Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
10/05/2024, 07:19
Behavioral task
behavioral1
Sample
9eca20a1136b80e16ba2914ec77d7430_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
9eca20a1136b80e16ba2914ec77d7430_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
9eca20a1136b80e16ba2914ec77d7430_NeikiAnalytics.exe
-
Size
721KB
-
MD5
9eca20a1136b80e16ba2914ec77d7430
-
SHA1
ed7da214f5f7e6c780bb17f6fbb050045fbac625
-
SHA256
ac521479e4e200f6ce0d7225a5f2c0d1e9d5d6b333240d02cfbfbcfe7dd9dfff
-
SHA512
22a986d77eacc4a5bcfcba22e7a2e397175e0803675be26db3984f4aee7ab1d7a63c2ee76fbeb14d6c0eadc6654f985760c72779de9731629cd115a728fa5917
-
SSDEEP
12288:DquErHF6xC9D6DmR1J98w4oknqOKw/zTd1RVaHvymUi6rjXrm62iU952aLovi75G:arl6kD68JmloO7TdNaPymUi63i62xHLC
Malware Config
Extracted
azorult
http://185.79.156.23/j0n0/index.php
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 9eca20a1136b80e16ba2914ec77d7430_NeikiAnalytics.exe -
resource yara_rule behavioral2/memory/64-0-0x0000000000060000-0x00000000001F4000-memory.dmp upx behavioral2/memory/64-23-0x0000000000060000-0x00000000001F4000-memory.dmp upx -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/64-23-0x0000000000060000-0x00000000001F4000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 64 set thread context of 4808 64 9eca20a1136b80e16ba2914ec77d7430_NeikiAnalytics.exe 85 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
pid Process 4060 timeout.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 64 9eca20a1136b80e16ba2914ec77d7430_NeikiAnalytics.exe 64 9eca20a1136b80e16ba2914ec77d7430_NeikiAnalytics.exe 64 9eca20a1136b80e16ba2914ec77d7430_NeikiAnalytics.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 64 9eca20a1136b80e16ba2914ec77d7430_NeikiAnalytics.exe 64 9eca20a1136b80e16ba2914ec77d7430_NeikiAnalytics.exe 64 9eca20a1136b80e16ba2914ec77d7430_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 64 wrote to memory of 4808 64 9eca20a1136b80e16ba2914ec77d7430_NeikiAnalytics.exe 85 PID 64 wrote to memory of 4808 64 9eca20a1136b80e16ba2914ec77d7430_NeikiAnalytics.exe 85 PID 64 wrote to memory of 4808 64 9eca20a1136b80e16ba2914ec77d7430_NeikiAnalytics.exe 85 PID 64 wrote to memory of 4808 64 9eca20a1136b80e16ba2914ec77d7430_NeikiAnalytics.exe 85 PID 64 wrote to memory of 4808 64 9eca20a1136b80e16ba2914ec77d7430_NeikiAnalytics.exe 85 PID 64 wrote to memory of 2736 64 9eca20a1136b80e16ba2914ec77d7430_NeikiAnalytics.exe 86 PID 64 wrote to memory of 2736 64 9eca20a1136b80e16ba2914ec77d7430_NeikiAnalytics.exe 86 PID 64 wrote to memory of 2736 64 9eca20a1136b80e16ba2914ec77d7430_NeikiAnalytics.exe 86 PID 2736 wrote to memory of 4060 2736 cmd.exe 89 PID 2736 wrote to memory of 4060 2736 cmd.exe 89 PID 2736 wrote to memory of 4060 2736 cmd.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\9eca20a1136b80e16ba2914ec77d7430_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\9eca20a1136b80e16ba2914ec77d7430_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:64 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵PID:4808
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c TimeOut 1 & Del /F "C:\Users\Admin\AppData\Local\Temp\9eca20a1136b80e16ba2914ec77d7430_NeikiAnalytics.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\SysWOW64\timeout.exeTimeOut 13⤵
- Delays execution with timeout.exe
PID:4060
-
-