Analysis
-
max time kernel
142s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
11-05-2024 01:00
General
-
Target
446bbcd1b1286fb3181f446312df1500_NeikiAnalytics.exe
-
Size
591KB
-
MD5
446bbcd1b1286fb3181f446312df1500
-
SHA1
bbbd0fb3daf71deadf748120ed4c2760194d72dc
-
SHA256
cdb2cf292a9680a20c3a600bc9c5eb2d76252c6ba3a4edd9154158d855694b30
-
SHA512
c95a34e7f10e1cfa126d8bf8af3ae099a2bc3a6b46acb8e42900ea1c00387c1d9c29d5ee900999d092e392bde5c21c5ec922855a0cf1bb39a2e21ac6eb8c5094
-
SSDEEP
12288:by905/BrsrSS900VazoYYK+faypu4niRg6Jli4gNPUR0FlkA:byy/JrX3+ZpusiWM8NPC0FlR
Malware Config
Signatures
-
Detect ZGRat V1 20 IoCs
-
Detects Healer an antivirus disabler dropper 17 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Executes dropped EXE 2 IoCs
-
Windows security modification 2 TTPs 2 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\446bbcd1b1286fb3181f446312df1500_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\446bbcd1b1286fb3181f446312df1500_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\77994781.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\77994781.exe2⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 10803⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rk995219.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rk995219.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1140 -ip 11401⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
377KB
MD57aa18f1401c4a8c8a246aeecb0e9e81b
SHA18bb765b56077cb70cfeb1a5dcc979d8c5e465682
SHA2569753ffa20b8d468ae3080e9ab4bd0d45acc2d739c0e7ec7104054b80931f08e6
SHA51254c72f69a24ac03b2d2057c68cb38ba519258c8f7c1533c766150aa22c95463d926f335fcbbac8b909caf6576643f5731c35b1d08c10433de176a62584c7ab45
-
Filesize
459KB
MD55cbea374e56f795e0cc544a45a3b1f6a
SHA1417b27345f5944347ba77fc8d10b5732b5c303bf
SHA25683e890c0ffb12c48d616ca4f298ba6b01427518187e7e26c95e41711c204c747
SHA5124ac8d63f183a2f805587a844f6113f027ca70d4fbbc343652661448acbb16231ebcaaedbb3214b8f26024e0857825402dff05872ce409d97215e82b663302223
-
Filesize
1024KB
-
Filesize
192KB
-
Filesize
180KB
-
Filesize
4.0MB
-
Filesize
104KB
-
Filesize
5.6MB
-
Filesize
96KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
4.0MB
-
Filesize
192KB
-
Filesize
232KB
-
Filesize
4.1MB
-
Filesize
240KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
6.1MB
-
Filesize
72KB
-
Filesize
1.0MB
-
Filesize
240KB
-
Filesize
304KB