Analysis

  • max time kernel
    149s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-05-2024 06:17

General

  • Target

    f39cdd0a44629f41e757d113a9c12a80_NEIKI.exe

  • Size

    70KB

  • MD5

    f39cdd0a44629f41e757d113a9c12a80

  • SHA1

    995a8a36055cda4cddc371ce7f45cb28db2db92c

  • SHA256

    432e813152f849e923b8d914f09459fc40129f59b5a7d4406f1a230a2b307eff

  • SHA512

    e8f1ce8c9d3bd1cd509bac4e2637cd392c974ad4e766152db2a6ee4e72c65a09cfc3a75100f3ea22cde1b319e21b4b8a5c7345ecb5c9b5ca9fd20676b6f6e0d6

  • SSDEEP

    1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8slf:Olg35GTslA5t3/w82

Malware Config

Signatures

  • Windows security bypass 2 TTPs 4 IoCs
  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
  • Sets file execution options in registry 2 TTPs 3 IoCs
  • Executes dropped EXE 2 IoCs
  • Windows security modification 2 TTPs 4 IoCs
  • Modifies WinLogon 2 TTPs 5 IoCs
  • Drops file in System32 directory 9 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:624
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      1⤵
        PID:3432
        • C:\Users\Admin\AppData\Local\Temp\f39cdd0a44629f41e757d113a9c12a80_NEIKI.exe
          "C:\Users\Admin\AppData\Local\Temp\f39cdd0a44629f41e757d113a9c12a80_NEIKI.exe"
          2⤵
          • Drops file in System32 directory
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3708
          • C:\Windows\SysWOW64\bkicim.exe
            "C:\Windows\system32\bkicim.exe"
            3⤵
            • Windows security bypass
            • Modifies Installed Components in the registry
            • Sets file execution options in registry
            • Executes dropped EXE
            • Windows security modification
            • Modifies WinLogon
            • Drops file in System32 directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2728
            • C:\Windows\SysWOW64\bkicim.exe
              --k33p
              4⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              PID:2388

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Windows\SysWOW64\bkicim.exe

        Filesize

        70KB

        MD5

        f39cdd0a44629f41e757d113a9c12a80

        SHA1

        995a8a36055cda4cddc371ce7f45cb28db2db92c

        SHA256

        432e813152f849e923b8d914f09459fc40129f59b5a7d4406f1a230a2b307eff

        SHA512

        e8f1ce8c9d3bd1cd509bac4e2637cd392c974ad4e766152db2a6ee4e72c65a09cfc3a75100f3ea22cde1b319e21b4b8a5c7345ecb5c9b5ca9fd20676b6f6e0d6

      • C:\Windows\SysWOW64\eggicek-eacooc.dll

        Filesize

        5KB

        MD5

        f37b21c00fd81bd93c89ce741a88f183

        SHA1

        b2796500597c68e2f5638e1101b46eaf32676c1c

        SHA256

        76cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0

        SHA512

        252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4

      • C:\Windows\SysWOW64\pmoaxeah-med.exe

        Filesize

        73KB

        MD5

        e1b87eabe5a902d31822f570f03dc2c7

        SHA1

        636c1be74efac479a9d1c6782b46f2784ed7d8fd

        SHA256

        47412b6caca1a5339dc432181aa57b51d283cdf17633dda071246da695d07bfc

        SHA512

        d5e54582b2c95ebcd038d33db46b1838719c5661071c3de254c6a747283bd55bbd64b391f6d251934b0d521b23fbb0b9e982af447f29b973b086ebdf4294c363

      • C:\Windows\SysWOW64\sboceam.exe

        Filesize

        74KB

        MD5

        139ea8b57f59d9fd08a569c555d54f51

        SHA1

        4c298f37547dc4be2d2e5833698290577906a72a

        SHA256

        f519bc1b30f31698824f883a0e34e924308383c62f2897a784881c4bedc47cd0

        SHA512

        991915b025c6b557b36a1ec5ef1790ac2e15e28299510aaa4d2f866847c8c3e9151bc4b8659b8e74e2a16d0955dc2dce41acea96db73632a21896edb53aa8eea

      • memory/2388-50-0x0000000000400000-0x0000000000414000-memory.dmp

        Filesize

        80KB

      • memory/2728-49-0x0000000000400000-0x0000000000414000-memory.dmp

        Filesize

        80KB

      • memory/3708-4-0x0000000000400000-0x0000000000414000-memory.dmp

        Filesize

        80KB