Overview
overview
7Static
static
3caada1d448...KI.exe
windows7-x64
7caada1d448...KI.exe
windows10-2004-x64
7$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3config.dll
windows7-x64
5config.dll
windows10-2004-x64
5iconAnimate.exe
windows7-x64
1iconAnimate.exe
windows10-2004-x64
1iconTips.exe
windows7-x64
1iconTips.exe
windows10-2004-x64
1uninst.exe
windows7-x64
7uninst.exe
windows10-2004-x64
7$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/inetc.dll
windows7-x64
3$PLUGINSDIR/inetc.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3wour_wrnd.exe
windows7-x64
1wour_wrnd.exe
windows10-2004-x64
1Analysis
-
max time kernel
94s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
09/05/2024, 02:13
Static task
static1
Behavioral task
behavioral1
Sample
caada1d448c6b4ffedeffc3f598005d0_NEIKI.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
caada1d448c6b4ffedeffc3f598005d0_NEIKI.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win7-20240419-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240220-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
config.dll
Resource
win7-20240419-en
Behavioral task
behavioral12
Sample
config.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
iconAnimate.exe
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
iconAnimate.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral15
Sample
iconTips.exe
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
iconTips.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral17
Sample
uninst.exe
Resource
win7-20240508-en
Behavioral task
behavioral18
Sample
uninst.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win7-20240215-en
Behavioral task
behavioral20
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral21
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win7-20240508-en
Behavioral task
behavioral22
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240508-en
Behavioral task
behavioral24
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral25
Sample
$PLUGINSDIR/inetc.dll
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
$PLUGINSDIR/inetc.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral27
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
wour_wrnd.exe
Resource
win7-20240508-en
Behavioral task
behavioral30
Sample
wour_wrnd.exe
Resource
win10v2004-20240426-en
General
-
Target
caada1d448c6b4ffedeffc3f598005d0_NEIKI.exe
-
Size
1.4MB
-
MD5
caada1d448c6b4ffedeffc3f598005d0
-
SHA1
019dc31ba781d841fe6a69e270cda780f35905c0
-
SHA256
b267fc474977cc4b40c6956662ea7e8c073e68ca003b1cbc54c159154f181d8a
-
SHA512
1129aec75546c6c227075233f17482c8c522aa8bfd9f374e665e23cb909ac24d993cc7a44fd3a47752a4979114cafab9d14435ce860ba8dd1afd00055d5cb3b4
-
SSDEEP
24576:KCokxkoQXWnb68MPnemRKO4vIQgVWmdjzE4KhZd0FcZqP+whE5jVmJizfZmhSKaB:t5xk3XYPQneK7mVxmdjg9hZdH/SE5jVv
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation caada1d448c6b4ffedeffc3f598005d0_NEIKI.exe -
Executes dropped EXE 2 IoCs
pid Process 2576 wour_wrnd.exe 3524 wour_wrnd.exe -
Loads dropped DLL 8 IoCs
pid Process 4544 caada1d448c6b4ffedeffc3f598005d0_NEIKI.exe 4544 caada1d448c6b4ffedeffc3f598005d0_NEIKI.exe 4544 caada1d448c6b4ffedeffc3f598005d0_NEIKI.exe 4544 caada1d448c6b4ffedeffc3f598005d0_NEIKI.exe 4544 caada1d448c6b4ffedeffc3f598005d0_NEIKI.exe 4544 caada1d448c6b4ffedeffc3f598005d0_NEIKI.exe 4544 caada1d448c6b4ffedeffc3f598005d0_NEIKI.exe 3524 wour_wrnd.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 wour_wrnd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 4544 caada1d448c6b4ffedeffc3f598005d0_NEIKI.exe 4544 caada1d448c6b4ffedeffc3f598005d0_NEIKI.exe 4544 caada1d448c6b4ffedeffc3f598005d0_NEIKI.exe 4544 caada1d448c6b4ffedeffc3f598005d0_NEIKI.exe 4544 caada1d448c6b4ffedeffc3f598005d0_NEIKI.exe 4544 caada1d448c6b4ffedeffc3f598005d0_NEIKI.exe 3524 wour_wrnd.exe 3524 wour_wrnd.exe 3524 wour_wrnd.exe 3524 wour_wrnd.exe 3524 wour_wrnd.exe 3524 wour_wrnd.exe 3524 wour_wrnd.exe 3524 wour_wrnd.exe 3524 wour_wrnd.exe 3524 wour_wrnd.exe 3524 wour_wrnd.exe 3524 wour_wrnd.exe 3524 wour_wrnd.exe 3524 wour_wrnd.exe 3524 wour_wrnd.exe 3524 wour_wrnd.exe 3524 wour_wrnd.exe 3524 wour_wrnd.exe 3524 wour_wrnd.exe 3524 wour_wrnd.exe 3524 wour_wrnd.exe 3524 wour_wrnd.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4544 wrote to memory of 2576 4544 caada1d448c6b4ffedeffc3f598005d0_NEIKI.exe 79 PID 4544 wrote to memory of 2576 4544 caada1d448c6b4ffedeffc3f598005d0_NEIKI.exe 79 PID 4544 wrote to memory of 2576 4544 caada1d448c6b4ffedeffc3f598005d0_NEIKI.exe 79 PID 4544 wrote to memory of 3524 4544 caada1d448c6b4ffedeffc3f598005d0_NEIKI.exe 80 PID 4544 wrote to memory of 3524 4544 caada1d448c6b4ffedeffc3f598005d0_NEIKI.exe 80 PID 4544 wrote to memory of 3524 4544 caada1d448c6b4ffedeffc3f598005d0_NEIKI.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\caada1d448c6b4ffedeffc3f598005d0_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\caada1d448c6b4ffedeffc3f598005d0_NEIKI.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Users\Admin\AppData\Roaming\qxz\wour_wrnd.exe"C:\Users\Admin\AppData\Roaming\qxz\wour_wrnd.exe" SW_SHOWNORMAL2⤵
- Executes dropped EXE
PID:2576
-
-
C:\Users\Admin\AppData\Roaming\qxz\wour_wrnd.exe"C:\Users\Admin\AppData\Roaming\qxz\wour_wrnd.exe" /setupsucc2⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
PID:3524
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD58614c450637267afacad1645e23ba24a
SHA1e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2
SHA2560fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758
SHA512af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b
-
Filesize
4KB
MD599f345cf51b6c3c317d20a81acb11012
SHA1b3d0355f527c536ea14a8ff51741c8739d66f727
SHA256c2689ba1f66066afce85ca6457ecd36370be0fe351c58422e45efd0948655c93
SHA512937aa75be84a74f2be3b54dc80fac02c17dad1915d924ef82ab354d2a49bc773ee6d801203c52686113783a7c7ea0e8ed8e673ba696d6d3212f7006e291ed2ef
-
Filesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
Filesize
1.2MB
MD5f9da380edeade2cd43e88209aa5f5593
SHA1639cbdb652bfd2bbcccba9629a3e3bd99b4085f4
SHA2564bd67a9d8c2cab01c6f11bed72ebbcc350cdfae84bc88f4999a1cf580a63cfe4
SHA512b0da97fd3bd6397fe4bba8ef63e4f0821f15663a864c85f2f9449851859f123478fb61d9a638384d48a2ec749400d2340948b76f3658e82e5080ea940e102b60
-
Filesize
354B
MD598efa8568aed419201ecb2350293ae0c
SHA14a43c3d1297534734c4075e3af7f82655c07e388
SHA25671f4a6f8fef1aadd97d12f79860a6709e2901bf3cf7061017c6e70ba4c61b2ab
SHA512cbeaa53e11b063b2a7641468148c671d4c4f0b32bb7fd423cf614275c0453f0ee35d28415a9040769f13d4189eabb3c03bef184bd6854135b018daf6a14f3f4b
-
Filesize
32KB
MD51b65ca9566e6fcc4f5286a8bdd9518ee
SHA10744a66417dc712701b426d26ecd4b811b7065dd
SHA256dfa88f801ad48651ac69e19154fd5248710b2c80b4c902f9763c2a07a4e54623
SHA51247f9505c9ecf38c4ee1be397bab976416ad7a15eaf82aa905e304c44782a132dfa0c6a75d3ce37a85e8ffcd335617be880e6a758e5be8060b91b5158508fe829