Analysis
- max time kernel
149s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
02/11/2026, 22:13
General
- Target NeITDevice_Latest.exe
- Size 20.5MB
- Sample261102-144n4axtas
- SHA256 11e77bf12a5a5a4a4447c8656dfbb503753daab847b4949cc442594ea76ff577
Malware Config
Signatures
- Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Drops file in System32 directory 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Windows directory 2 IoCs
- Executes dropped EXE 6 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks SCSI registry key(s) 3 TTPs 14 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 4 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 41 IoCs
- Suspicious behavior: LoadsDriver 5 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of FindShellTrayWindow 4 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\NeITDevice_Latest.exe"C:\Users\Admin\AppData\Local\Temp\NeITDevice_Latest.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.EXEC:\Windows\system32\schtasks.EXE /create /tn NeITDeviceUpdater /tr "powershell.exe -nologo -noprofile -noninteractive -ExecutionPolicy Bypass -File \"C:\Windows\policy\SDK_RUN\NeITDeviceUpdater.ps1\"" /sc hourly /mo 1 /ru SYSTEM /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\ProgramData\Netease\POPOXIAOYI\NeITDevice\dependent\smartctl.exeC:\ProgramData\Netease\POPOXIAOYI\NeITDevice\dependent\smartctl.exe -a --json=o -d ata /dev/pd02⤵
- Writes to the Master Boot Record (MBR)
- Executes dropped EXE
-
-
C:\ProgramData\Netease\POPOXIAOYI\NeITDevice\dependent\CLIWrapper.exeC:\ProgramData\Netease\POPOXIAOYI\NeITDevice\dependent\CLIWrapper.exe GetGpuInfo2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\ProgramData\Netease\POPOXIAOYI\NeITDevice\dependent\CLIWrapper.exeC:\ProgramData\Netease\POPOXIAOYI\NeITDevice\dependent\CLIWrapper.exe GetTemperature2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\ProgramData\Netease\POPOXIAOYI\NeITDevice\dependent\CLIWrapper.exeC:\ProgramData\Netease\POPOXIAOYI\NeITDevice\dependent\CLIWrapper.exe GetGpuUsage2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\ProgramData\Netease\POPOXIAOYI\NeITDevice\dependent\tools\cpu-z\cpuz.exeC:\ProgramData\Netease\POPOXIAOYI\NeITDevice\dependent\tools\cpu-z\cpuz.exe -txt=C:\Users\Admin\AppData\Local\Temp\netease_cpuz_236_2408066872⤵
- Writes to the Master Boot Record (MBR)
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
-
C:\ProgramData\Netease\POPOXIAOYI\NeITDevice\dependent\CLIWrapper.exeC:\ProgramData\Netease\POPOXIAOYI\NeITDevice\dependent\CLIWrapper.exe GetTrafficUsage2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
CLIWrapper.exe
NeITDeviceUpdater.ps1
NeITDeviceWrapper.exe
smartctl.exe
cpuz.exe
cpuz.ini
WinRing0Wdf.sys
netease_cpuz_236_240806687.txt
memory/236-106-0x00007FF785A80000-0x00007FF788CFA000-memory.dmp
memory/236-102-0x00007FF785A80000-0x00007FF788CFA000-memory.dmp
memory/236-94-0x00007FF785A80000-0x00007FF788CFA000-memory.dmp
memory/236-48-0x00007FF785A80000-0x00007FF788CFA000-memory.dmp
memory/236-71-0x00007FF785A80000-0x00007FF788CFA000-memory.dmp
memory/236-98-0x00007FF785A80000-0x00007FF788CFA000-memory.dmp
memory/236-0-0x00007FF785A80000-0x00007FF788CFA000-memory.dmp
memory/236-85-0x00007FF785A80000-0x00007FF788CFA000-memory.dmp
memory/236-54-0x00007FF785A80000-0x00007FF788CFA000-memory.dmp
memory/236-89-0x00007FF785A80000-0x00007FF788CFA000-memory.dmp
memory/2852-38-0x000001F471F60000-0x000001F471FA8000-memory.dmp
memory/2852-37-0x000001F4719B0000-0x000001F4719D2000-memory.dmp
memory/2852-49-0x000001F471A50000-0x000001F471B7F000-memory.dmp
memory/3324-59-0x00007FF7DB6F0000-0x00007FF7DB828000-memory.dmp