Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
26-06-2024 08:38
Static task
static1
Behavioral task
behavioral1
Sample
6f855977f4e1a527b45c597fa95ff713fb970dcef4474b2600ca5560f7546210_NeikiAnalytics.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
6f855977f4e1a527b45c597fa95ff713fb970dcef4474b2600ca5560f7546210_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
6f855977f4e1a527b45c597fa95ff713fb970dcef4474b2600ca5560f7546210_NeikiAnalytics.exe
-
Size
951KB
-
MD5
fcf77222c8865f407c22623e23e5c010
-
SHA1
a2f35c3ff7372415ae70368b68b7cfef3f958150
-
SHA256
6f855977f4e1a527b45c597fa95ff713fb970dcef4474b2600ca5560f7546210
-
SHA512
1e1b99876ce841cb0feaea89f079e101b8beaf0b961b29ef4b4bc182b5e7acf22d2ce5e305b7408af3616b8c0011d6de7ce5eb4c1e0788758b57eb5674859251
-
SSDEEP
24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5e:Rh+ZkldDPK8YaKje
Malware Config
Extracted
revengerat
Marzo26
marzorevenger.duckdns.org:4230
RV_MUTEX-PiGGjjtnxDpn
Signatures
-
RevengeRAT
Remote-access trojan with a wide range of capabilities.
-
Drops startup file 1 IoCs
Processes:
6f855977f4e1a527b45c597fa95ff713fb970dcef4474b2600ca5560f7546210_NeikiAnalytics.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AudioHandlers.url 6f855977f4e1a527b45c597fa95ff713fb970dcef4474b2600ca5560f7546210_NeikiAnalytics.exe -
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral2/memory/672-0-0x0000000000C00000-0x0000000000CF3000-memory.dmp autoit_exe behavioral2/memory/672-12-0x0000000000C00000-0x0000000000CF3000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
6f855977f4e1a527b45c597fa95ff713fb970dcef4474b2600ca5560f7546210_NeikiAnalytics.exedescription pid process target process PID 672 set thread context of 396 672 6f855977f4e1a527b45c597fa95ff713fb970dcef4474b2600ca5560f7546210_NeikiAnalytics.exe RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegAsm.exedescription pid process Token: SeDebugPrivilege 396 RegAsm.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
6f855977f4e1a527b45c597fa95ff713fb970dcef4474b2600ca5560f7546210_NeikiAnalytics.exepid process 672 6f855977f4e1a527b45c597fa95ff713fb970dcef4474b2600ca5560f7546210_NeikiAnalytics.exe 672 6f855977f4e1a527b45c597fa95ff713fb970dcef4474b2600ca5560f7546210_NeikiAnalytics.exe 672 6f855977f4e1a527b45c597fa95ff713fb970dcef4474b2600ca5560f7546210_NeikiAnalytics.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
6f855977f4e1a527b45c597fa95ff713fb970dcef4474b2600ca5560f7546210_NeikiAnalytics.exepid process 672 6f855977f4e1a527b45c597fa95ff713fb970dcef4474b2600ca5560f7546210_NeikiAnalytics.exe 672 6f855977f4e1a527b45c597fa95ff713fb970dcef4474b2600ca5560f7546210_NeikiAnalytics.exe 672 6f855977f4e1a527b45c597fa95ff713fb970dcef4474b2600ca5560f7546210_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
6f855977f4e1a527b45c597fa95ff713fb970dcef4474b2600ca5560f7546210_NeikiAnalytics.exedescription pid process target process PID 672 wrote to memory of 396 672 6f855977f4e1a527b45c597fa95ff713fb970dcef4474b2600ca5560f7546210_NeikiAnalytics.exe RegAsm.exe PID 672 wrote to memory of 396 672 6f855977f4e1a527b45c597fa95ff713fb970dcef4474b2600ca5560f7546210_NeikiAnalytics.exe RegAsm.exe PID 672 wrote to memory of 396 672 6f855977f4e1a527b45c597fa95ff713fb970dcef4474b2600ca5560f7546210_NeikiAnalytics.exe RegAsm.exe PID 672 wrote to memory of 396 672 6f855977f4e1a527b45c597fa95ff713fb970dcef4474b2600ca5560f7546210_NeikiAnalytics.exe RegAsm.exe PID 672 wrote to memory of 396 672 6f855977f4e1a527b45c597fa95ff713fb970dcef4474b2600ca5560f7546210_NeikiAnalytics.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6f855977f4e1a527b45c597fa95ff713fb970dcef4474b2600ca5560f7546210_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\6f855977f4e1a527b45c597fa95ff713fb970dcef4474b2600ca5560f7546210_NeikiAnalytics.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3960,i,6166776566165096562,4582328833313060853,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/396-1-0x0000000000620000-0x0000000000628000-memory.dmpFilesize
32KB
-
memory/396-6-0x0000000073442000-0x0000000073443000-memory.dmpFilesize
4KB
-
memory/396-7-0x0000000073440000-0x00000000739F1000-memory.dmpFilesize
5.7MB
-
memory/396-8-0x0000000073440000-0x00000000739F1000-memory.dmpFilesize
5.7MB
-
memory/396-13-0x0000000073442000-0x0000000073443000-memory.dmpFilesize
4KB
-
memory/396-14-0x0000000073440000-0x00000000739F1000-memory.dmpFilesize
5.7MB
-
memory/672-0-0x0000000000C00000-0x0000000000CF3000-memory.dmpFilesize
972KB
-
memory/672-5-0x0000000002300000-0x0000000002301000-memory.dmpFilesize
4KB
-
memory/672-12-0x0000000000C00000-0x0000000000CF3000-memory.dmpFilesize
972KB