6fe9f576b25ae243da838681572233ab76af20f5638e40bab041286b7e4378de

Analysis

max time kernel
149s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 07:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

18f985b29775b3a46a81a0a7e4f7be80_NEIKI.exe
Size

72KB
MD5

18f985b29775b3a46a81a0a7e4f7be80
SHA1

042234e569bdd2a0b3dbce2022ee999cf8150902
SHA256

6fe9f576b25ae243da838681572233ab76af20f5638e40bab041286b7e4378de
SHA512

265552e2c8eab5de14c407e147c0e8c75502c1eeab5eea11a088ffc30198bc05f39c68293c677a9703b28bbfd71a64d1d44fb0a9ecf6011dfa2dba22bc59d2a7
SSDEEP

1536:xPaRJeLZTu684iEU7tNpJzLB0QHql/z4pvVjygFDTqoFCjZS:RaRJeRu68GenzV0LpMpvVjy2DTq7FS

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	oukpoted-ouxac.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	oukpoted-ouxac.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	oukpoted-ouxac.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	oukpoted-ouxac.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4249534D-495a-4858-4249-534D495A4858}\StubPath = "C:\\Windows\\system32\\anmeavum.exe"	oukpoted-ouxac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4249534D-495a-4858-4249-534D495A4858}	oukpoted-ouxac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4249534D-495a-4858-4249-534D495A4858}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a"	oukpoted-ouxac.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4249534D-495a-4858-4249-534D495A4858}\IsInstalled = "1"	oukpoted-ouxac.exe

Sets file execution options in registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe	oukpoted-ouxac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a"	oukpoted-ouxac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\acvetad.exe"	oukpoted-ouxac.exe

Executes dropped EXE 2 IoCs

pid	Process
1536	oukpoted-ouxac.exe
2620	oukpoted-ouxac.exe

Loads dropped DLL 3 IoCs

pid	Process
3056	18f985b29775b3a46a81a0a7e4f7be80_NEIKI.exe
3056	18f985b29775b3a46a81a0a7e4f7be80_NEIKI.exe
1536	oukpoted-ouxac.exe

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	oukpoted-ouxac.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	oukpoted-ouxac.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	oukpoted-ouxac.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	oukpoted-ouxac.exe

Modifies WinLogon 2 TTPs 5 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a"	oukpoted-ouxac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\eatroaceax.dll"	oukpoted-ouxac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup"	oukpoted-ouxac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}	oukpoted-ouxac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	oukpoted-ouxac.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\oukpoted-ouxac.exe	oukpoted-ouxac.exe
File opened for modification	C:\Windows\SysWOW64\oukpoted-ouxac.exe	18f985b29775b3a46a81a0a7e4f7be80_NEIKI.exe
File created	C:\Windows\SysWOW64\acvetad.exe	oukpoted-ouxac.exe
File created	C:\Windows\SysWOW64\anmeavum.exe	oukpoted-ouxac.exe
File opened for modification	C:\Windows\SysWOW64\eatroaceax.dll	oukpoted-ouxac.exe
File created	C:\Windows\SysWOW64\oukpoted-ouxac.exe	18f985b29775b3a46a81a0a7e4f7be80_NEIKI.exe
File opened for modification	C:\Windows\SysWOW64\acvetad.exe	oukpoted-ouxac.exe
File opened for modification	C:\Windows\SysWOW64\anmeavum.exe	oukpoted-ouxac.exe
File created	C:\Windows\SysWOW64\eatroaceax.dll	oukpoted-ouxac.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1536	oukpoted-ouxac.exe
1536	oukpoted-ouxac.exe
1536	oukpoted-ouxac.exe
1536	oukpoted-ouxac.exe
2620	oukpoted-ouxac.exe
1536	oukpoted-ouxac.exe
1536	oukpoted-ouxac.exe
1536	oukpoted-ouxac.exe
1536	oukpoted-ouxac.exe
1536	oukpoted-ouxac.exe
1536	oukpoted-ouxac.exe
1536	oukpoted-ouxac.exe
1536	oukpoted-ouxac.exe
1536	oukpoted-ouxac.exe
1536	oukpoted-ouxac.exe
1536	oukpoted-ouxac.exe
1536	oukpoted-ouxac.exe
1536	oukpoted-ouxac.exe
1536	oukpoted-ouxac.exe
1536	oukpoted-ouxac.exe
1536	oukpoted-ouxac.exe
1536	oukpoted-ouxac.exe
1536	oukpoted-ouxac.exe
1536	oukpoted-ouxac.exe
1536	oukpoted-ouxac.exe
1536	oukpoted-ouxac.exe
1536	oukpoted-ouxac.exe
1536	oukpoted-ouxac.exe
1536	oukpoted-ouxac.exe
1536	oukpoted-ouxac.exe
1536	oukpoted-ouxac.exe
1536	oukpoted-ouxac.exe
1536	oukpoted-ouxac.exe
1536	oukpoted-ouxac.exe
1536	oukpoted-ouxac.exe
1536	oukpoted-ouxac.exe
1536	oukpoted-ouxac.exe
1536	oukpoted-ouxac.exe
1536	oukpoted-ouxac.exe
1536	oukpoted-ouxac.exe
1536	oukpoted-ouxac.exe
1536	oukpoted-ouxac.exe
1536	oukpoted-ouxac.exe
1536	oukpoted-ouxac.exe
1536	oukpoted-ouxac.exe
1536	oukpoted-ouxac.exe
1536	oukpoted-ouxac.exe
1536	oukpoted-ouxac.exe
1536	oukpoted-ouxac.exe
1536	oukpoted-ouxac.exe
1536	oukpoted-ouxac.exe
1536	oukpoted-ouxac.exe
1536	oukpoted-ouxac.exe
1536	oukpoted-ouxac.exe
1536	oukpoted-ouxac.exe
1536	oukpoted-ouxac.exe
1536	oukpoted-ouxac.exe
1536	oukpoted-ouxac.exe
1536	oukpoted-ouxac.exe
1536	oukpoted-ouxac.exe
1536	oukpoted-ouxac.exe
1536	oukpoted-ouxac.exe
1536	oukpoted-ouxac.exe
1536	oukpoted-ouxac.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1536	oukpoted-ouxac.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 1536	3056	18f985b29775b3a46a81a0a7e4f7be80_NEIKI.exe	28
PID 3056 wrote to memory of 1536	3056	18f985b29775b3a46a81a0a7e4f7be80_NEIKI.exe	28
PID 3056 wrote to memory of 1536	3056	18f985b29775b3a46a81a0a7e4f7be80_NEIKI.exe	28
PID 3056 wrote to memory of 1536	3056	18f985b29775b3a46a81a0a7e4f7be80_NEIKI.exe	28
PID 1536 wrote to memory of 436	1536	oukpoted-ouxac.exe	5
PID 1536 wrote to memory of 1064	1536	oukpoted-ouxac.exe	18
PID 1536 wrote to memory of 1064	1536	oukpoted-ouxac.exe	18
PID 1536 wrote to memory of 2620	1536	oukpoted-ouxac.exe	29
PID 1536 wrote to memory of 2620	1536	oukpoted-ouxac.exe	29
PID 1536 wrote to memory of 2620	1536	oukpoted-ouxac.exe	29
PID 1536 wrote to memory of 2620	1536	oukpoted-ouxac.exe	29
PID 1536 wrote to memory of 1064	1536	oukpoted-ouxac.exe	18
PID 1536 wrote to memory of 1064	1536	oukpoted-ouxac.exe	18
PID 1536 wrote to memory of 1064	1536	oukpoted-ouxac.exe	18
PID 1536 wrote to memory of 1064	1536	oukpoted-ouxac.exe	18
PID 1536 wrote to memory of 1064	1536	oukpoted-ouxac.exe	18
PID 1536 wrote to memory of 1064	1536	oukpoted-ouxac.exe	18
PID 1536 wrote to memory of 1064	1536	oukpoted-ouxac.exe	18
PID 1536 wrote to memory of 1064	1536	oukpoted-ouxac.exe	18
PID 1536 wrote to memory of 1064	1536	oukpoted-ouxac.exe	18
PID 1536 wrote to memory of 1064	1536	oukpoted-ouxac.exe	18
PID 1536 wrote to memory of 1064	1536	oukpoted-ouxac.exe	18
PID 1536 wrote to memory of 1064	1536	oukpoted-ouxac.exe	18
PID 1536 wrote to memory of 1064	1536	oukpoted-ouxac.exe	18
PID 1536 wrote to memory of 1064	1536	oukpoted-ouxac.exe	18
PID 1536 wrote to memory of 1064	1536	oukpoted-ouxac.exe	18
PID 1536 wrote to memory of 1064	1536	oukpoted-ouxac.exe	18
PID 1536 wrote to memory of 1064	1536	oukpoted-ouxac.exe	18
PID 1536 wrote to memory of 1064	1536	oukpoted-ouxac.exe	18
PID 1536 wrote to memory of 1064	1536	oukpoted-ouxac.exe	18
PID 1536 wrote to memory of 1064	1536	oukpoted-ouxac.exe	18
PID 1536 wrote to memory of 1064	1536	oukpoted-ouxac.exe	18
PID 1536 wrote to memory of 1064	1536	oukpoted-ouxac.exe	18
PID 1536 wrote to memory of 1064	1536	oukpoted-ouxac.exe	18
PID 1536 wrote to memory of 1064	1536	oukpoted-ouxac.exe	18
PID 1536 wrote to memory of 1064	1536	oukpoted-ouxac.exe	18
PID 1536 wrote to memory of 1064	1536	oukpoted-ouxac.exe	18
PID 1536 wrote to memory of 1064	1536	oukpoted-ouxac.exe	18
PID 1536 wrote to memory of 1064	1536	oukpoted-ouxac.exe	18
PID 1536 wrote to memory of 1064	1536	oukpoted-ouxac.exe	18
PID 1536 wrote to memory of 1064	1536	oukpoted-ouxac.exe	18
PID 1536 wrote to memory of 1064	1536	oukpoted-ouxac.exe	18
PID 1536 wrote to memory of 1064	1536	oukpoted-ouxac.exe	18
PID 1536 wrote to memory of 1064	1536	oukpoted-ouxac.exe	18
PID 1536 wrote to memory of 1064	1536	oukpoted-ouxac.exe	18
PID 1536 wrote to memory of 1064	1536	oukpoted-ouxac.exe	18
PID 1536 wrote to memory of 1064	1536	oukpoted-ouxac.exe	18
PID 1536 wrote to memory of 1064	1536	oukpoted-ouxac.exe	18
PID 1536 wrote to memory of 1064	1536	oukpoted-ouxac.exe	18
PID 1536 wrote to memory of 1064	1536	oukpoted-ouxac.exe	18
PID 1536 wrote to memory of 1064	1536	oukpoted-ouxac.exe	18
PID 1536 wrote to memory of 1064	1536	oukpoted-ouxac.exe	18
PID 1536 wrote to memory of 1064	1536	oukpoted-ouxac.exe	18
PID 1536 wrote to memory of 1064	1536	oukpoted-ouxac.exe	18
PID 1536 wrote to memory of 1064	1536	oukpoted-ouxac.exe	18
PID 1536 wrote to memory of 1064	1536	oukpoted-ouxac.exe	18
PID 1536 wrote to memory of 1064	1536	oukpoted-ouxac.exe	18
PID 1536 wrote to memory of 1064	1536	oukpoted-ouxac.exe	18
PID 1536 wrote to memory of 1064	1536	oukpoted-ouxac.exe	18
PID 1536 wrote to memory of 1064	1536	oukpoted-ouxac.exe	18
PID 1536 wrote to memory of 1064	1536	oukpoted-ouxac.exe	18
PID 1536 wrote to memory of 1064	1536	oukpoted-ouxac.exe	18
PID 1536 wrote to memory of 1064	1536	oukpoted-ouxac.exe	18
PID 1536 wrote to memory of 1064	1536	oukpoted-ouxac.exe	18

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:436

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1064
- C:\Users\Admin\AppData\Local\Temp\18f985b29775b3a46a81a0a7e4f7be80_NEIKI.exe
  "C:\Users\Admin\AppData\Local\Temp\18f985b29775b3a46a81a0a7e4f7be80_NEIKI.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:3056
- - C:\Windows\SysWOW64\oukpoted-ouxac.exe
    "C:\Windows\SysWOW64\oukpoted-ouxac.exe"
    3⤵
    - Windows security bypass
    - Modifies Installed Components in the registry
    - Sets file execution options in registry
    - Executes dropped EXE
    - Loads dropped DLL
    - Windows security modification
    - Modifies WinLogon
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1536
  - - C:\Windows\SysWOW64\oukpoted-ouxac.exe
      --k33p
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:2620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\acvetad.exe

Filesize
73KB

MD5
8792444c2198bf8519d91d5412a23fda

SHA1
ef7ea03e13c0ef94d675a1fc467b4db0ed2e6802

SHA256
a5c29c84d9af338f511457bd798363936cde01bc70edc74f3d3e2bf41d143d21

SHA512
d2a3821262fbcb17940d2da0d784fcf8f42709e879bbc28583092e7389f8185c0765eed84fd489572f0aac35fcd98c0304bfd0d80a3747c26d63d5982a47b324

Download Submit
C:\Windows\SysWOW64\anmeavum.exe

Filesize
72KB

MD5
3d060999a630471fe9dbd62783aad53f

SHA1
eed77fd073ec7ac94ec39a4f5576b66b83caae43

SHA256
89e5a06e5aa2c2f2773c3879e8a13c11655bd506610082bde85b798cc4878b16

SHA512
e9739465813b01a1e44cc55ee198db8d15ffe3a783db02b22906ff264efae41e798e28776d5c406542b1d5cc4490e17706d8408afe7fc4bbb50127b2d2921efb

Download Submit
C:\Windows\SysWOW64\eatroaceax.dll

Filesize
5KB

MD5
f37b21c00fd81bd93c89ce741a88f183

SHA1
b2796500597c68e2f5638e1101b46eaf32676c1c

SHA256
76cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0

SHA512
252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4

Download Submit
\Windows\SysWOW64\oukpoted-ouxac.exe

Filesize
70KB

MD5
3af3644776efce7c981d3616519f7d3c

SHA1
3eeac8015867660a451f8b5ddf3619148dab0192

SHA256
cad135c1d5bd39b051c1170fdafae2031ce602b2b6502d55bcaeb8708bc725ce

SHA512
2d5480e66b09f1d339ef0c68dd91b3199ac4dfeafbdb8e991c981594f366bba52203fbab55aeb06b2bfff3b3d5f4cd35d63dbedc3a027cfe415df2852611e341

Download Submit
memory/1536-53-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2620-54-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3056-7-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download