Overview

overview

10

Static

static

3

c4d259833c...KI.exe

windows7-x64

10

c4d259833c...KI.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-05-2024 01:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c4d259833cc9e192e355c281ed6b9720_NEIKI.exe

  • Size

    80KB

  • MD5

    c4d259833cc9e192e355c281ed6b9720

  • SHA1

    3a397aff1b3742097046e516ba43f17843036850

  • SHA256

    ce7296b33e2de1a6a0a76a14f0c1ad16c3b811764197f4677e1b2f8d169b5374

  • SHA512

    3104276a6fc74fa5627dfa06bab9cbea37a3c763add187cea5c82d9a3c4250158185e4d5ec1bdf98c6716b4a22a8162a5467cfe12b171677f399b5046fee7a54

  • SSDEEP

    1536:5vvMoORizUPliPsm/gL16ZpQGh6MgHN+PhuLGR/11:RvxOMUMPsgQvTMY+PhGGR/11

Score
10/10
evasionpersistence

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 16 IoCs
    persistence
  • Modifies visibility of file extensions in Explorer 2 TTPs 8 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 8 IoCs
    evasion
  • Adds policy Run key to start application 2 TTPs 18 IoCs
    persistence
  • Disables RegEdit via registry modification 8 IoCs
    evasion
  • Drops file in Drivers directory 1 IoCs
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • Adds Run key to start application 2 TTPs 16 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Windows directory 33 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Discovers systems in the same network 1 TTPs 1 IoCs
    discovery
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c4d259833cc9e192e355c281ed6b9720_NEIKI.exe
    "C:\Users\Admin\AppData\Local\Temp\c4d259833cc9e192e355c281ed6b9720_NEIKI.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Adds policy Run key to start application
    • Disables RegEdit via registry modification
    • Checks computer location settings
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3632
    • C:\Windows\SysWOW64\s4827\smss.exe
      "C:\Windows\system32\s4827\smss.exe" ~Brontok~Log~
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Adds policy Run key to start application
      • Disables RegEdit via registry modification
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Suspicious use of WriteProcessMemory
      PID:2768
      • C:\Windows\SysWOW64\s4827\winlogon.exe
        "C:\Windows\system32\s4827\winlogon.exe" ~Brontok~Is~The~Best~
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • Adds policy Run key to start application
        • Disables RegEdit via registry modification
        • Checks computer location settings
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1004
        • C:\Windows\SysWOW64\s4827\services.exe
          "C:\Windows\system32\s4827\services.exe" ~Brontok~Serv~
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visibility of file extensions in Explorer
          • Modifies visiblity of hidden/system files in Explorer
          • Adds policy Run key to start application
          • Disables RegEdit via registry modification
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in System32 directory
          • Drops file in Windows directory
          PID:2364
        • C:\Windows\SysWOW64\s4827\csrss.exe
          "C:\Windows\system32\s4827\csrss.exe" ~Brontok~SpreadMail~
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visibility of file extensions in Explorer
          • Modifies visiblity of hidden/system files in Explorer
          • Adds policy Run key to start application
          • Disables RegEdit via registry modification
          • Drops file in Drivers directory
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in System32 directory
          • Drops file in Windows directory
          PID:1440
        • C:\Windows\SysWOW64\s4827\lsass.exe
          "C:\Windows\system32\s4827\lsass.exe" ~Brontok~Network~
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visibility of file extensions in Explorer
          • Modifies visiblity of hidden/system files in Explorer
          • Adds policy Run key to start application
          • Disables RegEdit via registry modification
          • Checks computer location settings
          • Executes dropped EXE
          • Adds Run key to start application
          • Enumerates connected drives
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Suspicious use of WriteProcessMemory
          PID:928
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c net view /domain > "C:\Windows\system32\s4827\domlist.txt"
            5⤵
            • Drops file in System32 directory
            • Suspicious use of WriteProcessMemory
            PID:1956
            • C:\Windows\SysWOW64\net.exe
              net view /domain
              6⤵
              • Discovers systems in the same network
              PID:3980
        • C:\Windows\Ad10218\qm4623.exe
          "C:\Windows\Ad10218\qm4623.exe" ~Brontok~Back~Log~
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visibility of file extensions in Explorer
          • Modifies visiblity of hidden/system files in Explorer
          • Adds policy Run key to start application
          • Disables RegEdit via registry modification
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in System32 directory
          • Drops file in Windows directory
          PID:3920
        • C:\Windows\SysWOW64\s4827\m4623.exe
          "C:\Windows\system32\s4827\m4623.exe" ~Brontok~Back~Log~
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visibility of file extensions in Explorer
          • Modifies visiblity of hidden/system files in Explorer
          • Adds policy Run key to start application
          • Disables RegEdit via registry modification
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in System32 directory
          • Drops file in Windows directory
          PID:384
        • C:\Windows\SysWOW64\at.exe
          "C:\Windows\System32\at.exe" /delete /y
          4⤵
            PID:1488
          • C:\Windows\SysWOW64\at.exe
            "C:\Windows\System32\at.exe" 17:08 /every:M,T,W,Th,F,S,Su "C:\Users\Admin\AppData\Local\jalak-93927015-bali.com"
            4⤵
              PID:4728
            • C:\Windows\SysWOW64\at.exe
              "C:\Windows\System32\at.exe" 11:03 /every:M,T,W,Th,F,S,Su "C:\Users\Admin\AppData\Local\jalak-93927015-bali.com"
              4⤵
                PID:1804

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Windows\Ad10218\qm4623.exe
          Filesize

          80KB

          MD5

          1ce42d1a59a4570d1225bd80432e137f

          SHA1

          4bc0de9d538464eff084c8e65264e6c6b8a06143

          SHA256

          a4f785dff951e4978f122992ec4b86201746de755dcec4deadd7393e73e78235

          SHA512

          5462074e58f90929f481e41932adb16546b5a917d9ef241e3bfd4a9bf9ebf460fc470676f03bcdd9c206d3ee0a80e461d29e35e55fb9642979f5d557b155dc27

          Download Submit

        • C:\Windows\SysWOW64\c_27552k.com
          Filesize

          80KB

          MD5

          c4d259833cc9e192e355c281ed6b9720

          SHA1

          3a397aff1b3742097046e516ba43f17843036850

          SHA256

          ce7296b33e2de1a6a0a76a14f0c1ad16c3b811764197f4677e1b2f8d169b5374

          SHA512

          3104276a6fc74fa5627dfa06bab9cbea37a3c763add187cea5c82d9a3c4250158185e4d5ec1bdf98c6716b4a22a8162a5467cfe12b171677f399b5046fee7a54

          Download Submit

        • C:\Windows\SysWOW64\s4827\lsass.exe
          Filesize

          80KB

          MD5

          ab593cc22a80b1859cee5a59d3b3e92e

          SHA1

          fef567c8cfa39a91094dd9f316e93fe721fec2d5

          SHA256

          cc0cccd8cd581baa86565cff3fbe45c370ef3a58acb45209e5d1680ee8d4e597

          SHA512

          7ecf8307774c0d72edbf4ce20647f46fa474129b9685b671078c8f56ee09a0d8806508aad0773a4974fc358e8d666195dd7756e844f436535e8c45550fab5a1a

          Download Submit

        • C:\Windows\SysWOW64\s4827\m4623.exe
          Filesize

          80KB

          MD5

          7d2c998edb9d07c9a3653c5f619c8471

          SHA1

          176306d82f01ee3e6b09917dac0666417f984dac

          SHA256

          1bb6fc30668241aac7a78c396a32c3f7c55863e0271d667020cae460e1c7b79c

          SHA512

          6f842c6ad7d57efc0858133614f0e545125ae7e9bc9111b712062336ad36dca079899fea8e780ddff9e43ba6ffa9181d4934cda26cc0292c07fb78e5ee8fa72b

          Download Submit

        • C:\Windows\SysWOW64\s4827\winlogon.exe
          Filesize

          80KB

          MD5

          dc28fe979101da58701a7e330b55312e

          SHA1

          30a8c5d46889e0c23dc228982dc7588e44cb3f88

          SHA256

          fbb965556b7c653e099c2ca32a2e4024873d76ead83373fe9d01aa1cd21ab08f

          SHA512

          63a86a462e59a5a4b00b9f4484d015abf8efdb61067f39039f8290d2298d49458c289dce378551fe1d825a3b084ece8489045cd3164b9a42de18ac9540947a01

          Download Submit

        • memory/384-158-0x0000000000400000-0x0000000000417000-memory.dmp

          Filesize

          92KB

          Download

        • memory/928-146-0x0000000000400000-0x0000000000417000-memory.dmp

          Filesize

          92KB

          Download

        • memory/1004-72-0x0000000000400000-0x0000000000417000-memory.dmp

          Filesize

          92KB

          Download

        • memory/3632-0-0x0000000000400000-0x0000000000417000-memory.dmp

          Filesize

          92KB

          Download

        • memory/3920-149-0x0000000000400000-0x0000000000417000-memory.dmp

          Filesize

          92KB

          Download