Overview
overview
7Static
static
3caada1d448...KI.exe
windows7-x64
7caada1d448...KI.exe
windows10-2004-x64
7$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3config.dll
windows7-x64
5config.dll
windows10-2004-x64
5iconAnimate.exe
windows7-x64
1iconAnimate.exe
windows10-2004-x64
1iconTips.exe
windows7-x64
1iconTips.exe
windows10-2004-x64
1uninst.exe
windows7-x64
7uninst.exe
windows10-2004-x64
7$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/inetc.dll
windows7-x64
3$PLUGINSDIR/inetc.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3wour_wrnd.exe
windows7-x64
1wour_wrnd.exe
windows10-2004-x64
1Analysis
-
max time kernel
93s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
09/05/2024, 02:13
Static task
static1
Behavioral task
behavioral1
Sample
caada1d448c6b4ffedeffc3f598005d0_NEIKI.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
caada1d448c6b4ffedeffc3f598005d0_NEIKI.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win7-20240419-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240220-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
config.dll
Resource
win7-20240419-en
Behavioral task
behavioral12
Sample
config.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
iconAnimate.exe
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
iconAnimate.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral15
Sample
iconTips.exe
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
iconTips.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral17
Sample
uninst.exe
Resource
win7-20240508-en
Behavioral task
behavioral18
Sample
uninst.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win7-20240215-en
Behavioral task
behavioral20
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral21
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win7-20240508-en
Behavioral task
behavioral22
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240508-en
Behavioral task
behavioral24
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral25
Sample
$PLUGINSDIR/inetc.dll
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
$PLUGINSDIR/inetc.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral27
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
wour_wrnd.exe
Resource
win7-20240508-en
Behavioral task
behavioral30
Sample
wour_wrnd.exe
Resource
win10v2004-20240426-en
General
-
Target
uninst.exe
-
Size
290KB
-
MD5
78366c7f86a685e23eb897c6f34eb503
-
SHA1
1c01a172a7137890b6b5a4b4fac0f9d8562b5ac0
-
SHA256
51f44ce9c10bc7a860c431ee7f16c2012fe88513c87d7efad7757c35c2a59c4b
-
SHA512
20967b60bb14a8772978ba71b3e4e4e8cc7ac934889d01a52486885f1099b02b16091ccc549c9b6117713f72aedc02694d71449ac89db692bf1ab8a9d0d3456a
-
SSDEEP
6144:ke34KGjndtYt7Z+n9pGnVoUc99jCbd2/whMcitrqjGIu:fGjn4sGnGxnmiJ
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 3984 Au_.exe -
Executes dropped EXE 1 IoCs
pid Process 3984 Au_.exe -
Loads dropped DLL 2 IoCs
pid Process 3984 Au_.exe 3984 Au_.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 wour_wrnd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NSIS installer 2 IoCs
resource yara_rule behavioral18/files/0x00090000000233e2-3.dat nsis_installer_1 behavioral18/files/0x00090000000233e2-3.dat nsis_installer_2 -
Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 3984 Au_.exe 3984 Au_.exe 2616 wour_wrnd.exe 2616 wour_wrnd.exe 2616 wour_wrnd.exe 2616 wour_wrnd.exe 2616 wour_wrnd.exe 2616 wour_wrnd.exe 2616 wour_wrnd.exe 2616 wour_wrnd.exe 2616 wour_wrnd.exe 2616 wour_wrnd.exe 2616 wour_wrnd.exe 2616 wour_wrnd.exe 2616 wour_wrnd.exe 2616 wour_wrnd.exe 2616 wour_wrnd.exe 2616 wour_wrnd.exe 2616 wour_wrnd.exe 2616 wour_wrnd.exe 2616 wour_wrnd.exe 2616 wour_wrnd.exe 2616 wour_wrnd.exe 2616 wour_wrnd.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2200 wrote to memory of 3984 2200 uninst.exe 79 PID 2200 wrote to memory of 3984 2200 uninst.exe 79 PID 2200 wrote to memory of 3984 2200 uninst.exe 79 PID 3984 wrote to memory of 2616 3984 Au_.exe 83 PID 3984 wrote to memory of 2616 3984 Au_.exe 83 PID 3984 wrote to memory of 2616 3984 Au_.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\uninst.exe"C:\Users\Admin\AppData\Local\Temp\uninst.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe"C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\2⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\wour_wrnd.exe"C:\Users\Admin\AppData\Local\Temp\wour_wrnd.exe" /uninstallsucc3⤵
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
PID:2616
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
402B
MD574ed4c94c0bf9e64ddd3d81e90bc8e44
SHA1f0a5721e6e7b64408a7aba1a51f0c4c281dced33
SHA25620e4f8b6a34dd809495e912b22f8527b27758b489459ade68bf2fdd4c3bb4d53
SHA512e9181b9fa0761750f245ff7ddd9b8a1f912e0042b3e0ad58a694a9ad59f5e3ed7f29fd8b29f434285a7d2a4d675cf583c6fffbc362a478a065a67c4237c09cf9
-
Filesize
3KB
MD58614c450637267afacad1645e23ba24a
SHA1e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2
SHA2560fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758
SHA512af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b
-
Filesize
20KB
MD5c498ae64b4971132bba676873978de1e
SHA192e4009cd776b6c8616d8bffade7668ef3cb3c27
SHA2565552bdde7e4113393f683ef501e4cc84dccc071bdc51391ea7fa3e7c1d49e4e8
SHA5128e5ca35493f749a39ceae6796d2658ba10f7d8d9ceca45bb4365b338fabd1dfa9b9f92e33f50c91b0273e66adfbce4b98b09c15fd2473f8b214ed797462333d7
-
Filesize
290KB
MD578366c7f86a685e23eb897c6f34eb503
SHA11c01a172a7137890b6b5a4b4fac0f9d8562b5ac0
SHA25651f44ce9c10bc7a860c431ee7f16c2012fe88513c87d7efad7757c35c2a59c4b
SHA51220967b60bb14a8772978ba71b3e4e4e8cc7ac934889d01a52486885f1099b02b16091ccc549c9b6117713f72aedc02694d71449ac89db692bf1ab8a9d0d3456a