Analysis
-
max time kernel
5s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
10/05/2024, 00:53
Behavioral task
behavioral1
Sample
33e4d8a4826079bc2d1e7cef9070b560_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
33e4d8a4826079bc2d1e7cef9070b560_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
33e4d8a4826079bc2d1e7cef9070b560_NeikiAnalytics.exe
-
Size
2.0MB
-
MD5
33e4d8a4826079bc2d1e7cef9070b560
-
SHA1
20af6e2578932db3eba18e61011fec867f6f53a9
-
SHA256
2a895b13071e9e08f01365b9eb7b7210335e9986e9a41483e78c087c353be052
-
SHA512
858bab29f1dd0dbd14493cd72309509ed0538f75ae4a7d0796d609e285b06dda390f316a2fe90d7ee0fcf225b28c0dfc9d16c5319430f401acd576af745351e6
-
SSDEEP
24576:su6J33O0c+JY5UZ+XC0kGso6FaI1IXgM6YmenKKSUlmDaGJTA4Pqa6jUvOkQwKYc:2u0c++OCvkGs9Fap5aLKLkDl+dUvO9Ym
Malware Config
Extracted
azorult
http://0x21.in:8000/_az/
Extracted
quasar
1.3.0.0
EbayProfiles
5.8.88.191:443
sockartek.icu:443
QSR_MUTEX_0kBRNrRz5TDLEQouI0
-
encryption_key
MWhG6wsClMX8aJM2CVXT
-
install_name
winsock.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
win defender run
-
subdirectory
SubDir
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
flow ioc pid Process 5076 schtasks.exe 10 ip-api.com Process not Found 63 ip-api.com Process not Found -
Quasar payload 3 IoCs
resource yara_rule behavioral2/files/0x00070000000233fd-12.dat family_quasar behavioral2/memory/2800-30-0x0000000000800000-0x000000000085E000-memory.dmp family_quasar behavioral2/files/0x0007000000023401-53.dat family_quasar -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation 33e4d8a4826079bc2d1e7cef9070b560_NeikiAnalytics.exe -
Executes dropped EXE 3 IoCs
pid Process 4304 vnc.exe 2800 windef.exe 4744 winsock.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\a: 33e4d8a4826079bc2d1e7cef9070b560_NeikiAnalytics.exe File opened (read-only) \??\e: 33e4d8a4826079bc2d1e7cef9070b560_NeikiAnalytics.exe File opened (read-only) \??\i: 33e4d8a4826079bc2d1e7cef9070b560_NeikiAnalytics.exe File opened (read-only) \??\j: 33e4d8a4826079bc2d1e7cef9070b560_NeikiAnalytics.exe File opened (read-only) \??\q: 33e4d8a4826079bc2d1e7cef9070b560_NeikiAnalytics.exe File opened (read-only) \??\t: 33e4d8a4826079bc2d1e7cef9070b560_NeikiAnalytics.exe File opened (read-only) \??\u: 33e4d8a4826079bc2d1e7cef9070b560_NeikiAnalytics.exe File opened (read-only) \??\g: 33e4d8a4826079bc2d1e7cef9070b560_NeikiAnalytics.exe File opened (read-only) \??\n: 33e4d8a4826079bc2d1e7cef9070b560_NeikiAnalytics.exe File opened (read-only) \??\w: 33e4d8a4826079bc2d1e7cef9070b560_NeikiAnalytics.exe File opened (read-only) \??\b: 33e4d8a4826079bc2d1e7cef9070b560_NeikiAnalytics.exe File opened (read-only) \??\h: 33e4d8a4826079bc2d1e7cef9070b560_NeikiAnalytics.exe File opened (read-only) \??\m: 33e4d8a4826079bc2d1e7cef9070b560_NeikiAnalytics.exe File opened (read-only) \??\p: 33e4d8a4826079bc2d1e7cef9070b560_NeikiAnalytics.exe File opened (read-only) \??\s: 33e4d8a4826079bc2d1e7cef9070b560_NeikiAnalytics.exe File opened (read-only) \??\x: 33e4d8a4826079bc2d1e7cef9070b560_NeikiAnalytics.exe File opened (read-only) \??\y: 33e4d8a4826079bc2d1e7cef9070b560_NeikiAnalytics.exe File opened (read-only) \??\k: 33e4d8a4826079bc2d1e7cef9070b560_NeikiAnalytics.exe File opened (read-only) \??\l: 33e4d8a4826079bc2d1e7cef9070b560_NeikiAnalytics.exe File opened (read-only) \??\o: 33e4d8a4826079bc2d1e7cef9070b560_NeikiAnalytics.exe File opened (read-only) \??\r: 33e4d8a4826079bc2d1e7cef9070b560_NeikiAnalytics.exe File opened (read-only) \??\v: 33e4d8a4826079bc2d1e7cef9070b560_NeikiAnalytics.exe File opened (read-only) \??\z: 33e4d8a4826079bc2d1e7cef9070b560_NeikiAnalytics.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 63 ip-api.com 10 ip-api.com -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/files/0x0007000000023401-53.dat autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 624 set thread context of 4624 624 33e4d8a4826079bc2d1e7cef9070b560_NeikiAnalytics.exe 90 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 4 IoCs
pid pid_target Process procid_target 2236 4304 WerFault.exe 84 3976 4744 WerFault.exe 97 3100 3096 WerFault.exe 123 4080 1404 WerFault.exe 119 -
Creates scheduled task(s) 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5076 schtasks.exe 1612 schtasks.exe 2724 schtasks.exe 1852 schtasks.exe 3536 schtasks.exe 4556 schtasks.exe -
Runs ping.exe 1 TTPs 2 IoCs
pid Process 3876 PING.EXE 1876 PING.EXE -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 624 33e4d8a4826079bc2d1e7cef9070b560_NeikiAnalytics.exe 624 33e4d8a4826079bc2d1e7cef9070b560_NeikiAnalytics.exe 624 33e4d8a4826079bc2d1e7cef9070b560_NeikiAnalytics.exe 624 33e4d8a4826079bc2d1e7cef9070b560_NeikiAnalytics.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2800 windef.exe Token: SeDebugPrivilege 4744 winsock.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4744 winsock.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 624 wrote to memory of 4304 624 33e4d8a4826079bc2d1e7cef9070b560_NeikiAnalytics.exe 84 PID 624 wrote to memory of 4304 624 33e4d8a4826079bc2d1e7cef9070b560_NeikiAnalytics.exe 84 PID 624 wrote to memory of 4304 624 33e4d8a4826079bc2d1e7cef9070b560_NeikiAnalytics.exe 84 PID 4304 wrote to memory of 1340 4304 vnc.exe 86 PID 4304 wrote to memory of 1340 4304 vnc.exe 86 PID 624 wrote to memory of 2800 624 33e4d8a4826079bc2d1e7cef9070b560_NeikiAnalytics.exe 87 PID 624 wrote to memory of 2800 624 33e4d8a4826079bc2d1e7cef9070b560_NeikiAnalytics.exe 87 PID 624 wrote to memory of 2800 624 33e4d8a4826079bc2d1e7cef9070b560_NeikiAnalytics.exe 87 PID 4304 wrote to memory of 1340 4304 vnc.exe 86 PID 624 wrote to memory of 4624 624 33e4d8a4826079bc2d1e7cef9070b560_NeikiAnalytics.exe 90 PID 624 wrote to memory of 4624 624 33e4d8a4826079bc2d1e7cef9070b560_NeikiAnalytics.exe 90 PID 624 wrote to memory of 4624 624 33e4d8a4826079bc2d1e7cef9070b560_NeikiAnalytics.exe 90 PID 624 wrote to memory of 4624 624 33e4d8a4826079bc2d1e7cef9070b560_NeikiAnalytics.exe 90 PID 624 wrote to memory of 4624 624 33e4d8a4826079bc2d1e7cef9070b560_NeikiAnalytics.exe 90 PID 624 wrote to memory of 5076 624 33e4d8a4826079bc2d1e7cef9070b560_NeikiAnalytics.exe 92 PID 624 wrote to memory of 5076 624 33e4d8a4826079bc2d1e7cef9070b560_NeikiAnalytics.exe 92 PID 624 wrote to memory of 5076 624 33e4d8a4826079bc2d1e7cef9070b560_NeikiAnalytics.exe 92 PID 2800 wrote to memory of 1612 2800 windef.exe 95 PID 2800 wrote to memory of 1612 2800 windef.exe 95 PID 2800 wrote to memory of 1612 2800 windef.exe 95 PID 2800 wrote to memory of 4744 2800 windef.exe 97 PID 2800 wrote to memory of 4744 2800 windef.exe 97 PID 2800 wrote to memory of 4744 2800 windef.exe 97 PID 4744 wrote to memory of 2724 4744 winsock.exe 98 PID 4744 wrote to memory of 2724 4744 winsock.exe 98 PID 4744 wrote to memory of 2724 4744 winsock.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\33e4d8a4826079bc2d1e7cef9070b560_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\33e4d8a4826079bc2d1e7cef9070b560_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Enumerates connected drives
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Users\Admin\AppData\Local\Temp\vnc.exe"C:\Users\Admin\AppData\Local\Temp\vnc.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k3⤵PID:1340
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4304 -s 5483⤵
- Program crash
PID:2236
-
-
-
C:\Users\Admin\AppData\Local\Temp\windef.exe"C:\Users\Admin\AppData\Local\Temp\windef.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\windef.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
PID:1612
-
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f4⤵
- Creates scheduled task(s)
PID:2724
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IUJpIrQjQlAU.bat" "4⤵PID:2056
-
C:\Windows\SysWOW64\chcp.comchcp 650015⤵PID:1020
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost5⤵
- Runs ping.exe
PID:3876
-
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"5⤵PID:1404
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f6⤵
- Creates scheduled task(s)
PID:1852
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1pxVeYaFKYoB.bat" "6⤵PID:1628
-
C:\Windows\SysWOW64\chcp.comchcp 650017⤵PID:2728
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost7⤵
- Runs ping.exe
PID:1876
-
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"7⤵PID:2796
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f8⤵
- Creates scheduled task(s)
PID:4556
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1404 -s 22326⤵
- Program crash
PID:4080
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4744 -s 22324⤵
- Program crash
PID:3976
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\33e4d8a4826079bc2d1e7cef9070b560_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\33e4d8a4826079bc2d1e7cef9070b560_NeikiAnalytics.exe"2⤵PID:4624
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F2⤵
- Quasar RAT
- Creates scheduled task(s)
PID:5076
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4304 -ip 43041⤵PID:2188
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4744 -ip 47441⤵PID:680
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exeC:\Users\Admin\btpanui\SystemPropertiesPerformance.exe1⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\vnc.exe"C:\Users\Admin\AppData\Local\Temp\vnc.exe"2⤵PID:3096
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k3⤵PID:1956
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 5203⤵
- Program crash
PID:3100
-
-
-
C:\Users\Admin\AppData\Local\Temp\windef.exe"C:\Users\Admin\AppData\Local\Temp\windef.exe"2⤵PID:2192
-
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe"C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe"2⤵PID:3956
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:3536
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3096 -ip 30961⤵PID:3448
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1404 -ip 14041⤵PID:1356
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵PID:4884
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵PID:1484
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD510eab9c2684febb5327b6976f2047587
SHA1a12ed54146a7f5c4c580416aecb899549712449e
SHA256f49dbd55029bfbc15134f7c6a4f967d6c39142c63f2e8f1f8c78fab108a2c928
SHA5127e5fd90fffae723bd0c662a90e0730b507805f072771ee673d1d8c262dbf60c8a03ba5fe088f699a97c2e886380de158b2ccd59ee62e3d012dd6dd14ea9d0e50
-
Filesize
208B
MD57a5921993d79009595f4430589208cad
SHA134020e5e64585ea9982f8922adbf79af25a913db
SHA2564168b50e78f5c191610342ca48a10f9e7352cfc78dcc19c7a84e3b61b76f646a
SHA512889c39f8896da1f85c7c71fb8193517da9cefe78affe0ca19044da9fbbe813444802055283d8eec2fe89e6462c71a144450760f01f9dd86a87fc5c3c84f9cb4c
-
Filesize
208B
MD5567729a6d2a4d4eb9a088fbc0b2cbf44
SHA18402349cdd4ee4f877418a0d78d3f3e6e6e18a1b
SHA2567e2a8b11315c74efd59f3cea991798cdfccf8f0a99193a8a19a89a2aaea5db73
SHA5122550b196a1a47007e2849c139acbd6392385abc2ba0f2badfcf6be7a04360bd7bf612588473383811f8401b841765cb539001d2a2d8bf0601eb078930e35894d
-
Filesize
405KB
MD5b8ba87ee4c3fc085a2fed0d839aadce1
SHA1b3a2e3256406330e8b1779199bb2b9865122d766
SHA2564e8a99cd33c9e5c747a3ce8f1a3e17824846f4a8f7cb0631aebd0815db2ce3a4
SHA5127a775a12cd5bcd182d64be0d31f800b456ca6d1b531189cea9c72e1940871cfe92ccd005938f67bfa4784ae44c54b3a7ea29a5bb59766e98c78bf53b680f2ab2
-
Filesize
349KB
MD5b4a202e03d4135484d0e730173abcc72
SHA101b30014545ea526c15a60931d676f9392ea0c70
SHA2567050608d53f80269df951d00883ed79815c060ce7678a76b5c3f6a2a985beea9
SHA512632a035a3b722ea29b02aad1f0da3df5bdc38abc7e6617223790955c6c0830f1070b528680416d5c63ea5e846074cdad87f06c21c35a77b1ccc4edc089d8b1fb
-
Filesize
224B
MD52d3ef0e613c45df0b850edc9741dd162
SHA1c71fb1e56d3eaadd3a85a6c8d3892d376822ffc7
SHA2564d77d5e0f23574e295c7964f9c7a7f3a61884e08b27b16865496eeda67a78bfe
SHA5123ad987a070a547ee9527fd3dd49c2062dca0d521415595079f018473030c13f5d1b0345a157c610b5bc6c3235542356f73814169f7ac09bb59ea768043e13a49
-
Filesize
2.0MB
MD5770477c6c8ab2ba6ab1f55c7bf33ce8d
SHA19432e46b07558400fc85e50cd9b12bd61ef7f96d
SHA2565cbbf2a9f631b413acd22f09d2c0779fd0665b7ee3a1f3d7f5f9627eae5c763e
SHA5120ab62d7f9b3a9fd60c62ede0138b9fee06e96c175bb744a67abbfb039d328ab6dc74043b82563684c4c61ac30b7dcb0f06608d004d5ed486c26ef67b35e59dfd