njrat | 9c9bc6bec04a100f46b6254b3778864fbf6e841039cbd9e72ef0c40e1414dbd7

Analysis

max time kernel
140s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 23:07

Target
8f1e311b5834d04a8a0373eeef04e300_NEIKI.exe
Size 286KB
Sample240508-24a78aeh69
SHA256 9c9bc6bec04a100f46b6254b3778864fbf6e841039cbd9e72ef0c40e1414dbd7
MD5 8f1e311b5834d04a8a0373eeef04e300
SHA1 acfe4b8a16035499a20d4c6b3bc8ae7c48bc98a7
SHA512 8370906b32b3636e777e01251414cff0caa8f350303b42859170f16311566e75ca5f67048434e2f6e1fd243db60140ec4ac6d72758fc0873e5dff20a00fd3683
SSDEEP 3072:W3GKFNxsSm3hdQSvePiCefLQkD+mgAm7T7dfAPI+TyTNQ3hXafaL0JHLoY46jyIl:a2qSoeTxD+m67HdYfGTe2ohHkX
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

Disable or Modify System Firewall

pid	Process
548	netsh.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\server.exe	8f1e311b5834d04a8a0373eeef04e300_NEIKI.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\server.exe	8f1e311b5834d04a8a0373eeef04e300_NEIKI.exe

Adds Run key to start application 2 TTPs 2 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\def9b6cd3f2b0c43097dfbc918862b82 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8f1e311b5834d04a8a0373eeef04e300_NEIKI.exe"	8f1e311b5834d04a8a0373eeef04e300_NEIKI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\def9b6cd3f2b0c43097dfbc918862b82 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8f1e311b5834d04a8a0373eeef04e300_NEIKI.exe"	8f1e311b5834d04a8a0373eeef04e300_NEIKI.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4920	8f1e311b5834d04a8a0373eeef04e300_NEIKI.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4920 wrote to memory of 548	4920	8f1e311b5834d04a8a0373eeef04e300_NEIKI.exe	83
PID 4920 wrote to memory of 548	4920	8f1e311b5834d04a8a0373eeef04e300_NEIKI.exe	83

C:\Users\Admin\AppData\Local\Temp\8f1e311b5834d04a8a0373eeef04e300_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\8f1e311b5834d04a8a0373eeef04e300_NEIKI.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4920
- C:\Windows\SYSTEM32\netsh.exe
  netsh firewall add allowedprogram C:\Users\Admin\AppData\Local\Temp\8f1e311b5834d04a8a0373eeef04e300_NEIKI.exe "8f1e311b5834d04a8a0373eeef04e300_NEIKI.exe" ENABLE
  2⤵
  - Modifies Windows Firewall
  PID:548