Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
08/05/2024, 11:32
General
-
Target
884f71e0b7f19e17465045ba8faba6b0_NEIKI.exe
-
Size
193KB
-
MD5
884f71e0b7f19e17465045ba8faba6b0
-
SHA1
3b19b262a750d9c1daaccbf7485f618c16c3e4ec
-
SHA256
e3f9c1e1553d770426534df91e9a3c4bbaabca870af060a14e90711f82fc65a8
-
SHA512
28364c2e1838e39c73e4f9287e9683f19b8fcf85cf7ebfffd913d33652fe51a981c5de4bc55ba1bf1ed3a56d7da99e20cdfdd4dcf694bf75d66a985c7104e5bf
-
SSDEEP
3072:4MrgO3JrtkMJ5mU8FjBp6v5bkWLLSyRaUDtCerDJO6cGA5Rag2exBD6:ZlZULjBpe1fgUDtXrI5Rag2GBG
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\884f71e0b7f19e17465045ba8faba6b0_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\884f71e0b7f19e17465045ba8faba6b0_NEIKI.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\884f71e0b7f19e17465045ba8faba6b0_NEIKI.exeC:\Users\Admin\AppData\Local\Temp\884f71e0b7f19e17465045ba8faba6b0_NEIKI.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
193KB
MD5aa655693884a4b05c86ed463e14e0046
SHA101506e64fe9118fab7ef1f2738c140f94ab28c62
SHA2563adaf5254bd9f50f0a3e4f1fea3345d08772cf3c796ad76d2b237d957e0c572f
SHA5120a460539ed644502407b921af7e4d5a4b148f77a56f721372c77120a0b04b256e2707b1a8ce453586cc13cd3c46b96b442ef98d206b7fe245467d13c90501d7c
-
Filesize
224KB
-
Filesize
224KB
-
Filesize
224KB
-
Filesize
104KB
-
Filesize
224KB