d9538c5bec24e885c167b2aa6bcab05b9e4c55623880b0cefbffc66ee788c7d5

Analysis

max time kernel
140s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 01:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b96323d3104a0fd9606acf15ff8c29c0_NEIKI.exe
Size

489KB
MD5

b96323d3104a0fd9606acf15ff8c29c0
SHA1

5588946c05749ada8fae06ae14c5f9dc1cc3e875
SHA256

d9538c5bec24e885c167b2aa6bcab05b9e4c55623880b0cefbffc66ee788c7d5
SHA512

8e35bfe167a48bee05ec67428866b9c235d70621d9a3508ceab32931a34f235045beca32c49f163cee13b1c398e600cf9c0e231a44e183f8737e5cb4af36b3be
SSDEEP

12288:WytbV3kSoXaLnToslnSUIxvL8AwLHjtyMjtYYyjB:5b5kSYaLTVlYlL8AgHJywtYYMB

Score

1^/10

Malware Config

Signatures

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4408	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4704	b96323d3104a0fd9606acf15ff8c29c0_NEIKI.exe
4704	b96323d3104a0fd9606acf15ff8c29c0_NEIKI.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4704	b96323d3104a0fd9606acf15ff8c29c0_NEIKI.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4704 wrote to memory of 4840	4704	b96323d3104a0fd9606acf15ff8c29c0_NEIKI.exe	83
PID 4704 wrote to memory of 4840	4704	b96323d3104a0fd9606acf15ff8c29c0_NEIKI.exe	83
PID 4840 wrote to memory of 4408	4840	cmd.exe	85
PID 4840 wrote to memory of 4408	4840	cmd.exe	85

C:\Users\Admin\AppData\Local\Temp\b96323d3104a0fd9606acf15ff8c29c0_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\b96323d3104a0fd9606acf15ff8c29c0_NEIKI.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\b96323d3104a0fd9606acf15ff8c29c0_NEIKI.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4840
- - C:\Windows\system32\PING.EXE
    ping 1.1.1.1 -n 1 -w 6000
    3⤵
    - Runs ping.exe
    PID:4408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads