Overview

overview

7

Static

static

3

b2f8393d3e...KI.exe

windows7-x64

7

b2f8393d3e...KI.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/05/2024, 10:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    b2f8393d3e850dae22090eaa6f1103b4_NEIKI.exe

  • Size

    4.1MB

  • MD5

    b2f8393d3e850dae22090eaa6f1103b4

  • SHA1

    1008a8b899908494a28fb618044223c968878b10

  • SHA256

    4848ac2dca034d49a696e008888d6f70ae4a32e3daf1b655b974c86ceac52ad9

  • SHA512

    99e0fdf77956eaaea300339fe8eac15292954532ff47bf5d138575c74353ab18f6fd7c5b3a575e7e89503a4437ef4955928df969d6a91b2a87ee69f39ba4cc77

  • SSDEEP

    98304:+R0pI/IQlUoMPdmpSpK4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdmx5n9klRKN41v

Score
7/10
persistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b2f8393d3e850dae22090eaa6f1103b4_NEIKI.exe
    "C:\Users\Admin\AppData\Local\Temp\b2f8393d3e850dae22090eaa6f1103b4_NEIKI.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2448
    • C:\UserDotFZ\adobec.exe
      C:\UserDotFZ\adobec.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:4908

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\GalaxOX\optidevloc.exe
          Filesize

          4.1MB

          MD5

          afe8c4841668b64e3c3ab5dccc9c53ab

          SHA1

          e3a65fe244a35bf30a03de01e71db83707996cc5

          SHA256

          111930407aa402a9ba532c0f949f701c920fe30bd721198033fce9800487941f

          SHA512

          1ef63d6ae0007ea9b9df0dcea47e11079858d1cd74c72e6a8b2628f560db2d1bb97819100a8bb17ff33536d580a4543b01916dee57b709641d0edc42cae54209

          Download Submit

        • C:\UserDotFZ\adobec.exe
          Filesize

          4.1MB

          MD5

          4c9bb9deff943addef157ce167267483

          SHA1

          e433d43c76ef582f4c3ce494652e69cbb8cbf1e1

          SHA256

          803cbdc357e2c4aed5356c34ffacb088c5b2db80036cb67bb9fd9e6564007fef

          SHA512

          b06cea9d4a2a4f53d5dc05a8c50801eadbc4769637b3b15f9d1c64a6faef16bd3fe170fbe6dd3183053efe86187eed009b54be3731e2f2682e8a7b98ba7b6066

          Download Submit

        • C:\Users\Admin\253086396416_10.0_Admin.ini
          Filesize

          214B

          MD5

          28f454575fd59c2d47cac3e7b49d5dda

          SHA1

          adcd00bf2599c40168cfb648a03540c9e288a50e

          SHA256

          913d5f064f8536602ba5a42e06fdbcd3f38aa7f38752157a36749507429473c5

          SHA512

          bc4bda937ae3f80ed12da246fb3aed9e1125f32e2fb5d5d937eb51fb71ac90d13eb3323529540c612848ddf388d65523a4c4903efd2e02a10108cb88b40a5bb1

          Download Submit