42d48a690eafd0253c31961712b5044682d5f920d24ea6182900c2363ff79b72

General

Target

0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe
Size

259KB
MD5

0b56bfcef95d5d801b4dfca45e504130
SHA1

3161636b85984f31e99d1fe797a9f49be2861ca7
SHA256

42d48a690eafd0253c31961712b5044682d5f920d24ea6182900c2363ff79b72
SHA512

1040a84889b75552763c8654522004f13a5f2630d045fef148271d77b8d8200737d58b5448f6384e3d0525fadc3b1d2a146bddeba9277d9cd8dc1fcfe126ae1c
SSDEEP

3072:PU5kYlj1i2KCsvJrp77bLeBdVw9+TpFLMHb+FHzGs:yCrp7Aa8z0gG

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0007000000015023-6.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
2080	services.exe

Loads dropped DLL 4 IoCs

pid	Process
912	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe
912	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe
912	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe
2080	services.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/912-0-0x0000000000400000-0x0000000000441000-memory.dmp	upx
behavioral1/files/0x0007000000015023-6.dat	upx
behavioral1/memory/912-8-0x0000000000220000-0x0000000000240000-memory.dmp	upx
behavioral1/files/0x000d000000012333-9.dat	upx
behavioral1/memory/912-10-0x0000000000220000-0x0000000000261000-memory.dmp	upx
behavioral1/memory/2080-17-0x0000000000400000-0x0000000000441000-memory.dmp	upx
behavioral1/memory/912-21-0x0000000000400000-0x0000000000441000-memory.dmp	upx
behavioral1/memory/2080-22-0x00000000002A0000-0x00000000002C0000-memory.dmp	upx
behavioral1/memory/2080-23-0x0000000000400000-0x0000000000441000-memory.dmp	upx

Enumerates connected drives 3 TTPs 17 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe
File opened (read-only)	\??\Q:	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe
File opened (read-only)	\??\K:	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe
File opened (read-only)	\??\U:	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe
File opened (read-only)	\??\N:	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe
File opened (read-only)	\??\L:	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe
File opened (read-only)	\??\T:	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe
File opened (read-only)	\??\V:	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe
File opened (read-only)	\??\I:	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe
File opened (read-only)	\??\G:	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe
File opened (read-only)	\??\H:	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe
File opened (read-only)	\??\J:	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe
File opened (read-only)	\??\M:	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe
File opened (read-only)	\??\O:	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe
File opened (read-only)	\??\R:	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe
File opened (read-only)	\??\S:	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe
File opened (read-only)	\??\E:	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ZTVR.dll	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe
File opened for modification	C:\Windows\SysWOW64\ZTVR.dll	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe

Modifies registry class 26 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4D65F220-63CA-11D8-9BDB-FD58F515A839}	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ZTVR.ShellExecuteHook1005\Clsid\ = "{4D65F220-63CA-11D8-9BDB-FD58F515A839}"	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QPWorkFile1005PV	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4D65F220-63CA-11D8-9BDB-FD58F515A839}\InprocServer32	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ZTVR.ShellExecuteHook1005	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4D65F220-63CA-11D8-9BDB-FD58F515A839}\ProgID\ = "ZTVR.ShellExecuteHook1005"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QPWorkFile1005PV\EFile = "051037066052045079089029049032110062140066236005047080014021085007229168172195225181115027019077081208251141223"	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4D65F220-63CA-11D8-9BDB-FD58F515A839}\InprocServer32\ = "C:\\Windows\\SysWow64\\ZTVR.dll"	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4D65F220-63CA-11D8-9BDB-FD58F515A839}	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4D65F220-63CA-11D8-9BDB-FD58F515A839}\InprocServer32	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ZTVR.ShellExecuteHook1005\ = "Maihook1005"	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ZTVR.ShellExecuteHook1005\Clsid	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QPWorkFile1005PV\DFile = "051039068052045076088048049032099048015066152058087000064010255006239253132219174208219176045085179015021249081213011033231"	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ZTVR.ShellExecuteHook1005\ = "Maihook1005"	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ZTVR.ShellExecuteHook1005	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QPWorkFile1005PV	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4D65F220-63CA-11D8-9BDB-FD58F515A839}\InprocServer32\ThreadingModel = "Apartment"	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4D65F220-63CA-11D8-9BDB-FD58F515A839}\ = "Maihook1005"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4D65F220-63CA-11D8-9BDB-FD58F515A839}\InprocServer32\ = "C:\\Windows\\SysWow64\\ZTVR.dll"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4D65F220-63CA-11D8-9BDB-FD58F515A839}\ = "Maihook1005"	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4D65F220-63CA-11D8-9BDB-FD58F515A839}\ProgID	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ZTVR.ShellExecuteHook1005\Clsid\ = "{4D65F220-63CA-11D8-9BDB-FD58F515A839}"	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4D65F220-63CA-11D8-9BDB-FD58F515A839}\ProgID	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4D65F220-63CA-11D8-9BDB-FD58F515A839}\ProgID\ = "ZTVR.ShellExecuteHook1005"	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4D65F220-63CA-11D8-9BDB-FD58F515A839}\InprocServer32\ThreadingModel = "Apartment"	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ZTVR.ShellExecuteHook1005\Clsid	services.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
912	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe
2080	services.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2080	services.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 912 wrote to memory of 2080	912	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe	28
PID 912 wrote to memory of 2080	912	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe	28
PID 912 wrote to memory of 2080	912	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe	28
PID 912 wrote to memory of 2080	912	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe	28

C:\Users\Admin\AppData\Local\Temp\0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:912
- C:\PerfLogs\services.exe
  C:\PerfLogs\services.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\PerfLogs\services.exe

Filesize
259KB

MD5
362856bf9798d988aaf76dcaaaf2fdae

SHA1
d69775ab7d650a0b6fb9a2645800603bdc8d7e6a

SHA256
3c81070264fb923e3d6e772ceb9f1f639ec4c2c44fa76c4b70895e8c7deb1920

SHA512
2fcc5b7b78b745ffe9947f7ad05390f2230139ebbedf807c46818c46c1f84640921ac87b76a41e1ce9af2a95b8fc1d794a8df9153e79ea524a292ce07772e584

Download Submit
\Windows\SysWOW64\ZTVR.dll

Filesize
306KB

MD5
f3c0380c5971f4e7d69ef08b2a44084e

SHA1
e23ed3a1480fab70bf22879431d0d7c45bcaf67c

SHA256
566686330634d78b69d3d444815431b8d59f8a258e73579a1c51172e21b56242

SHA512
b4213287b8b4dea776dc460746a5fc6211cd1016f4e08198413b43ed41b9579101e49c44e328ac35ad07c9704804ff97293b3bedcaa108c55342c61523dec23b

Download Submit
memory/912-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/912-8-0x0000000000220000-0x0000000000240000-memory.dmp

Filesize
128KB

Download
memory/912-10-0x0000000000220000-0x0000000000261000-memory.dmp

Filesize
260KB

Download
memory/912-21-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2080-17-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2080-22-0x00000000002A0000-0x00000000002C0000-memory.dmp

Filesize
128KB

Download
memory/2080-23-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2080-24-0x00000000002A0000-0x00000000002C0000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing