General
-
Target
6d819b46d059a6f36b5a85919d8eb470_NeikiAnalytics.exe
-
Size
1.5MB
-
Sample
240607-z8jdaaea47
-
MD5
6d819b46d059a6f36b5a85919d8eb470
-
SHA1
cbec530757ba9906be563713812d3f85c0e44ea0
-
SHA256
835367bb2aa6a58d9ed7589caec0bd2d18cbc6ee520c52aa1beb106f6af274f9
-
SHA512
8b5f9733e35c65f6b3711f0da1ee5de907ed29728384311b3363c23cb9a49918f0a81f65512d7c62e051281f7c8818fb831418528b67c1b095a83f9df64cb2e7
-
SSDEEP
24576:UD39v74lfGQrFUspugRNJI2DJ53J/J/L5dJPjomE:Up7E+QrFUBgq2U
Static task
static1
Behavioral task
behavioral1
Sample
6d819b46d059a6f36b5a85919d8eb470_NeikiAnalytics.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
6d819b46d059a6f36b5a85919d8eb470_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
Malware Config
Extracted
remcos
1.7 Pro
Host
213.183.58.19:4000
-
audio_folder
audio
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
5
-
copy_file
remcos.exe
-
copy_folder
remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
true
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
true
-
keylog_file
read.dat
-
keylog_flag
false
-
keylog_folder
CastC
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
remcos_sccafsoidz
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screens
-
screenshot_path
%AppData%
-
screenshot_time
1
-
startup_value
remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Extracted
remcos
Host
213.183.58.19:4000
-
audio_folder
audio
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
5
-
copy_file
remcos.exe
-
copy_folder
remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
true
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
true
-
keylog_file
read.dat
-
keylog_flag
false
-
keylog_folder
CastC
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
remcos_sccafsoidz
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screens
-
screenshot_path
%AppData%
-
screenshot_time
1
-
startup_value
remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
6d819b46d059a6f36b5a85919d8eb470_NeikiAnalytics.exe
-
Size
1.5MB
-
MD5
6d819b46d059a6f36b5a85919d8eb470
-
SHA1
cbec530757ba9906be563713812d3f85c0e44ea0
-
SHA256
835367bb2aa6a58d9ed7589caec0bd2d18cbc6ee520c52aa1beb106f6af274f9
-
SHA512
8b5f9733e35c65f6b3711f0da1ee5de907ed29728384311b3363c23cb9a49918f0a81f65512d7c62e051281f7c8818fb831418528b67c1b095a83f9df64cb2e7
-
SSDEEP
24576:UD39v74lfGQrFUspugRNJI2DJ53J/J/L5dJPjomE:Up7E+QrFUBgq2U
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-