Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
09/05/2024, 01:39
Static task
static1
Behavioral task
behavioral1
Sample
c1a23d40f56e4154e87d503f81e7f850_NEIKI.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
c1a23d40f56e4154e87d503f81e7f850_NEIKI.exe
Resource
win10v2004-20240426-en
General
-
Target
c1a23d40f56e4154e87d503f81e7f850_NEIKI.exe
-
Size
119KB
-
MD5
c1a23d40f56e4154e87d503f81e7f850
-
SHA1
1f61b3944cc99ff5fb03924d4dd3a0b5b23927d1
-
SHA256
bfab6baa1b63096bac246652ee6bddaa19672c99600cd4251d107a16d63b7db6
-
SHA512
4aac7421f2cae51f56419dd30a9ba076f8de6aa61bc31ab9552930ed834de75bab4c56c932f2a1a2d5a1022f63eaaf0bd3a1fabf499c737d02353115451aba49
-
SSDEEP
3072:F/fF5/ybRxbVlD7fShaPDXaJ8OyBQceZ9PW4w:ZfF5/ybRpDtnOyBF+9W4w
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 4964 urdvxc.exe -
Executes dropped EXE 5 IoCs
pid Process 3452 urdvxc.exe 3304 urdvxc.exe 4184 urdvxc.exe 4964 urdvxc.exe 1140 urdvxc.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\urdvxc.exe c1a23d40f56e4154e87d503f81e7f850_NEIKI.exe File created C:\Windows\SysWOW64\urdvxc.exe urdvxc.exe File created C:\Windows\SysWOW64\urdvxc.exe urdvxc.exe File created C:\Windows\SysWOW64\urdvxc.exe c1a23d40f56e4154e87d503f81e7f850_NEIKI.exe -
Drops file in Program Files directory 27 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\Office16\OSPP.HTM urdvxc.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\error_window.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\Welcome.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk-1.8\chllsvtv.exe urdvxc.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\batch_window.html urdvxc.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\create_stream.html urdvxc.exe File opened for modification C:\Program Files\Java\jre-1.8\Welcome.html urdvxc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\tsbknceh.exe urdvxc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\README.HTM urdvxc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM urdvxc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\README.HTM urdvxc.exe File opened for modification C:\Program Files\UnblockSend.htm urdvxc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html urdvxc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\rvhrjtnt.exe urdvxc.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\browse_window.html urdvxc.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\mosaic_window.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk-1.8\README.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\Welcome.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\revhnlhn.exe urdvxc.exe File opened for modification C:\Program Files\Java\jre-1.8\hcjzqenb.exe urdvxc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM urdvxc.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\equalizer_window.html urdvxc.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPP.HTM urdvxc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html urdvxc.exe File opened for modification C:\Program Files\UndoSync.mhtml urdvxc.exe File opened for modification C:\Program Files\Java\jdk-1.8\README.html urdvxc.exe File opened for modification C:\Program Files\Java\jre-1.8\Welcome.html urdvxc.exe -
Modifies registry class 44 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A03FB31-4A2C-0E64-ADA6-8E011148C8AE}\ = "rnxehjhseeltctjb" c1a23d40f56e4154e87d503f81e7f850_NEIKI.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32 urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\LocalServer32 urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\vfs\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\1033\\rvhrjtnt.exe" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84} urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A03FB31-4A2C-0E64-ADA6-8E011148C8AE} c1a23d40f56e4154e87d503f81e7f850_NEIKI.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A03FB31-4A2C-0E64-ADA6-8E011148C8AE}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\c1a23d40f56e4154e87d503f81e7f850_NEIKI.exe" c1a23d40f56e4154e87d503f81e7f850_NEIKI.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "llhshbzrkszshcjb" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "kllnlrjltlebqvee" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32 urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3} urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84} urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\LocalServer32\ = "C:\\Program Files\\Java\\jdk-1.8\\jre\\revhnlhn.exe" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD} urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\ = "khsskwtjqqvxejkn" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\LocalServer32\ = "C:\\Program Files\\Java\\jdk-1.8\\chllsvtv.exe" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892} urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A03FB31-4A2C-0E64-ADA6-8E011148C8AE}\LocalServer32 c1a23d40f56e4154e87d503f81e7f850_NEIKI.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84} urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32 urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "lwrkwntjxetjqrrq" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32 urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509} urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\ = "vwbswnsehnxthnjb" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\LocalServer32 urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Office16\\PersonaSpy\\tsbknceh.exe" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\ = "nbbkvwnslcnccrrl" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\LocalServer32 urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32 urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84} urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "zhecqnehletennns" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564} urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "bbqkkbvnlkzlsvsb" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84} urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\ = "tqjtrlbnrhclshcl" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\LocalServer32 urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\LocalServer32\ = "C:\\Program Files\\Java\\jre-1.8\\hcjzqenb.exe" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\ = "vlrrqkerljewlnbb" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\LocalServer32 urdvxc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3452 urdvxc.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3252 wrote to memory of 3452 3252 c1a23d40f56e4154e87d503f81e7f850_NEIKI.exe 85 PID 3252 wrote to memory of 3452 3252 c1a23d40f56e4154e87d503f81e7f850_NEIKI.exe 85 PID 3252 wrote to memory of 3452 3252 c1a23d40f56e4154e87d503f81e7f850_NEIKI.exe 85 PID 3252 wrote to memory of 3304 3252 c1a23d40f56e4154e87d503f81e7f850_NEIKI.exe 87 PID 3252 wrote to memory of 3304 3252 c1a23d40f56e4154e87d503f81e7f850_NEIKI.exe 87 PID 3252 wrote to memory of 3304 3252 c1a23d40f56e4154e87d503f81e7f850_NEIKI.exe 87 PID 3252 wrote to memory of 4964 3252 c1a23d40f56e4154e87d503f81e7f850_NEIKI.exe 90 PID 3252 wrote to memory of 4964 3252 c1a23d40f56e4154e87d503f81e7f850_NEIKI.exe 90 PID 3252 wrote to memory of 4964 3252 c1a23d40f56e4154e87d503f81e7f850_NEIKI.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\c1a23d40f56e4154e87d503f81e7f850_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\c1a23d40f56e4154e87d503f81e7f850_NEIKI.exe"1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Windows\SysWOW64\urdvxc.exeC:\Windows\system32\urdvxc.exe /installservice2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3452
-
-
C:\Windows\SysWOW64\urdvxc.exeC:\Windows\system32\urdvxc.exe /start2⤵
- Executes dropped EXE
- Modifies registry class
PID:3304
-
-
C:\Windows\SysWOW64\urdvxc.exeC:\Windows\system32\urdvxc.exe /uninstallservice patch:C:\Users\Admin\AppData\Local\Temp\c1a23d40f56e4154e87d503f81e7f850_NEIKI.exe2⤵
- Deletes itself
- Executes dropped EXE
- Modifies registry class
PID:4964
-
-
C:\Windows\SysWOW64\urdvxc.exe"C:\Windows\SysWOW64\urdvxc.exe" /service1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
PID:4184
-
C:\Windows\SysWOW64\urdvxc.exe"C:\Windows\SysWOW64\urdvxc.exe" /service1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
PID:1140
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
263B
MD58e0789ff750b413c70a9b109432cf0ba
SHA184c429f3b741a44bced2a137ee62254348e89da6
SHA256f37026c18146ffd616868fc2b6b18bd1d4d35d701a99d1eb1e3b0974c01079b1
SHA51236b4cd6cb7854ed594ab3e1918731e2ad76fc3dab376f691518a2fb19fc8d1edd6f512846fbb171123dac0f661444a84c112dad014477fb7f6420dc03700a899
-
Filesize
1KB
MD52fe21944034eb6b2b24f4bed8b1bee2c
SHA1b53bb2babe0c2fe682a2e1c05d79dcf4fedf15a1
SHA2566ffa2002e97816536eb55bef0ba11402fda791a3c4e7fa42f15f64967cdf1e9e
SHA5124ac42b5d64d2f98e652a269a78bc012caf340fe43e7ef97fae58a1437b7360b05b949637c061d1ce818a2ca789c6db09d9c432efbe5dd8f7ee938f81976725eb
-
Filesize
1KB
MD574f13c185956384b11539babc72982c9
SHA151cac9d61127f9340f81798ea4d084fb242f5c24
SHA256f0c4d208aba36b21dda722b40bea5b38e0c2e32e7beb2964bf31bca7ea778585
SHA51285b54d801cd804b63e43f26e9ae2de01dccf4c4d8917a8645f17c3767e9458847f45117716073af9e0a53a5b23d25227196b159d9f17a0e7450f46aa03641d46
-
Filesize
1KB
MD575887f366667b2254dfd35014d4eb318
SHA103127bc21514e315f8c370a9ac5dbd1cd9e766e7
SHA256fcd66e8e56164804b031e01cf09f3da3338eb9d92b9bf4eb23097ce32018b9a9
SHA512953e558d01d43f252870db5ecce7e347f69b3e553ecfadb106be203745492636d95dbcfc7446d31b138691e5e833b8f1a77d08995b7fb8ade5ae44af7fe48979
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM
Filesize11KB
MD54c7125f69cf2046a45daeac49cb0019f
SHA1b4b17fbe1091003ed480f40654f22c89c763f01b
SHA2561102b8a9933b2191f1b80bd9bc478f301536216332ddf2986d3ffc792474be3d
SHA512ef255433949b3cd61a4694d2b23bd2a5d6b4a8a8e082fef068ad0c77abc4ba3fb833c1e31bdb9134613d237d7c033fa2647cfe73f06d3ad8de72128a8f323d62
-
Filesize
119KB
MD5c1a23d40f56e4154e87d503f81e7f850
SHA11f61b3944cc99ff5fb03924d4dd3a0b5b23927d1
SHA256bfab6baa1b63096bac246652ee6bddaa19672c99600cd4251d107a16d63b7db6
SHA5124aac7421f2cae51f56419dd30a9ba076f8de6aa61bc31ab9552930ed834de75bab4c56c932f2a1a2d5a1022f63eaaf0bd3a1fabf499c737d02353115451aba49