Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
08/05/2024, 09:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5503c4cd56e97ca80c26399e1c1b8240_NEIKI.exe
Resource
win7-20240221-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
5503c4cd56e97ca80c26399e1c1b8240_NEIKI.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
5503c4cd56e97ca80c26399e1c1b8240_NEIKI.exe
-
Size
69KB
-
MD5
5503c4cd56e97ca80c26399e1c1b8240
-
SHA1
cbc9da7b02bff2a1a7e203ea0cf5108ee3cc9f70
-
SHA256
27c94f9544a75407f53021efc58c8b476769cb31c577b0014e39e136893a7ab2
-
SHA512
564d6fccfe92ac7e62d6a88b1e2b4e9b9c0ad7cc424dd1e08e0f208d7c034b3382dab45e4ac9280f69d557ccfe453a939b887c254d016fff18c3215037c51d92
-
SSDEEP
1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8slc:Olg35GTslA5t3/w8R
Score
10/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" ouxceseah-edor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" ouxceseah-edor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" ouxceseah-edor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" ouxceseah-edor.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4C464B54-444a-474c-4C46-4B54444A474c}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" ouxceseah-edor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4C464B54-444a-474c-4C46-4B54444A474c}\IsInstalled = "1" ouxceseah-edor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4C464B54-444a-474c-4C46-4B54444A474c}\StubPath = "C:\\Windows\\system32\\asloorir.exe" ouxceseah-edor.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4C464B54-444a-474c-4C46-4B54444A474c} ouxceseah-edor.exe -
Sets file execution options in registry 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe ouxceseah-edor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" ouxceseah-edor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\atxoatet.exe" ouxceseah-edor.exe -
Executes dropped EXE 2 IoCs
pid Process 940 ouxceseah-edor.exe 868 ouxceseah-edor.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" ouxceseah-edor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" ouxceseah-edor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" ouxceseah-edor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" ouxceseah-edor.exe -
Modifies WinLogon 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} ouxceseah-edor.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify ouxceseah-edor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" ouxceseah-edor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\adkihan-ocum.dll" ouxceseah-edor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" ouxceseah-edor.exe -
Drops file in System32 directory 9 IoCs
description ioc Process File created C:\Windows\SysWOW64\ouxceseah-edor.exe 5503c4cd56e97ca80c26399e1c1b8240_NEIKI.exe File created C:\Windows\SysWOW64\adkihan-ocum.dll ouxceseah-edor.exe File opened for modification C:\Windows\SysWOW64\ouxceseah-edor.exe ouxceseah-edor.exe File opened for modification C:\Windows\SysWOW64\asloorir.exe ouxceseah-edor.exe File created C:\Windows\SysWOW64\asloorir.exe ouxceseah-edor.exe File opened for modification C:\Windows\SysWOW64\adkihan-ocum.dll ouxceseah-edor.exe File opened for modification C:\Windows\SysWOW64\ouxceseah-edor.exe 5503c4cd56e97ca80c26399e1c1b8240_NEIKI.exe File opened for modification C:\Windows\SysWOW64\atxoatet.exe ouxceseah-edor.exe File created C:\Windows\SysWOW64\atxoatet.exe ouxceseah-edor.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 940 ouxceseah-edor.exe 940 ouxceseah-edor.exe 940 ouxceseah-edor.exe 940 ouxceseah-edor.exe 940 ouxceseah-edor.exe 940 ouxceseah-edor.exe 940 ouxceseah-edor.exe 940 ouxceseah-edor.exe 868 ouxceseah-edor.exe 868 ouxceseah-edor.exe 940 ouxceseah-edor.exe 940 ouxceseah-edor.exe 940 ouxceseah-edor.exe 940 ouxceseah-edor.exe 940 ouxceseah-edor.exe 940 ouxceseah-edor.exe 940 ouxceseah-edor.exe 940 ouxceseah-edor.exe 940 ouxceseah-edor.exe 940 ouxceseah-edor.exe 940 ouxceseah-edor.exe 940 ouxceseah-edor.exe 940 ouxceseah-edor.exe 940 ouxceseah-edor.exe 940 ouxceseah-edor.exe 940 ouxceseah-edor.exe 940 ouxceseah-edor.exe 940 ouxceseah-edor.exe 940 ouxceseah-edor.exe 940 ouxceseah-edor.exe 940 ouxceseah-edor.exe 940 ouxceseah-edor.exe 940 ouxceseah-edor.exe 940 ouxceseah-edor.exe 940 ouxceseah-edor.exe 940 ouxceseah-edor.exe 940 ouxceseah-edor.exe 940 ouxceseah-edor.exe 940 ouxceseah-edor.exe 940 ouxceseah-edor.exe 940 ouxceseah-edor.exe 940 ouxceseah-edor.exe 940 ouxceseah-edor.exe 940 ouxceseah-edor.exe 940 ouxceseah-edor.exe 940 ouxceseah-edor.exe 940 ouxceseah-edor.exe 940 ouxceseah-edor.exe 940 ouxceseah-edor.exe 940 ouxceseah-edor.exe 940 ouxceseah-edor.exe 940 ouxceseah-edor.exe 940 ouxceseah-edor.exe 940 ouxceseah-edor.exe 940 ouxceseah-edor.exe 940 ouxceseah-edor.exe 940 ouxceseah-edor.exe 940 ouxceseah-edor.exe 940 ouxceseah-edor.exe 940 ouxceseah-edor.exe 940 ouxceseah-edor.exe 940 ouxceseah-edor.exe 940 ouxceseah-edor.exe 940 ouxceseah-edor.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1680 5503c4cd56e97ca80c26399e1c1b8240_NEIKI.exe Token: SeDebugPrivilege 940 ouxceseah-edor.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1680 wrote to memory of 940 1680 5503c4cd56e97ca80c26399e1c1b8240_NEIKI.exe 83 PID 1680 wrote to memory of 940 1680 5503c4cd56e97ca80c26399e1c1b8240_NEIKI.exe 83 PID 1680 wrote to memory of 940 1680 5503c4cd56e97ca80c26399e1c1b8240_NEIKI.exe 83 PID 940 wrote to memory of 608 940 ouxceseah-edor.exe 5 PID 940 wrote to memory of 3420 940 ouxceseah-edor.exe 56 PID 940 wrote to memory of 3420 940 ouxceseah-edor.exe 56 PID 940 wrote to memory of 868 940 ouxceseah-edor.exe 84 PID 940 wrote to memory of 868 940 ouxceseah-edor.exe 84 PID 940 wrote to memory of 868 940 ouxceseah-edor.exe 84 PID 940 wrote to memory of 3420 940 ouxceseah-edor.exe 56 PID 940 wrote to memory of 3420 940 ouxceseah-edor.exe 56 PID 940 wrote to memory of 3420 940 ouxceseah-edor.exe 56 PID 940 wrote to memory of 3420 940 ouxceseah-edor.exe 56 PID 940 wrote to memory of 3420 940 ouxceseah-edor.exe 56 PID 940 wrote to memory of 3420 940 ouxceseah-edor.exe 56 PID 940 wrote to memory of 3420 940 ouxceseah-edor.exe 56 PID 940 wrote to memory of 3420 940 ouxceseah-edor.exe 56 PID 940 wrote to memory of 3420 940 ouxceseah-edor.exe 56 PID 940 wrote to memory of 3420 940 ouxceseah-edor.exe 56 PID 940 wrote to memory of 3420 940 ouxceseah-edor.exe 56 PID 940 wrote to memory of 3420 940 ouxceseah-edor.exe 56 PID 940 wrote to memory of 3420 940 ouxceseah-edor.exe 56 PID 940 wrote to memory of 3420 940 ouxceseah-edor.exe 56 PID 940 wrote to memory of 3420 940 ouxceseah-edor.exe 56 PID 940 wrote to memory of 3420 940 ouxceseah-edor.exe 56 PID 940 wrote to memory of 3420 940 ouxceseah-edor.exe 56 PID 940 wrote to memory of 3420 940 ouxceseah-edor.exe 56 PID 940 wrote to memory of 3420 940 ouxceseah-edor.exe 56 PID 940 wrote to memory of 3420 940 ouxceseah-edor.exe 56 PID 940 wrote to memory of 3420 940 ouxceseah-edor.exe 56 PID 940 wrote to memory of 3420 940 ouxceseah-edor.exe 56 PID 940 wrote to memory of 3420 940 ouxceseah-edor.exe 56 PID 940 wrote to memory of 3420 940 ouxceseah-edor.exe 56 PID 940 wrote to memory of 3420 940 ouxceseah-edor.exe 56 PID 940 wrote to memory of 3420 940 ouxceseah-edor.exe 56 PID 940 wrote to memory of 3420 940 ouxceseah-edor.exe 56 PID 940 wrote to memory of 3420 940 ouxceseah-edor.exe 56 PID 940 wrote to memory of 3420 940 ouxceseah-edor.exe 56 PID 940 wrote to memory of 3420 940 ouxceseah-edor.exe 56 PID 940 wrote to memory of 3420 940 ouxceseah-edor.exe 56 PID 940 wrote to memory of 3420 940 ouxceseah-edor.exe 56 PID 940 wrote to memory of 3420 940 ouxceseah-edor.exe 56 PID 940 wrote to memory of 3420 940 ouxceseah-edor.exe 56 PID 940 wrote to memory of 3420 940 ouxceseah-edor.exe 56 PID 940 wrote to memory of 3420 940 ouxceseah-edor.exe 56 PID 940 wrote to memory of 3420 940 ouxceseah-edor.exe 56 PID 940 wrote to memory of 3420 940 ouxceseah-edor.exe 56 PID 940 wrote to memory of 3420 940 ouxceseah-edor.exe 56 PID 940 wrote to memory of 3420 940 ouxceseah-edor.exe 56 PID 940 wrote to memory of 3420 940 ouxceseah-edor.exe 56 PID 940 wrote to memory of 3420 940 ouxceseah-edor.exe 56 PID 940 wrote to memory of 3420 940 ouxceseah-edor.exe 56 PID 940 wrote to memory of 3420 940 ouxceseah-edor.exe 56 PID 940 wrote to memory of 3420 940 ouxceseah-edor.exe 56 PID 940 wrote to memory of 3420 940 ouxceseah-edor.exe 56 PID 940 wrote to memory of 3420 940 ouxceseah-edor.exe 56 PID 940 wrote to memory of 3420 940 ouxceseah-edor.exe 56 PID 940 wrote to memory of 3420 940 ouxceseah-edor.exe 56 PID 940 wrote to memory of 3420 940 ouxceseah-edor.exe 56 PID 940 wrote to memory of 3420 940 ouxceseah-edor.exe 56 PID 940 wrote to memory of 3420 940 ouxceseah-edor.exe 56 PID 940 wrote to memory of 3420 940 ouxceseah-edor.exe 56 PID 940 wrote to memory of 3420 940 ouxceseah-edor.exe 56 PID 940 wrote to memory of 3420 940 ouxceseah-edor.exe 56
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:608
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\5503c4cd56e97ca80c26399e1c1b8240_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\5503c4cd56e97ca80c26399e1c1b8240_NEIKI.exe"2⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Windows\SysWOW64\ouxceseah-edor.exe"C:\Windows\system32\ouxceseah-edor.exe"3⤵
- Windows security bypass
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Windows\SysWOW64\ouxceseah-edor.exe--k33p4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:868
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5f37b21c00fd81bd93c89ce741a88f183
SHA1b2796500597c68e2f5638e1101b46eaf32676c1c
SHA25676cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
SHA512252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4
-
Filesize
71KB
MD5f19778eced5054abfb9462748e993b64
SHA1f51d4f4b5b9d677854685d67a85b42044c92cb57
SHA256e3017629057804b983ffc4c94df09ed64f4483bc5b74305bdfab0a003fe25f79
SHA512251cdb38fa77649d23ed417b4e70e9665b93914d9a46a4fc1ddbfb41d38b22cddfc5f2136aa01a7de59793081389de2f696f4659267361102e1eac905c31042c
-
Filesize
72KB
MD5b9462592c9b11f6f0b607f561e8cba5c
SHA10da0b800105ef5b25cb265b6d1efde0ae70dfa32
SHA25643b2629733cadf395cd461b416b508729d40f3dabd4cc64e9a652523864409d4
SHA51209d0718f98295fd12f319909c88ba981f2877f7329b828fe0e6dd25580649e84df1db454fcb46ccb13a86d4be1142175a63f995a3fc859cde028b311caecd7c5
-
Filesize
69KB
MD55503c4cd56e97ca80c26399e1c1b8240
SHA1cbc9da7b02bff2a1a7e203ea0cf5108ee3cc9f70
SHA25627c94f9544a75407f53021efc58c8b476769cb31c577b0014e39e136893a7ab2
SHA512564d6fccfe92ac7e62d6a88b1e2b4e9b9c0ad7cc424dd1e08e0f208d7c034b3382dab45e4ac9280f69d557ccfe453a939b887c254d016fff18c3215037c51d92