1df17bc6b90d6be45b08b15a31a838545dd447fcac48f3b8afaeca9cda9fc697

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 00:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b037f3414bf1a0fc34da9a5eb01258a0_NEIKI.exe
Size

179KB
MD5

b037f3414bf1a0fc34da9a5eb01258a0
SHA1

96d2928121e44a93f6c69e7006f4b9faa3d75d0d
SHA256

1df17bc6b90d6be45b08b15a31a838545dd447fcac48f3b8afaeca9cda9fc697
SHA512

8e67323dc260edd778cb69037b364fdeab018c1e87d3d23735a28d1f11dd340789fe437412b4b75a9e77be4fb2b9a335586eccc0c11fd76adf529d8f33fa2316
SSDEEP

3072:2SUbxauaFNfQKPu+qxR/KpcTbF+63em0fKT387hr35S8obMc6jPb7yMHND0rpSl:2SGxhaFFQfxUEp3/xT387hY/wVbPJHVt

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
3080	b037f3414bf1a0fc34da9a5eb01258a0_NEIKI.exe
3080	b037f3414bf1a0fc34da9a5eb01258a0_NEIKI.exe
3080	b037f3414bf1a0fc34da9a5eb01258a0_NEIKI.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\b037f3414bf1a0fc34da9a5eb01258a0_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\b037f3414bf1a0fc34da9a5eb01258a0_NEIKI.exe"
1⤵
- Loads dropped DLL
PID:3080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\gentee00\gentee.dll

Filesize
100KB

MD5
30439e079a3d603c461d2c2f4f8cb064

SHA1
aaf470f6bd8deadedbc31adf17035041176c6134

SHA256
d6d0535175fb2302e5b5a498119823c37f6bddff4ab24f551aa7e038c343077a

SHA512
607a81be02bde679aff45770e2fd5c2471d64439fdb23c3e494aed98970131e5d677e1eba3b7b36fca5b8d5b99580856bb8cf1806139c9f73693afb512126b9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\gentee00\guig.dll

Filesize
20KB

MD5
9b741674245340cb9c503b296f361e2e

SHA1
9717d3e125c42cd057a0dd0698f783dd6a472e35

SHA256
f9407a51b66121c81a123eae4615841de7588364ec245a1fc95c5f5dc9c99660

SHA512
fe5ccfaebdb0f7263c507bfb32d5022b74970eeb22be8492661f995204603fa172a052ddd0c7fbb929056631774bdea8ffbe8e04f98a9c8e9c60bc4405deec7b

Download Submit