Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
08-05-2024 06:11
Behavioral task
behavioral1
Sample
f1871002492bac5f786b08f4c3b53200_NEIKI.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f1871002492bac5f786b08f4c3b53200_NEIKI.exe
Resource
win10v2004-20240226-en
General
-
Target
f1871002492bac5f786b08f4c3b53200_NEIKI.exe
-
Size
130KB
-
MD5
f1871002492bac5f786b08f4c3b53200
-
SHA1
21ff21621cb3b38db8113be274de925390d36354
-
SHA256
4c7b9e3a3031e788964c0e377ebf1ce72453eddc65f3145e02c656588aa0a5c5
-
SHA512
7cc2623e01dc75c8cf72a0bb1e4d51ee81baaf2710bfc8a8889b64e8c71da0225915cc8219aa5ed4bd24d28663dab0604cb991f9014daa760834566a194a91b4
-
SSDEEP
1536:eH1ZaQvR1KiX3NK6I+hZhYrt/w5Q6G6IpiRYzz9qJHhhnm0yG5aP/5UROXTmX:SKQJcinxphkG5Q6GdpIOkJHhKRyOXK
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 6 IoCs
Processes:
resource yara_rule behavioral2/memory/2016-51-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/2016-48-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/2016-56-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/2016-58-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/2016-59-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/2016-63-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
f1871002492bac5f786b08f4c3b53200_NEIKI.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation f1871002492bac5f786b08f4c3b53200_NEIKI.exe -
Executes dropped EXE 3 IoCs
Processes:
Flaseher.exeFlaseher.exeFlaseher.exepid process 5004 Flaseher.exe 1132 Flaseher.exe 2016 Flaseher.exe -
Processes:
resource yara_rule behavioral2/memory/3304-0-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/3304-6-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/4340-9-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4340-11-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4340-12-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3304-15-0x0000000000400000-0x0000000000423000-memory.dmp upx C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe upx behavioral2/memory/5004-37-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/4340-40-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/5004-41-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/5004-42-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/5004-46-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/5004-55-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/4340-60-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/1132-62-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\.Flasfh = "C:\\Users\\Admin\\AppData\\Roaming\\..Flash\\Flaseher.exe" reg.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
f1871002492bac5f786b08f4c3b53200_NEIKI.exeFlaseher.exedescription pid process target process PID 3304 set thread context of 4340 3304 f1871002492bac5f786b08f4c3b53200_NEIKI.exe f1871002492bac5f786b08f4c3b53200_NEIKI.exe PID 5004 set thread context of 1132 5004 Flaseher.exe Flaseher.exe PID 5004 set thread context of 2016 5004 Flaseher.exe Flaseher.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
Flaseher.exedescription pid process Token: SeDebugPrivilege 1132 Flaseher.exe Token: SeDebugPrivilege 1132 Flaseher.exe Token: SeDebugPrivilege 1132 Flaseher.exe Token: SeDebugPrivilege 1132 Flaseher.exe Token: SeDebugPrivilege 1132 Flaseher.exe Token: SeDebugPrivilege 1132 Flaseher.exe Token: SeDebugPrivilege 1132 Flaseher.exe Token: SeDebugPrivilege 1132 Flaseher.exe Token: SeDebugPrivilege 1132 Flaseher.exe Token: SeDebugPrivilege 1132 Flaseher.exe Token: SeDebugPrivilege 1132 Flaseher.exe Token: SeDebugPrivilege 1132 Flaseher.exe Token: SeDebugPrivilege 1132 Flaseher.exe Token: SeDebugPrivilege 1132 Flaseher.exe Token: SeDebugPrivilege 1132 Flaseher.exe Token: SeDebugPrivilege 1132 Flaseher.exe Token: SeDebugPrivilege 1132 Flaseher.exe Token: SeDebugPrivilege 1132 Flaseher.exe Token: SeDebugPrivilege 1132 Flaseher.exe Token: SeDebugPrivilege 1132 Flaseher.exe Token: SeDebugPrivilege 1132 Flaseher.exe Token: SeDebugPrivilege 1132 Flaseher.exe Token: SeDebugPrivilege 1132 Flaseher.exe Token: SeDebugPrivilege 1132 Flaseher.exe Token: SeDebugPrivilege 1132 Flaseher.exe Token: SeDebugPrivilege 1132 Flaseher.exe Token: SeDebugPrivilege 1132 Flaseher.exe Token: SeDebugPrivilege 1132 Flaseher.exe Token: SeDebugPrivilege 1132 Flaseher.exe Token: SeDebugPrivilege 1132 Flaseher.exe Token: SeDebugPrivilege 1132 Flaseher.exe Token: SeDebugPrivilege 1132 Flaseher.exe Token: SeDebugPrivilege 1132 Flaseher.exe Token: SeDebugPrivilege 1132 Flaseher.exe Token: SeDebugPrivilege 1132 Flaseher.exe Token: SeDebugPrivilege 1132 Flaseher.exe Token: SeDebugPrivilege 1132 Flaseher.exe Token: SeDebugPrivilege 1132 Flaseher.exe Token: SeDebugPrivilege 1132 Flaseher.exe Token: SeDebugPrivilege 1132 Flaseher.exe Token: SeDebugPrivilege 1132 Flaseher.exe Token: SeDebugPrivilege 1132 Flaseher.exe Token: SeDebugPrivilege 1132 Flaseher.exe Token: SeDebugPrivilege 1132 Flaseher.exe Token: SeDebugPrivilege 1132 Flaseher.exe Token: SeDebugPrivilege 1132 Flaseher.exe Token: SeDebugPrivilege 1132 Flaseher.exe Token: SeDebugPrivilege 1132 Flaseher.exe Token: SeDebugPrivilege 1132 Flaseher.exe Token: SeDebugPrivilege 1132 Flaseher.exe Token: SeDebugPrivilege 1132 Flaseher.exe Token: SeDebugPrivilege 1132 Flaseher.exe Token: SeDebugPrivilege 1132 Flaseher.exe Token: SeDebugPrivilege 1132 Flaseher.exe Token: SeDebugPrivilege 1132 Flaseher.exe Token: SeDebugPrivilege 1132 Flaseher.exe Token: SeDebugPrivilege 1132 Flaseher.exe Token: SeDebugPrivilege 1132 Flaseher.exe Token: SeDebugPrivilege 1132 Flaseher.exe Token: SeDebugPrivilege 1132 Flaseher.exe Token: SeDebugPrivilege 1132 Flaseher.exe Token: SeDebugPrivilege 1132 Flaseher.exe Token: SeDebugPrivilege 1132 Flaseher.exe Token: SeDebugPrivilege 1132 Flaseher.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
f1871002492bac5f786b08f4c3b53200_NEIKI.exef1871002492bac5f786b08f4c3b53200_NEIKI.exeFlaseher.exeFlaseher.exepid process 3304 f1871002492bac5f786b08f4c3b53200_NEIKI.exe 4340 f1871002492bac5f786b08f4c3b53200_NEIKI.exe 5004 Flaseher.exe 1132 Flaseher.exe -
Suspicious use of WriteProcessMemory 38 IoCs
Processes:
f1871002492bac5f786b08f4c3b53200_NEIKI.exef1871002492bac5f786b08f4c3b53200_NEIKI.execmd.exeFlaseher.exedescription pid process target process PID 3304 wrote to memory of 4340 3304 f1871002492bac5f786b08f4c3b53200_NEIKI.exe f1871002492bac5f786b08f4c3b53200_NEIKI.exe PID 3304 wrote to memory of 4340 3304 f1871002492bac5f786b08f4c3b53200_NEIKI.exe f1871002492bac5f786b08f4c3b53200_NEIKI.exe PID 3304 wrote to memory of 4340 3304 f1871002492bac5f786b08f4c3b53200_NEIKI.exe f1871002492bac5f786b08f4c3b53200_NEIKI.exe PID 3304 wrote to memory of 4340 3304 f1871002492bac5f786b08f4c3b53200_NEIKI.exe f1871002492bac5f786b08f4c3b53200_NEIKI.exe PID 3304 wrote to memory of 4340 3304 f1871002492bac5f786b08f4c3b53200_NEIKI.exe f1871002492bac5f786b08f4c3b53200_NEIKI.exe PID 3304 wrote to memory of 4340 3304 f1871002492bac5f786b08f4c3b53200_NEIKI.exe f1871002492bac5f786b08f4c3b53200_NEIKI.exe PID 3304 wrote to memory of 4340 3304 f1871002492bac5f786b08f4c3b53200_NEIKI.exe f1871002492bac5f786b08f4c3b53200_NEIKI.exe PID 3304 wrote to memory of 4340 3304 f1871002492bac5f786b08f4c3b53200_NEIKI.exe f1871002492bac5f786b08f4c3b53200_NEIKI.exe PID 4340 wrote to memory of 2996 4340 f1871002492bac5f786b08f4c3b53200_NEIKI.exe cmd.exe PID 4340 wrote to memory of 2996 4340 f1871002492bac5f786b08f4c3b53200_NEIKI.exe cmd.exe PID 4340 wrote to memory of 2996 4340 f1871002492bac5f786b08f4c3b53200_NEIKI.exe cmd.exe PID 2996 wrote to memory of 3636 2996 cmd.exe reg.exe PID 2996 wrote to memory of 3636 2996 cmd.exe reg.exe PID 2996 wrote to memory of 3636 2996 cmd.exe reg.exe PID 4340 wrote to memory of 5004 4340 f1871002492bac5f786b08f4c3b53200_NEIKI.exe Flaseher.exe PID 4340 wrote to memory of 5004 4340 f1871002492bac5f786b08f4c3b53200_NEIKI.exe Flaseher.exe PID 4340 wrote to memory of 5004 4340 f1871002492bac5f786b08f4c3b53200_NEIKI.exe Flaseher.exe PID 5004 wrote to memory of 1132 5004 Flaseher.exe Flaseher.exe PID 5004 wrote to memory of 1132 5004 Flaseher.exe Flaseher.exe PID 5004 wrote to memory of 1132 5004 Flaseher.exe Flaseher.exe PID 5004 wrote to memory of 1132 5004 Flaseher.exe Flaseher.exe PID 5004 wrote to memory of 1132 5004 Flaseher.exe Flaseher.exe PID 5004 wrote to memory of 1132 5004 Flaseher.exe Flaseher.exe PID 5004 wrote to memory of 1132 5004 Flaseher.exe Flaseher.exe PID 5004 wrote to memory of 1132 5004 Flaseher.exe Flaseher.exe PID 5004 wrote to memory of 2016 5004 Flaseher.exe Flaseher.exe PID 5004 wrote to memory of 2016 5004 Flaseher.exe Flaseher.exe PID 5004 wrote to memory of 2016 5004 Flaseher.exe Flaseher.exe PID 5004 wrote to memory of 2016 5004 Flaseher.exe Flaseher.exe PID 5004 wrote to memory of 2016 5004 Flaseher.exe Flaseher.exe PID 5004 wrote to memory of 2016 5004 Flaseher.exe Flaseher.exe PID 5004 wrote to memory of 2016 5004 Flaseher.exe Flaseher.exe PID 5004 wrote to memory of 2016 5004 Flaseher.exe Flaseher.exe PID 5004 wrote to memory of 2016 5004 Flaseher.exe Flaseher.exe PID 5004 wrote to memory of 2016 5004 Flaseher.exe Flaseher.exe PID 5004 wrote to memory of 2016 5004 Flaseher.exe Flaseher.exe PID 5004 wrote to memory of 2016 5004 Flaseher.exe Flaseher.exe PID 5004 wrote to memory of 2016 5004 Flaseher.exe Flaseher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f1871002492bac5f786b08f4c3b53200_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\f1871002492bac5f786b08f4c3b53200_NEIKI.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\f1871002492bac5f786b08f4c3b53200_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\f1871002492bac5f786b08f4c3b53200_NEIKI.exe"2⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WLVLH.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v ".Flasfh" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe" /f4⤵
- Adds Run key to start application
PID:3636 -
C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1132 -
C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"4⤵
- Executes dropped EXE
PID:2016
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3696 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:81⤵PID:4600
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
145B
MD5da0cbe87b720a79b294147ed6a4b98be
SHA1ebf0dc9efd7a12cb192e355cda87546acb4ab360
SHA2567ccfeff356fdccc9145bd1e263aa1c56360ca7b6552ed5a5665c596d02a627ed
SHA512f55c4a3d24d2f11db5eda3c816d1cd3b8804a171a7bf715b13d60788247fbb352eafaa5bd4e0a8086c1013396be0a48c7bdb904ab0f974fa0c75e81e3d365acc
-
Filesize
130KB
MD5286104b6d8c19d3f93971da3ff938bf4
SHA16ba0887dc6959319bb539b142622e372a3d98039
SHA2563c81bc737706e227e6c2a8234e75ca0e3f747a70fa8b7ef2a8f3c13e81d250f0
SHA512ea76afa70a7a23d2c1a96e53cd0578437acff639b70293bd309d95ca1bb8f32fe1170de71e60548554248e3312b0633e6282450408a80bff7a2358d8bc1bdc97