Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    09/05/2024, 00:15

General

  • Target

    a923172e99c654d59dc54c291514d5c0_NEIKI.exe

  • Size

    1.7MB

  • MD5

    a923172e99c654d59dc54c291514d5c0

  • SHA1

    0f21057b4aae5267f953591f1e46a4d5a05aa0c6

  • SHA256

    8248dd738672533329b97b8dd2a346a1ed68b96bfe5adbaf9e41a64d4667e578

  • SHA512

    7dcba83b2ec9db84ae04e95e8b079620d6e0fb51bf723fe72817960af16fff94e971b19d2de6c2f8e59b9728add7a14006a4a6ee7f528118ce072e7372e626ea

  • SSDEEP

    24576:6D4Hc3VVd1utfeLhR/E+pUCiFpOV8SWOVqqyzH2u/Q8RjA+g7Xae5l/Jl2t:6kc3VVHusLhR/EsUCiFpOWJ2WFIbX3u

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Modifies registry class 37 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a923172e99c654d59dc54c291514d5c0_NEIKI.exe
    "C:\Users\Admin\AppData\Local\Temp\a923172e99c654d59dc54c291514d5c0_NEIKI.exe"
    1⤵
    • Loads dropped DLL
    • Writes to the Master Boot Record (MBR)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2860
    • C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 mswke.dll -s
      2⤵
      • Loads dropped DLL
      • Modifies registry class
      PID:2584

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\mswke.dll

          Filesize

          756KB

          MD5

          db7349002f34926a1a4739352016ef7c

          SHA1

          959390512349767af31fde1af854b176c41198c3

          SHA256

          824ec6ef24df25e87ff5553eea571c879eed0b4a9a9c3c30fefb5f9b69ca22ee

          SHA512

          5e79b833594346fa8c0db7074d4369e9b473b86912ea17183748cb91d247e1aa61b4380c1e2e79cd2548065b37cc53ff9525fe19e8251889a27fd3d0e0633175

        • memory/2584-13-0x000000006FFF0000-0x0000000070000000-memory.dmp

          Filesize

          64KB

        • memory/2584-11-0x00000000001B0000-0x00000000001B2000-memory.dmp

          Filesize

          8KB

        • memory/2584-10-0x0000000010000000-0x0000000010164000-memory.dmp

          Filesize

          1.4MB

        • memory/2584-12-0x000000006FFF0000-0x0000000070000000-memory.dmp

          Filesize

          64KB

        • memory/2860-16-0x0000000010000000-0x0000000010164000-memory.dmp

          Filesize

          1.4MB

        • memory/2860-0-0x0000000000400000-0x00000000005F1000-memory.dmp

          Filesize

          1.9MB

        • memory/2860-17-0x0000000000790000-0x0000000000792000-memory.dmp

          Filesize

          8KB

        • memory/2860-19-0x0000000002180000-0x000000000218A000-memory.dmp

          Filesize

          40KB

        • memory/2860-18-0x0000000002180000-0x000000000218A000-memory.dmp

          Filesize

          40KB

        • memory/2860-20-0x0000000010000000-0x0000000010164000-memory.dmp

          Filesize

          1.4MB

        • memory/2860-22-0x0000000000790000-0x0000000000792000-memory.dmp

          Filesize

          8KB

        • memory/2860-23-0x0000000002180000-0x000000000218A000-memory.dmp

          Filesize

          40KB

        • memory/2860-24-0x0000000000400000-0x00000000005F1000-memory.dmp

          Filesize

          1.9MB