Analysis
-
max time kernel
150s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
08/05/2024, 09:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5503c4cd56e97ca80c26399e1c1b8240_NEIKI.exe
Resource
win7-20240221-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
5503c4cd56e97ca80c26399e1c1b8240_NEIKI.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
5503c4cd56e97ca80c26399e1c1b8240_NEIKI.exe
-
Size
69KB
-
MD5
5503c4cd56e97ca80c26399e1c1b8240
-
SHA1
cbc9da7b02bff2a1a7e203ea0cf5108ee3cc9f70
-
SHA256
27c94f9544a75407f53021efc58c8b476769cb31c577b0014e39e136893a7ab2
-
SHA512
564d6fccfe92ac7e62d6a88b1e2b4e9b9c0ad7cc424dd1e08e0f208d7c034b3382dab45e4ac9280f69d557ccfe453a939b887c254d016fff18c3215037c51d92
-
SSDEEP
1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8slc:Olg35GTslA5t3/w8R
Score
10/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" ouxceseah-edor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" ouxceseah-edor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" ouxceseah-edor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" ouxceseah-edor.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4B584950-5043-4b46-4B58-495050434b46}\StubPath = "C:\\Windows\\system32\\asloorir.exe" ouxceseah-edor.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4B584950-5043-4b46-4B58-495050434b46} ouxceseah-edor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4B584950-5043-4b46-4B58-495050434b46}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" ouxceseah-edor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4B584950-5043-4b46-4B58-495050434b46}\IsInstalled = "1" ouxceseah-edor.exe -
Sets file execution options in registry 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe ouxceseah-edor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" ouxceseah-edor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\atxoatet.exe" ouxceseah-edor.exe -
Executes dropped EXE 2 IoCs
pid Process 2560 ouxceseah-edor.exe 2520 ouxceseah-edor.exe -
Loads dropped DLL 3 IoCs
pid Process 2456 5503c4cd56e97ca80c26399e1c1b8240_NEIKI.exe 2456 5503c4cd56e97ca80c26399e1c1b8240_NEIKI.exe 2560 ouxceseah-edor.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" ouxceseah-edor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" ouxceseah-edor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" ouxceseah-edor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" ouxceseah-edor.exe -
Modifies WinLogon 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} ouxceseah-edor.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify ouxceseah-edor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" ouxceseah-edor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\adkihan-ocum.dll" ouxceseah-edor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" ouxceseah-edor.exe -
Drops file in System32 directory 9 IoCs
description ioc Process File created C:\Windows\SysWOW64\asloorir.exe ouxceseah-edor.exe File opened for modification C:\Windows\SysWOW64\adkihan-ocum.dll ouxceseah-edor.exe File created C:\Windows\SysWOW64\adkihan-ocum.dll ouxceseah-edor.exe File opened for modification C:\Windows\SysWOW64\ouxceseah-edor.exe ouxceseah-edor.exe File created C:\Windows\SysWOW64\ouxceseah-edor.exe 5503c4cd56e97ca80c26399e1c1b8240_NEIKI.exe File opened for modification C:\Windows\SysWOW64\atxoatet.exe ouxceseah-edor.exe File opened for modification C:\Windows\SysWOW64\asloorir.exe ouxceseah-edor.exe File opened for modification C:\Windows\SysWOW64\ouxceseah-edor.exe 5503c4cd56e97ca80c26399e1c1b8240_NEIKI.exe File created C:\Windows\SysWOW64\atxoatet.exe ouxceseah-edor.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2560 ouxceseah-edor.exe 2560 ouxceseah-edor.exe 2560 ouxceseah-edor.exe 2560 ouxceseah-edor.exe 2520 ouxceseah-edor.exe 2560 ouxceseah-edor.exe 2560 ouxceseah-edor.exe 2560 ouxceseah-edor.exe 2560 ouxceseah-edor.exe 2560 ouxceseah-edor.exe 2560 ouxceseah-edor.exe 2560 ouxceseah-edor.exe 2560 ouxceseah-edor.exe 2560 ouxceseah-edor.exe 2560 ouxceseah-edor.exe 2560 ouxceseah-edor.exe 2560 ouxceseah-edor.exe 2560 ouxceseah-edor.exe 2560 ouxceseah-edor.exe 2560 ouxceseah-edor.exe 2560 ouxceseah-edor.exe 2560 ouxceseah-edor.exe 2560 ouxceseah-edor.exe 2560 ouxceseah-edor.exe 2560 ouxceseah-edor.exe 2560 ouxceseah-edor.exe 2560 ouxceseah-edor.exe 2560 ouxceseah-edor.exe 2560 ouxceseah-edor.exe 2560 ouxceseah-edor.exe 2560 ouxceseah-edor.exe 2560 ouxceseah-edor.exe 2560 ouxceseah-edor.exe 2560 ouxceseah-edor.exe 2560 ouxceseah-edor.exe 2560 ouxceseah-edor.exe 2560 ouxceseah-edor.exe 2560 ouxceseah-edor.exe 2560 ouxceseah-edor.exe 2560 ouxceseah-edor.exe 2560 ouxceseah-edor.exe 2560 ouxceseah-edor.exe 2560 ouxceseah-edor.exe 2560 ouxceseah-edor.exe 2560 ouxceseah-edor.exe 2560 ouxceseah-edor.exe 2560 ouxceseah-edor.exe 2560 ouxceseah-edor.exe 2560 ouxceseah-edor.exe 2560 ouxceseah-edor.exe 2560 ouxceseah-edor.exe 2560 ouxceseah-edor.exe 2560 ouxceseah-edor.exe 2560 ouxceseah-edor.exe 2560 ouxceseah-edor.exe 2560 ouxceseah-edor.exe 2560 ouxceseah-edor.exe 2560 ouxceseah-edor.exe 2560 ouxceseah-edor.exe 2560 ouxceseah-edor.exe 2560 ouxceseah-edor.exe 2560 ouxceseah-edor.exe 2560 ouxceseah-edor.exe 2560 ouxceseah-edor.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2456 5503c4cd56e97ca80c26399e1c1b8240_NEIKI.exe Token: SeDebugPrivilege 2560 ouxceseah-edor.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2456 wrote to memory of 2560 2456 5503c4cd56e97ca80c26399e1c1b8240_NEIKI.exe 28 PID 2456 wrote to memory of 2560 2456 5503c4cd56e97ca80c26399e1c1b8240_NEIKI.exe 28 PID 2456 wrote to memory of 2560 2456 5503c4cd56e97ca80c26399e1c1b8240_NEIKI.exe 28 PID 2456 wrote to memory of 2560 2456 5503c4cd56e97ca80c26399e1c1b8240_NEIKI.exe 28 PID 2560 wrote to memory of 424 2560 ouxceseah-edor.exe 5 PID 2560 wrote to memory of 1204 2560 ouxceseah-edor.exe 21 PID 2560 wrote to memory of 2520 2560 ouxceseah-edor.exe 29 PID 2560 wrote to memory of 2520 2560 ouxceseah-edor.exe 29 PID 2560 wrote to memory of 2520 2560 ouxceseah-edor.exe 29 PID 2560 wrote to memory of 2520 2560 ouxceseah-edor.exe 29 PID 2560 wrote to memory of 1204 2560 ouxceseah-edor.exe 21 PID 2560 wrote to memory of 1204 2560 ouxceseah-edor.exe 21 PID 2560 wrote to memory of 1204 2560 ouxceseah-edor.exe 21 PID 2560 wrote to memory of 1204 2560 ouxceseah-edor.exe 21 PID 2560 wrote to memory of 1204 2560 ouxceseah-edor.exe 21 PID 2560 wrote to memory of 1204 2560 ouxceseah-edor.exe 21 PID 2560 wrote to memory of 1204 2560 ouxceseah-edor.exe 21 PID 2560 wrote to memory of 1204 2560 ouxceseah-edor.exe 21 PID 2560 wrote to memory of 1204 2560 ouxceseah-edor.exe 21 PID 2560 wrote to memory of 1204 2560 ouxceseah-edor.exe 21 PID 2560 wrote to memory of 1204 2560 ouxceseah-edor.exe 21 PID 2560 wrote to memory of 1204 2560 ouxceseah-edor.exe 21 PID 2560 wrote to memory of 1204 2560 ouxceseah-edor.exe 21 PID 2560 wrote to memory of 1204 2560 ouxceseah-edor.exe 21 PID 2560 wrote to memory of 1204 2560 ouxceseah-edor.exe 21 PID 2560 wrote to memory of 1204 2560 ouxceseah-edor.exe 21 PID 2560 wrote to memory of 1204 2560 ouxceseah-edor.exe 21 PID 2560 wrote to memory of 1204 2560 ouxceseah-edor.exe 21 PID 2560 wrote to memory of 1204 2560 ouxceseah-edor.exe 21 PID 2560 wrote to memory of 1204 2560 ouxceseah-edor.exe 21 PID 2560 wrote to memory of 1204 2560 ouxceseah-edor.exe 21 PID 2560 wrote to memory of 1204 2560 ouxceseah-edor.exe 21 PID 2560 wrote to memory of 1204 2560 ouxceseah-edor.exe 21 PID 2560 wrote to memory of 1204 2560 ouxceseah-edor.exe 21 PID 2560 wrote to memory of 1204 2560 ouxceseah-edor.exe 21 PID 2560 wrote to memory of 1204 2560 ouxceseah-edor.exe 21 PID 2560 wrote to memory of 1204 2560 ouxceseah-edor.exe 21 PID 2560 wrote to memory of 1204 2560 ouxceseah-edor.exe 21 PID 2560 wrote to memory of 1204 2560 ouxceseah-edor.exe 21 PID 2560 wrote to memory of 1204 2560 ouxceseah-edor.exe 21 PID 2560 wrote to memory of 1204 2560 ouxceseah-edor.exe 21 PID 2560 wrote to memory of 1204 2560 ouxceseah-edor.exe 21 PID 2560 wrote to memory of 1204 2560 ouxceseah-edor.exe 21 PID 2560 wrote to memory of 1204 2560 ouxceseah-edor.exe 21 PID 2560 wrote to memory of 1204 2560 ouxceseah-edor.exe 21 PID 2560 wrote to memory of 1204 2560 ouxceseah-edor.exe 21 PID 2560 wrote to memory of 1204 2560 ouxceseah-edor.exe 21 PID 2560 wrote to memory of 1204 2560 ouxceseah-edor.exe 21 PID 2560 wrote to memory of 1204 2560 ouxceseah-edor.exe 21 PID 2560 wrote to memory of 1204 2560 ouxceseah-edor.exe 21 PID 2560 wrote to memory of 1204 2560 ouxceseah-edor.exe 21 PID 2560 wrote to memory of 1204 2560 ouxceseah-edor.exe 21 PID 2560 wrote to memory of 1204 2560 ouxceseah-edor.exe 21 PID 2560 wrote to memory of 1204 2560 ouxceseah-edor.exe 21 PID 2560 wrote to memory of 1204 2560 ouxceseah-edor.exe 21 PID 2560 wrote to memory of 1204 2560 ouxceseah-edor.exe 21 PID 2560 wrote to memory of 1204 2560 ouxceseah-edor.exe 21 PID 2560 wrote to memory of 1204 2560 ouxceseah-edor.exe 21 PID 2560 wrote to memory of 1204 2560 ouxceseah-edor.exe 21 PID 2560 wrote to memory of 1204 2560 ouxceseah-edor.exe 21 PID 2560 wrote to memory of 1204 2560 ouxceseah-edor.exe 21 PID 2560 wrote to memory of 1204 2560 ouxceseah-edor.exe 21 PID 2560 wrote to memory of 1204 2560 ouxceseah-edor.exe 21 PID 2560 wrote to memory of 1204 2560 ouxceseah-edor.exe 21
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:424
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\5503c4cd56e97ca80c26399e1c1b8240_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5503c4cd56e97ca80c26399e1c1b8240_NEIKI.exe"2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Windows\SysWOW64\ouxceseah-edor.exe"C:\Windows\system32\ouxceseah-edor.exe"3⤵
- Windows security bypass
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\SysWOW64\ouxceseah-edor.exe--k33p4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2520
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5f37b21c00fd81bd93c89ce741a88f183
SHA1b2796500597c68e2f5638e1101b46eaf32676c1c
SHA25676cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
SHA512252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4
-
Filesize
71KB
MD50a92477e2a2193671e03967b7f115076
SHA1db327ca54f73e3cc0c44cd15a3db355a997aa2f2
SHA256b839b2d01823e491f5e20213948b7b24921ba3adfa5c4afbb2256be0f0ba98f7
SHA512803a0957cc8acaa25b0642085c0666c5ac206aee4f01a8afc7500aca5e2066d38f19549be7e84a5ec3c5b66184cea4456cf130d84d5902cf1f6d837a36c1672c
-
Filesize
72KB
MD56829aef4305efd7cedd21cf58adf0871
SHA1e9e778f5870f9eb3861f5a0186be78ac08e2e32b
SHA256fe7a7b1b437c0b016b0ae3a618d4cd39d1a47b362da8232eefaeda6123dda422
SHA512e1393920da9f267bd8ae332946bb71489bba402ccbb6d820aaf0409042b22c0b85df2a26d855bf45cecdaa494af16a3c9294b8f52b42234349dd9c901ee01941
-
Filesize
69KB
MD55503c4cd56e97ca80c26399e1c1b8240
SHA1cbc9da7b02bff2a1a7e203ea0cf5108ee3cc9f70
SHA25627c94f9544a75407f53021efc58c8b476769cb31c577b0014e39e136893a7ab2
SHA512564d6fccfe92ac7e62d6a88b1e2b4e9b9c0ad7cc424dd1e08e0f208d7c034b3382dab45e4ac9280f69d557ccfe453a939b887c254d016fff18c3215037c51d92