Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
08-05-2024 17:28
General
-
Target
029fa9bd4b574623a93390a908ab46d0_NEIKI.exe
-
Size
1.3MB
-
MD5
029fa9bd4b574623a93390a908ab46d0
-
SHA1
72bc9a85ae2ea43e9c78f3713f58a8370abecd35
-
SHA256
ddd45351e05ed1360985bef4ed14f558596b5521cacb9d24046549a2cdc2e01d
-
SHA512
979f539f377513207eaf58838391d6cafe5ae5fd595e299104574d91311965b210b6f4afa028dea7a82edce1e5bdbeaf5df4da96e74afbe75fbfe76f6a85f7a6
-
SSDEEP
24576:zq2RXvNDXDLU+JyxAdkO8syl7UDD6+K7jHxUuzXSAaEVjjyGweVl8zN/ME1:zqOfNDTLUe6+LyNUvS7L7SAvwhpRB1
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
-
Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL 3 IoCs
-
UPX packed file 16 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Modifies registry class 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\029fa9bd4b574623a93390a908ab46d0_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\029fa9bd4b574623a93390a908ab46d0_NEIKI.exe"1⤵
- Identifies Wine through registry keys
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\RunDll32.exeRunDll32.exe "C:\Users\Admin\AppData\Local\Temp\utt4C2C.tmp",_OCPRD119RunOpenCandyDLL@16 20202⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
221KB
MD5f9dfb7d01568bf06b3b335652e8eb637
SHA11bfcca85cf0fae45ef4683a33653a0b9420d5333
SHA256a14248c0cebba9b698a8b8e0a36df6e04d01fb258b374a48498729609bc17ff8
SHA512e4ebbe75ed4add4db5ac17468a165561c99b6601dd6d21c96ffd099dae4fd71223f06ba602da0c499a9ae5bbbd24ceac093a2fc8973f475c227b56dadb8d69de
-
Filesize
293KB
MD57a9bf84ae6f5793548177fb6998ce922
SHA152f3182e4cd4058d14afd9e40b14fed9d9b1494b
SHA2566b85f7a8a87270292f546cd1de615e594a37e518c4d0d35d136a52a0cc934c80
SHA5122e8bba02c58c39d08337c730afff85649a2f35d3cc68938456b8e4674a5aa6034fa056f847f18213716d9195526a4da8cc8af7ed7e022c581fc05963eb53a789
-
Filesize
6KB
MD52596e6cf97dcf15eea04b8548e8844cb
SHA19b31e394974c3a5f9971bfc2faaece9762945f1c
SHA2568b4a1b6d059f3512078fe065c58baf292efca5e02e290d156170cb792c1f796d
SHA512b666ed59d3a38b90e201a3336bd41055b3264b4e4c214d0424cfe76220edb478dd9e719cea6e0121b2e5589507850887777066cc275d50a177ff1152fc1244b9
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
624KB
-
Filesize
816KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
5.8MB
-
Filesize
5.8MB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
4KB
-
Filesize
816KB
-
Filesize
816KB