Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
-
submitted
08/05/2024, 12:41
General
-
Target
b24cd4449518aa1483d2aa6089158d10_NEIKI.exe
-
Size
212KB
-
MD5
b24cd4449518aa1483d2aa6089158d10
-
SHA1
89b71649933ec56b28d6e3aeea552bd98eaa478b
-
SHA256
222d55dbbd434de2c7ef92f162bec45eeb827c01c61ed0295af2cb682d02338d
-
SHA512
6cb0b982c476e31fc97b2d8c9d6cbfb96b8e04b15d34e753e01e5c8e4c53245c4cf433472e5ef2e286acbd73210896f5493b46411bb04318eb8ff867f5a8dcc5
-
SSDEEP
6144:0ob34ERMS/H7YAVsobrVn5G4E3Hi96mbQzJWFO8Omw4G:zboEj/8ASWM4Ki96/zqIKG
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b24cd4449518aa1483d2aa6089158d10_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\b24cd4449518aa1483d2aa6089158d10_NEIKI.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168B
MD5d57e3a550060f85d44a175139ea23021
SHA12c5cb3428a322c9709a34d04dd86fe7628f8f0a6
SHA25643edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c
SHA5120364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063
-
Filesize
167B
MD50104c301c5e02bd6148b8703d19b3a73
SHA17436e0b4b1f8c222c38069890b75fa2baf9ca620
SHA256446a6087825fa73eadb045e5a2e9e2adf7df241b571228187728191d961dda1f
SHA51284427b656a6234a651a6d8285c103645b861a18a6c5af4abb5cb4f3beb5a4f0df4a74603a0896c7608790fbb886dc40508e92d5709f44dca05dd46c8316d15bf
-
Filesize
22KB
MD54dcf6494ace286e90750e9e42ff29af8
SHA10aede0eb2de19fc9f77463a6eb4849ec9c30340f
SHA256841073814a1250c6a47cf4da5afc641b10dd85752d566982d44685d6e3ef15c1
SHA512c9f8f5fcf0c934ec8a84071cd2ad466862e0bcee7d4a82bf2e14a1bca158f1e3d2159b2a8894cc0b61776d565b4a86e2542d200ceff3347397f3c6f8c08752a9
-
Filesize
41KB
MD549cbeaf7aa302b6717cffbf004cb445d
SHA199b86b820a127761739e20ab1127f86fceb48347
SHA256d30f42659b9ac71b9851962216dd3a47c0e8ce0b7963b503332079fb43b04433
SHA5127b0492457dd2eac2158a10eaebbc3845b91e876738c16e929a856a3d2be966c6dca65886671813bec8d9d049972acb96506296f9ac66fb8f4650e397742013f5
-
Filesize
42KB
MD5d0d2aae7ec2168cb62098d951b097b77
SHA19125fb16087992c69fc65a1817a08677aab7e128
SHA256544cf829e0e894450df9b2e21832bf7bec01d9cbe9b147923ecffb8ea8286e1a
SHA5125ade75498bf2e6ffce4217165a729614a56557ac474c11ea57607e29a1269b23a2c1758fe94da6a4c518b3ad9757d0b99644667d0327b79314890335f1b642a7
-
Filesize
593B
MD53b03d93d3487806337b5c6443ce7a62d
SHA193a7a790bb6348606cbdaf5daeaaf4ea8cf731d0
SHA2567392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30
SHA512770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88
-
Filesize
457B
MD5531ec87a0b2f9477a52d88b111d0d46a
SHA150a72e5752075309f91c062e0282a7e7cd1e751e
SHA2564875b451859b1eb8d0d3b040b1bb8d654d212edb6d9c721cf0f4372129579385
SHA51207994963fd76b31ef0ba2c7f418dcb3ee0290f6baca2d8ec63a6e6b861557b13fbc20d2f0a10a66f35c4d72d4d2c1920ac88b96174604f2f8856868912327da1
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
23KB
MD586979a904b794c369ec9824b092a5690
SHA1a691efae2edb3544238e5069e94e9111172d9474
SHA25604b8c37ae66f5bd67f0793c6a4ef4c7be0f92110e963c0e798d2a8f534aec828
SHA512e3cd676a26ad108371a2af4dd0e99ecd55b1368b274e68a3984f0ea03ece3a7145e0929dbd4f66d3285ded934a92c9e69f3e743ff4ecb6bd5d5524012f714cd1
-
Filesize
212KB
MD566617b75b9e1bb4ad3fc80088b39ad28
SHA1e380eeed78a461619c2e62f792b6ce5c8202943b
SHA2560480ed2e2af893f866d81e1dcce2687506042674f52fee8c2f40ec7b1565d76c
SHA5120d5a1a68901ec88ab5a7dad34eba9b303bcf17e61d3662f51b2c39f1b0651c9f4e7cbd6058d86cbb1be0bd61c3a88e162d55b2b2a3c2417ad3d51169a611e78d
-
Filesize
1.7MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
1.7MB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB