Analysis
-
max time kernel
150s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
08-05-2024 06:11
Behavioral task
behavioral1
Sample
f1871002492bac5f786b08f4c3b53200_NEIKI.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f1871002492bac5f786b08f4c3b53200_NEIKI.exe
Resource
win10v2004-20240226-en
General
-
Target
f1871002492bac5f786b08f4c3b53200_NEIKI.exe
-
Size
130KB
-
MD5
f1871002492bac5f786b08f4c3b53200
-
SHA1
21ff21621cb3b38db8113be274de925390d36354
-
SHA256
4c7b9e3a3031e788964c0e377ebf1ce72453eddc65f3145e02c656588aa0a5c5
-
SHA512
7cc2623e01dc75c8cf72a0bb1e4d51ee81baaf2710bfc8a8889b64e8c71da0225915cc8219aa5ed4bd24d28663dab0604cb991f9014daa760834566a194a91b4
-
SSDEEP
1536:eH1ZaQvR1KiX3NK6I+hZhYrt/w5Q6G6IpiRYzz9qJHhhnm0yG5aP/5UROXTmX:SKQJcinxphkG5Q6GdpIOkJHhKRyOXK
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Flaseher.exepid process 163592 Flaseher.exe -
Loads dropped DLL 5 IoCs
Processes:
f1871002492bac5f786b08f4c3b53200_NEIKI.exepid process 194208 f1871002492bac5f786b08f4c3b53200_NEIKI.exe 194208 f1871002492bac5f786b08f4c3b53200_NEIKI.exe 194208 f1871002492bac5f786b08f4c3b53200_NEIKI.exe 194208 f1871002492bac5f786b08f4c3b53200_NEIKI.exe 194208 f1871002492bac5f786b08f4c3b53200_NEIKI.exe -
Processes:
resource yara_rule behavioral1/memory/2944-0-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/2944-77-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/194208-798797-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/2944-798800-0x0000000000400000-0x0000000000423000-memory.dmp upx \Users\Admin\AppData\Roaming\..Flash\Flaseher.exe upx behavioral1/memory/194208-798827-0x0000000003220000-0x0000000003243000-memory.dmp upx behavioral1/memory/163592-798845-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/194208-817475-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\.Flasfh = "C:\\Users\\Admin\\AppData\\Roaming\\..Flash\\Flaseher.exe" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
f1871002492bac5f786b08f4c3b53200_NEIKI.exedescription pid process target process PID 2944 set thread context of 194208 2944 f1871002492bac5f786b08f4c3b53200_NEIKI.exe f1871002492bac5f786b08f4c3b53200_NEIKI.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
f1871002492bac5f786b08f4c3b53200_NEIKI.exef1871002492bac5f786b08f4c3b53200_NEIKI.exeFlaseher.exepid process 2944 f1871002492bac5f786b08f4c3b53200_NEIKI.exe 194208 f1871002492bac5f786b08f4c3b53200_NEIKI.exe 163592 Flaseher.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
f1871002492bac5f786b08f4c3b53200_NEIKI.exef1871002492bac5f786b08f4c3b53200_NEIKI.execmd.exedescription pid process target process PID 2944 wrote to memory of 194208 2944 f1871002492bac5f786b08f4c3b53200_NEIKI.exe f1871002492bac5f786b08f4c3b53200_NEIKI.exe PID 2944 wrote to memory of 194208 2944 f1871002492bac5f786b08f4c3b53200_NEIKI.exe f1871002492bac5f786b08f4c3b53200_NEIKI.exe PID 2944 wrote to memory of 194208 2944 f1871002492bac5f786b08f4c3b53200_NEIKI.exe f1871002492bac5f786b08f4c3b53200_NEIKI.exe PID 2944 wrote to memory of 194208 2944 f1871002492bac5f786b08f4c3b53200_NEIKI.exe f1871002492bac5f786b08f4c3b53200_NEIKI.exe PID 2944 wrote to memory of 194208 2944 f1871002492bac5f786b08f4c3b53200_NEIKI.exe f1871002492bac5f786b08f4c3b53200_NEIKI.exe PID 2944 wrote to memory of 194208 2944 f1871002492bac5f786b08f4c3b53200_NEIKI.exe f1871002492bac5f786b08f4c3b53200_NEIKI.exe PID 2944 wrote to memory of 194208 2944 f1871002492bac5f786b08f4c3b53200_NEIKI.exe f1871002492bac5f786b08f4c3b53200_NEIKI.exe PID 2944 wrote to memory of 194208 2944 f1871002492bac5f786b08f4c3b53200_NEIKI.exe f1871002492bac5f786b08f4c3b53200_NEIKI.exe PID 194208 wrote to memory of 71020 194208 f1871002492bac5f786b08f4c3b53200_NEIKI.exe cmd.exe PID 194208 wrote to memory of 71020 194208 f1871002492bac5f786b08f4c3b53200_NEIKI.exe cmd.exe PID 194208 wrote to memory of 71020 194208 f1871002492bac5f786b08f4c3b53200_NEIKI.exe cmd.exe PID 194208 wrote to memory of 71020 194208 f1871002492bac5f786b08f4c3b53200_NEIKI.exe cmd.exe PID 71020 wrote to memory of 160324 71020 cmd.exe reg.exe PID 71020 wrote to memory of 160324 71020 cmd.exe reg.exe PID 71020 wrote to memory of 160324 71020 cmd.exe reg.exe PID 71020 wrote to memory of 160324 71020 cmd.exe reg.exe PID 194208 wrote to memory of 163592 194208 f1871002492bac5f786b08f4c3b53200_NEIKI.exe Flaseher.exe PID 194208 wrote to memory of 163592 194208 f1871002492bac5f786b08f4c3b53200_NEIKI.exe Flaseher.exe PID 194208 wrote to memory of 163592 194208 f1871002492bac5f786b08f4c3b53200_NEIKI.exe Flaseher.exe PID 194208 wrote to memory of 163592 194208 f1871002492bac5f786b08f4c3b53200_NEIKI.exe Flaseher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f1871002492bac5f786b08f4c3b53200_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\f1871002492bac5f786b08f4c3b53200_NEIKI.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\f1871002492bac5f786b08f4c3b53200_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\f1871002492bac5f786b08f4c3b53200_NEIKI.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:194208 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\OKLWT.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:71020 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v ".Flasfh" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe" /f4⤵
- Adds Run key to start application
PID:160324 -
C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:163592
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
145B
MD5da0cbe87b720a79b294147ed6a4b98be
SHA1ebf0dc9efd7a12cb192e355cda87546acb4ab360
SHA2567ccfeff356fdccc9145bd1e263aa1c56360ca7b6552ed5a5665c596d02a627ed
SHA512f55c4a3d24d2f11db5eda3c816d1cd3b8804a171a7bf715b13d60788247fbb352eafaa5bd4e0a8086c1013396be0a48c7bdb904ab0f974fa0c75e81e3d365acc
-
Filesize
130KB
MD54d6296d6f55b2537fb67ac3022ce1832
SHA13b5ada6cae1e8ccb3fa69b9c40a782352fef40c7
SHA25629cee1aca37a86b2c130c9234c2cbe7c468144aa5a3980abc5c965f606fc25f6
SHA512a77a71dada88bb986ad3dae3cde74859926e065776facbab9dc4533d3549086348f9d29f03faf5b30fd86b2534481df601d473733d33b87c8a1f42b08402c642