28600201b1501a6a0e83c6f453cfbfea3387eddab725b7c31604873221121b54

Analysis

max time kernel
149s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 11:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

84387b3554454889383d28593295f330_NEIKI.exe
Size

71KB
MD5

84387b3554454889383d28593295f330
SHA1

d0b44b9b9cc476f9a4e976e79453600aa648d708
SHA256

28600201b1501a6a0e83c6f453cfbfea3387eddab725b7c31604873221121b54
SHA512

f315ceaec0b987ba595c16bd946ad1b78343ed023dea8beebd2405cdee985af4783664838bc71bb3bb22d53aa9b0cb50e3529cd5cf28693b147ce61ee875f4c3
SSDEEP

1536:xUnHNbMNaFo7LlSChua7GfKezrsP7LGjQdO:8bMcFo330kJezKLGyO

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	uhcefut-udat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	uhcefut-udat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	uhcefut-udat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	uhcefut-udat.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{51475451-5a54-5245-5147-54515A545245}\IsInstalled = "1"	uhcefut-udat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{51475451-5a54-5245-5147-54515A545245}\StubPath = "C:\\Windows\\system32\\abcafuh-ucor.exe"	uhcefut-udat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{51475451-5a54-5245-5147-54515A545245}	uhcefut-udat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{51475451-5a54-5245-5147-54515A545245}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a"	uhcefut-udat.exe

Sets file execution options in registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe	uhcefut-udat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a"	uhcefut-udat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\eapduhos.exe"	uhcefut-udat.exe

Executes dropped EXE 2 IoCs

pid	Process
2964	uhcefut-udat.exe
2608	uhcefut-udat.exe

Loads dropped DLL 3 IoCs

pid	Process
1460	84387b3554454889383d28593295f330_NEIKI.exe
1460	84387b3554454889383d28593295f330_NEIKI.exe
2964	uhcefut-udat.exe

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	uhcefut-udat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	uhcefut-udat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	uhcefut-udat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	uhcefut-udat.exe

Modifies WinLogon 2 TTPs 5 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\ebkonis-asom.dll"	uhcefut-udat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup"	uhcefut-udat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}	uhcefut-udat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	uhcefut-udat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a"	uhcefut-udat.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ebkonis-asom.dll	uhcefut-udat.exe
File opened for modification	C:\Windows\SysWOW64\uhcefut-udat.exe	uhcefut-udat.exe
File opened for modification	C:\Windows\SysWOW64\uhcefut-udat.exe	84387b3554454889383d28593295f330_NEIKI.exe
File created	C:\Windows\SysWOW64\uhcefut-udat.exe	84387b3554454889383d28593295f330_NEIKI.exe
File created	C:\Windows\SysWOW64\eapduhos.exe	uhcefut-udat.exe
File created	C:\Windows\SysWOW64\abcafuh-ucor.exe	uhcefut-udat.exe
File opened for modification	C:\Windows\SysWOW64\eapduhos.exe	uhcefut-udat.exe
File opened for modification	C:\Windows\SysWOW64\abcafuh-ucor.exe	uhcefut-udat.exe
File opened for modification	C:\Windows\SysWOW64\ebkonis-asom.dll	uhcefut-udat.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2964	uhcefut-udat.exe
2964	uhcefut-udat.exe
2964	uhcefut-udat.exe
2964	uhcefut-udat.exe
2608	uhcefut-udat.exe
2964	uhcefut-udat.exe
2964	uhcefut-udat.exe
2964	uhcefut-udat.exe
2964	uhcefut-udat.exe
2964	uhcefut-udat.exe
2964	uhcefut-udat.exe
2964	uhcefut-udat.exe
2964	uhcefut-udat.exe
2964	uhcefut-udat.exe
2964	uhcefut-udat.exe
2964	uhcefut-udat.exe
2964	uhcefut-udat.exe
2964	uhcefut-udat.exe
2964	uhcefut-udat.exe
2964	uhcefut-udat.exe
2964	uhcefut-udat.exe
2964	uhcefut-udat.exe
2964	uhcefut-udat.exe
2964	uhcefut-udat.exe
2964	uhcefut-udat.exe
2964	uhcefut-udat.exe
2964	uhcefut-udat.exe
2964	uhcefut-udat.exe
2964	uhcefut-udat.exe
2964	uhcefut-udat.exe
2964	uhcefut-udat.exe
2964	uhcefut-udat.exe
2964	uhcefut-udat.exe
2964	uhcefut-udat.exe
2964	uhcefut-udat.exe
2964	uhcefut-udat.exe
2964	uhcefut-udat.exe
2964	uhcefut-udat.exe
2964	uhcefut-udat.exe
2964	uhcefut-udat.exe
2964	uhcefut-udat.exe
2964	uhcefut-udat.exe
2964	uhcefut-udat.exe
2964	uhcefut-udat.exe
2964	uhcefut-udat.exe
2964	uhcefut-udat.exe
2964	uhcefut-udat.exe
2964	uhcefut-udat.exe
2964	uhcefut-udat.exe
2964	uhcefut-udat.exe
2964	uhcefut-udat.exe
2964	uhcefut-udat.exe
2964	uhcefut-udat.exe
2964	uhcefut-udat.exe
2964	uhcefut-udat.exe
2964	uhcefut-udat.exe
2964	uhcefut-udat.exe
2964	uhcefut-udat.exe
2964	uhcefut-udat.exe
2964	uhcefut-udat.exe
2964	uhcefut-udat.exe
2964	uhcefut-udat.exe
2964	uhcefut-udat.exe
2964	uhcefut-udat.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2964	uhcefut-udat.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1460 wrote to memory of 2964	1460	84387b3554454889383d28593295f330_NEIKI.exe	28
PID 1460 wrote to memory of 2964	1460	84387b3554454889383d28593295f330_NEIKI.exe	28
PID 1460 wrote to memory of 2964	1460	84387b3554454889383d28593295f330_NEIKI.exe	28
PID 1460 wrote to memory of 2964	1460	84387b3554454889383d28593295f330_NEIKI.exe	28
PID 2964 wrote to memory of 436	2964	uhcefut-udat.exe	5
PID 2964 wrote to memory of 1152	2964	uhcefut-udat.exe	20
PID 2964 wrote to memory of 1152	2964	uhcefut-udat.exe	20
PID 2964 wrote to memory of 2608	2964	uhcefut-udat.exe	29
PID 2964 wrote to memory of 2608	2964	uhcefut-udat.exe	29
PID 2964 wrote to memory of 2608	2964	uhcefut-udat.exe	29
PID 2964 wrote to memory of 2608	2964	uhcefut-udat.exe	29
PID 2964 wrote to memory of 1152	2964	uhcefut-udat.exe	20
PID 2964 wrote to memory of 1152	2964	uhcefut-udat.exe	20
PID 2964 wrote to memory of 1152	2964	uhcefut-udat.exe	20
PID 2964 wrote to memory of 1152	2964	uhcefut-udat.exe	20
PID 2964 wrote to memory of 1152	2964	uhcefut-udat.exe	20
PID 2964 wrote to memory of 1152	2964	uhcefut-udat.exe	20
PID 2964 wrote to memory of 1152	2964	uhcefut-udat.exe	20
PID 2964 wrote to memory of 1152	2964	uhcefut-udat.exe	20
PID 2964 wrote to memory of 1152	2964	uhcefut-udat.exe	20
PID 2964 wrote to memory of 1152	2964	uhcefut-udat.exe	20
PID 2964 wrote to memory of 1152	2964	uhcefut-udat.exe	20
PID 2964 wrote to memory of 1152	2964	uhcefut-udat.exe	20
PID 2964 wrote to memory of 1152	2964	uhcefut-udat.exe	20
PID 2964 wrote to memory of 1152	2964	uhcefut-udat.exe	20
PID 2964 wrote to memory of 1152	2964	uhcefut-udat.exe	20
PID 2964 wrote to memory of 1152	2964	uhcefut-udat.exe	20
PID 2964 wrote to memory of 1152	2964	uhcefut-udat.exe	20
PID 2964 wrote to memory of 1152	2964	uhcefut-udat.exe	20
PID 2964 wrote to memory of 1152	2964	uhcefut-udat.exe	20
PID 2964 wrote to memory of 1152	2964	uhcefut-udat.exe	20
PID 2964 wrote to memory of 1152	2964	uhcefut-udat.exe	20
PID 2964 wrote to memory of 1152	2964	uhcefut-udat.exe	20
PID 2964 wrote to memory of 1152	2964	uhcefut-udat.exe	20
PID 2964 wrote to memory of 1152	2964	uhcefut-udat.exe	20
PID 2964 wrote to memory of 1152	2964	uhcefut-udat.exe	20
PID 2964 wrote to memory of 1152	2964	uhcefut-udat.exe	20
PID 2964 wrote to memory of 1152	2964	uhcefut-udat.exe	20
PID 2964 wrote to memory of 1152	2964	uhcefut-udat.exe	20
PID 2964 wrote to memory of 1152	2964	uhcefut-udat.exe	20
PID 2964 wrote to memory of 1152	2964	uhcefut-udat.exe	20
PID 2964 wrote to memory of 1152	2964	uhcefut-udat.exe	20
PID 2964 wrote to memory of 1152	2964	uhcefut-udat.exe	20
PID 2964 wrote to memory of 1152	2964	uhcefut-udat.exe	20
PID 2964 wrote to memory of 1152	2964	uhcefut-udat.exe	20
PID 2964 wrote to memory of 1152	2964	uhcefut-udat.exe	20
PID 2964 wrote to memory of 1152	2964	uhcefut-udat.exe	20
PID 2964 wrote to memory of 1152	2964	uhcefut-udat.exe	20
PID 2964 wrote to memory of 1152	2964	uhcefut-udat.exe	20
PID 2964 wrote to memory of 1152	2964	uhcefut-udat.exe	20
PID 2964 wrote to memory of 1152	2964	uhcefut-udat.exe	20
PID 2964 wrote to memory of 1152	2964	uhcefut-udat.exe	20
PID 2964 wrote to memory of 1152	2964	uhcefut-udat.exe	20
PID 2964 wrote to memory of 1152	2964	uhcefut-udat.exe	20
PID 2964 wrote to memory of 1152	2964	uhcefut-udat.exe	20
PID 2964 wrote to memory of 1152	2964	uhcefut-udat.exe	20
PID 2964 wrote to memory of 1152	2964	uhcefut-udat.exe	20
PID 2964 wrote to memory of 1152	2964	uhcefut-udat.exe	20
PID 2964 wrote to memory of 1152	2964	uhcefut-udat.exe	20
PID 2964 wrote to memory of 1152	2964	uhcefut-udat.exe	20
PID 2964 wrote to memory of 1152	2964	uhcefut-udat.exe	20
PID 2964 wrote to memory of 1152	2964	uhcefut-udat.exe	20
PID 2964 wrote to memory of 1152	2964	uhcefut-udat.exe	20
PID 2964 wrote to memory of 1152	2964	uhcefut-udat.exe	20

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:436

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1152
- C:\Users\Admin\AppData\Local\Temp\84387b3554454889383d28593295f330_NEIKI.exe
  "C:\Users\Admin\AppData\Local\Temp\84387b3554454889383d28593295f330_NEIKI.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1460
- - C:\Windows\SysWOW64\uhcefut-udat.exe
    "C:\Windows\SysWOW64\uhcefut-udat.exe"
    3⤵
    - Windows security bypass
    - Modifies Installed Components in the registry
    - Sets file execution options in registry
    - Executes dropped EXE
    - Loads dropped DLL
    - Windows security modification
    - Modifies WinLogon
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2964
  - - C:\Windows\SysWOW64\uhcefut-udat.exe
      --k33p
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:2608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\abcafuh-ucor.exe

Filesize
71KB

MD5
51aa933b42d5c0a8834849fd35d26ded

SHA1
9fb73e4fba4dd23ecf836ce75f02d33df5e01236

SHA256
b42eb762a97ecfed3658d334803b05e502c6992df4f510a86718209e895243b1

SHA512
351a904d878e98f3573a930ba3c2bc5da8b5024f794a3e3046e59c511ad6b458a81f1d03d03e31787e1b5010426a048dfb0f0f2dc97391e4c83cd60e7b2364e2

Download Submit
C:\Windows\SysWOW64\eapduhos.exe

Filesize
72KB

MD5
da96e823134d94741c0a574f100dba0d

SHA1
7c510c3236dc70964fabc4b9808bf123a80e8a8c

SHA256
6fd858beb03c84b93a92f173a0a5611df017acce49e06b9b6d5b19d30971995b

SHA512
13277cd5e345bb789300073f274702f4a7ea01a258409b299d762869fac8d1d3b79b8980bfc6b90d5383a0dd3c3dab492b3e723e7871424706026da895204ea4

Download Submit
C:\Windows\SysWOW64\ebkonis-asom.dll

Filesize
5KB

MD5
f37b21c00fd81bd93c89ce741a88f183

SHA1
b2796500597c68e2f5638e1101b46eaf32676c1c

SHA256
76cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0

SHA512
252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4

Download Submit
\Windows\SysWOW64\uhcefut-udat.exe

Filesize
69KB

MD5
15a98469b3fd1db0980bae07201a3db9

SHA1
8e860546d587475445496e82683a6580b1a1b9a8

SHA256
d646c335e6fbbe71df12ed6bc681d6f72133ead74999de73222cf6834aa3b010

SHA512
bd6d57e0c0d231c6ca349aefde39a39446aa3db23f2f418d0e23c774a40d40d5b1786ec1d8e7d01a1f3f70506bf93ad71e6c234458f152a8a8135bc353d71f3f

Download Submit
memory/1460-7-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2608-54-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2964-53-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download