Analysis
-
max time kernel
149s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
07-05-2024 21:39
General
-
Target
3fcf99f1e0d9dc0a7286728d20bc7580_NEIKI.exe
-
Size
997KB
-
MD5
3fcf99f1e0d9dc0a7286728d20bc7580
-
SHA1
c4bee57583397289f759e7262b6e0ab9eb4d3129
-
SHA256
e86ff967ff444d50d892200880556b56a66262b4a0fe2a22dee45127d3df6a7f
-
SHA512
afbbe4cba3fd8b92d9223d69c05665dfad3df0251c691b33372ec4b3759af565ab6ddb1cbbeccf2124ecb072a4ba32a820dad7867a271f7b14892d65b9929978
-
SSDEEP
12288:IdJTcoZzrQlJ88LdyODyoOwpghwS72CJ5ZDlN7k:IdJxzr8685y49327ZpN7k
Malware Config
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Detect ZGRat V1 2 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Async RAT payload 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
-
Modifies registry class 22 IoCs
-
Suspicious behavior: EnumeratesProcesses 29 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 10 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\3fcf99f1e0d9dc0a7286728d20bc7580_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\3fcf99f1e0d9dc0a7286728d20bc7580_NEIKI.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "AnyDesk60" /tr '"C:\Users\Admin\AppData\Roaming\AnyDesk60.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "AnyDesk60" /tr '"C:\Users\Admin\AppData\Roaming\AnyDesk60.exe"'3⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp5275.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
-
C:\Users\Admin\AppData\Roaming\AnyDesk60.exe"C:\Users\Admin\AppData\Roaming\AnyDesk60.exe"3⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
112B
MD591c85adf5883009f0171e62e56f4222c
SHA1aae28c6a8fd23f1bc96ce288eef34e47fa47c220
SHA2564cfea7eca82a2585aad6d4eecf60821f3b2edb6a94ff225a0ca66657389f4c46
SHA512bb6f339eab5cecdae728f06c7d31d7551ee71ea747d91fef211df2a1d3a96b495d6aa9f8c46bad50a0bb646c4e52071401ae49be1ba0d6e2837ec7b1a2e99d7f
-
Filesize
320B
MD50f944a8bd80c6ffe20a648408388f76e
SHA18c493f5c99e9be2e32e7eef0d1d3beb4d524f104
SHA256bff71c4689ea73c1a229428d9a7e10d15c755d64f58e8fa00fc7806086cda9c2
SHA512ffe435668bd0af411021bc0055b7893542dbc42845264ef7a1bec70a8009734f90ed9a274e3fca7b37bda27a2d166c7451c3f0f67c181e5898c3111dd013e165
-
Filesize
112B
MD543358f4a1b59c42d34e80730be18ddf6
SHA13d58451bee0190597154740928eadb61245a71ac
SHA256e831f042b10f3712843ff91e339f63c83630bf73b88c840d905f1f165ad0129a
SHA5127913a895bbe202e60015f32851ff312d178d2a4d267d94aecd4b5ec26eb3e59e6396f36269d682352c3a265ae8cd12a55ca5d73c0435b23ac3f7519d93f407a2
-
Filesize
153B
MD5f6a6e7dfb661f6e02fdf43c170c4b5f8
SHA1c0440dce57ceb27ee6314ed232ff4906a994c329
SHA25621517b78213544bdb6261dcd2bbed9def51ccf6f79fd718737385f8e8ca87c03
SHA5126ee600128d6ac3a3099d09f43796749456da2df6eb218757f2d2a7df0271046021e19098e74fe513e7338ba0605fe4abaed14d55d0d96433fd96b0d147c3474f
-
Filesize
997KB
MD53fcf99f1e0d9dc0a7286728d20bc7580
SHA1c4bee57583397289f759e7262b6e0ab9eb4d3129
SHA256e86ff967ff444d50d892200880556b56a66262b4a0fe2a22dee45127d3df6a7f
SHA512afbbe4cba3fd8b92d9223d69c05665dfad3df0251c691b33372ec4b3759af565ab6ddb1cbbeccf2124ecb072a4ba32a820dad7867a271f7b14892d65b9929978
-
Filesize
40KB
-
Filesize
1.7MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
1016KB
-
Filesize
10.8MB
-
Filesize
8KB