90c359d5a28988947cbd562ba6ae8f2728208344da9c42ea564d13faad48eeb6

Analysis

max time kernel
132s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 07:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0de4219c10dae34c6f61477cd64ca6b0_NEIKI.exe
Size

94KB
MD5

0de4219c10dae34c6f61477cd64ca6b0
SHA1

1b006d34cbe6f1cd12051167750d05019c6544b4
SHA256

90c359d5a28988947cbd562ba6ae8f2728208344da9c42ea564d13faad48eeb6
SHA512

6905137aa4da12a0bc03c6026260cc8ec6668cc805b4c80beef538e9476707080e98912bb2a46d552d571c08e9f4145cccec48e178252e196fd8ef71b9f030a9
SSDEEP

1536:tF0AJELoJHG9qa+oa33KJJzAKWYr0v7iJSzIRXKTzRZICrWaGZh7h:tiAyLN9qa+oEGrWViJSzIR6JJrWNZ7

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2268	WwanSvc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Window Update = "\"C:\\ProgramData\\Update\\WwanSvc.exe\" /run"	0de4219c10dae34c6f61477cd64ca6b0_NEIKI.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 220 wrote to memory of 2268	220	0de4219c10dae34c6f61477cd64ca6b0_NEIKI.exe	84
PID 220 wrote to memory of 2268	220	0de4219c10dae34c6f61477cd64ca6b0_NEIKI.exe	84
PID 220 wrote to memory of 2268	220	0de4219c10dae34c6f61477cd64ca6b0_NEIKI.exe	84

C:\Users\Admin\AppData\Local\Temp\0de4219c10dae34c6f61477cd64ca6b0_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\0de4219c10dae34c6f61477cd64ca6b0_NEIKI.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:220
- C:\ProgramData\Update\WwanSvc.exe
  "C:\ProgramData\Update\WwanSvc.exe" /run
  2⤵
  - Executes dropped EXE
  PID:2268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Update\WwanSvc.exe

Filesize
94KB

MD5
94be47d325a7c13591d9abf692621c3c

SHA1
d82f07823b888fa933a06ce8dd8e22e592f6a833

SHA256
bb57731c97ffcfe2de863cfb3fa58cfa90f98b1a2c6626f2c6a430ebaa21bddb

SHA512
7470217cc4444f9a4151f8157b86884a0b2bda290fda308a6559a9821b9ac737e5f0e7c231517f83d5dbf2f1273203d34cf1bf84eab45aba1ef96d25237a1288

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads