Analysis
- max time kernel
138s - max time network
123s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
09/05/2024, 00:27
General
- Target aca5b2387c10786a2306a98166581a60_NEIKI.exe
- Size 758KB
- Sample240509-arydfagb7t
- SHA256 6b953bd9494e5f61c1ede1ec264bf6df54911c4edefecd2eda3fb11fdbd10785
Malware Config
Signatures
- Detects HijackLoader (aka IDAT Loader) 1 IoCs
- HijackLoader
HijackLoader is a multistage loader first seen in 2023.
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 1 IoCs
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 17 IoCs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Suspicious use of SetThreadContext 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious behavior: MapViewOfSection 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\aca5b2387c10786a2306a98166581a60_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\aca5b2387c10786a2306a98166581a60_NEIKI.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
-
C:\Users\Admin\AppData\Roaming\winhttpcom\XWin_MobaX_1.16.3.exeC:\Users\Admin\AppData\Roaming\winhttpcom\XWin_MobaX_1.16.3.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
c833d240
tmp4CA6.tmp
tmp4CD8.tmp
XWin_MobaX_1.16.3.exe
faltboat.dxf
libX11-6.dll
libX11-xcb-1.dll
libXau-6.dll
libXdmcp-6.dll
libXfont-1.dll
libdl.dll
libfontenc-1.dll
libgcc_s_dw2-1.dll
libwinpthread-1.dll
libxcb-1.dll
libxcb-image-0.dll
libxcb-shm-0.dll
libxcb-util-1.dll
zlib1.dll
memory/1532-150-0x0000000006090000-0x00000000060AE000-memory.dmp
memory/1532-151-0x0000000006170000-0x00000000061C0000-memory.dmp
memory/1532-152-0x0000000006230000-0x0000000006296000-memory.dmp
memory/1532-171-0x0000000000F70000-0x0000000000F82000-memory.dmp
memory/1532-172-0x0000000001830000-0x000000000186C000-memory.dmp
memory/1532-149-0x0000000006FB0000-0x00000000074DC000-memory.dmp
memory/1532-148-0x00000000064D0000-0x0000000006A74000-memory.dmp
memory/1532-147-0x0000000005950000-0x00000000059C6000-memory.dmp
memory/1532-146-0x0000000005D50000-0x0000000005F12000-memory.dmp
memory/1532-145-0x00000000059F0000-0x0000000005A82000-memory.dmp
memory/1532-144-0x0000000001300000-0x00000000013D2000-memory.dmp
memory/2500-138-0x00000000735B0000-0x000000007372B000-memory.dmp
memory/2500-132-0x00000000735B0000-0x000000007372B000-memory.dmp
memory/2500-141-0x00000000735B0000-0x000000007372B000-memory.dmp
memory/4512-87-0x000000006DC20000-0x000000006DC48000-memory.dmp
memory/4512-115-0x00000000735B0000-0x000000007372B000-memory.dmp
memory/4512-88-0x000000006C370000-0x000000006C4B3000-memory.dmp
memory/4512-82-0x00000000735B0000-0x000000007372B000-memory.dmp
memory/4512-86-0x000000006C4C0000-0x000000006C4CC000-memory.dmp
memory/4512-83-0x0000000000400000-0x000000000074B000-memory.dmp
memory/4512-84-0x000000006E010000-0x000000006E02C000-memory.dmp
memory/4512-80-0x00000000735B0000-0x000000007372B000-memory.dmp
memory/4512-81-0x00007FFCD6B70000-0x00007FFCD6D65000-memory.dmp
memory/4512-89-0x000000006DC50000-0x000000006DC5D000-memory.dmp
memory/4512-93-0x000000006DFD0000-0x000000006DFF3000-memory.dmp
memory/4512-90-0x000000006DBF0000-0x000000006DBFE000-memory.dmp
memory/4512-92-0x000000006DB60000-0x000000006DB93000-memory.dmp
memory/4512-91-0x000000006DBC0000-0x000000006DBCF000-memory.dmp
memory/4512-94-0x000000006DBD0000-0x000000006DBDE000-memory.dmp
memory/4512-95-0x000000006DBE0000-0x000000006DBED000-memory.dmp
memory/4512-96-0x000000006E000000-0x000000006E00F000-memory.dmp
memory/4512-97-0x000000006DAB0000-0x000000006DACE000-memory.dmp
memory/4512-85-0x000000006DDC0000-0x000000006DDE0000-memory.dmp
memory/4596-9-0x0000000000400000-0x00000000004C5000-memory.dmp
memory/4596-13-0x00000000735B0000-0x000000007372B000-memory.dmp
memory/4596-114-0x00000000735B0000-0x000000007372B000-memory.dmp
memory/4596-113-0x00000000735C2000-0x00000000735C3000-memory.dmp
memory/4596-45-0x00000000735B0000-0x000000007372B000-memory.dmp
memory/4596-44-0x00000000735C2000-0x00000000735C3000-memory.dmp
memory/4596-11-0x00007FFCD6B70000-0x00007FFCD6D65000-memory.dmp
memory/4596-10-0x00000000735B0000-0x000000007372B000-memory.dmp