Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
10/05/2024, 05:58
Static task
static1
Behavioral task
behavioral1
Sample
86a9fd7269d1fadb204a7612df599e50_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
86a9fd7269d1fadb204a7612df599e50_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
86a9fd7269d1fadb204a7612df599e50_NeikiAnalytics.exe
-
Size
113KB
-
MD5
86a9fd7269d1fadb204a7612df599e50
-
SHA1
7e404cb4f315312d6f37b61c46f2e54ddb038728
-
SHA256
3243f9b754342412b3dfdcdb6b3dabeea1388ee94ee32af129ceec5d8097799b
-
SHA512
02d7625060a1fb7c3751e66177633818a490b932744f4551b9543eb599ff92c1d2b1e3133dee87a1bba548227b66a4bd5059523a7c7fc3d95a3f5792d8df5c31
-
SSDEEP
1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuMiatS:P5eznsjsguGDFqGZ2ra
Malware Config
Extracted
njrat
0.7d
neuf
doddyfire.linkpc.net:10000
e1a87040f2026369a233f9ae76301b7b
-
reg_key
e1a87040f2026369a233f9ae76301b7b
-
splitter
|'|'|
Signatures
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 3892 netsh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation 86a9fd7269d1fadb204a7612df599e50_NeikiAnalytics.exe -
Executes dropped EXE 2 IoCs
pid Process 220 chargeable.exe 4940 chargeable.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\confuse = "C:\\Users\\Admin\\AppData\\Roaming\\confuse\\chargeable.exe" 86a9fd7269d1fadb204a7612df599e50_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysMain = "C:\\Users\\Admin\\AppData\\Local\\Temp\\86a9fd7269d1fadb204a7612df599e50_NeikiAnalytics.exe" 86a9fd7269d1fadb204a7612df599e50_NeikiAnalytics.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 220 set thread context of 4940 220 chargeable.exe 94 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 33 IoCs
description pid Process Token: SeDebugPrivilege 4940 chargeable.exe Token: 33 4940 chargeable.exe Token: SeIncBasePriorityPrivilege 4940 chargeable.exe Token: 33 4940 chargeable.exe Token: SeIncBasePriorityPrivilege 4940 chargeable.exe Token: 33 4940 chargeable.exe Token: SeIncBasePriorityPrivilege 4940 chargeable.exe Token: 33 4940 chargeable.exe Token: SeIncBasePriorityPrivilege 4940 chargeable.exe Token: 33 4940 chargeable.exe Token: SeIncBasePriorityPrivilege 4940 chargeable.exe Token: 33 4940 chargeable.exe Token: SeIncBasePriorityPrivilege 4940 chargeable.exe Token: 33 4940 chargeable.exe Token: SeIncBasePriorityPrivilege 4940 chargeable.exe Token: 33 4940 chargeable.exe Token: SeIncBasePriorityPrivilege 4940 chargeable.exe Token: 33 4940 chargeable.exe Token: SeIncBasePriorityPrivilege 4940 chargeable.exe Token: 33 4940 chargeable.exe Token: SeIncBasePriorityPrivilege 4940 chargeable.exe Token: 33 4940 chargeable.exe Token: SeIncBasePriorityPrivilege 4940 chargeable.exe Token: 33 4940 chargeable.exe Token: SeIncBasePriorityPrivilege 4940 chargeable.exe Token: 33 4940 chargeable.exe Token: SeIncBasePriorityPrivilege 4940 chargeable.exe Token: 33 4940 chargeable.exe Token: SeIncBasePriorityPrivilege 4940 chargeable.exe Token: 33 4940 chargeable.exe Token: SeIncBasePriorityPrivilege 4940 chargeable.exe Token: 33 4940 chargeable.exe Token: SeIncBasePriorityPrivilege 4940 chargeable.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1840 wrote to memory of 220 1840 86a9fd7269d1fadb204a7612df599e50_NeikiAnalytics.exe 92 PID 1840 wrote to memory of 220 1840 86a9fd7269d1fadb204a7612df599e50_NeikiAnalytics.exe 92 PID 1840 wrote to memory of 220 1840 86a9fd7269d1fadb204a7612df599e50_NeikiAnalytics.exe 92 PID 220 wrote to memory of 4940 220 chargeable.exe 94 PID 220 wrote to memory of 4940 220 chargeable.exe 94 PID 220 wrote to memory of 4940 220 chargeable.exe 94 PID 220 wrote to memory of 4940 220 chargeable.exe 94 PID 220 wrote to memory of 4940 220 chargeable.exe 94 PID 220 wrote to memory of 4940 220 chargeable.exe 94 PID 220 wrote to memory of 4940 220 chargeable.exe 94 PID 220 wrote to memory of 4940 220 chargeable.exe 94 PID 4940 wrote to memory of 3892 4940 chargeable.exe 96 PID 4940 wrote to memory of 3892 4940 chargeable.exe 96 PID 4940 wrote to memory of 3892 4940 chargeable.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\86a9fd7269d1fadb204a7612df599e50_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\86a9fd7269d1fadb204a7612df599e50_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe"C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Users\Admin\AppData\Roaming\confuse\chargeable.exeC:\Users\Admin\AppData\Roaming\confuse\chargeable.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe" "chargeable.exe" ENABLE4⤵
- Modifies Windows Firewall
PID:3892
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
400B
MD50a9b4592cd49c3c21f6767c2dabda92f
SHA1f534297527ae5ccc0ecb2221ddeb8e58daeb8b74
SHA256c7effe9cb81a70d738dee863991afefab040290d4c4b78b4202383bcb9f88fcd
SHA5126b878df474e5bbfb8e9e265f15a76560c2ef151dcebc6388c82d7f6f86ffaf83f5ade5a09f1842e493cb6c8fd63b0b88d088c728fd725f7139f965a5ee332307
-
Filesize
113KB
MD55901e3ce6b0ee930066b4bbaff9788e2
SHA1ff052960e7180692c5ad49e07933fdd8f419e6cd
SHA2565235eab99b6b782d012245848ec4c8f099fa2d4343f82d633c3f58c60e2efce3
SHA51289c37067094ab82c65e7fc75b3f308547e2c15d7c9ca0c753e9651c9717e00a53a0bec154d6781f0824b6d62119d6953a05f74f15bfdf47e3115b76e3dbf42d0