f71ef496b1c10bce0af8e0563f54193116ef3685d32d0b57f61ad545d7bd81b7

Analysis

max time kernel
149s
max time network
120s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 05:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e2297772f1235bae3963d106e06c2ae0_NEIKI.exe
Size

8KB
MD5

e2297772f1235bae3963d106e06c2ae0
SHA1

df2eb49c07be0dc41bd75030bd1fd1461aac1f08
SHA256

f71ef496b1c10bce0af8e0563f54193116ef3685d32d0b57f61ad545d7bd81b7
SHA512

ea0324310515cd3f6d7ff4def2ff36ad4df7510917e23e04681f3637e08dc1247cd4cc570e50901cfc8b7a46c7a83af3bcd32ec67f7825caeebec0404bf146dc
SSDEEP

96:ZXv4mUWKh9ctgC1RSO5nKymV44vYArXKbAhD62XKQ8nP8MAO2wyU2wX12LOfBvO1:qmUWKs/F5nKfzvzrXkC6DEUyU2wX/4

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2412	pjehc.exe

Loads dropped DLL 2 IoCs

pid	Process
2944	e2297772f1235bae3963d106e06c2ae0_NEIKI.exe
2944	e2297772f1235bae3963d106e06c2ae0_NEIKI.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 2412	2944	e2297772f1235bae3963d106e06c2ae0_NEIKI.exe	28
PID 2944 wrote to memory of 2412	2944	e2297772f1235bae3963d106e06c2ae0_NEIKI.exe	28
PID 2944 wrote to memory of 2412	2944	e2297772f1235bae3963d106e06c2ae0_NEIKI.exe	28
PID 2944 wrote to memory of 2412	2944	e2297772f1235bae3963d106e06c2ae0_NEIKI.exe	28

C:\Users\Admin\AppData\Local\Temp\e2297772f1235bae3963d106e06c2ae0_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\e2297772f1235bae3963d106e06c2ae0_NEIKI.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Users\Admin\AppData\Local\Temp\pjehc.exe
  "C:\Users\Admin\AppData\Local\Temp\pjehc.exe"
  2⤵
  - Executes dropped EXE
  PID:2412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\pjehc.exe

Filesize
8KB

MD5
ec85a43bd5ece4543b8c102ea6d5c769

SHA1
6ed889249445cd9c581d5b698528437e60f97dca

SHA256
a5f0f613c2cf6f9843b45d70958d426ce990a383782a7cccf718724b0daefe2f

SHA512
fec5f5ed93dbd3d90d48b709c2a712e071273e299137750185c958a02d2cd13405f941974c0175aeece28e3a6cb44db8b102996eb7caa82192b13764748b025d

Download Submit