Analysis
- max time kernel
147s - max time network
99s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
10/05/2024, 10:44
General
- Target c79733ad7eefa61a1e3f5f6db5c04ee0_NeikiAnalytics.exe
- Size 1.3MB
- Sample240510-msx6aaaa2v
- SHA256 f571d9cbaf9c5b082c8b4865472c7207ba89907beae9151efdb6a257bc6d2b86
Malware Config
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Detect ZGRat V1 33 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c79733ad7eefa61a1e3f5f6db5c04ee0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\c79733ad7eefa61a1e3f5f6db5c04ee0_NeikiAnalytics.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\c79733ad7eefa61a1e3f5f6db5c04ee0_NeikiAnalytics.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2532 -s 7002⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2532 -ip 25321⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2228-11-0x0000000000400000-0x0000000000446000-memory.dmp
memory/2228-13-0x0000000000400000-0x0000000000446000-memory.dmp
memory/2228-14-0x0000000000400000-0x0000000000446000-memory.dmp
memory/2228-12-0x0000000000400000-0x0000000000446000-memory.dmp
memory/2228-15-0x000000007415E000-0x000000007415F000-memory.dmp
memory/2228-16-0x0000000004A70000-0x0000000004AC4000-memory.dmp
memory/2228-17-0x0000000074150000-0x0000000074900000-memory.dmp
memory/2228-19-0x0000000005080000-0x0000000005624000-memory.dmp
memory/2228-18-0x0000000074150000-0x0000000074900000-memory.dmp
memory/2228-20-0x0000000004B30000-0x0000000004B82000-memory.dmp
memory/2228-21-0x0000000074150000-0x0000000074900000-memory.dmp
memory/2228-77-0x0000000004B30000-0x0000000004B7D000-memory.dmp
memory/2228-67-0x0000000004B30000-0x0000000004B7D000-memory.dmp
memory/2228-43-0x0000000004B30000-0x0000000004B7D000-memory.dmp
memory/2228-33-0x0000000004B30000-0x0000000004B7D000-memory.dmp
memory/2228-81-0x0000000004B30000-0x0000000004B7D000-memory.dmp
memory/2228-79-0x0000000004B30000-0x0000000004B7D000-memory.dmp
memory/2228-75-0x0000000004B30000-0x0000000004B7D000-memory.dmp
memory/2228-73-0x0000000004B30000-0x0000000004B7D000-memory.dmp
memory/2228-71-0x0000000004B30000-0x0000000004B7D000-memory.dmp
memory/2228-69-0x0000000004B30000-0x0000000004B7D000-memory.dmp
memory/2228-65-0x0000000004B30000-0x0000000004B7D000-memory.dmp
memory/2228-63-0x0000000004B30000-0x0000000004B7D000-memory.dmp
memory/2228-61-0x0000000004B30000-0x0000000004B7D000-memory.dmp
memory/2228-59-0x0000000004B30000-0x0000000004B7D000-memory.dmp
memory/2228-58-0x0000000004B30000-0x0000000004B7D000-memory.dmp
memory/2228-55-0x0000000004B30000-0x0000000004B7D000-memory.dmp
memory/2228-53-0x0000000004B30000-0x0000000004B7D000-memory.dmp
memory/2228-51-0x0000000004B30000-0x0000000004B7D000-memory.dmp
memory/2228-49-0x0000000004B30000-0x0000000004B7D000-memory.dmp
memory/2228-47-0x0000000004B30000-0x0000000004B7D000-memory.dmp
memory/2228-45-0x0000000004B30000-0x0000000004B7D000-memory.dmp
memory/2228-41-0x0000000004B30000-0x0000000004B7D000-memory.dmp
memory/2228-39-0x0000000004B30000-0x0000000004B7D000-memory.dmp
memory/2228-37-0x0000000004B30000-0x0000000004B7D000-memory.dmp
memory/2228-35-0x0000000004B30000-0x0000000004B7D000-memory.dmp
memory/2228-31-0x0000000004B30000-0x0000000004B7D000-memory.dmp
memory/2228-29-0x0000000004B30000-0x0000000004B7D000-memory.dmp
memory/2228-27-0x0000000004B30000-0x0000000004B7D000-memory.dmp
memory/2228-25-0x0000000004B30000-0x0000000004B7D000-memory.dmp
memory/2228-23-0x0000000004B30000-0x0000000004B7D000-memory.dmp
memory/2228-22-0x0000000004B30000-0x0000000004B7D000-memory.dmp
memory/2228-1052-0x0000000004D30000-0x0000000004D96000-memory.dmp
memory/2228-1053-0x0000000074150000-0x0000000074900000-memory.dmp
memory/2228-1054-0x0000000005C90000-0x0000000005CE0000-memory.dmp
memory/2228-1055-0x0000000005D80000-0x0000000005E12000-memory.dmp
memory/2228-1056-0x0000000005CE0000-0x0000000005CEA000-memory.dmp
memory/2228-1057-0x0000000000400000-0x0000000000446000-memory.dmp
memory/2228-1058-0x000000007415E000-0x000000007415F000-memory.dmp
memory/2228-1059-0x0000000074150000-0x0000000074900000-memory.dmp
memory/2532-10-0x0000000003AB0000-0x0000000003AB4000-memory.dmp