Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-06-2024 06:05
Static task
static1
Behavioral task
behavioral1
Sample
4467138cf6bec169b6c0cb9abe48e86202b75a5301828766b059c8af06d4a0f5_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
4467138cf6bec169b6c0cb9abe48e86202b75a5301828766b059c8af06d4a0f5_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
General
-
Target
4467138cf6bec169b6c0cb9abe48e86202b75a5301828766b059c8af06d4a0f5_NeikiAnalytics.exe
-
Size
137KB
-
MD5
e00031d57b49909b95ded10db62617d0
-
SHA1
18058c6408248bd17b68344118e03a8ca30b47c3
-
SHA256
4467138cf6bec169b6c0cb9abe48e86202b75a5301828766b059c8af06d4a0f5
-
SHA512
5cc7b09643456ac64e1a87437882d021be18c07b70d21b104c4cea0e0230f874732dd364a6ae7840ebce511aafc2e365e1fc71c02f86f7c7ebf8564db0bc50fc
-
SSDEEP
1536:ITHiPBX4nDzMyRXGHrc9YRHqbTypgpmb5Q+ZReSdhk/J+YLgD3mrxb53cSuYQjKR:xPd4n/M+WLcilrpgGH/GwY87mVmIXB
Malware Config
Extracted
remcos
1.7 Pro
Host
systemcontrol.ddns.net:45000
systemcontrol2.ddns.net:45000
-
audio_folder
audio
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
5
-
copy_file
OfficeUpgrade.exe
-
copy_folder
OfficeUpgrade
-
delete_file
false
-
hide_file
true
-
hide_keylog_file
true
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
true
-
keylog_file
Upgrader.dat
-
keylog_flag
false
-
keylog_folder
Upgrader
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
req_khauflaoyr
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screens
-
screenshot_path
%AppData%
-
screenshot_time
1
-
startup_value
OfficeUpgrade
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
wn2ra4ohzdr.exewn2ra4ohzdr.exepid process 2664 wn2ra4ohzdr.exe 3024 wn2ra4ohzdr.exe -
Loads dropped DLL 1 IoCs
Processes:
4467138cf6bec169b6c0cb9abe48e86202b75a5301828766b059c8af06d4a0f5_NeikiAnalytics.exepid process 2368 4467138cf6bec169b6c0cb9abe48e86202b75a5301828766b059c8af06d4a0f5_NeikiAnalytics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
4467138cf6bec169b6c0cb9abe48e86202b75a5301828766b059c8af06d4a0f5_NeikiAnalytics.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\raj4dkhhiap = "C:\\Users\\Admin\\AppData\\Roaming\\raj4dkhhiap\\wn2ra4ohzdr.exe" 4467138cf6bec169b6c0cb9abe48e86202b75a5301828766b059c8af06d4a0f5_NeikiAnalytics.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
wn2ra4ohzdr.exedescription pid process target process PID 2664 set thread context of 3024 2664 wn2ra4ohzdr.exe wn2ra4ohzdr.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
wn2ra4ohzdr.exepid process 3024 wn2ra4ohzdr.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
4467138cf6bec169b6c0cb9abe48e86202b75a5301828766b059c8af06d4a0f5_NeikiAnalytics.exewn2ra4ohzdr.exedescription pid process target process PID 2368 wrote to memory of 2664 2368 4467138cf6bec169b6c0cb9abe48e86202b75a5301828766b059c8af06d4a0f5_NeikiAnalytics.exe wn2ra4ohzdr.exe PID 2368 wrote to memory of 2664 2368 4467138cf6bec169b6c0cb9abe48e86202b75a5301828766b059c8af06d4a0f5_NeikiAnalytics.exe wn2ra4ohzdr.exe PID 2368 wrote to memory of 2664 2368 4467138cf6bec169b6c0cb9abe48e86202b75a5301828766b059c8af06d4a0f5_NeikiAnalytics.exe wn2ra4ohzdr.exe PID 2368 wrote to memory of 2664 2368 4467138cf6bec169b6c0cb9abe48e86202b75a5301828766b059c8af06d4a0f5_NeikiAnalytics.exe wn2ra4ohzdr.exe PID 2664 wrote to memory of 3024 2664 wn2ra4ohzdr.exe wn2ra4ohzdr.exe PID 2664 wrote to memory of 3024 2664 wn2ra4ohzdr.exe wn2ra4ohzdr.exe PID 2664 wrote to memory of 3024 2664 wn2ra4ohzdr.exe wn2ra4ohzdr.exe PID 2664 wrote to memory of 3024 2664 wn2ra4ohzdr.exe wn2ra4ohzdr.exe PID 2664 wrote to memory of 3024 2664 wn2ra4ohzdr.exe wn2ra4ohzdr.exe PID 2664 wrote to memory of 3024 2664 wn2ra4ohzdr.exe wn2ra4ohzdr.exe PID 2664 wrote to memory of 3024 2664 wn2ra4ohzdr.exe wn2ra4ohzdr.exe PID 2664 wrote to memory of 3024 2664 wn2ra4ohzdr.exe wn2ra4ohzdr.exe PID 2664 wrote to memory of 3024 2664 wn2ra4ohzdr.exe wn2ra4ohzdr.exe PID 2664 wrote to memory of 3024 2664 wn2ra4ohzdr.exe wn2ra4ohzdr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4467138cf6bec169b6c0cb9abe48e86202b75a5301828766b059c8af06d4a0f5_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4467138cf6bec169b6c0cb9abe48e86202b75a5301828766b059c8af06d4a0f5_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe"C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe"C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exeFilesize
137KB
MD566c2f338f80512975a165b60317992e3
SHA107e32cb0e5c2bfbd3a2f0e4f8d0bed194af670ff
SHA2565735cd98674934fca4ef8a7ca98e1d8c9fb8ffacfb7176eff97c8090a405b01d
SHA51222db849b9aa7757275fe85c46b7a0c4c3fded2f44e02cb393862aaffa8404b46c382f4d1704f7dd000a3009acf1a7e77b01fe701dc5aba26758b6ce5aac6434b
-
memory/2368-0-0x000000007466E000-0x000000007466F000-memory.dmpFilesize
4KB
-
memory/2368-1-0x0000000000EF0000-0x0000000000F18000-memory.dmpFilesize
160KB
-
memory/2368-2-0x0000000074660000-0x0000000074D4E000-memory.dmpFilesize
6.9MB
-
memory/2368-3-0x0000000000610000-0x0000000000630000-memory.dmpFilesize
128KB
-
memory/2368-12-0x0000000074660000-0x0000000074D4E000-memory.dmpFilesize
6.9MB
-
memory/2664-13-0x0000000074660000-0x0000000074D4E000-memory.dmpFilesize
6.9MB
-
memory/2664-14-0x00000000013E0000-0x0000000001408000-memory.dmpFilesize
160KB
-
memory/2664-15-0x0000000074660000-0x0000000074D4E000-memory.dmpFilesize
6.9MB
-
memory/2664-38-0x0000000074660000-0x0000000074D4E000-memory.dmpFilesize
6.9MB
-
memory/3024-18-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/3024-28-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/3024-27-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/3024-25-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/3024-23-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/3024-20-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/3024-33-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/3024-34-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/3024-37-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/3024-16-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/3024-41-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB