42d48a690eafd0253c31961712b5044682d5f920d24ea6182900c2363ff79b72

General

Target

0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe
Size

259KB
MD5

0b56bfcef95d5d801b4dfca45e504130
SHA1

3161636b85984f31e99d1fe797a9f49be2861ca7
SHA256

42d48a690eafd0253c31961712b5044682d5f920d24ea6182900c2363ff79b72
SHA512

1040a84889b75552763c8654522004f13a5f2630d045fef148271d77b8d8200737d58b5448f6384e3d0525fadc3b1d2a146bddeba9277d9cd8dc1fcfe126ae1c
SSDEEP

3072:PU5kYlj1i2KCsvJrp77bLeBdVw9+TpFLMHb+FHzGs:yCrp7Aa8z0gG

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000a000000023ba5-6.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
3420	svchost.exe

Loads dropped DLL 4 IoCs

pid	Process
456	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe
456	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe
3420	svchost.exe
3420	svchost.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/456-0-0x0000000000400000-0x0000000000441000-memory.dmp	upx
behavioral2/files/0x000a000000023ba5-6.dat	upx
behavioral2/memory/456-19-0x0000000000400000-0x0000000000441000-memory.dmp	upx
behavioral2/files/0x000d000000023b5c-13.dat	upx
behavioral2/memory/3420-22-0x0000000000400000-0x0000000000441000-memory.dmp	upx

Enumerates connected drives 3 TTPs 17 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe
File opened (read-only)	\??\K:	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe
File opened (read-only)	\??\M:	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe
File opened (read-only)	\??\Q:	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe
File opened (read-only)	\??\U:	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe
File opened (read-only)	\??\N:	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe
File opened (read-only)	\??\P:	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe
File opened (read-only)	\??\E:	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe
File opened (read-only)	\??\G:	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe
File opened (read-only)	\??\J:	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe
File opened (read-only)	\??\L:	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe
File opened (read-only)	\??\O:	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe
File opened (read-only)	\??\V:	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe
File opened (read-only)	\??\H:	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe
File opened (read-only)	\??\R:	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe
File opened (read-only)	\??\S:	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe
File opened (read-only)	\??\T:	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\EJFGF.dll	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe
File opened for modification	C:\Windows\SysWOW64\EJFGF.dll	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\svchost.exe	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe

Modifies registry class 26 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\EJFGF.ShellExecuteHook1005\Clsid\ = "{4D65F220-63CA-11D8-9BDB-FD58F515A839}"	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4D65F220-63CA-11D8-9BDB-FD58F515A839}\InprocServer32	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4D65F220-63CA-11D8-9BDB-FD58F515A839}\InprocServer32	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\EJFGF.ShellExecuteHook1005	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4D65F220-63CA-11D8-9BDB-FD58F515A839}\ = "Maihook1005"	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4D65F220-63CA-11D8-9BDB-FD58F515A839}\InprocServer32\ThreadingModel = "Apartment"	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4D65F220-63CA-11D8-9BDB-FD58F515A839}\InprocServer32\ = "C:\\Windows\\SysWow64\\EJFGF.dll"	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\EJFGF.ShellExecuteHook1005\ = "Maihook1005"	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\EJFGF.ShellExecuteHook1005\Clsid\ = "{4D65F220-63CA-11D8-9BDB-FD58F515A839}"	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QPWorkFile1005PV\DFile = "057039135053033191014055050036084068032064216073247005037123181108202186181088141190157014047176116076114166213105226000113018"	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\EJFGF.ShellExecuteHook1005\ = "Maihook1005"	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QPWorkFile1005PV	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4D65F220-63CA-11D8-9BDB-FD58F515A839}\ProgID\ = "EJFGF.ShellExecuteHook1005"	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4D65F220-63CA-11D8-9BDB-FD58F515A839}\ = "Maihook1005"	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4D65F220-63CA-11D8-9BDB-FD58F515A839}\ProgID	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\EJFGF.ShellExecuteHook1005	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4D65F220-63CA-11D8-9BDB-FD58F515A839}\InprocServer32\ThreadingModel = "Apartment"	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\EJFGF.ShellExecuteHook1005\Clsid	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4D65F220-63CA-11D8-9BDB-FD58F515A839}\ProgID	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QPWorkFile1005PV\EFile = "051038071052045075088202049032098049011066216110130112210078165248208035153205025190254061202231254207126005097013225207032004140005228196100"	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QPWorkFile1005PV	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4D65F220-63CA-11D8-9BDB-FD58F515A839}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4D65F220-63CA-11D8-9BDB-FD58F515A839}\ProgID\ = "EJFGF.ShellExecuteHook1005"	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4D65F220-63CA-11D8-9BDB-FD58F515A839}	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4D65F220-63CA-11D8-9BDB-FD58F515A839}\InprocServer32\ = "C:\\Windows\\SysWow64\\EJFGF.dll"	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\EJFGF.ShellExecuteHook1005\Clsid	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
456	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe
456	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe
3420	svchost.exe
3420	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3420	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 456 wrote to memory of 3420	456	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe	91
PID 456 wrote to memory of 3420	456	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe	91
PID 456 wrote to memory of 3420	456	0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe	91

C:\Users\Admin\AppData\Local\Temp\0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\0b56bfcef95d5d801b4dfca45e504130_NEIKI.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:456
- C:\Program Files (x86)\svchost.exe
  "C:\Program Files (x86)\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  PID:3420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\svchost.exe

Filesize
259KB

MD5
929acde02cd3567e102362d368168b4f

SHA1
ad80b8c2c6136802b588fd842ba9412e752a3633

SHA256
6ef2d5f52598c2031c1fb3634e5831ade65c55a24c98549a472dcbb162362a9a

SHA512
15893567888b92e3936373a458928c5ab99874838dc0851638ee883497fca8ca5e552993aeaa4e45fc93fd08c16999344f6b3ea32c53a4cd254f89ef177c74e7

Download Submit
C:\Windows\SysWOW64\EJFGF.dll

Filesize
306KB

MD5
f3c0380c5971f4e7d69ef08b2a44084e

SHA1
e23ed3a1480fab70bf22879431d0d7c45bcaf67c

SHA256
566686330634d78b69d3d444815431b8d59f8a258e73579a1c51172e21b56242

SHA512
b4213287b8b4dea776dc460746a5fc6211cd1016f4e08198413b43ed41b9579101e49c44e328ac35ad07c9704804ff97293b3bedcaa108c55342c61523dec23b

Download Submit
memory/456-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/456-19-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/456-15-0x0000000002420000-0x0000000002440000-memory.dmp

Filesize
128KB

Download
memory/456-14-0x0000000002420000-0x0000000002440000-memory.dmp

Filesize
128KB

Download
memory/3420-20-0x0000000002540000-0x0000000002560000-memory.dmp

Filesize
128KB

Download
memory/3420-21-0x0000000002540000-0x0000000002560000-memory.dmp

Filesize
128KB

Download
memory/3420-22-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3420-23-0x0000000002540000-0x0000000002560000-memory.dmp

Filesize
128KB

Download
memory/3420-24-0x0000000002540000-0x0000000002560000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing