Analysis

  • max time kernel
    94s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/05/2024, 00:15

General

  • Target

    a923172e99c654d59dc54c291514d5c0_NEIKI.exe

  • Size

    1.7MB

  • MD5

    a923172e99c654d59dc54c291514d5c0

  • SHA1

    0f21057b4aae5267f953591f1e46a4d5a05aa0c6

  • SHA256

    8248dd738672533329b97b8dd2a346a1ed68b96bfe5adbaf9e41a64d4667e578

  • SHA512

    7dcba83b2ec9db84ae04e95e8b079620d6e0fb51bf723fe72817960af16fff94e971b19d2de6c2f8e59b9728add7a14006a4a6ee7f528118ce072e7372e626ea

  • SSDEEP

    24576:6D4Hc3VVd1utfeLhR/E+pUCiFpOV8SWOVqqyzH2u/Q8RjA+g7Xae5l/Jl2t:6kc3VVHusLhR/EsUCiFpOWJ2WFIbX3u

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a923172e99c654d59dc54c291514d5c0_NEIKI.exe
    "C:\Users\Admin\AppData\Local\Temp\a923172e99c654d59dc54c291514d5c0_NEIKI.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3728
    • C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 mswke.dll -s
      2⤵
      • Loads dropped DLL
      PID:4708

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\mswke.dll

          Filesize

          756KB

          MD5

          db7349002f34926a1a4739352016ef7c

          SHA1

          959390512349767af31fde1af854b176c41198c3

          SHA256

          824ec6ef24df25e87ff5553eea571c879eed0b4a9a9c3c30fefb5f9b69ca22ee

          SHA512

          5e79b833594346fa8c0db7074d4369e9b473b86912ea17183748cb91d247e1aa61b4380c1e2e79cd2548065b37cc53ff9525fe19e8251889a27fd3d0e0633175

        • memory/3728-0-0x0000000000400000-0x00000000005F1000-memory.dmp

          Filesize

          1.9MB

        • memory/3728-21-0x0000000000400000-0x00000000005F1000-memory.dmp

          Filesize

          1.9MB

        • memory/4708-15-0x0000000002A20000-0x0000000002A21000-memory.dmp

          Filesize

          4KB

        • memory/4708-12-0x000000006FFF0000-0x0000000070000000-memory.dmp

          Filesize

          64KB

        • memory/4708-13-0x0000000002A00000-0x0000000002A01000-memory.dmp

          Filesize

          4KB

        • memory/4708-10-0x0000000010000000-0x0000000010164000-memory.dmp

          Filesize

          1.4MB

        • memory/4708-14-0x0000000002A20000-0x0000000002A21000-memory.dmp

          Filesize

          4KB

        • memory/4708-16-0x0000000002A20000-0x0000000002A21000-memory.dmp

          Filesize

          4KB

        • memory/4708-18-0x0000000002A20000-0x0000000002A21000-memory.dmp

          Filesize

          4KB

        • memory/4708-17-0x0000000002A20000-0x0000000002A21000-memory.dmp

          Filesize

          4KB

        • memory/4708-19-0x000000006FFF0000-0x0000000070000000-memory.dmp

          Filesize

          64KB

        • memory/4708-11-0x0000000002970000-0x0000000002972000-memory.dmp

          Filesize

          8KB