Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
08-05-2024 04:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d02d096dafa32173718ba528e332eb50_NEIKI.dll
Resource
win7-20240221-en
windows7-x64
15 signatures
150 seconds
General
-
Target
d02d096dafa32173718ba528e332eb50_NEIKI.dll
-
Size
120KB
-
MD5
d02d096dafa32173718ba528e332eb50
-
SHA1
f777de1f04ad7e66f442b94cdb4fcb09ff824c72
-
SHA256
eb3e1d1a48fb893c608f66967901ad3a81dc1202b9a2a8867781c6a8b73c912d
-
SHA512
06b7aa40efd984a30cd07e5f02fa31b4fb7517c33c1caa097e9418f9e78a44fd0e0c4b702114125ad4c55e20471e404b7810ca969f6ad80eeefcbe5a5b6e9c9a
-
SSDEEP
1536:238sQrZ6slzXUEtD4FDOVbD2icfpQr6g/ZcB0qmTrsJk0m2JXD2xmYXL9M87Q6aQ:q86isFDwOYcBsTrs3XgmWK6a/S
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f763006.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f763006.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76140d.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76140d.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76140d.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f763006.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76140d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f763006.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f763006.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76140d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76140d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76140d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f763006.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f763006.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f763006.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76140d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76140d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76140d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f763006.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f763006.exe -
Executes dropped EXE 3 IoCs
pid Process 2724 f76140d.exe 2368 f7615b2.exe 2040 f763006.exe -
Loads dropped DLL 6 IoCs
pid Process 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe -
resource yara_rule behavioral1/memory/2724-12-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2724-18-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2724-15-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2724-19-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2724-17-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2724-21-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2724-22-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2724-20-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2724-16-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2724-14-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2724-63-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2724-64-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2724-65-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2724-66-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2724-67-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2724-69-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2724-70-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2724-84-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2724-86-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2724-87-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2724-90-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2724-121-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2724-151-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2040-168-0x0000000000910000-0x00000000019CA000-memory.dmp upx behavioral1/memory/2040-205-0x0000000000910000-0x00000000019CA000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f763006.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f763006.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76140d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76140d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76140d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76140d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f763006.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f763006.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76140d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76140d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76140d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f763006.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f763006.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f763006.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76140d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f763006.exe -
Enumerates connected drives 3 TTPs 17 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: f76140d.exe File opened (read-only) \??\H: f76140d.exe File opened (read-only) \??\I: f76140d.exe File opened (read-only) \??\L: f76140d.exe File opened (read-only) \??\E: f763006.exe File opened (read-only) \??\G: f763006.exe File opened (read-only) \??\E: f76140d.exe File opened (read-only) \??\G: f76140d.exe File opened (read-only) \??\K: f76140d.exe File opened (read-only) \??\P: f76140d.exe File opened (read-only) \??\R: f76140d.exe File opened (read-only) \??\S: f76140d.exe File opened (read-only) \??\T: f76140d.exe File opened (read-only) \??\J: f76140d.exe File opened (read-only) \??\M: f76140d.exe File opened (read-only) \??\N: f76140d.exe File opened (read-only) \??\Q: f76140d.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\f76148a f76140d.exe File opened for modification C:\Windows\SYSTEM.INI f76140d.exe File created C:\Windows\f7664cb f763006.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2724 f76140d.exe 2724 f76140d.exe 2040 f763006.exe -
Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeDebugPrivilege 2724 f76140d.exe Token: SeDebugPrivilege 2724 f76140d.exe Token: SeDebugPrivilege 2724 f76140d.exe Token: SeDebugPrivilege 2724 f76140d.exe Token: SeDebugPrivilege 2724 f76140d.exe Token: SeDebugPrivilege 2724 f76140d.exe Token: SeDebugPrivilege 2724 f76140d.exe Token: SeDebugPrivilege 2724 f76140d.exe Token: SeDebugPrivilege 2724 f76140d.exe Token: SeDebugPrivilege 2724 f76140d.exe Token: SeDebugPrivilege 2724 f76140d.exe Token: SeDebugPrivilege 2724 f76140d.exe Token: SeDebugPrivilege 2724 f76140d.exe Token: SeDebugPrivilege 2724 f76140d.exe Token: SeDebugPrivilege 2724 f76140d.exe Token: SeDebugPrivilege 2724 f76140d.exe Token: SeDebugPrivilege 2724 f76140d.exe Token: SeDebugPrivilege 2724 f76140d.exe Token: SeDebugPrivilege 2724 f76140d.exe Token: SeDebugPrivilege 2724 f76140d.exe Token: SeDebugPrivilege 2724 f76140d.exe Token: SeDebugPrivilege 2040 f763006.exe Token: SeDebugPrivilege 2040 f763006.exe Token: SeDebugPrivilege 2040 f763006.exe Token: SeDebugPrivilege 2040 f763006.exe Token: SeDebugPrivilege 2040 f763006.exe Token: SeDebugPrivilege 2040 f763006.exe Token: SeDebugPrivilege 2040 f763006.exe Token: SeDebugPrivilege 2040 f763006.exe Token: SeDebugPrivilege 2040 f763006.exe Token: SeDebugPrivilege 2040 f763006.exe Token: SeDebugPrivilege 2040 f763006.exe Token: SeDebugPrivilege 2040 f763006.exe Token: SeDebugPrivilege 2040 f763006.exe Token: SeDebugPrivilege 2040 f763006.exe Token: SeDebugPrivilege 2040 f763006.exe Token: SeDebugPrivilege 2040 f763006.exe Token: SeDebugPrivilege 2040 f763006.exe Token: SeDebugPrivilege 2040 f763006.exe Token: SeDebugPrivilege 2040 f763006.exe Token: SeDebugPrivilege 2040 f763006.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 1984 wrote to memory of 2256 1984 rundll32.exe 28 PID 1984 wrote to memory of 2256 1984 rundll32.exe 28 PID 1984 wrote to memory of 2256 1984 rundll32.exe 28 PID 1984 wrote to memory of 2256 1984 rundll32.exe 28 PID 1984 wrote to memory of 2256 1984 rundll32.exe 28 PID 1984 wrote to memory of 2256 1984 rundll32.exe 28 PID 1984 wrote to memory of 2256 1984 rundll32.exe 28 PID 2256 wrote to memory of 2724 2256 rundll32.exe 29 PID 2256 wrote to memory of 2724 2256 rundll32.exe 29 PID 2256 wrote to memory of 2724 2256 rundll32.exe 29 PID 2256 wrote to memory of 2724 2256 rundll32.exe 29 PID 2724 wrote to memory of 1048 2724 f76140d.exe 17 PID 2724 wrote to memory of 1060 2724 f76140d.exe 18 PID 2724 wrote to memory of 1144 2724 f76140d.exe 20 PID 2724 wrote to memory of 2136 2724 f76140d.exe 23 PID 2724 wrote to memory of 1984 2724 f76140d.exe 27 PID 2724 wrote to memory of 2256 2724 f76140d.exe 28 PID 2724 wrote to memory of 2256 2724 f76140d.exe 28 PID 2256 wrote to memory of 2368 2256 rundll32.exe 30 PID 2256 wrote to memory of 2368 2256 rundll32.exe 30 PID 2256 wrote to memory of 2368 2256 rundll32.exe 30 PID 2256 wrote to memory of 2368 2256 rundll32.exe 30 PID 2256 wrote to memory of 2040 2256 rundll32.exe 31 PID 2256 wrote to memory of 2040 2256 rundll32.exe 31 PID 2256 wrote to memory of 2040 2256 rundll32.exe 31 PID 2256 wrote to memory of 2040 2256 rundll32.exe 31 PID 2724 wrote to memory of 1048 2724 f76140d.exe 17 PID 2724 wrote to memory of 1060 2724 f76140d.exe 18 PID 2724 wrote to memory of 1144 2724 f76140d.exe 20 PID 2724 wrote to memory of 2368 2724 f76140d.exe 30 PID 2724 wrote to memory of 2368 2724 f76140d.exe 30 PID 2724 wrote to memory of 2040 2724 f76140d.exe 31 PID 2724 wrote to memory of 2040 2724 f76140d.exe 31 PID 2040 wrote to memory of 1048 2040 f763006.exe 17 PID 2040 wrote to memory of 1060 2040 f763006.exe 18 PID 2040 wrote to memory of 1144 2040 f763006.exe 20 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76140d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f763006.exe
Processes
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1048
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1060
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1144
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d02d096dafa32173718ba528e332eb50_NEIKI.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d02d096dafa32173718ba528e332eb50_NEIKI.dll,#13⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\f76140d.exeC:\Users\Admin\AppData\Local\Temp\f76140d.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2724
-
-
C:\Users\Admin\AppData\Local\Temp\f7615b2.exeC:\Users\Admin\AppData\Local\Temp\f7615b2.exe4⤵
- Executes dropped EXE
PID:2368
-
-
C:\Users\Admin\AppData\Local\Temp\f763006.exeC:\Users\Admin\AppData\Local\Temp\f763006.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2040
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:2136
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
257B
MD59bdae825ea045c8805d85f7b6152936c
SHA137a608f878e7b538183181662a9c972cfc3763fb
SHA2565dfd518dc7faa9865ccc1fda24ed4e4315eb34e3fa21b84c20593ce8a137b931
SHA512bfe4b544dd66331c47937edf6b1eec52e604da8a0422fc5a2d7d0e120d430501f33b446a7be8f9049137ee27be6a420e2c3a4eb1f867a7238b8ad716ce3930a4
-
Filesize
97KB
MD5cbde42ce59b4ba88a3bb3293047c2300
SHA106ef3a7c5771f248f11f9cb256e038ebc4283cde
SHA25628ad43f13fedc152dd66161294a7e08b1e2a55b62b248ce3b457f04fa4d82e9d
SHA51273ad2b363e056dbae2c451d425789c96e47b16549504a0a534b8aff8de8e763c19cabd05014c57f8afdb3abc23fe58b302f630d1b3e549ae26f082841a2f3fe7