691028e80f00d979f380c5a9879a1eab2e496200bd90231f53e9012f89f44c2b

Analysis

max time kernel
149s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 05:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e5e61e08845dad8eb0fb3c6141f0d7d0_NEIKI.exe
Size

69KB
MD5

e5e61e08845dad8eb0fb3c6141f0d7d0
SHA1

402df92c6ee67b0bf0f6bbd7d87d7323587b4511
SHA256

691028e80f00d979f380c5a9879a1eab2e496200bd90231f53e9012f89f44c2b
SHA512

d949ec05d55aa263fe06e9f8151f2fc1b5770e1bd99818dcc0c1408011a1771ec26f528ccdc7fe67c94bf5a255222372ac1a32a71c49b75f2f43497d03fc0592
SSDEEP

1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8Df:Olg35GTslA5t3/w8Df

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	alsebuc-odid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	alsebuc-odid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	alsebuc-odid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	alsebuc-odid.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4748505A-5247-4643-4748-505A52474643}	alsebuc-odid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4748505A-5247-4643-4748-505A52474643}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a"	alsebuc-odid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4748505A-5247-4643-4748-505A52474643}\IsInstalled = "1"	alsebuc-odid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4748505A-5247-4643-4748-505A52474643}\StubPath = "C:\\Windows\\system32\\uxxoxav.exe"	alsebuc-odid.exe

Sets file execution options in registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe	alsebuc-odid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a"	alsebuc-odid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\eargokoap.exe"	alsebuc-odid.exe

Executes dropped EXE 2 IoCs

pid	Process
2180	alsebuc-odid.exe
2544	alsebuc-odid.exe

Loads dropped DLL 3 IoCs

pid	Process
2740	e5e61e08845dad8eb0fb3c6141f0d7d0_NEIKI.exe
2740	e5e61e08845dad8eb0fb3c6141f0d7d0_NEIKI.exe
2180	alsebuc-odid.exe

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	alsebuc-odid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	alsebuc-odid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	alsebuc-odid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	alsebuc-odid.exe

Modifies WinLogon 2 TTPs 5 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a"	alsebuc-odid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\arleacir.dll"	alsebuc-odid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup"	alsebuc-odid.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}	alsebuc-odid.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	alsebuc-odid.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\eargokoap.exe	alsebuc-odid.exe
File created	C:\Windows\SysWOW64\uxxoxav.exe	alsebuc-odid.exe
File created	C:\Windows\SysWOW64\arleacir.dll	alsebuc-odid.exe
File opened for modification	C:\Windows\SysWOW64\alsebuc-odid.exe	alsebuc-odid.exe
File created	C:\Windows\SysWOW64\alsebuc-odid.exe	e5e61e08845dad8eb0fb3c6141f0d7d0_NEIKI.exe
File opened for modification	C:\Windows\SysWOW64\eargokoap.exe	alsebuc-odid.exe
File opened for modification	C:\Windows\SysWOW64\uxxoxav.exe	alsebuc-odid.exe
File opened for modification	C:\Windows\SysWOW64\arleacir.dll	alsebuc-odid.exe
File opened for modification	C:\Windows\SysWOW64\alsebuc-odid.exe	e5e61e08845dad8eb0fb3c6141f0d7d0_NEIKI.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2180	alsebuc-odid.exe
2180	alsebuc-odid.exe
2180	alsebuc-odid.exe
2180	alsebuc-odid.exe
2544	alsebuc-odid.exe
2180	alsebuc-odid.exe
2180	alsebuc-odid.exe
2180	alsebuc-odid.exe
2180	alsebuc-odid.exe
2180	alsebuc-odid.exe
2180	alsebuc-odid.exe
2180	alsebuc-odid.exe
2180	alsebuc-odid.exe
2180	alsebuc-odid.exe
2180	alsebuc-odid.exe
2180	alsebuc-odid.exe
2180	alsebuc-odid.exe
2180	alsebuc-odid.exe
2180	alsebuc-odid.exe
2180	alsebuc-odid.exe
2180	alsebuc-odid.exe
2180	alsebuc-odid.exe
2180	alsebuc-odid.exe
2180	alsebuc-odid.exe
2180	alsebuc-odid.exe
2180	alsebuc-odid.exe
2180	alsebuc-odid.exe
2180	alsebuc-odid.exe
2180	alsebuc-odid.exe
2180	alsebuc-odid.exe
2180	alsebuc-odid.exe
2180	alsebuc-odid.exe
2180	alsebuc-odid.exe
2180	alsebuc-odid.exe
2180	alsebuc-odid.exe
2180	alsebuc-odid.exe
2180	alsebuc-odid.exe
2180	alsebuc-odid.exe
2180	alsebuc-odid.exe
2180	alsebuc-odid.exe
2180	alsebuc-odid.exe
2180	alsebuc-odid.exe
2180	alsebuc-odid.exe
2180	alsebuc-odid.exe
2180	alsebuc-odid.exe
2180	alsebuc-odid.exe
2180	alsebuc-odid.exe
2180	alsebuc-odid.exe
2180	alsebuc-odid.exe
2180	alsebuc-odid.exe
2180	alsebuc-odid.exe
2180	alsebuc-odid.exe
2180	alsebuc-odid.exe
2180	alsebuc-odid.exe
2180	alsebuc-odid.exe
2180	alsebuc-odid.exe
2180	alsebuc-odid.exe
2180	alsebuc-odid.exe
2180	alsebuc-odid.exe
2180	alsebuc-odid.exe
2180	alsebuc-odid.exe
2180	alsebuc-odid.exe
2180	alsebuc-odid.exe
2180	alsebuc-odid.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2740	e5e61e08845dad8eb0fb3c6141f0d7d0_NEIKI.exe
Token: SeDebugPrivilege	2180	alsebuc-odid.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 2180	2740	e5e61e08845dad8eb0fb3c6141f0d7d0_NEIKI.exe	28
PID 2740 wrote to memory of 2180	2740	e5e61e08845dad8eb0fb3c6141f0d7d0_NEIKI.exe	28
PID 2740 wrote to memory of 2180	2740	e5e61e08845dad8eb0fb3c6141f0d7d0_NEIKI.exe	28
PID 2740 wrote to memory of 2180	2740	e5e61e08845dad8eb0fb3c6141f0d7d0_NEIKI.exe	28
PID 2180 wrote to memory of 436	2180	alsebuc-odid.exe	5
PID 2180 wrote to memory of 1208	2180	alsebuc-odid.exe	21
PID 2180 wrote to memory of 1208	2180	alsebuc-odid.exe	21
PID 2180 wrote to memory of 2544	2180	alsebuc-odid.exe	29
PID 2180 wrote to memory of 2544	2180	alsebuc-odid.exe	29
PID 2180 wrote to memory of 2544	2180	alsebuc-odid.exe	29
PID 2180 wrote to memory of 2544	2180	alsebuc-odid.exe	29
PID 2180 wrote to memory of 1208	2180	alsebuc-odid.exe	21
PID 2180 wrote to memory of 1208	2180	alsebuc-odid.exe	21
PID 2180 wrote to memory of 1208	2180	alsebuc-odid.exe	21
PID 2180 wrote to memory of 1208	2180	alsebuc-odid.exe	21
PID 2180 wrote to memory of 1208	2180	alsebuc-odid.exe	21
PID 2180 wrote to memory of 1208	2180	alsebuc-odid.exe	21
PID 2180 wrote to memory of 1208	2180	alsebuc-odid.exe	21
PID 2180 wrote to memory of 1208	2180	alsebuc-odid.exe	21
PID 2180 wrote to memory of 1208	2180	alsebuc-odid.exe	21
PID 2180 wrote to memory of 1208	2180	alsebuc-odid.exe	21
PID 2180 wrote to memory of 1208	2180	alsebuc-odid.exe	21
PID 2180 wrote to memory of 1208	2180	alsebuc-odid.exe	21
PID 2180 wrote to memory of 1208	2180	alsebuc-odid.exe	21
PID 2180 wrote to memory of 1208	2180	alsebuc-odid.exe	21
PID 2180 wrote to memory of 1208	2180	alsebuc-odid.exe	21
PID 2180 wrote to memory of 1208	2180	alsebuc-odid.exe	21
PID 2180 wrote to memory of 1208	2180	alsebuc-odid.exe	21
PID 2180 wrote to memory of 1208	2180	alsebuc-odid.exe	21
PID 2180 wrote to memory of 1208	2180	alsebuc-odid.exe	21
PID 2180 wrote to memory of 1208	2180	alsebuc-odid.exe	21
PID 2180 wrote to memory of 1208	2180	alsebuc-odid.exe	21
PID 2180 wrote to memory of 1208	2180	alsebuc-odid.exe	21
PID 2180 wrote to memory of 1208	2180	alsebuc-odid.exe	21
PID 2180 wrote to memory of 1208	2180	alsebuc-odid.exe	21
PID 2180 wrote to memory of 1208	2180	alsebuc-odid.exe	21
PID 2180 wrote to memory of 1208	2180	alsebuc-odid.exe	21
PID 2180 wrote to memory of 1208	2180	alsebuc-odid.exe	21
PID 2180 wrote to memory of 1208	2180	alsebuc-odid.exe	21
PID 2180 wrote to memory of 1208	2180	alsebuc-odid.exe	21
PID 2180 wrote to memory of 1208	2180	alsebuc-odid.exe	21
PID 2180 wrote to memory of 1208	2180	alsebuc-odid.exe	21
PID 2180 wrote to memory of 1208	2180	alsebuc-odid.exe	21
PID 2180 wrote to memory of 1208	2180	alsebuc-odid.exe	21
PID 2180 wrote to memory of 1208	2180	alsebuc-odid.exe	21
PID 2180 wrote to memory of 1208	2180	alsebuc-odid.exe	21
PID 2180 wrote to memory of 1208	2180	alsebuc-odid.exe	21
PID 2180 wrote to memory of 1208	2180	alsebuc-odid.exe	21
PID 2180 wrote to memory of 1208	2180	alsebuc-odid.exe	21
PID 2180 wrote to memory of 1208	2180	alsebuc-odid.exe	21
PID 2180 wrote to memory of 1208	2180	alsebuc-odid.exe	21
PID 2180 wrote to memory of 1208	2180	alsebuc-odid.exe	21
PID 2180 wrote to memory of 1208	2180	alsebuc-odid.exe	21
PID 2180 wrote to memory of 1208	2180	alsebuc-odid.exe	21
PID 2180 wrote to memory of 1208	2180	alsebuc-odid.exe	21
PID 2180 wrote to memory of 1208	2180	alsebuc-odid.exe	21
PID 2180 wrote to memory of 1208	2180	alsebuc-odid.exe	21
PID 2180 wrote to memory of 1208	2180	alsebuc-odid.exe	21
PID 2180 wrote to memory of 1208	2180	alsebuc-odid.exe	21
PID 2180 wrote to memory of 1208	2180	alsebuc-odid.exe	21
PID 2180 wrote to memory of 1208	2180	alsebuc-odid.exe	21
PID 2180 wrote to memory of 1208	2180	alsebuc-odid.exe	21
PID 2180 wrote to memory of 1208	2180	alsebuc-odid.exe	21
PID 2180 wrote to memory of 1208	2180	alsebuc-odid.exe	21

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:436

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1208
- C:\Users\Admin\AppData\Local\Temp\e5e61e08845dad8eb0fb3c6141f0d7d0_NEIKI.exe
  "C:\Users\Admin\AppData\Local\Temp\e5e61e08845dad8eb0fb3c6141f0d7d0_NEIKI.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2740
- - C:\Windows\SysWOW64\alsebuc-odid.exe
    "C:\Windows\system32\alsebuc-odid.exe"
    3⤵
    - Windows security bypass
    - Modifies Installed Components in the registry
    - Sets file execution options in registry
    - Executes dropped EXE
    - Loads dropped DLL
    - Windows security modification
    - Modifies WinLogon
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2180
  - - C:\Windows\SysWOW64\alsebuc-odid.exe
      --k33p
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:2544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\arleacir.dll

Filesize
5KB

MD5
f37b21c00fd81bd93c89ce741a88f183

SHA1
b2796500597c68e2f5638e1101b46eaf32676c1c

SHA256
76cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0

SHA512
252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4

Download Submit
C:\Windows\SysWOW64\eargokoap.exe

Filesize
72KB

MD5
954294bb325f242a325a79789050c2bc

SHA1
0bdfc150acef02ec2fa523ca23f3e31087aaca14

SHA256
b52fa5d36dd1e3ae6c0d51481db06711217a1af793a2d33f6e570a9f87e8e6d4

SHA512
7ef1b2e15e86111faef59993007f1d861dad6d03433f003cf6a9a6e8509256f62ba3275e7c011909f28ea031905b9163380202cdf3e383d7a91073b473728ab9

Download Submit
C:\Windows\SysWOW64\uxxoxav.exe

Filesize
71KB

MD5
3a10da789d41f79f81c0204e9e1faf6f

SHA1
e3e07545a8c90c3d8f7cb2194d47165062415ad7

SHA256
81171875547eabbc10825c36e2c6c1caf9e879bfee41863b24d3bd592ae1eaa9

SHA512
7a1dec31545c9ed1746a400174d9533f6d5d249e55d81fe826eca96a984f38c74d35b5aea4f913018cac08aada9a97bfc4de65a15c618a8bf6559f469bb7c438

Download Submit
\Windows\SysWOW64\alsebuc-odid.exe

Filesize
69KB

MD5
e5e61e08845dad8eb0fb3c6141f0d7d0

SHA1
402df92c6ee67b0bf0f6bbd7d87d7323587b4511

SHA256
691028e80f00d979f380c5a9879a1eab2e496200bd90231f53e9012f89f44c2b

SHA512
d949ec05d55aa263fe06e9f8151f2fc1b5770e1bd99818dcc0c1408011a1771ec26f528ccdc7fe67c94bf5a255222372ac1a32a71c49b75f2f43497d03fc0592

Download Submit
memory/2180-55-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2544-56-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2740-10-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download