Overview
overview
7Static
static
3caada1d448...KI.exe
windows7-x64
7caada1d448...KI.exe
windows10-2004-x64
7$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3config.dll
windows7-x64
5config.dll
windows10-2004-x64
5iconAnimate.exe
windows7-x64
1iconAnimate.exe
windows10-2004-x64
1iconTips.exe
windows7-x64
1iconTips.exe
windows10-2004-x64
1uninst.exe
windows7-x64
7uninst.exe
windows10-2004-x64
7$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/inetc.dll
windows7-x64
3$PLUGINSDIR/inetc.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3wour_wrnd.exe
windows7-x64
1wour_wrnd.exe
windows10-2004-x64
1Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
09/05/2024, 02:13
Static task
static1
Behavioral task
behavioral1
Sample
caada1d448c6b4ffedeffc3f598005d0_NEIKI.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
caada1d448c6b4ffedeffc3f598005d0_NEIKI.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win7-20240419-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240220-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
config.dll
Resource
win7-20240419-en
Behavioral task
behavioral12
Sample
config.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
iconAnimate.exe
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
iconAnimate.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral15
Sample
iconTips.exe
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
iconTips.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral17
Sample
uninst.exe
Resource
win7-20240508-en
Behavioral task
behavioral18
Sample
uninst.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win7-20240215-en
Behavioral task
behavioral20
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral21
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win7-20240508-en
Behavioral task
behavioral22
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240508-en
Behavioral task
behavioral24
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral25
Sample
$PLUGINSDIR/inetc.dll
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
$PLUGINSDIR/inetc.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral27
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
wour_wrnd.exe
Resource
win7-20240508-en
Behavioral task
behavioral30
Sample
wour_wrnd.exe
Resource
win10v2004-20240426-en
General
-
Target
uninst.exe
-
Size
290KB
-
MD5
78366c7f86a685e23eb897c6f34eb503
-
SHA1
1c01a172a7137890b6b5a4b4fac0f9d8562b5ac0
-
SHA256
51f44ce9c10bc7a860c431ee7f16c2012fe88513c87d7efad7757c35c2a59c4b
-
SHA512
20967b60bb14a8772978ba71b3e4e4e8cc7ac934889d01a52486885f1099b02b16091ccc549c9b6117713f72aedc02694d71449ac89db692bf1ab8a9d0d3456a
-
SSDEEP
6144:ke34KGjndtYt7Z+n9pGnVoUc99jCbd2/whMcitrqjGIu:fGjn4sGnGxnmiJ
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2196 Au_.exe -
Executes dropped EXE 1 IoCs
pid Process 2196 Au_.exe -
Loads dropped DLL 3 IoCs
pid Process 2248 uninst.exe 2196 Au_.exe 2196 Au_.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 wour_wrnd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NSIS installer 2 IoCs
resource yara_rule behavioral17/files/0x000a000000015c8c-2.dat nsis_installer_1 behavioral17/files/0x000a000000015c8c-2.dat nsis_installer_2 -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 2196 Au_.exe 2792 wour_wrnd.exe 2792 wour_wrnd.exe 2792 wour_wrnd.exe 2792 wour_wrnd.exe 2792 wour_wrnd.exe 2792 wour_wrnd.exe 2792 wour_wrnd.exe 2792 wour_wrnd.exe 2792 wour_wrnd.exe 2792 wour_wrnd.exe 2792 wour_wrnd.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2196 Au_.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2248 wrote to memory of 2196 2248 uninst.exe 28 PID 2248 wrote to memory of 2196 2248 uninst.exe 28 PID 2248 wrote to memory of 2196 2248 uninst.exe 28 PID 2248 wrote to memory of 2196 2248 uninst.exe 28 PID 2248 wrote to memory of 2196 2248 uninst.exe 28 PID 2248 wrote to memory of 2196 2248 uninst.exe 28 PID 2248 wrote to memory of 2196 2248 uninst.exe 28 PID 2196 wrote to memory of 2792 2196 Au_.exe 30 PID 2196 wrote to memory of 2792 2196 Au_.exe 30 PID 2196 wrote to memory of 2792 2196 Au_.exe 30 PID 2196 wrote to memory of 2792 2196 Au_.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\uninst.exe"C:\Users\Admin\AppData\Local\Temp\uninst.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe"C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\2⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\wour_wrnd.exe"C:\Users\Admin\AppData\Local\Temp\wour_wrnd.exe" /uninstallsucc3⤵
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
PID:2792
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
402B
MD5b9e922ed99ed720ba19a779f3d6ed688
SHA1f3119081e3732f10fe66a4b1ed33ffc43ad7c49c
SHA256374e7067b81f5d72894a1fee4d89d83e25159e1bf0c8be44b469fee17977f8df
SHA5124cd2eec4186f6541018103a8b2ebb872b9a97a7b9fefce0f4ee3a97487440fac349e915fffd476ce14c9c594bfac876160e3c86381d4df3f81693225a5fa6f70
-
Filesize
3KB
MD58614c450637267afacad1645e23ba24a
SHA1e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2
SHA2560fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758
SHA512af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b
-
Filesize
20KB
MD5c498ae64b4971132bba676873978de1e
SHA192e4009cd776b6c8616d8bffade7668ef3cb3c27
SHA2565552bdde7e4113393f683ef501e4cc84dccc071bdc51391ea7fa3e7c1d49e4e8
SHA5128e5ca35493f749a39ceae6796d2658ba10f7d8d9ceca45bb4365b338fabd1dfa9b9f92e33f50c91b0273e66adfbce4b98b09c15fd2473f8b214ed797462333d7
-
Filesize
290KB
MD578366c7f86a685e23eb897c6f34eb503
SHA11c01a172a7137890b6b5a4b4fac0f9d8562b5ac0
SHA25651f44ce9c10bc7a860c431ee7f16c2012fe88513c87d7efad7757c35c2a59c4b
SHA51220967b60bb14a8772978ba71b3e4e4e8cc7ac934889d01a52486885f1099b02b16091ccc549c9b6117713f72aedc02694d71449ac89db692bf1ab8a9d0d3456a