be3186d4058caaf253499d001de30059b1ae98136405ac6fd41c985ca396769f

Analysis

max time kernel
18s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 13:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c5eff680bd540336da241f20725823f0_NEIKI.exe
Size 128KB
Sample240508-qsbh3ahc95
SHA256 be3186d4058caaf253499d001de30059b1ae98136405ac6fd41c985ca396769f
MD5 c5eff680bd540336da241f20725823f0
SHA1 f6404355d4fe42b00640b0e7c67fb247004e5a85
SHA512 df5c73622dd43f6cd9ba1c2d3ad3748ca82b078bacca996ccf2c5a0016e9f8be74435ff70947327012594f916615dc4d4c43457bb2f9b43f427771150d42ca66
SSDEEP 3072:VvgwhTm5amkqIJS20hD7Me+QpWT21/Blx77x19:jmhUKWyJBlx77/9
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation	c5eff680bd540336da241f20725823f0_NEIKI.exe

Executes dropped EXE 3 IoCs

pid	Process
1328	c5eff680bd540336da241f20725823f0_NEIKI.exe
2692	datafli.exe
5060	datafli.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1328-21-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/1328-11-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/1328-16-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/1328-63-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/5060-66-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Key Name = "C:\\Users\\Admin\\AppData\\Roaming\\FolderName\\datafli.exe"	reg.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 3420 set thread context of 5040	3420	c5eff680bd540336da241f20725823f0_NEIKI.exe	92
PID 3420 set thread context of 1328	3420	c5eff680bd540336da241f20725823f0_NEIKI.exe	93
PID 2692 set thread context of 3388	2692	datafli.exe	101
PID 2692 set thread context of 5060	2692	datafli.exe	102
PID 2692 set thread context of 0	2692	datafli.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5040	svchost.exe
5040	svchost.exe
5040	svchost.exe
5040	svchost.exe
5040	svchost.exe
5040	svchost.exe
5040	svchost.exe
5040	svchost.exe
5040	svchost.exe
5040	svchost.exe
5040	svchost.exe
5040	svchost.exe
5040	svchost.exe
5040	svchost.exe
5040	svchost.exe
5040	svchost.exe
5040	svchost.exe
5040	svchost.exe
5040	svchost.exe
5040	svchost.exe
5040	svchost.exe
5040	svchost.exe
5040	svchost.exe
5040	svchost.exe
5040	svchost.exe
5040	svchost.exe
5040	svchost.exe
5040	svchost.exe
5040	svchost.exe
5040	svchost.exe
5040	svchost.exe
5040	svchost.exe
5040	svchost.exe
5040	svchost.exe
5040	svchost.exe
5040	svchost.exe
5040	svchost.exe
5040	svchost.exe
5040	svchost.exe
5040	svchost.exe
5040	svchost.exe
5040	svchost.exe
5040	svchost.exe
5040	svchost.exe
5040	svchost.exe
5040	svchost.exe
5040	svchost.exe
5040	svchost.exe
5040	svchost.exe
5040	svchost.exe
5040	svchost.exe
5040	svchost.exe
5040	svchost.exe
5040	svchost.exe
5040	svchost.exe
5040	svchost.exe
5040	svchost.exe
5040	svchost.exe
5040	svchost.exe
5040	svchost.exe
5040	svchost.exe
5040	svchost.exe
5040	svchost.exe
5040	svchost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5060	datafli.exe
Token: SeDebugPrivilege	5060	datafli.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3420	c5eff680bd540336da241f20725823f0_NEIKI.exe
5040	svchost.exe
1328	c5eff680bd540336da241f20725823f0_NEIKI.exe
2692	datafli.exe
3388	svchost.exe
5060	datafli.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 3420 wrote to memory of 5040	3420	c5eff680bd540336da241f20725823f0_NEIKI.exe	92
PID 3420 wrote to memory of 5040	3420	c5eff680bd540336da241f20725823f0_NEIKI.exe	92
PID 3420 wrote to memory of 5040	3420	c5eff680bd540336da241f20725823f0_NEIKI.exe	92
PID 3420 wrote to memory of 5040	3420	c5eff680bd540336da241f20725823f0_NEIKI.exe	92
PID 3420 wrote to memory of 5040	3420	c5eff680bd540336da241f20725823f0_NEIKI.exe	92
PID 3420 wrote to memory of 5040	3420	c5eff680bd540336da241f20725823f0_NEIKI.exe	92
PID 3420 wrote to memory of 5040	3420	c5eff680bd540336da241f20725823f0_NEIKI.exe	92
PID 3420 wrote to memory of 5040	3420	c5eff680bd540336da241f20725823f0_NEIKI.exe	92
PID 3420 wrote to memory of 5040	3420	c5eff680bd540336da241f20725823f0_NEIKI.exe	92
PID 3420 wrote to memory of 1328	3420	c5eff680bd540336da241f20725823f0_NEIKI.exe	93
PID 3420 wrote to memory of 1328	3420	c5eff680bd540336da241f20725823f0_NEIKI.exe	93
PID 3420 wrote to memory of 1328	3420	c5eff680bd540336da241f20725823f0_NEIKI.exe	93
PID 3420 wrote to memory of 1328	3420	c5eff680bd540336da241f20725823f0_NEIKI.exe	93
PID 3420 wrote to memory of 1328	3420	c5eff680bd540336da241f20725823f0_NEIKI.exe	93
PID 3420 wrote to memory of 1328	3420	c5eff680bd540336da241f20725823f0_NEIKI.exe	93
PID 3420 wrote to memory of 1328	3420	c5eff680bd540336da241f20725823f0_NEIKI.exe	93
PID 3420 wrote to memory of 1328	3420	c5eff680bd540336da241f20725823f0_NEIKI.exe	93
PID 1328 wrote to memory of 1980	1328	c5eff680bd540336da241f20725823f0_NEIKI.exe	94
PID 1328 wrote to memory of 1980	1328	c5eff680bd540336da241f20725823f0_NEIKI.exe	94
PID 1328 wrote to memory of 1980	1328	c5eff680bd540336da241f20725823f0_NEIKI.exe	94
PID 1980 wrote to memory of 2748	1980	cmd.exe	97
PID 1980 wrote to memory of 2748	1980	cmd.exe	97
PID 1980 wrote to memory of 2748	1980	cmd.exe	97
PID 1328 wrote to memory of 2692	1328	c5eff680bd540336da241f20725823f0_NEIKI.exe	98
PID 1328 wrote to memory of 2692	1328	c5eff680bd540336da241f20725823f0_NEIKI.exe	98
PID 1328 wrote to memory of 2692	1328	c5eff680bd540336da241f20725823f0_NEIKI.exe	98
PID 2692 wrote to memory of 3388	2692	datafli.exe	101
PID 2692 wrote to memory of 3388	2692	datafli.exe	101
PID 2692 wrote to memory of 3388	2692	datafli.exe	101
PID 2692 wrote to memory of 3388	2692	datafli.exe	101
PID 2692 wrote to memory of 3388	2692	datafli.exe	101
PID 2692 wrote to memory of 3388	2692	datafli.exe	101
PID 2692 wrote to memory of 3388	2692	datafli.exe	101
PID 2692 wrote to memory of 3388	2692	datafli.exe	101
PID 2692 wrote to memory of 3388	2692	datafli.exe	101
PID 2692 wrote to memory of 5060	2692	datafli.exe	102
PID 2692 wrote to memory of 5060	2692	datafli.exe	102
PID 2692 wrote to memory of 5060	2692	datafli.exe	102
PID 2692 wrote to memory of 5060	2692	datafli.exe	102
PID 2692 wrote to memory of 5060	2692	datafli.exe	102
PID 2692 wrote to memory of 5060	2692	datafli.exe	102
PID 2692 wrote to memory of 5060	2692	datafli.exe	102
PID 2692 wrote to memory of 5060	2692	datafli.exe	102

C:\Users\Admin\AppData\Local\Temp\c5eff680bd540336da241f20725823f0_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\c5eff680bd540336da241f20725823f0_NEIKI.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3420
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\system32\svchost.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:5040
- C:\Users\Admin\AppData\Local\Temp\c5eff680bd540336da241f20725823f0_NEIKI.exe
  "C:\Users\Admin\AppData\Local\Temp\c5eff680bd540336da241f20725823f0_NEIKI.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1328
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EFBBW.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1980
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Key Name" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\FolderName\datafli.exe" /f
      4⤵
      Adds Run key to start application
      PID:2748
- - C:\Users\Admin\AppData\Roaming\FolderName\datafli.exe
    "C:\Users\Admin\AppData\Roaming\FolderName\datafli.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2692
  - - C:\Windows\SysWOW64\svchost.exe
      "C:\Windows\system32\svchost.exe"
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:3388
  - - C:\Users\Admin\AppData\Roaming\FolderName\datafli.exe
      "C:\Users\Admin\AppData\Roaming\FolderName\datafli.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:5060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EFBBW.txt

Path C:\Users\Admin\AppData\Local\Temp\EFBBW.txt
Size 148B
SHA256 48eb38071c5a2a5c40b3110fcbcb52f6ad0849c3ec20b1cf1be5fa223ac0aaf4
MD5 cad4294c9f78a2359f70ea09f0f56325
SHA1 1d02ee76821a5b6fe45aa4f12bac8f86b0043691
SHA512 cd62dd9423a3224d2c4d27853554e0574212cf48a824d562ab3e17231bb839f1dadb12067a7ca39c0cf8ddd5b0e3e8c1dbf601f9822567957e7c29e51fe1693d
MD5 SHA1 SHA512

Submit Download

c5eff680bd540336da241f20725823f0_NEIKI.exe

Path C:\Users\Admin\AppData\Local\Temp\c5eff680bd540336da241f20725823f0_NEIKI.exe
Size 128KB
SHA256 be3186d4058caaf253499d001de30059b1ae98136405ac6fd41c985ca396769f
MD5 c5eff680bd540336da241f20725823f0
SHA1 f6404355d4fe42b00640b0e7c67fb247004e5a85
SHA512 df5c73622dd43f6cd9ba1c2d3ad3748ca82b078bacca996ccf2c5a0016e9f8be74435ff70947327012594f916615dc4d4c43457bb2f9b43f427771150d42ca66
SSDEEP 3072:VvgwhTm5amkqIJS20hD7Me+QpWT21/Blx77x19:jmhUKWyJBlx77/9
MD5 SHA1 SHA512 SSDEEP

Submit Download

datafli.exe

Path C:\Users\Admin\AppData\Roaming\FolderName\datafli.exe
Size 128KB
SHA256 66a91a5a7fa06bd31d3a3757601523026968a6a6a96fc9ca87c921ba0f748a59
MD5 29206e82ec430ec91e37979e39cf8f90
SHA1 85e1b1a2d5dde4d9c597506698f3fa471acf11e7
SHA512 f552e67283223091cd3925dc5d72f5ccc701d3b02dfa803c0e2bcde21b04b155125687c4c4965a2e2e6ce017ebbfb0f933e87cb1eb78ce6eb3df9eecdc03db19
SSDEEP 3072:VvgwhTm5amkqIJS20hD7Me+QpWT21/Blx77x19:jmhUKWyJBlx77/9
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1328-16-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/1328-63-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/1328-21-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/1328-11-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/2692-59-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/3388-60-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/3388-48-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/3388-73-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/3388-50-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/3420-7-0x0000000002250000-0x0000000002251000-memory.dmp

Download

memory/3420-6-0x0000000002200000-0x0000000002201000-memory.dmp

Download

memory/3420-5-0x00000000021C0000-0x00000000021C1000-memory.dmp

Download

memory/3420-8-0x0000000002AE0000-0x0000000002AE1000-memory.dmp

Download

memory/3420-3-0x0000000002140000-0x0000000002141000-memory.dmp

Download

memory/3420-9-0x0000000002B30000-0x0000000002B31000-memory.dmp

Download

memory/3420-4-0x0000000002180000-0x0000000002181000-memory.dmp

Download

memory/3420-10-0x0000000002B70000-0x0000000002B71000-memory.dmp

Download

memory/5040-17-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/5040-2-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/5040-14-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/5040-71-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/5040-22-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/5060-66-0x0000000000400000-0x000000000040B000-memory.dmp

Download