Analysis
- max time kernel
131s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
10/05/2024, 19:08
General
- Target 4de76ad34e9ccffc91bbec7a3c4e79e0_NeikiAnalytics.exe
- Size 4.5MB
- Sample240510-xtqspsfg23
- SHA256 e84cad4f234445a47bf803591ac168031558e9215ba714c2197fe75b5188aa1c
Malware Config
Signatures
- Detect ZGRat V1 2 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- .NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Loads dropped DLL 1 IoCs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4de76ad34e9ccffc91bbec7a3c4e79e0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4de76ad34e9ccffc91bbec7a3c4e79e0_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Protect544cd51a.dll
memory/1724-16-0x0000000074660000-0x0000000074E10000-memory.dmp
memory/1724-1-0x00000000001E0000-0x000000000065A000-memory.dmp
memory/1724-2-0x0000000004FE0000-0x000000000507C000-memory.dmp
memory/1724-3-0x0000000074660000-0x0000000074E10000-memory.dmp
memory/1724-4-0x0000000005130000-0x00000000052C2000-memory.dmp
memory/1724-10-0x0000000002B80000-0x0000000002B90000-memory.dmp
memory/1724-11-0x0000000074660000-0x0000000074E10000-memory.dmp
memory/1724-12-0x0000000074660000-0x0000000074E10000-memory.dmp
memory/1724-13-0x0000000074660000-0x0000000074E10000-memory.dmp
memory/1724-0-0x000000007466E000-0x000000007466F000-memory.dmp
memory/5036-19-0x00000000057B0000-0x0000000005842000-memory.dmp
memory/5036-25-0x0000000008960000-0x000000000899C000-memory.dmp
memory/5036-18-0x0000000005E80000-0x0000000006424000-memory.dmp
memory/5036-14-0x0000000000400000-0x000000000046E000-memory.dmp
memory/5036-20-0x0000000074630000-0x00000000746DB000-memory.dmp
memory/5036-21-0x0000000005750000-0x000000000575A000-memory.dmp
memory/5036-22-0x0000000008E90000-0x00000000094A8000-memory.dmp
memory/5036-23-0x00000000089C0000-0x0000000008ACA000-memory.dmp
memory/5036-24-0x0000000008900000-0x0000000008912000-memory.dmp
memory/5036-17-0x0000000074630000-0x00000000746DB000-memory.dmp
memory/5036-26-0x0000000008AD0000-0x0000000008B1C000-memory.dmp
memory/5036-27-0x0000000008C50000-0x0000000008CB6000-memory.dmp
memory/5036-28-0x00000000095B0000-0x0000000009626000-memory.dmp
memory/5036-29-0x0000000008E30000-0x0000000008E4E000-memory.dmp
memory/5036-30-0x000000000A200000-0x000000000A3C2000-memory.dmp
memory/5036-31-0x000000000A900000-0x000000000AE2C000-memory.dmp
memory/5036-33-0x0000000074630000-0x00000000746DB000-memory.dmp