Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
28-06-2024 15:57
Behavioral task
behavioral1
Sample
9fab1e4e8fb2e5f3a159f20029c5aa23d048cae5742b7296cb40b21f73dd9e60_NeikiAnalytics.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
9fab1e4e8fb2e5f3a159f20029c5aa23d048cae5742b7296cb40b21f73dd9e60_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
9fab1e4e8fb2e5f3a159f20029c5aa23d048cae5742b7296cb40b21f73dd9e60_NeikiAnalytics.exe
-
Size
1.3MB
-
MD5
955783630e77d45be3a394dbaf788540
-
SHA1
eb039d194f09d625ca81e59804c2f45d42c157b4
-
SHA256
9fab1e4e8fb2e5f3a159f20029c5aa23d048cae5742b7296cb40b21f73dd9e60
-
SHA512
c2de75d09491c58cfccd79d23de2b72479dee189468b0a2c247a1774f6925bf205f5726a76d6d0316cf95499b32e81f4e523ba9697b794ca627adbfb4766c938
-
SSDEEP
24576:Ku6J33O0c+JY5UZ+XC0kGso6Fa720W4njUprvVcC1f2o5RRfgUWYg:8u0c++OCvkGs9Fa+rd1f26RaYg
Malware Config
Extracted
netwire
Wealthy2019.com.strangled.net:20190
wealthyme.ddns.net:20190
-
activex_autorun
false
-
copy_executable
true
-
delete_original
false
-
host_id
sunshineslisa
-
install_path
%AppData%\Imgburn\Host.exe
-
keylogger_dir
%AppData%\Logs\Imgburn\
-
lock_executable
false
-
offline_keylogger
true
-
password
sucess
-
registry_autorun
false
-
use_mutex
false
Extracted
warzonerat
wealth.warzonedns.com:5202
Signatures
-
NetWire RAT payload 6 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\Blasthost.exe netwire behavioral1/memory/1696-23-0x0000000000400000-0x000000000042C000-memory.dmp netwire behavioral1/memory/2588-45-0x0000000000400000-0x000000000042C000-memory.dmp netwire C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe netwire behavioral1/memory/2808-84-0x0000000000400000-0x000000000042C000-memory.dmp netwire behavioral1/memory/2588-85-0x0000000000400000-0x000000000042C000-memory.dmp netwire -
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2744-28-0x0000000000080000-0x000000000009D000-memory.dmp warzonerat behavioral1/memory/2744-38-0x0000000000080000-0x000000000009D000-memory.dmp warzonerat -
Executes dropped EXE 11 IoCs
Processes:
Blasthost.exeHost.exeRtDCpl64.exeBlasthost.exeRtDCpl64.exeRtDCpl64.exeBlasthost.exeRtDCpl64.exeRtDCpl64.exeBlasthost.exeRtDCpl64.exepid process 1696 Blasthost.exe 2588 Host.exe 664 RtDCpl64.exe 2808 Blasthost.exe 920 RtDCpl64.exe 2756 RtDCpl64.exe 428 Blasthost.exe 2260 RtDCpl64.exe 1776 RtDCpl64.exe 2404 Blasthost.exe 1672 RtDCpl64.exe -
Loads dropped DLL 16 IoCs
Processes:
9fab1e4e8fb2e5f3a159f20029c5aa23d048cae5742b7296cb40b21f73dd9e60_NeikiAnalytics.exeBlasthost.exeRtDCpl64.exeRtDCpl64.exeRtDCpl64.exepid process 2224 9fab1e4e8fb2e5f3a159f20029c5aa23d048cae5742b7296cb40b21f73dd9e60_NeikiAnalytics.exe 2224 9fab1e4e8fb2e5f3a159f20029c5aa23d048cae5742b7296cb40b21f73dd9e60_NeikiAnalytics.exe 2224 9fab1e4e8fb2e5f3a159f20029c5aa23d048cae5742b7296cb40b21f73dd9e60_NeikiAnalytics.exe 2224 9fab1e4e8fb2e5f3a159f20029c5aa23d048cae5742b7296cb40b21f73dd9e60_NeikiAnalytics.exe 1696 Blasthost.exe 1696 Blasthost.exe 664 RtDCpl64.exe 664 RtDCpl64.exe 664 RtDCpl64.exe 664 RtDCpl64.exe 2756 RtDCpl64.exe 2756 RtDCpl64.exe 2756 RtDCpl64.exe 1776 RtDCpl64.exe 1776 RtDCpl64.exe 1776 RtDCpl64.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe autoit_exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
9fab1e4e8fb2e5f3a159f20029c5aa23d048cae5742b7296cb40b21f73dd9e60_NeikiAnalytics.exeRtDCpl64.exeRtDCpl64.exeRtDCpl64.exedescription pid process target process PID 2224 set thread context of 2744 2224 9fab1e4e8fb2e5f3a159f20029c5aa23d048cae5742b7296cb40b21f73dd9e60_NeikiAnalytics.exe 9fab1e4e8fb2e5f3a159f20029c5aa23d048cae5742b7296cb40b21f73dd9e60_NeikiAnalytics.exe PID 664 set thread context of 920 664 RtDCpl64.exe RtDCpl64.exe PID 2756 set thread context of 2260 2756 RtDCpl64.exe RtDCpl64.exe PID 1776 set thread context of 1672 1776 RtDCpl64.exe RtDCpl64.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 2072 schtasks.exe 1424 schtasks.exe 2944 schtasks.exe 2584 schtasks.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
9fab1e4e8fb2e5f3a159f20029c5aa23d048cae5742b7296cb40b21f73dd9e60_NeikiAnalytics.exeBlasthost.exe9fab1e4e8fb2e5f3a159f20029c5aa23d048cae5742b7296cb40b21f73dd9e60_NeikiAnalytics.exetaskeng.exeRtDCpl64.exeRtDCpl64.exeRtDCpl64.exedescription pid process target process PID 2224 wrote to memory of 1696 2224 9fab1e4e8fb2e5f3a159f20029c5aa23d048cae5742b7296cb40b21f73dd9e60_NeikiAnalytics.exe Blasthost.exe PID 2224 wrote to memory of 1696 2224 9fab1e4e8fb2e5f3a159f20029c5aa23d048cae5742b7296cb40b21f73dd9e60_NeikiAnalytics.exe Blasthost.exe PID 2224 wrote to memory of 1696 2224 9fab1e4e8fb2e5f3a159f20029c5aa23d048cae5742b7296cb40b21f73dd9e60_NeikiAnalytics.exe Blasthost.exe PID 2224 wrote to memory of 1696 2224 9fab1e4e8fb2e5f3a159f20029c5aa23d048cae5742b7296cb40b21f73dd9e60_NeikiAnalytics.exe Blasthost.exe PID 1696 wrote to memory of 2588 1696 Blasthost.exe Host.exe PID 1696 wrote to memory of 2588 1696 Blasthost.exe Host.exe PID 1696 wrote to memory of 2588 1696 Blasthost.exe Host.exe PID 1696 wrote to memory of 2588 1696 Blasthost.exe Host.exe PID 2224 wrote to memory of 2744 2224 9fab1e4e8fb2e5f3a159f20029c5aa23d048cae5742b7296cb40b21f73dd9e60_NeikiAnalytics.exe 9fab1e4e8fb2e5f3a159f20029c5aa23d048cae5742b7296cb40b21f73dd9e60_NeikiAnalytics.exe PID 2224 wrote to memory of 2744 2224 9fab1e4e8fb2e5f3a159f20029c5aa23d048cae5742b7296cb40b21f73dd9e60_NeikiAnalytics.exe 9fab1e4e8fb2e5f3a159f20029c5aa23d048cae5742b7296cb40b21f73dd9e60_NeikiAnalytics.exe PID 2224 wrote to memory of 2744 2224 9fab1e4e8fb2e5f3a159f20029c5aa23d048cae5742b7296cb40b21f73dd9e60_NeikiAnalytics.exe 9fab1e4e8fb2e5f3a159f20029c5aa23d048cae5742b7296cb40b21f73dd9e60_NeikiAnalytics.exe PID 2224 wrote to memory of 2744 2224 9fab1e4e8fb2e5f3a159f20029c5aa23d048cae5742b7296cb40b21f73dd9e60_NeikiAnalytics.exe 9fab1e4e8fb2e5f3a159f20029c5aa23d048cae5742b7296cb40b21f73dd9e60_NeikiAnalytics.exe PID 2224 wrote to memory of 2744 2224 9fab1e4e8fb2e5f3a159f20029c5aa23d048cae5742b7296cb40b21f73dd9e60_NeikiAnalytics.exe 9fab1e4e8fb2e5f3a159f20029c5aa23d048cae5742b7296cb40b21f73dd9e60_NeikiAnalytics.exe PID 2224 wrote to memory of 2744 2224 9fab1e4e8fb2e5f3a159f20029c5aa23d048cae5742b7296cb40b21f73dd9e60_NeikiAnalytics.exe 9fab1e4e8fb2e5f3a159f20029c5aa23d048cae5742b7296cb40b21f73dd9e60_NeikiAnalytics.exe PID 2744 wrote to memory of 2720 2744 9fab1e4e8fb2e5f3a159f20029c5aa23d048cae5742b7296cb40b21f73dd9e60_NeikiAnalytics.exe cmd.exe PID 2744 wrote to memory of 2720 2744 9fab1e4e8fb2e5f3a159f20029c5aa23d048cae5742b7296cb40b21f73dd9e60_NeikiAnalytics.exe cmd.exe PID 2744 wrote to memory of 2720 2744 9fab1e4e8fb2e5f3a159f20029c5aa23d048cae5742b7296cb40b21f73dd9e60_NeikiAnalytics.exe cmd.exe PID 2744 wrote to memory of 2720 2744 9fab1e4e8fb2e5f3a159f20029c5aa23d048cae5742b7296cb40b21f73dd9e60_NeikiAnalytics.exe cmd.exe PID 2224 wrote to memory of 2072 2224 9fab1e4e8fb2e5f3a159f20029c5aa23d048cae5742b7296cb40b21f73dd9e60_NeikiAnalytics.exe schtasks.exe PID 2224 wrote to memory of 2072 2224 9fab1e4e8fb2e5f3a159f20029c5aa23d048cae5742b7296cb40b21f73dd9e60_NeikiAnalytics.exe schtasks.exe PID 2224 wrote to memory of 2072 2224 9fab1e4e8fb2e5f3a159f20029c5aa23d048cae5742b7296cb40b21f73dd9e60_NeikiAnalytics.exe schtasks.exe PID 2224 wrote to memory of 2072 2224 9fab1e4e8fb2e5f3a159f20029c5aa23d048cae5742b7296cb40b21f73dd9e60_NeikiAnalytics.exe schtasks.exe PID 2744 wrote to memory of 2720 2744 9fab1e4e8fb2e5f3a159f20029c5aa23d048cae5742b7296cb40b21f73dd9e60_NeikiAnalytics.exe cmd.exe PID 2744 wrote to memory of 2720 2744 9fab1e4e8fb2e5f3a159f20029c5aa23d048cae5742b7296cb40b21f73dd9e60_NeikiAnalytics.exe cmd.exe PID 2460 wrote to memory of 664 2460 taskeng.exe RtDCpl64.exe PID 2460 wrote to memory of 664 2460 taskeng.exe RtDCpl64.exe PID 2460 wrote to memory of 664 2460 taskeng.exe RtDCpl64.exe PID 2460 wrote to memory of 664 2460 taskeng.exe RtDCpl64.exe PID 664 wrote to memory of 2808 664 RtDCpl64.exe Blasthost.exe PID 664 wrote to memory of 2808 664 RtDCpl64.exe Blasthost.exe PID 664 wrote to memory of 2808 664 RtDCpl64.exe Blasthost.exe PID 664 wrote to memory of 2808 664 RtDCpl64.exe Blasthost.exe PID 664 wrote to memory of 920 664 RtDCpl64.exe RtDCpl64.exe PID 664 wrote to memory of 920 664 RtDCpl64.exe RtDCpl64.exe PID 664 wrote to memory of 920 664 RtDCpl64.exe RtDCpl64.exe PID 664 wrote to memory of 920 664 RtDCpl64.exe RtDCpl64.exe PID 664 wrote to memory of 920 664 RtDCpl64.exe RtDCpl64.exe PID 664 wrote to memory of 920 664 RtDCpl64.exe RtDCpl64.exe PID 664 wrote to memory of 1424 664 RtDCpl64.exe schtasks.exe PID 664 wrote to memory of 1424 664 RtDCpl64.exe schtasks.exe PID 664 wrote to memory of 1424 664 RtDCpl64.exe schtasks.exe PID 664 wrote to memory of 1424 664 RtDCpl64.exe schtasks.exe PID 920 wrote to memory of 1612 920 RtDCpl64.exe cmd.exe PID 920 wrote to memory of 1612 920 RtDCpl64.exe cmd.exe PID 920 wrote to memory of 1612 920 RtDCpl64.exe cmd.exe PID 920 wrote to memory of 1612 920 RtDCpl64.exe cmd.exe PID 920 wrote to memory of 1612 920 RtDCpl64.exe cmd.exe PID 920 wrote to memory of 1612 920 RtDCpl64.exe cmd.exe PID 2460 wrote to memory of 2756 2460 taskeng.exe RtDCpl64.exe PID 2460 wrote to memory of 2756 2460 taskeng.exe RtDCpl64.exe PID 2460 wrote to memory of 2756 2460 taskeng.exe RtDCpl64.exe PID 2460 wrote to memory of 2756 2460 taskeng.exe RtDCpl64.exe PID 2756 wrote to memory of 428 2756 RtDCpl64.exe Blasthost.exe PID 2756 wrote to memory of 428 2756 RtDCpl64.exe Blasthost.exe PID 2756 wrote to memory of 428 2756 RtDCpl64.exe Blasthost.exe PID 2756 wrote to memory of 428 2756 RtDCpl64.exe Blasthost.exe PID 2756 wrote to memory of 2260 2756 RtDCpl64.exe RtDCpl64.exe PID 2756 wrote to memory of 2260 2756 RtDCpl64.exe RtDCpl64.exe PID 2756 wrote to memory of 2260 2756 RtDCpl64.exe RtDCpl64.exe PID 2756 wrote to memory of 2260 2756 RtDCpl64.exe RtDCpl64.exe PID 2756 wrote to memory of 2260 2756 RtDCpl64.exe RtDCpl64.exe PID 2756 wrote to memory of 2260 2756 RtDCpl64.exe RtDCpl64.exe PID 2756 wrote to memory of 2944 2756 RtDCpl64.exe schtasks.exe PID 2756 wrote to memory of 2944 2756 RtDCpl64.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9fab1e4e8fb2e5f3a159f20029c5aa23d048cae5742b7296cb40b21f73dd9e60_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\9fab1e4e8fb2e5f3a159f20029c5aa23d048cae5742b7296cb40b21f73dd9e60_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Blasthost.exe"C:\Users\Admin\AppData\Roaming\Blasthost.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe"C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\9fab1e4e8fb2e5f3a159f20029c5aa23d048cae5742b7296cb40b21f73dd9e60_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\9fab1e4e8fb2e5f3a159f20029c5aa23d048cae5742b7296cb40b21f73dd9e60_NeikiAnalytics.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"3⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F2⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\taskeng.exetaskeng.exe {E6A41C07-3B9A-4B0D-8002-42EA7D8658FA} S-1-5-21-39690363-730359138-1046745555-1000:EILATWEW\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exeC:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Blasthost.exe"C:\Users\Admin\AppData\Roaming\Blasthost.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F3⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exeC:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Blasthost.exe"C:\Users\Admin\AppData\Roaming\Blasthost.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F3⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exeC:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\Blasthost.exe"C:\Users\Admin\AppData\Roaming\Blasthost.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F3⤵
- Scheduled Task/Job: Scheduled Task
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Blasthost.exeFilesize
132KB
MD56087bf6af59b9c531f2c9bb421d5e902
SHA18bc0f1596c986179b82585c703bacae6d2a00316
SHA2563a8ffff8485c9ed35dae82574ea1a455ea2ead532251cebea19149d78dfd682c
SHA512c8ed34470a874ce21c91cb7843521d66decc32c3f0a9c8d5b55889a7b990dfe5199ade8b6c6ef94b1bced6d3b5f0721e14bcc06320e8efe73ca3fe27fd6b9292
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exeFilesize
1.3MB
MD530380daf3696fc6f530a65450b71a23c
SHA1790134cb9c1f2068bcf563ece7a1c76895fe7a06
SHA256ef14271ec73bb8e6996bfecf3e5072d201f61df0e84ff554dad19a1ac26b4ad7
SHA5125dbcaa8ffd1d17e3b78b75fb586d5845ebffd94ca12e99158c0f5233df38e76c6ba2d7d8b0bb6580d49480ed78de5b4c2808ee8dbf841644694f5477a3fe9e40
-
memory/920-73-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmpFilesize
4KB
-
memory/1524-114-0x0000000000120000-0x0000000000121000-memory.dmpFilesize
4KB
-
memory/1612-79-0x0000000000160000-0x0000000000161000-memory.dmpFilesize
4KB
-
memory/1696-23-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/2224-25-0x0000000000720000-0x0000000000721000-memory.dmpFilesize
4KB
-
memory/2588-45-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/2588-85-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/2720-40-0x0000000000160000-0x0000000000161000-memory.dmpFilesize
4KB
-
memory/2720-42-0x0000000000160000-0x0000000000161000-memory.dmpFilesize
4KB
-
memory/2744-38-0x0000000000080000-0x000000000009D000-memory.dmpFilesize
116KB
-
memory/2744-35-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmpFilesize
4KB
-
memory/2744-28-0x0000000000080000-0x000000000009D000-memory.dmpFilesize
116KB
-
memory/2744-26-0x0000000000080000-0x000000000009D000-memory.dmpFilesize
116KB
-
memory/2808-84-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB