Analysis
-
max time kernel
0s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 02:13
Static task
static1
Behavioral task
behavioral1
Sample
2de214ec471e9e26d95d5e921dfecdbf05dc740c983aeb63ebe510578a226cc7_NeikiAnalytics.exe
Resource
win7-20240419-en
General
-
Target
2de214ec471e9e26d95d5e921dfecdbf05dc740c983aeb63ebe510578a226cc7_NeikiAnalytics.exe
-
Size
88KB
-
MD5
ab0dda5cd7272c32d5f23f0b1c1ff990
-
SHA1
f686df6059a503d408ace8d71942179c564175e0
-
SHA256
2de214ec471e9e26d95d5e921dfecdbf05dc740c983aeb63ebe510578a226cc7
-
SHA512
69f89485d1d914ad66450697185cc7342db53d9c80f066b94bf2d24a41854023a58fffb5c597a44498de8d44a549ef1b4490945b141aebfa4b4c1d556eef1ffc
-
SSDEEP
1536:5CCwU2APx7AZ8dQXdfC7LsxFBPIDEBnjFbzMqseUFEt+4MzOBk4NBf9EZ+:5CCF62QXda3C7gDyjpzMkBBk4NBf96
Malware Config
Extracted
asyncrat
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Default
127.0.0.1:1337
pifwaysdoflx
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
2de214ec471e9e26d95d5e921dfecdbf05dc740c983aeb63ebe510578a226cc7_NeikiAnalytics.exedescription pid process target process PID 1200 set thread context of 3040 1200 2de214ec471e9e26d95d5e921dfecdbf05dc740c983aeb63ebe510578a226cc7_NeikiAnalytics.exe RegAsm.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
2de214ec471e9e26d95d5e921dfecdbf05dc740c983aeb63ebe510578a226cc7_NeikiAnalytics.exepid process 1200 2de214ec471e9e26d95d5e921dfecdbf05dc740c983aeb63ebe510578a226cc7_NeikiAnalytics.exe 1200 2de214ec471e9e26d95d5e921dfecdbf05dc740c983aeb63ebe510578a226cc7_NeikiAnalytics.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
2de214ec471e9e26d95d5e921dfecdbf05dc740c983aeb63ebe510578a226cc7_NeikiAnalytics.exedescription pid process Token: SeDebugPrivilege 1200 2de214ec471e9e26d95d5e921dfecdbf05dc740c983aeb63ebe510578a226cc7_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
2de214ec471e9e26d95d5e921dfecdbf05dc740c983aeb63ebe510578a226cc7_NeikiAnalytics.execmd.exedescription pid process target process PID 1200 wrote to memory of 1400 1200 2de214ec471e9e26d95d5e921dfecdbf05dc740c983aeb63ebe510578a226cc7_NeikiAnalytics.exe powershell.exe PID 1200 wrote to memory of 1400 1200 2de214ec471e9e26d95d5e921dfecdbf05dc740c983aeb63ebe510578a226cc7_NeikiAnalytics.exe powershell.exe PID 1200 wrote to memory of 1400 1200 2de214ec471e9e26d95d5e921dfecdbf05dc740c983aeb63ebe510578a226cc7_NeikiAnalytics.exe powershell.exe PID 1200 wrote to memory of 1400 1200 2de214ec471e9e26d95d5e921dfecdbf05dc740c983aeb63ebe510578a226cc7_NeikiAnalytics.exe powershell.exe PID 1200 wrote to memory of 2572 1200 2de214ec471e9e26d95d5e921dfecdbf05dc740c983aeb63ebe510578a226cc7_NeikiAnalytics.exe cmd.exe PID 1200 wrote to memory of 2572 1200 2de214ec471e9e26d95d5e921dfecdbf05dc740c983aeb63ebe510578a226cc7_NeikiAnalytics.exe cmd.exe PID 1200 wrote to memory of 2572 1200 2de214ec471e9e26d95d5e921dfecdbf05dc740c983aeb63ebe510578a226cc7_NeikiAnalytics.exe cmd.exe PID 1200 wrote to memory of 2572 1200 2de214ec471e9e26d95d5e921dfecdbf05dc740c983aeb63ebe510578a226cc7_NeikiAnalytics.exe cmd.exe PID 2572 wrote to memory of 2776 2572 cmd.exe schtasks.exe PID 2572 wrote to memory of 2776 2572 cmd.exe schtasks.exe PID 2572 wrote to memory of 2776 2572 cmd.exe schtasks.exe PID 2572 wrote to memory of 2776 2572 cmd.exe schtasks.exe PID 1200 wrote to memory of 2368 1200 2de214ec471e9e26d95d5e921dfecdbf05dc740c983aeb63ebe510578a226cc7_NeikiAnalytics.exe RegAsm.exe PID 1200 wrote to memory of 2368 1200 2de214ec471e9e26d95d5e921dfecdbf05dc740c983aeb63ebe510578a226cc7_NeikiAnalytics.exe RegAsm.exe PID 1200 wrote to memory of 2368 1200 2de214ec471e9e26d95d5e921dfecdbf05dc740c983aeb63ebe510578a226cc7_NeikiAnalytics.exe RegAsm.exe PID 1200 wrote to memory of 2368 1200 2de214ec471e9e26d95d5e921dfecdbf05dc740c983aeb63ebe510578a226cc7_NeikiAnalytics.exe RegAsm.exe PID 1200 wrote to memory of 2368 1200 2de214ec471e9e26d95d5e921dfecdbf05dc740c983aeb63ebe510578a226cc7_NeikiAnalytics.exe RegAsm.exe PID 1200 wrote to memory of 2368 1200 2de214ec471e9e26d95d5e921dfecdbf05dc740c983aeb63ebe510578a226cc7_NeikiAnalytics.exe RegAsm.exe PID 1200 wrote to memory of 2368 1200 2de214ec471e9e26d95d5e921dfecdbf05dc740c983aeb63ebe510578a226cc7_NeikiAnalytics.exe RegAsm.exe PID 1200 wrote to memory of 3040 1200 2de214ec471e9e26d95d5e921dfecdbf05dc740c983aeb63ebe510578a226cc7_NeikiAnalytics.exe RegAsm.exe PID 1200 wrote to memory of 3040 1200 2de214ec471e9e26d95d5e921dfecdbf05dc740c983aeb63ebe510578a226cc7_NeikiAnalytics.exe RegAsm.exe PID 1200 wrote to memory of 3040 1200 2de214ec471e9e26d95d5e921dfecdbf05dc740c983aeb63ebe510578a226cc7_NeikiAnalytics.exe RegAsm.exe PID 1200 wrote to memory of 3040 1200 2de214ec471e9e26d95d5e921dfecdbf05dc740c983aeb63ebe510578a226cc7_NeikiAnalytics.exe RegAsm.exe PID 1200 wrote to memory of 3040 1200 2de214ec471e9e26d95d5e921dfecdbf05dc740c983aeb63ebe510578a226cc7_NeikiAnalytics.exe RegAsm.exe PID 1200 wrote to memory of 3040 1200 2de214ec471e9e26d95d5e921dfecdbf05dc740c983aeb63ebe510578a226cc7_NeikiAnalytics.exe RegAsm.exe PID 1200 wrote to memory of 3040 1200 2de214ec471e9e26d95d5e921dfecdbf05dc740c983aeb63ebe510578a226cc7_NeikiAnalytics.exe RegAsm.exe PID 1200 wrote to memory of 3040 1200 2de214ec471e9e26d95d5e921dfecdbf05dc740c983aeb63ebe510578a226cc7_NeikiAnalytics.exe RegAsm.exe PID 1200 wrote to memory of 3040 1200 2de214ec471e9e26d95d5e921dfecdbf05dc740c983aeb63ebe510578a226cc7_NeikiAnalytics.exe RegAsm.exe PID 1200 wrote to memory of 3040 1200 2de214ec471e9e26d95d5e921dfecdbf05dc740c983aeb63ebe510578a226cc7_NeikiAnalytics.exe RegAsm.exe PID 1200 wrote to memory of 3040 1200 2de214ec471e9e26d95d5e921dfecdbf05dc740c983aeb63ebe510578a226cc7_NeikiAnalytics.exe RegAsm.exe PID 1200 wrote to memory of 3040 1200 2de214ec471e9e26d95d5e921dfecdbf05dc740c983aeb63ebe510578a226cc7_NeikiAnalytics.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2de214ec471e9e26d95d5e921dfecdbf05dc740c983aeb63ebe510578a226cc7_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2de214ec471e9e26d95d5e921dfecdbf05dc740c983aeb63ebe510578a226cc7_NeikiAnalytics.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove -ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name '';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name '' -Value '"C:\Users\Admin\AppData\Roaming\.exe"' -PropertyType 'String'2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /C schtasks /create /tn \ /tr "C:\Users\Admin\AppData\Roaming\.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn \ /tr "C:\Users\Admin\AppData\Roaming\.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe#cmd2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe#cmd2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1200-0-0x00000000743EE000-0x00000000743EF000-memory.dmpFilesize
4KB
-
memory/1200-1-0x00000000008C0000-0x00000000008DC000-memory.dmpFilesize
112KB
-
memory/1200-17-0x00000000743E0000-0x0000000074ACE000-memory.dmpFilesize
6.9MB
-
memory/3040-7-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/3040-16-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/3040-15-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/3040-14-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/3040-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/3040-11-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/3040-5-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/3040-9-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB