Analysis

  • max time kernel
    94s
  • max time network
    97s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/05/2024, 02:13

General

  • Target

    caada1d448c6b4ffedeffc3f598005d0_NEIKI.exe

  • Size

    1.4MB

  • MD5

    caada1d448c6b4ffedeffc3f598005d0

  • SHA1

    019dc31ba781d841fe6a69e270cda780f35905c0

  • SHA256

    b267fc474977cc4b40c6956662ea7e8c073e68ca003b1cbc54c159154f181d8a

  • SHA512

    1129aec75546c6c227075233f17482c8c522aa8bfd9f374e665e23cb909ac24d993cc7a44fd3a47752a4979114cafab9d14435ce860ba8dd1afd00055d5cb3b4

  • SSDEEP

    24576:KCokxkoQXWnb68MPnemRKO4vIQgVWmdjzE4KhZd0FcZqP+whE5jVmJizfZmhSKaB:t5xk3XYPQneK7mVxmdjg9hZdH/SE5jVv

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 8 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\caada1d448c6b4ffedeffc3f598005d0_NEIKI.exe
    "C:\Users\Admin\AppData\Local\Temp\caada1d448c6b4ffedeffc3f598005d0_NEIKI.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4544
    • C:\Users\Admin\AppData\Roaming\qxz\wour_wrnd.exe
      "C:\Users\Admin\AppData\Roaming\qxz\wour_wrnd.exe" SW_SHOWNORMAL
      2⤵
      • Executes dropped EXE
      PID:2576
    • C:\Users\Admin\AppData\Roaming\qxz\wour_wrnd.exe
      "C:\Users\Admin\AppData\Roaming\qxz\wour_wrnd.exe" /setupsucc
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Writes to the Master Boot Record (MBR)
      • Suspicious behavior: EnumeratesProcesses
      PID:3524

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\nsb57A7.tmp\FindProcDLL.dll

          Filesize

          3KB

          MD5

          8614c450637267afacad1645e23ba24a

          SHA1

          e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2

          SHA256

          0fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758

          SHA512

          af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b

        • C:\Users\Admin\AppData\Local\Temp\nsb57A7.tmp\KillProcDLL.dll

          Filesize

          4KB

          MD5

          99f345cf51b6c3c317d20a81acb11012

          SHA1

          b3d0355f527c536ea14a8ff51741c8739d66f727

          SHA256

          c2689ba1f66066afce85ca6457ecd36370be0fe351c58422e45efd0948655c93

          SHA512

          937aa75be84a74f2be3b54dc80fac02c17dad1915d924ef82ab354d2a49bc773ee6d801203c52686113783a7c7ea0e8ed8e673ba696d6d3212f7006e291ed2ef

        • C:\Users\Admin\AppData\Local\Temp\nsb57A7.tmp\System.dll

          Filesize

          11KB

          MD5

          c17103ae9072a06da581dec998343fc1

          SHA1

          b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

          SHA256

          dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

          SHA512

          d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

        • C:\Users\Admin\AppData\Roaming\qxz\config.dll

          Filesize

          1.2MB

          MD5

          f9da380edeade2cd43e88209aa5f5593

          SHA1

          639cbdb652bfd2bbcccba9629a3e3bd99b4085f4

          SHA256

          4bd67a9d8c2cab01c6f11bed72ebbcc350cdfae84bc88f4999a1cf580a63cfe4

          SHA512

          b0da97fd3bd6397fe4bba8ef63e4f0821f15663a864c85f2f9449851859f123478fb61d9a638384d48a2ec749400d2340948b76f3658e82e5080ea940e102b60

        • C:\Users\Admin\AppData\Roaming\qxz\config.ini

          Filesize

          354B

          MD5

          98efa8568aed419201ecb2350293ae0c

          SHA1

          4a43c3d1297534734c4075e3af7f82655c07e388

          SHA256

          71f4a6f8fef1aadd97d12f79860a6709e2901bf3cf7061017c6e70ba4c61b2ab

          SHA512

          cbeaa53e11b063b2a7641468148c671d4c4f0b32bb7fd423cf614275c0453f0ee35d28415a9040769f13d4189eabb3c03bef184bd6854135b018daf6a14f3f4b

        • C:\Users\Admin\AppData\Roaming\qxz\wour_wrnd.exe

          Filesize

          32KB

          MD5

          1b65ca9566e6fcc4f5286a8bdd9518ee

          SHA1

          0744a66417dc712701b426d26ecd4b811b7065dd

          SHA256

          dfa88f801ad48651ac69e19154fd5248710b2c80b4c902f9763c2a07a4e54623

          SHA512

          47f9505c9ecf38c4ee1be397bab976416ad7a15eaf82aa905e304c44782a132dfa0c6a75d3ce37a85e8ffcd335617be880e6a758e5be8060b91b5158508fe829

        • memory/4544-16-0x0000000004710000-0x0000000004713000-memory.dmp

          Filesize

          12KB

        • memory/4544-15-0x0000000004710000-0x0000000004713000-memory.dmp

          Filesize

          12KB

        • memory/4544-62-0x0000000004821000-0x0000000004822000-memory.dmp

          Filesize

          4KB

        • memory/4544-61-0x0000000004820000-0x0000000004823000-memory.dmp

          Filesize

          12KB

        • memory/4544-60-0x0000000004DC1000-0x0000000004DC2000-memory.dmp

          Filesize

          4KB

        • memory/4544-59-0x0000000004DC0000-0x0000000004DC3000-memory.dmp

          Filesize

          12KB

        • memory/4544-17-0x0000000004711000-0x0000000004712000-memory.dmp

          Filesize

          4KB

        • memory/4544-74-0x0000000004711000-0x0000000004712000-memory.dmp

          Filesize

          4KB