Malware Analysis Report

2025-08-05 12:50

Sample ID 240509-b6bcwseb84
Target c373257cbcb95eb6e4df18b7c7622c20_NEIKI
SHA256 5c8da79fa26900cedf2c923ed3f710e534da1433d974df115e1bda25281a5a03
Tags
bootkit persistence
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

5c8da79fa26900cedf2c923ed3f710e534da1433d974df115e1bda25281a5a03

Threat Level: Shows suspicious behavior

The file c373257cbcb95eb6e4df18b7c7622c20_NEIKI was found to be: Shows suspicious behavior.

Malicious Activity Summary

bootkit persistence

Checks BIOS information in registry

Enumerates connected drives

Writes to the Master Boot Record (MBR)

Unsigned PE

Enumerates system info in registry

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-09 01:44

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-09 01:44

Reported

2024-05-09 01:47

Platform

win7-20240221-en

Max time kernel

118s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c373257cbcb95eb6e4df18b7c7622c20_NEIKI.exe"

Signatures

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\c373257cbcb95eb6e4df18b7c7622c20_NEIKI.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\c373257cbcb95eb6e4df18b7c7622c20_NEIKI.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\c373257cbcb95eb6e4df18b7c7622c20_NEIKI.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\c373257cbcb95eb6e4df18b7c7622c20_NEIKI.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\c373257cbcb95eb6e4df18b7c7622c20_NEIKI.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\c373257cbcb95eb6e4df18b7c7622c20_NEIKI.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\c373257cbcb95eb6e4df18b7c7622c20_NEIKI.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\c373257cbcb95eb6e4df18b7c7622c20_NEIKI.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\c373257cbcb95eb6e4df18b7c7622c20_NEIKI.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\c373257cbcb95eb6e4df18b7c7622c20_NEIKI.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\c373257cbcb95eb6e4df18b7c7622c20_NEIKI.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\c373257cbcb95eb6e4df18b7c7622c20_NEIKI.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\c373257cbcb95eb6e4df18b7c7622c20_NEIKI.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\c373257cbcb95eb6e4df18b7c7622c20_NEIKI.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\c373257cbcb95eb6e4df18b7c7622c20_NEIKI.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\c373257cbcb95eb6e4df18b7c7622c20_NEIKI.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\c373257cbcb95eb6e4df18b7c7622c20_NEIKI.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\c373257cbcb95eb6e4df18b7c7622c20_NEIKI.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\c373257cbcb95eb6e4df18b7c7622c20_NEIKI.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\c373257cbcb95eb6e4df18b7c7622c20_NEIKI.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\c373257cbcb95eb6e4df18b7c7622c20_NEIKI.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\c373257cbcb95eb6e4df18b7c7622c20_NEIKI.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\c373257cbcb95eb6e4df18b7c7622c20_NEIKI.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\c373257cbcb95eb6e4df18b7c7622c20_NEIKI.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\c373257cbcb95eb6e4df18b7c7622c20_NEIKI.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\c373257cbcb95eb6e4df18b7c7622c20_NEIKI.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBIOSDate C:\Users\Admin\AppData\Local\Temp\c373257cbcb95eb6e4df18b7c7622c20_NEIKI.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\c373257cbcb95eb6e4df18b7c7622c20_NEIKI.exe

"C:\Users\Admin\AppData\Local\Temp\c373257cbcb95eb6e4df18b7c7622c20_NEIKI.exe"

Network

N/A

Files

memory/2240-0-0x0000000000400000-0x000000000066E000-memory.dmp

memory/2240-1-0x0000000000400000-0x000000000066E000-memory.dmp

memory/2240-2-0x0000000000400000-0x000000000066E000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-09 01:44

Reported

2024-05-09 01:47

Platform

win10v2004-20240426-en

Max time kernel

148s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c373257cbcb95eb6e4df18b7c7622c20_NEIKI.exe"

Signatures

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\c373257cbcb95eb6e4df18b7c7622c20_NEIKI.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\c373257cbcb95eb6e4df18b7c7622c20_NEIKI.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\c373257cbcb95eb6e4df18b7c7622c20_NEIKI.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\c373257cbcb95eb6e4df18b7c7622c20_NEIKI.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\c373257cbcb95eb6e4df18b7c7622c20_NEIKI.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\c373257cbcb95eb6e4df18b7c7622c20_NEIKI.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\c373257cbcb95eb6e4df18b7c7622c20_NEIKI.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\c373257cbcb95eb6e4df18b7c7622c20_NEIKI.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\c373257cbcb95eb6e4df18b7c7622c20_NEIKI.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\c373257cbcb95eb6e4df18b7c7622c20_NEIKI.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\c373257cbcb95eb6e4df18b7c7622c20_NEIKI.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\c373257cbcb95eb6e4df18b7c7622c20_NEIKI.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\c373257cbcb95eb6e4df18b7c7622c20_NEIKI.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\c373257cbcb95eb6e4df18b7c7622c20_NEIKI.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\c373257cbcb95eb6e4df18b7c7622c20_NEIKI.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\c373257cbcb95eb6e4df18b7c7622c20_NEIKI.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\c373257cbcb95eb6e4df18b7c7622c20_NEIKI.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\c373257cbcb95eb6e4df18b7c7622c20_NEIKI.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\c373257cbcb95eb6e4df18b7c7622c20_NEIKI.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\c373257cbcb95eb6e4df18b7c7622c20_NEIKI.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\c373257cbcb95eb6e4df18b7c7622c20_NEIKI.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\c373257cbcb95eb6e4df18b7c7622c20_NEIKI.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\c373257cbcb95eb6e4df18b7c7622c20_NEIKI.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\c373257cbcb95eb6e4df18b7c7622c20_NEIKI.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\c373257cbcb95eb6e4df18b7c7622c20_NEIKI.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\c373257cbcb95eb6e4df18b7c7622c20_NEIKI.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBIOSDate C:\Users\Admin\AppData\Local\Temp\c373257cbcb95eb6e4df18b7c7622c20_NEIKI.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\c373257cbcb95eb6e4df18b7c7622c20_NEIKI.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\c373257cbcb95eb6e4df18b7c7622c20_NEIKI.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\c373257cbcb95eb6e4df18b7c7622c20_NEIKI.exe

"C:\Users\Admin\AppData\Local\Temp\c373257cbcb95eb6e4df18b7c7622c20_NEIKI.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 88.221.83.187:443 www.bing.com tcp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 187.83.221.88.in-addr.arpa udp
BE 88.221.83.187:443 www.bing.com tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 34.56.20.217.in-addr.arpa udp
US 8.8.8.8:53 242.238.32.23.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 28.73.42.20.in-addr.arpa udp

Files

memory/1684-0-0x0000000002560000-0x0000000002561000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

memory/1684-19-0x0000000000400000-0x000000000066E000-memory.dmp