52f21e96a4ce291cb59ccbab610e6b105a0ea6983900580f0fd15b865ad6f48e

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 16:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ff5f38ed08962bcd2924d1f6c150be80_NEIKI.exe
Size

2.8MB
MD5

ff5f38ed08962bcd2924d1f6c150be80
SHA1

0edcc5203792a1ad311de4d0d6b3ccc13681916b
SHA256

52f21e96a4ce291cb59ccbab610e6b105a0ea6983900580f0fd15b865ad6f48e
SHA512

21686f6dc978d98f5c241a9904bfd405a4641f8056612c59d5604df3156a8e86e83003b5defdb88007c1cfc13cdd8b5a7b4634431f24b848b2aa179b85597552
SSDEEP

49152:QhN2skpzPXDFBjWRJTCAIHuDeeaJ98mjRC9YC2Ns+/X0h54GEewKO11tmlNQ2ayk:Qj2bz/5YvpI2eey98CRC4L0ZRbO11wlE

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2952	install.exe
1200	Process not Found

Loads dropped DLL 5 IoCs

pid	Process
2180	ff5f38ed08962bcd2924d1f6c150be80_NEIKI.exe
2180	ff5f38ed08962bcd2924d1f6c150be80_NEIKI.exe
2952	install.exe
848	Process not Found
848	Process not Found

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2952	2180	ff5f38ed08962bcd2924d1f6c150be80_NEIKI.exe	28
PID 2180 wrote to memory of 2952	2180	ff5f38ed08962bcd2924d1f6c150be80_NEIKI.exe	28
PID 2180 wrote to memory of 2952	2180	ff5f38ed08962bcd2924d1f6c150be80_NEIKI.exe	28
PID 2180 wrote to memory of 2952	2180	ff5f38ed08962bcd2924d1f6c150be80_NEIKI.exe	28

C:\Users\Admin\AppData\Local\Temp\ff5f38ed08962bcd2924d1f6c150be80_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\ff5f38ed08962bcd2924d1f6c150be80_NEIKI.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2180
- \??\c:\12217c3e0d44fe8d7a3a85\install.exe
  c:\12217c3e0d44fe8d7a3a85\.\install.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2952

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\12217c3e0d44fe8d7a3a85\eula.1031.txt

Filesize
17KB

MD5
9147a93f43d8e58218ebcb15fda888c9

SHA1
8277c722ba478be8606d8429de3772b5de4e5f09

SHA256
a75019ac38e0d3570633fa282f3d95d20763657f4a2fe851fae52a3185d1eded

SHA512
cc9176027621a590a1d4f6e17942012023e3fabc3316bc62c4b17cd61ce76bf5cf270bd32da95dba7ddf3163e84114be1103a6f810ca1a05d914712895f09705

Download Submit
\12217c3e0d44fe8d7a3a85\install.exe

Filesize
835KB

MD5
e015a2d8890e2a96a93ca818f834c45b

SHA1
30bda2b4464b1c41210cba367e444aed56502360

SHA256
dc1ba9cb15d0808dc2d80ce13acfa0b07acdfcfe2cdf94da47e0e570e7345f6d

SHA512
20a80b50486e938b92f3aef85e59307f644b69dc5d1edee38038182b57caf636f5f1909959f6fafcfc2e915010d2b3d230cba8300fbc0f63ee2ee3ad8ad64123

Download Submit
\12217c3e0d44fe8d7a3a85\install.res.1033.dll

Filesize
88KB

MD5
43fb29e3a676d26fcbf0352207991523

SHA1
c485159b01baa676167c414fd15f1026e3ae7c14

SHA256
4107f4813bc41ed6a6586d1ba01a5c3703ed60c2df060cba6791f449f3689de7

SHA512
ad748c63d912e194bb5be42f6db192b22f59f760e0536118dfa963fe29001e7fe635d035f31d86aa5e77a1d4f7ceabf27b03645d0037f147293af1e32eab57a4

Download Submit
\??\c:\12217c3e0d44fe8d7a3a85\eula.1033.txt

Filesize
9KB

MD5
99c22d4a31f4ead4351b71d6f4e5f6a1

SHA1
73207ebe59f6e1073c0d76c8835a312c367b6104

SHA256
93a3c629fecfd10c1cf614714efd69b10e89cfcaf94c2609d688b27754e4ab41

SHA512
47b7ec5fed06d6c789935e9e95ea245c7c498b859e2c0165a437a7bf0006e447c4df4beeb97484c56446f1dae547a01387bea4e884970380f37432825eb16e94

Download Submit
\??\c:\12217c3e0d44fe8d7a3a85\globdata.ini

Filesize
1KB

MD5
0a6b586fabd072bd7382b5e24194eac7

SHA1
60e3c7215c1a40fbfb3016d52c2de44592f8ca95

SHA256
7912e3fcf2698cf4f8625e563cd8215c6668739cae18bd6f27af2d25bec5c951

SHA512
b96b0448e9f0e94a7867b6bb103979e9ef2c0e074bcb85988d450d63de6edcf21dc83bb154aafb7de524af3c3734f0bb1ba649db0408612479322e1aa85be9f4

Download Submit
\??\c:\12217c3e0d44fe8d7a3a85\install.ini

Filesize
843B

MD5
0da9ab4977f3e7ba8c65734df42fdab6

SHA1
b4ed6eea276f1a7988112f3bde0bd89906237c3f

SHA256
672621b056188f8d3fa5ab8cd3df4f95530c962af9bb11cf7c9bd1127b3c3605

SHA512
1ef58271cdedbdc53615631cc823483f874c89c2d62e0678de9d469a82bd676eb8abd34656caa5128b7edb0eb24dbf0992e5e571a97f7782c933b2be88af3144

Download Submit
\??\c:\12217c3e0d44fe8d7a3a85\vc_red.msi

Filesize
236KB

MD5
d53737cea320b066c099894ed1780705

SHA1
d8dc8c2c761933502307a331660bd3fb7bd2c078

SHA256
be6288737ea9691f29a17202eccbc0a2e3e1b1b4bacc090ceee2436970aec240

SHA512
0af685e4ffb9f7f2e5b28982b9cf3da4ee00e26bd05e830d5316bce277dc91dfee3fe557719ab3406ad866d1ce72644e7a5400dcd561b93d367e12eb96078ffe

Download Submit
\??\c:\12217c3e0d44fe8d7a3a85\vcredist.bmp

Filesize
5KB

MD5
06fba95313f26e300917c6cea4480890

SHA1
31beee44776f114078fc403e405eaa5936c4bc3b

SHA256
594884a8006e24ad5b1578cd7c75aca21171bb079ebdc4f6518905bcf2237ba1

SHA512
7dca0f1ab5d3fd1ac8755142a7ca4d085bb0c2f12a7272e56159dadfa22da79ec8261815be71b9f5e7c32f6e8121ecb2443060f7db76feaf01eb193200e67dfd

Download Submit
memory/2180-0-0x0000000001000000-0x00000000012E6000-memory.dmp

Filesize
2.9MB

Download
memory/2180-59-0x0000000001000000-0x00000000012E6000-memory.dmp

Filesize
2.9MB

Download
memory/2952-53-0x00000000000A0000-0x00000000000A1000-memory.dmp

Filesize
4KB

Download
memory/2952-60-0x00000000000A0000-0x00000000000A1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads