Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
09-05-2024 04:06
General
-
Target
e94807ae438bdeefc31cf88fdf29a880_NEIKI.exe
-
Size
212KB
-
MD5
e94807ae438bdeefc31cf88fdf29a880
-
SHA1
c3242aaa77728e07eecce378e7675077822e28ae
-
SHA256
c0aaabac5a17261d9d728c981e5289c8736628849a06e10968987376e52b6ddc
-
SHA512
ac97ec2a458d80ec026bcafb9b06b433a2002a237246bc1c44085839703c07324b20d600910337440c70e7601dd9f5af264e365ab86df5cd45184177b1d9fe58
-
SSDEEP
3072:LXi+1IfIwFs7ZbxrAerbWu7s3BLbOyYkW8/1HSG9VRfqXlzcM8tKog8vCa30+Z:LXMwwW7Z1rAeXT8bOcdHd9yrpoBv8+
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e94807ae438bdeefc31cf88fdf29a880_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\e94807ae438bdeefc31cf88fdf29a880_NEIKI.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168B
MD5d57e3a550060f85d44a175139ea23021
SHA12c5cb3428a322c9709a34d04dd86fe7628f8f0a6
SHA25643edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c
SHA5120364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063
-
Filesize
22KB
MD5624f36e529fbb84f62e2f4fe98b4c3c5
SHA1fb26fe29151b4868ef10417c44314aec202d4968
SHA256a69232f0103d45562f8eb0e0fb564b3f7db22c1e93c1544d6b4a127dff163ffc
SHA512dd61f3293099e38022103d9226d9f671a3f545ed09f74f22cfa1d06100b017bf9989b22e97d969c56aa4d16c9a2260f4c4992f76a42e2372d5b3159857884ec7
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
102KB
MD5e4fe1d6b9d85503a9b1559ba173e197a
SHA1a95a5b7a9197baca885f510b04c59adf702367a2
SHA2567d1b488268b777ef018cc107fa6a004bbaa31aa1f83f941997b6a2a55b7ef04e
SHA512e2142cd8a3c5867b6cbd3a5f368dbe1dd73febb2a15f7e4a09b9901d21ae5dec0953e46ea527eb9b5c59e53324f2e6b87d0dc56ad91d31ea540b0aa0752d5c44
-
Filesize
457B
MD5531ec87a0b2f9477a52d88b111d0d46a
SHA150a72e5752075309f91c062e0282a7e7cd1e751e
SHA2564875b451859b1eb8d0d3b040b1bb8d654d212edb6d9c721cf0f4372129579385
SHA51207994963fd76b31ef0ba2c7f418dcb3ee0290f6baca2d8ec63a6e6b861557b13fbc20d2f0a10a66f35c4d72d4d2c1920ac88b96174604f2f8856868912327da1
-
Filesize
212KB
MD57e933b7114fdbc2dc7888606e6ab9832
SHA1e739cb91ec71490436271c330050252b256a22c5
SHA256cda477b3860ee8e3a506d93349aa84571712f4f86ebdc87c966bbdd7f403de41
SHA5127b9456973892652fe25926f0aa025f1a592fbb1dbdabb17eaa2ae98075d7296337f9d7fe57417a59b087d3486df423068ede508fd305aa62d4ec48e815d980d0
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.0MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
672KB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
2.0MB