Overview
overview
6Static
static
3Neega Raid...rp.dll
windows10-2004-x64
1Neega Raid...le.dll
windows10-2004-x64
1Neega Raid...ib.dll
windows10-2004-x64
1Neega Raid...s.json
windows10-2004-x64
3Neega Raid...id.exe
windows10-2004-x64
1Neega Raid...id.exe
windows10-2004-x64
6Neega Raid...id.pdb
windows10-2004-x64
3Neega Raid...g.json
windows10-2004-x64
3Neega Raid...on.dll
windows10-2004-x64
1Neega Raid...er.dll
windows10-2004-x64
1Neega Raid...er.dll
windows10-2004-x64
1Neega Raid...g.json
windows10-2004-x64
3Analysis
-
max time kernel
95s -
max time network
201s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
02-04-2024 16:45
Static task
static1
Behavioral task
behavioral1
Sample
Neega Raider/AngleSharp.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral2
Sample
Neega Raider/Colorful.Console.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
Neega Raider/ICSharpCode.SharpZipLib.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral4
Sample
Neega Raider/NeegaRaid.deps.json
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
Neega Raider/NeegaRaid.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral6
Sample
Neega Raider/NeegaRaid.exe
Resource
win10v2004-20240319-en
Behavioral task
behavioral7
Sample
Neega Raider/NeegaRaid.pdb
Resource
win10v2004-20240226-en
Behavioral task
behavioral8
Sample
Neega Raider/NeegaRaid.runtimeconfig.json
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
Neega Raider/Newtonsoft.Json.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral10
Sample
Neega Raider/WebDriver.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
Neega Raider/WebDriverManager.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral12
Sample
Neega Raider/config.json
Resource
win10v2004-20240226-en
General
-
Target
Neega Raider/NeegaRaid.deps.json
-
Size
27KB
-
MD5
e30c7e4e38d36f1325e0705ebd9bdaf5
-
SHA1
44ca5ca1367b3256e585752adbbdb86e4e045ebb
-
SHA256
0e5aa59a1fbc38f1092b0975a751a27770bd6bff693e9168831be5e12816df11
-
SHA512
abff3b42c07c01cf8335784fd5cc579fa1c3bf4c317344b7fe7231dae0832fc591d61d747c77dbeeece442d0aca89cafbedacbc30e1354eef30520563ab3bfa0
-
SSDEEP
384:YZ8FSR6CP1xxFTqOJfxlFFe9AGxyKTfxcjMbDzvUAF+j8wy4OrL0f8iWz:YPN1u7fxcj1WGkNz
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
Processes:
OpenWith.execmd.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings cmd.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
OpenWith.exepid process 2960 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Neega Raider\NeegaRaid.deps.json"1⤵
- Modifies registry class
PID:3940
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2960