400 wrote to memory of 1144	400	atkonoop-edeas.exe	20
PID 400 wrote to memory of 1144	400	atkonoop-edeas.exe	20
PID 400 wrote to memory of 1144	400	atkonoop-edeas.exe	20
PID 400 wrote to memory of 1144	400	atkonoop-edeas.exe	20
PID 400 wrote to memory of 1144	400	atkonoop-edeas.exe	20
PID 400 wrote to memory of 1144	400	atkonoop-edeas.exe	20
PID 400 wrote to memory of 1144	400	atkonoop-edeas.exe	20
PID 400 wrote to memory of 1144	400	atkonoop-edeas.exe	20
PID 400 wrote to memory of 1144	400	atkonoop-edeas.exe	20
PID 400 wrote to memory of 1144	400	atkonoop-edeas.exe	20
PID 400 wrote to memory of 1144	400	atkonoop-edeas.exe	20
PID 400 wrote to memory of 1144	400	atkonoop-edeas.exe	20
PID 400 wrote to memory of 1144	400	atkonoop-edeas.exe	20
PID 400 wrote to memory of 1144	400	atkonoop-edeas.exe	20
PID 400 wrote to memory of 1144	400	atkonoop-edeas.exe	20
PID 400 wrote to memory of 1144	400	atkonoop-edeas.exe	20
PID 400 wrote to memory of 1144	400	atkonoop-edeas.exe	20
PID 400 wrote to memory of 1144	400	atkonoop-edeas.exe	20
PID 400 wrote to memory of 1144	400	atkonoop-edeas.exe	20
PID 400 wrote to memory of 1144	400	atkonoop-edeas.exe	20
PID 400 wrote to memory of 1144	400	atkonoop-edeas.exe	20
PID 400 wrote to memory of 1144	400	atkonoop-edeas.exe	20
PID 400 wrote to memory of 1144	400	atkonoop-edeas.exe	20
PID 400 wrote to memory of 1144	400	atkonoop-edeas.exe	20

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:432

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1144
- C:\Users\Admin\AppData\Local\Temp\cecb4324a7e7b2fa5f4cfc07f952b540_NEIKI.exe
  "C:\Users\Admin\AppData\Local\Temp\cecb4324a7e7b2fa5f4cfc07f952b540_NEIKI.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2072
- - C:\Windows\SysWOW64\atkonoop-edeas.exe
    "C:\Windows\system32\atkonoop-edeas.exe"
    3⤵
    - Windows security bypass
    - Modifies Installed Components in the registry
    - Sets file execution options in registry
    - Executes dropped EXE
    - Loads dropped DLL
    - Windows security modification
    - Modifies WinLogon
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:400
  - - C:\Windows\SysWOW64\atkonoop-edeas.exe
      --k33p
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\ecseanur-outum.exe

Filesize
73KB

MD5
7f36b3b653563721d178d9870212857b

SHA1
c9ba4cf115fbd52ebfb5646263d11720739ec3c4

SHA256
7702184130fdfd8798e5caa5d780600b3a8f1bdda7ada196b5d774fcc40c7a1b

SHA512
f6749e986c41a8df848735aa1006ac17efa996de9fcc20133260c1d37aaa69100c528a6d9d665354843beba8acf6f6867f9d110a168bf5a5927e46a79afa7a0d

Download Submit
C:\Windows\SysWOW64\evluteab-aseab.exe

Filesize
72KB

MD5
1e4a4f842dbd61ef0e74696bccf026a4

SHA1
0a6a6f6c42a63f2edc77c3790fc146f1aeaf4d14

SHA256
32468422a952f48a4f78fb40234206bde37a114f670ffebbe14bcb4854c0f655

SHA512
5e8177f6895d0dba64471c47091c7411573809a702b217f594040c0d48f2ab35d148d57a00b4efb7128852cc8a034fa5cd4897a4626734f6032e2950f99c7870

Download Submit
C:\Windows\SysWOW64\optamax-imex.dll

Filesize
5KB

MD5
f37b21c00fd81bd93c89ce741a88f183

SHA1
b2796500597c68e2f5638e1101b46eaf32676c1c

SHA256
76cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0

SHA512
252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4

Download Submit
\Windows\SysWOW64\atkonoop-edeas.exe

Filesize
70KB

MD5
cecb4324a7e7b2fa5f4cfc07f952b540

SHA1
692e4b175dbee4d47e88c0f58b9db93a6ab2cec6

SHA256
07a1eb71ebbbdc0e8752a738c83ac5b9c4fa5a4ad060c8ebbe9ea0851e963811

SHA512
4aa5816ec6fc0e290b4bfd6a9c6d10f518659a822b47715dc4b03030b942812cae99d8b04d32a34fa4d3a003deb3130bb8bae4465ba0e19efac5cec90cf266d1

Download Submit
memory/400-55-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2072-9-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2604-56-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download