Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/05/2024, 00:43

General

  • Target

    b0795e5246b26ec3928cf3decc313420_NEIKI.exe

  • Size

    119KB

  • MD5

    b0795e5246b26ec3928cf3decc313420

  • SHA1

    e776f3d12cc400a41adac40e69d9f5e67bde84b5

  • SHA256

    2d88784d6c48c3350439bdbcdc92d0348df4ea8fac7fec226bf734a52b11de10

  • SHA512

    d8f89d242e96348828089f2347bf202e2adc200ce69f99cd05d1aa93b3a0aa9d35ddef1f33b7c7e8e7ee2978fca5c7f7a57ca4a397c50eb539a86ee0831e45bf

  • SSDEEP

    1536:iEGxHsVDUoVnte2KN3FfnD2AWWUyZ1cNMTugLIMfVGA2hMucQ1uEPWyChGgp3L+p:i6VtiFvDtZgmDZVwhvuhth5dU+iGPi/j

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 5 IoCs
  • Drops file in System32 directory 4 IoCs
  • Drops file in Program Files directory 29 IoCs
  • Modifies registry class 44 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b0795e5246b26ec3928cf3decc313420_NEIKI.exe
    "C:\Users\Admin\AppData\Local\Temp\b0795e5246b26ec3928cf3decc313420_NEIKI.exe"
    1⤵
    • Drops file in System32 directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:640
    • C:\Windows\SysWOW64\urdvxc.exe
      C:\Windows\system32\urdvxc.exe /installservice
      2⤵
      • Executes dropped EXE
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      PID:4028
    • C:\Windows\SysWOW64\urdvxc.exe
      C:\Windows\system32\urdvxc.exe /start
      2⤵
      • Executes dropped EXE
      • Modifies registry class
      PID:2088
    • C:\Windows\SysWOW64\urdvxc.exe
      C:\Windows\system32\urdvxc.exe /uninstallservice patch:C:\Users\Admin\AppData\Local\Temp\b0795e5246b26ec3928cf3decc313420_NEIKI.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies registry class
      PID:3928
  • C:\Windows\SysWOW64\urdvxc.exe
    "C:\Windows\SysWOW64\urdvxc.exe" /service
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Modifies registry class
    PID:4032
  • C:\Windows\SysWOW64\urdvxc.exe
    "C:\Windows\SysWOW64\urdvxc.exe" /service
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Modifies registry class
    PID:928

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files\Java\jdk-1.8\README.html

          Filesize

          263B

          MD5

          8e0789ff750b413c70a9b109432cf0ba

          SHA1

          84c429f3b741a44bced2a137ee62254348e89da6

          SHA256

          f37026c18146ffd616868fc2b6b18bd1d4d35d701a99d1eb1e3b0974c01079b1

          SHA512

          36b4cd6cb7854ed594ab3e1918731e2ad76fc3dab376f691518a2fb19fc8d1edd6f512846fbb171123dac0f661444a84c112dad014477fb7f6420dc03700a899

        • C:\Program Files\Java\jdk-1.8\jre\Welcome.html

          Filesize

          1KB

          MD5

          2fe21944034eb6b2b24f4bed8b1bee2c

          SHA1

          b53bb2babe0c2fe682a2e1c05d79dcf4fedf15a1

          SHA256

          6ffa2002e97816536eb55bef0ba11402fda791a3c4e7fa42f15f64967cdf1e9e

          SHA512

          4ac42b5d64d2f98e652a269a78bc012caf340fe43e7ef97fae58a1437b7360b05b949637c061d1ce818a2ca789c6db09d9c432efbe5dd8f7ee938f81976725eb

        • C:\Program Files\Java\jre-1.8\Welcome.html

          Filesize

          1KB

          MD5

          bc7c57b483916c6260cf0467bd8f0817

          SHA1

          80d1f7095e14da4ba8e73252d998f2979b5038d3

          SHA256

          17199b56ed55902544a9c13f4f263cd0ce15ed1bc63ab1f49df634c732b5a48c

          SHA512

          f2bc75c0fc8b02751db4ff98fe3fe36d9117dd1d748bdf03d78f72a6b7fada03e6832d5123a5c3e9aadf2bf92a266cd76ca9beb3914efc09ccbc99cc24467ced

        • C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html

          Filesize

          1KB

          MD5

          75887f366667b2254dfd35014d4eb318

          SHA1

          03127bc21514e315f8c370a9ac5dbd1cd9e766e7

          SHA256

          fcd66e8e56164804b031e01cf09f3da3338eb9d92b9bf4eb23097ce32018b9a9

          SHA512

          953e558d01d43f252870db5ecce7e347f69b3e553ecfadb106be203745492636d95dbcfc7446d31b138691e5e833b8f1a77d08995b7fb8ade5ae44af7fe48979

        • C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM

          Filesize

          11KB

          MD5

          4c7125f69cf2046a45daeac49cb0019f

          SHA1

          b4b17fbe1091003ed480f40654f22c89c763f01b

          SHA256

          1102b8a9933b2191f1b80bd9bc478f301536216332ddf2986d3ffc792474be3d

          SHA512

          ef255433949b3cd61a4694d2b23bd2a5d6b4a8a8e082fef068ad0c77abc4ba3fb833c1e31bdb9134613d237d7c033fa2647cfe73f06d3ad8de72128a8f323d62

        • C:\Windows\SysWOW64\urdvxc.exe

          Filesize

          119KB

          MD5

          b0795e5246b26ec3928cf3decc313420

          SHA1

          e776f3d12cc400a41adac40e69d9f5e67bde84b5

          SHA256

          2d88784d6c48c3350439bdbcdc92d0348df4ea8fac7fec226bf734a52b11de10

          SHA512

          d8f89d242e96348828089f2347bf202e2adc200ce69f99cd05d1aa93b3a0aa9d35ddef1f33b7c7e8e7ee2978fca5c7f7a57ca4a397c50eb539a86ee0831e45bf

        • memory/640-37-0x00000000001E0000-0x00000000001FF000-memory.dmp

          Filesize

          124KB

        • memory/640-1-0x00000000001E0000-0x00000000001FF000-memory.dmp

          Filesize

          124KB

        • memory/640-0-0x0000000000400000-0x0000000000435000-memory.dmp

          Filesize

          212KB

        • memory/928-1565-0x00000000001C0000-0x00000000001DF000-memory.dmp

          Filesize

          124KB

        • memory/928-2920-0x00000000001C0000-0x00000000001DF000-memory.dmp

          Filesize

          124KB

        • memory/2088-9-0x00000000001C0000-0x00000000001DF000-memory.dmp

          Filesize

          124KB

        • memory/3928-38-0x00000000001C0000-0x00000000001DF000-memory.dmp

          Filesize

          124KB

        • memory/4028-5-0x0000000000400000-0x0000000000435000-memory.dmp

          Filesize

          212KB

        • memory/4028-7-0x00000000001E0000-0x00000000001FF000-memory.dmp

          Filesize

          124KB

        • memory/4032-46-0x00000000001E0000-0x00000000001FF000-memory.dmp

          Filesize

          124KB

        • memory/4032-54-0x00000000001E0000-0x00000000001FF000-memory.dmp

          Filesize

          124KB

        • memory/4032-22-0x00000000001E0000-0x00000000001FF000-memory.dmp

          Filesize

          124KB

        • memory/4032-23-0x00000000001E0000-0x00000000001FF000-memory.dmp

          Filesize

          124KB

        • memory/4032-24-0x00000000001E0000-0x00000000001FF000-memory.dmp

          Filesize

          124KB

        • memory/4032-25-0x00000000001E0000-0x00000000001FF000-memory.dmp

          Filesize

          124KB

        • memory/4032-26-0x00000000001E0000-0x00000000001FF000-memory.dmp

          Filesize

          124KB

        • memory/4032-27-0x00000000001E0000-0x00000000001FF000-memory.dmp

          Filesize

          124KB

        • memory/4032-28-0x00000000001E0000-0x00000000001FF000-memory.dmp

          Filesize

          124KB

        • memory/4032-29-0x00000000001E0000-0x00000000001FF000-memory.dmp

          Filesize

          124KB

        • memory/4032-30-0x00000000001E0000-0x00000000001FF000-memory.dmp

          Filesize

          124KB

        • memory/4032-31-0x00000000001E0000-0x00000000001FF000-memory.dmp

          Filesize

          124KB

        • memory/4032-32-0x00000000001E0000-0x00000000001FF000-memory.dmp

          Filesize

          124KB

        • memory/4032-33-0x00000000001E0000-0x00000000001FF000-memory.dmp

          Filesize

          124KB

        • memory/4032-34-0x00000000001E0000-0x00000000001FF000-memory.dmp

          Filesize

          124KB

        • memory/4032-35-0x00000000001E0000-0x00000000001FF000-memory.dmp

          Filesize

          124KB

        • memory/4032-39-0x00000000001E0000-0x00000000001FF000-memory.dmp

          Filesize

          124KB

        • memory/4032-40-0x00000000001E0000-0x00000000001FF000-memory.dmp

          Filesize

          124KB

        • memory/4032-41-0x00000000001E0000-0x00000000001FF000-memory.dmp

          Filesize

          124KB

        • memory/4032-42-0x00000000001E0000-0x00000000001FF000-memory.dmp

          Filesize

          124KB

        • memory/4032-43-0x00000000001E0000-0x00000000001FF000-memory.dmp

          Filesize

          124KB

        • memory/4032-44-0x00000000001E0000-0x00000000001FF000-memory.dmp

          Filesize

          124KB

        • memory/4032-45-0x00000000001E0000-0x00000000001FF000-memory.dmp

          Filesize

          124KB

        • memory/4032-20-0x00000000001E0000-0x00000000001FF000-memory.dmp

          Filesize

          124KB

        • memory/4032-47-0x00000000001E0000-0x00000000001FF000-memory.dmp

          Filesize

          124KB

        • memory/4032-48-0x00000000001E0000-0x00000000001FF000-memory.dmp

          Filesize

          124KB

        • memory/4032-49-0x00000000001E0000-0x00000000001FF000-memory.dmp

          Filesize

          124KB

        • memory/4032-50-0x00000000001E0000-0x00000000001FF000-memory.dmp

          Filesize

          124KB

        • memory/4032-51-0x00000000001E0000-0x00000000001FF000-memory.dmp

          Filesize

          124KB

        • memory/4032-52-0x00000000001E0000-0x00000000001FF000-memory.dmp

          Filesize

          124KB

        • memory/4032-53-0x00000000001E0000-0x00000000001FF000-memory.dmp

          Filesize

          124KB

        • memory/4032-21-0x00000000001E0000-0x00000000001FF000-memory.dmp

          Filesize

          124KB

        • memory/4032-55-0x00000000001E0000-0x00000000001FF000-memory.dmp

          Filesize

          124KB

        • memory/4032-56-0x00000000001E0000-0x00000000001FF000-memory.dmp

          Filesize

          124KB

        • memory/4032-57-0x00000000001E0000-0x00000000001FF000-memory.dmp

          Filesize

          124KB

        • memory/4032-58-0x00000000001E0000-0x00000000001FF000-memory.dmp

          Filesize

          124KB

        • memory/4032-59-0x00000000001E0000-0x00000000001FF000-memory.dmp

          Filesize

          124KB

        • memory/4032-60-0x00000000001E0000-0x00000000001FF000-memory.dmp

          Filesize

          124KB

        • memory/4032-61-0x00000000001E0000-0x00000000001FF000-memory.dmp

          Filesize

          124KB

        • memory/4032-62-0x00000000001E0000-0x00000000001FF000-memory.dmp

          Filesize

          124KB

        • memory/4032-63-0x00000000001E0000-0x00000000001FF000-memory.dmp

          Filesize

          124KB

        • memory/4032-64-0x00000000001E0000-0x00000000001FF000-memory.dmp

          Filesize

          124KB

        • memory/4032-65-0x00000000001E0000-0x00000000001FF000-memory.dmp

          Filesize

          124KB

        • memory/4032-66-0x00000000001E0000-0x00000000001FF000-memory.dmp

          Filesize

          124KB

        • memory/4032-67-0x00000000001E0000-0x00000000001FF000-memory.dmp

          Filesize

          124KB

        • memory/4032-68-0x00000000001E0000-0x00000000001FF000-memory.dmp

          Filesize

          124KB

        • memory/4032-69-0x00000000001E0000-0x00000000001FF000-memory.dmp

          Filesize

          124KB

        • memory/4032-70-0x00000000001E0000-0x00000000001FF000-memory.dmp

          Filesize

          124KB

        • memory/4032-71-0x00000000001E0000-0x00000000001FF000-memory.dmp

          Filesize

          124KB

        • memory/4032-72-0x00000000001E0000-0x00000000001FF000-memory.dmp

          Filesize

          124KB

        • memory/4032-73-0x00000000001E0000-0x00000000001FF000-memory.dmp

          Filesize

          124KB

        • memory/4032-74-0x00000000001E0000-0x00000000001FF000-memory.dmp

          Filesize

          124KB

        • memory/4032-75-0x00000000001E0000-0x00000000001FF000-memory.dmp

          Filesize

          124KB

        • memory/4032-76-0x00000000001E0000-0x00000000001FF000-memory.dmp

          Filesize

          124KB

        • memory/4032-77-0x00000000001E0000-0x00000000001FF000-memory.dmp

          Filesize

          124KB

        • memory/4032-78-0x00000000001E0000-0x00000000001FF000-memory.dmp

          Filesize

          124KB

        • memory/4032-423-0x00000000001E0000-0x00000000001FF000-memory.dmp

          Filesize

          124KB

        • memory/4032-19-0x00000000001E0000-0x00000000001FF000-memory.dmp

          Filesize

          124KB

        • memory/4032-17-0x00000000001E0000-0x00000000001FF000-memory.dmp

          Filesize

          124KB

        • memory/4032-18-0x00000000001E0000-0x00000000001FF000-memory.dmp

          Filesize

          124KB

        • memory/4032-16-0x00000000001E0000-0x00000000001FF000-memory.dmp

          Filesize

          124KB

        • memory/4032-12-0x00000000001E0000-0x00000000001FF000-memory.dmp

          Filesize

          124KB

        • memory/4032-11-0x00000000001E0000-0x00000000001FF000-memory.dmp

          Filesize

          124KB

        • memory/4032-1563-0x00000000001E0000-0x00000000001FF000-memory.dmp

          Filesize

          124KB