Overview

overview

7

Static

static

3

0029a4d756...KI.exe

windows7-x64

7

0029a4d756...KI.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0029a4d756eb4f0126fb7f1b7b1dbce0_NEIKI

  • Size

    120KB

  • Sample

    240509-j4n5zabd74

  • MD5

    0029a4d756eb4f0126fb7f1b7b1dbce0

  • SHA1

    9ca6e91913e6b84dcf0f8c4e9aba01e0a3674b1a

  • SHA256

    3659c82b50bdc329cee38060a50eeb74f74f302b14a788b3757607791fc43f63

  • SHA512

    2e664ba816a113ad098be5e103f88439e6114f558c0adebd0fdb030d7952d0a8d51b26bd1412d2c3b3d9eae1d4187b2d789f19623824d0e59bcb387be284e439

  • SSDEEP

    3072:tOjWuyt0ZsqsXOKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPPh:tIs9OKofHfHTXQLzgvnzHPowYbvrjD/E

Score
7/10
persistence

Malware Config

Targets

    • Target

      0029a4d756eb4f0126fb7f1b7b1dbce0_NEIKI

    • Size

      120KB

    • MD5

      0029a4d756eb4f0126fb7f1b7b1dbce0

    • SHA1

      9ca6e91913e6b84dcf0f8c4e9aba01e0a3674b1a

    • SHA256

      3659c82b50bdc329cee38060a50eeb74f74f302b14a788b3757607791fc43f63

    • SHA512

      2e664ba816a113ad098be5e103f88439e6114f558c0adebd0fdb030d7952d0a8d51b26bd1412d2c3b3d9eae1d4187b2d789f19623824d0e59bcb387be284e439

    • SSDEEP

      3072:tOjWuyt0ZsqsXOKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPPh:tIs9OKofHfHTXQLzgvnzHPowYbvrjD/E

    Score
    7/10
    persistence

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks