Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
10/05/2024, 01:23
Behavioral task
behavioral1
Sample
3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe
- Size 425KB
- Sample240510-br3htsae91
- SHA256 53c2eb5e0ce927cf890d72ff4f7d61b8f6e17a66557dbedf7839487351df5dd7
- MD5 3af7c0a66e5498a01bf1a633779f51c0
- SHA1 3d54628e6939cae72ce8420239f5467274fdcf43
- SHA512 3291e71934f0ecfe2362559965a8004f37c8211496f67ac58b7e48cc3e2a55771be20e3833ee29ff6965d597fd0145c69f33bd434844db4785f37d9bb730d769
- SSDEEP 12288:WquErHF6xC9D6DmR1J98w4oknqO/CyQftQYqYbLmK6:brl6kD68JmlokQfttqY2K6
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
njrat
Version
-
0.7d
Botnet
-
14 mai generateur xbox
C2
-
89.94.35.57:1604
Mutex
-
ef05e501c2e286164abf5fcaa961559f
Attributes
-
reg_key
ef05e501c2e286164abf5fcaa961559f
-
splitter
|'|'|
Signatures
- Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 1360 netsh.exe -
resource yara_rule behavioral2/memory/4592-0-0x0000000000470000-0x000000000056F000-memory.dmp upx behavioral2/memory/4592-12-0x0000000000470000-0x000000000056F000-memory.dmp upx behavioral2/memory/4592-13-0x0000000000470000-0x000000000056F000-memory.dmp upx behavioral2/memory/4592-14-0x0000000000470000-0x000000000056F000-memory.dmp upx behavioral2/memory/4592-19-0x0000000000470000-0x000000000056F000-memory.dmp upx behavioral2/memory/4592-20-0x0000000000470000-0x000000000056F000-memory.dmp upx behavioral2/memory/4592-21-0x0000000000470000-0x000000000056F000-memory.dmp upx behavioral2/memory/4592-22-0x0000000000470000-0x000000000056F000-memory.dmp upx behavioral2/memory/4592-23-0x0000000000470000-0x000000000056F000-memory.dmp upx behavioral2/memory/4592-24-0x0000000000470000-0x000000000056F000-memory.dmp upx behavioral2/memory/4592-25-0x0000000000470000-0x000000000056F000-memory.dmp upx behavioral2/memory/4592-26-0x0000000000470000-0x000000000056F000-memory.dmp upx behavioral2/memory/4592-27-0x0000000000470000-0x000000000056F000-memory.dmp upx behavioral2/memory/4592-28-0x0000000000470000-0x000000000056F000-memory.dmp upx behavioral2/memory/4592-29-0x0000000000470000-0x000000000056F000-memory.dmp upx behavioral2/memory/4592-30-0x0000000000470000-0x000000000056F000-memory.dmp upx - AutoIT Executable 15 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/4592-12-0x0000000000470000-0x000000000056F000-memory.dmp autoit_exe behavioral2/memory/4592-13-0x0000000000470000-0x000000000056F000-memory.dmp autoit_exe behavioral2/memory/4592-14-0x0000000000470000-0x000000000056F000-memory.dmp autoit_exe behavioral2/memory/4592-19-0x0000000000470000-0x000000000056F000-memory.dmp autoit_exe behavioral2/memory/4592-20-0x0000000000470000-0x000000000056F000-memory.dmp autoit_exe behavioral2/memory/4592-21-0x0000000000470000-0x000000000056F000-memory.dmp autoit_exe behavioral2/memory/4592-22-0x0000000000470000-0x000000000056F000-memory.dmp autoit_exe behavioral2/memory/4592-23-0x0000000000470000-0x000000000056F000-memory.dmp autoit_exe behavioral2/memory/4592-24-0x0000000000470000-0x000000000056F000-memory.dmp autoit_exe behavioral2/memory/4592-25-0x0000000000470000-0x000000000056F000-memory.dmp autoit_exe behavioral2/memory/4592-26-0x0000000000470000-0x000000000056F000-memory.dmp autoit_exe behavioral2/memory/4592-27-0x0000000000470000-0x000000000056F000-memory.dmp autoit_exe behavioral2/memory/4592-28-0x0000000000470000-0x000000000056F000-memory.dmp autoit_exe behavioral2/memory/4592-29-0x0000000000470000-0x000000000056F000-memory.dmp autoit_exe behavioral2/memory/4592-30-0x0000000000470000-0x000000000056F000-memory.dmp autoit_exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4592 set thread context of 4012 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe 86 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe - Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeDebugPrivilege 4012 RegAsm.exe Token: 33 4012 RegAsm.exe Token: SeIncBasePriorityPrivilege 4012 RegAsm.exe Token: 33 4012 RegAsm.exe Token: SeIncBasePriorityPrivilege 4012 RegAsm.exe Token: 33 4012 RegAsm.exe Token: SeIncBasePriorityPrivilege 4012 RegAsm.exe Token: 33 4012 RegAsm.exe Token: SeIncBasePriorityPrivilege 4012 RegAsm.exe Token: 33 4012 RegAsm.exe Token: SeIncBasePriorityPrivilege 4012 RegAsm.exe Token: 33 4012 RegAsm.exe Token: SeIncBasePriorityPrivilege 4012 RegAsm.exe Token: 33 4012 RegAsm.exe Token: SeIncBasePriorityPrivilege 4012 RegAsm.exe Token: 33 4012 RegAsm.exe Token: SeIncBasePriorityPrivilege 4012 RegAsm.exe Token: 33 4012 RegAsm.exe Token: SeIncBasePriorityPrivilege 4012 RegAsm.exe Token: 33 4012 RegAsm.exe Token: SeIncBasePriorityPrivilege 4012 RegAsm.exe Token: 33 4012 RegAsm.exe Token: SeIncBasePriorityPrivilege 4012 RegAsm.exe Token: 33 4012 RegAsm.exe Token: SeIncBasePriorityPrivilege 4012 RegAsm.exe Token: 33 4012 RegAsm.exe Token: SeIncBasePriorityPrivilege 4012 RegAsm.exe Token: 33 4012 RegAsm.exe Token: SeIncBasePriorityPrivilege 4012 RegAsm.exe Token: 33 4012 RegAsm.exe Token: SeIncBasePriorityPrivilege 4012 RegAsm.exe Token: 33 4012 RegAsm.exe Token: SeIncBasePriorityPrivilege 4012 RegAsm.exe Token: 33 4012 RegAsm.exe Token: SeIncBasePriorityPrivilege 4012 RegAsm.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4592 wrote to memory of 4012 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe 86 PID 4592 wrote to memory of 4012 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe 86 PID 4592 wrote to memory of 4012 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe 86 PID 4592 wrote to memory of 4012 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe 86 PID 4592 wrote to memory of 4012 4592 3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe 86 PID 4012 wrote to memory of 1360 4012 RegAsm.exe 92 PID 4012 wrote to memory of 1360 4012 RegAsm.exe 92 PID 4012 wrote to memory of 1360 4012 RegAsm.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3af7c0a66e5498a01bf1a633779f51c0_NeikiAnalytics.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "RegAsm.exe" ENABLE3⤵
- Modifies Windows Firewall
PID:1360
-
-