Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-05-2024 06:11

General

  • Target

    f1871002492bac5f786b08f4c3b53200_NEIKI.exe

  • Size

    130KB

  • MD5

    f1871002492bac5f786b08f4c3b53200

  • SHA1

    21ff21621cb3b38db8113be274de925390d36354

  • SHA256

    4c7b9e3a3031e788964c0e377ebf1ce72453eddc65f3145e02c656588aa0a5c5

  • SHA512

    7cc2623e01dc75c8cf72a0bb1e4d51ee81baaf2710bfc8a8889b64e8c71da0225915cc8219aa5ed4bd24d28663dab0604cb991f9014daa760834566a194a91b4

  • SSDEEP

    1536:eH1ZaQvR1KiX3NK6I+hZhYrt/w5Q6G6IpiRYzz9qJHhhnm0yG5aP/5UROXTmX:SKQJcinxphkG5Q6GdpIOkJHhKRyOXK

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • ModiLoader Second Stage 6 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • UPX packed file 15 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f1871002492bac5f786b08f4c3b53200_NEIKI.exe
    "C:\Users\Admin\AppData\Local\Temp\f1871002492bac5f786b08f4c3b53200_NEIKI.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3304
    • C:\Users\Admin\AppData\Local\Temp\f1871002492bac5f786b08f4c3b53200_NEIKI.exe
      "C:\Users\Admin\AppData\Local\Temp\f1871002492bac5f786b08f4c3b53200_NEIKI.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4340
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WLVLH.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2996
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v ".Flasfh" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe" /f
          4⤵
          • Adds Run key to start application
          PID:3636
      • C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe
        "C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:5004
        • C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe
          "C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:1132
        • C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe
          "C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"
          4⤵
          • Executes dropped EXE
          PID:2016
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3696 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:4600

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\WLVLH.txt

      Filesize

      145B

      MD5

      da0cbe87b720a79b294147ed6a4b98be

      SHA1

      ebf0dc9efd7a12cb192e355cda87546acb4ab360

      SHA256

      7ccfeff356fdccc9145bd1e263aa1c56360ca7b6552ed5a5665c596d02a627ed

      SHA512

      f55c4a3d24d2f11db5eda3c816d1cd3b8804a171a7bf715b13d60788247fbb352eafaa5bd4e0a8086c1013396be0a48c7bdb904ab0f974fa0c75e81e3d365acc

    • C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe

      Filesize

      130KB

      MD5

      286104b6d8c19d3f93971da3ff938bf4

      SHA1

      6ba0887dc6959319bb539b142622e372a3d98039

      SHA256

      3c81bc737706e227e6c2a8234e75ca0e3f747a70fa8b7ef2a8f3c13e81d250f0

      SHA512

      ea76afa70a7a23d2c1a96e53cd0578437acff639b70293bd309d95ca1bb8f32fe1170de71e60548554248e3312b0633e6282450408a80bff7a2358d8bc1bdc97

    • memory/1132-62-0x0000000000400000-0x000000000040B000-memory.dmp

      Filesize

      44KB

    • memory/2016-51-0x0000000000400000-0x0000000000411000-memory.dmp

      Filesize

      68KB

    • memory/2016-59-0x0000000000400000-0x0000000000411000-memory.dmp

      Filesize

      68KB

    • memory/2016-48-0x0000000000400000-0x0000000000411000-memory.dmp

      Filesize

      68KB

    • memory/2016-56-0x0000000000400000-0x0000000000411000-memory.dmp

      Filesize

      68KB

    • memory/2016-63-0x0000000000400000-0x0000000000411000-memory.dmp

      Filesize

      68KB

    • memory/2016-58-0x0000000000400000-0x0000000000411000-memory.dmp

      Filesize

      68KB

    • memory/3304-6-0x0000000000400000-0x0000000000423000-memory.dmp

      Filesize

      140KB

    • memory/3304-15-0x0000000000400000-0x0000000000423000-memory.dmp

      Filesize

      140KB

    • memory/3304-5-0x0000000002B10000-0x0000000002B11000-memory.dmp

      Filesize

      4KB

    • memory/3304-3-0x0000000002320000-0x0000000002321000-memory.dmp

      Filesize

      4KB

    • memory/3304-0-0x0000000000400000-0x0000000000423000-memory.dmp

      Filesize

      140KB

    • memory/3304-4-0x0000000002350000-0x0000000002351000-memory.dmp

      Filesize

      4KB

    • memory/3304-8-0x0000000002B60000-0x0000000002B61000-memory.dmp

      Filesize

      4KB

    • memory/3304-7-0x0000000002B50000-0x0000000002B51000-memory.dmp

      Filesize

      4KB

    • memory/4340-12-0x0000000000400000-0x000000000040B000-memory.dmp

      Filesize

      44KB

    • memory/4340-40-0x0000000000400000-0x000000000040B000-memory.dmp

      Filesize

      44KB

    • memory/4340-60-0x0000000000400000-0x000000000040B000-memory.dmp

      Filesize

      44KB

    • memory/4340-11-0x0000000000400000-0x000000000040B000-memory.dmp

      Filesize

      44KB

    • memory/4340-9-0x0000000000400000-0x000000000040B000-memory.dmp

      Filesize

      44KB

    • memory/5004-46-0x0000000000400000-0x0000000000423000-memory.dmp

      Filesize

      140KB

    • memory/5004-42-0x0000000000400000-0x0000000000423000-memory.dmp

      Filesize

      140KB

    • memory/5004-55-0x0000000000400000-0x0000000000423000-memory.dmp

      Filesize

      140KB

    • memory/5004-41-0x0000000000400000-0x0000000000423000-memory.dmp

      Filesize

      140KB

    • memory/5004-37-0x0000000000400000-0x0000000000423000-memory.dmp

      Filesize

      140KB