Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
13/05/2024, 20:14
Static task
static1
Behavioral task
behavioral1
Sample
1065005c1e4f2e65aaab7c6a4187a8b0_NeikiAnalytics.exe
Resource
win7-20240215-en
General
-
Target
1065005c1e4f2e65aaab7c6a4187a8b0_NeikiAnalytics.exe
-
Size
276KB
-
MD5
1065005c1e4f2e65aaab7c6a4187a8b0
-
SHA1
7bcdb9505c6c13dffdf5e1ac7b8bd371a46ba627
-
SHA256
7ab3eb25abe219404418d6ab09c5da0780b1f1654320e25e2d217b0e01abb229
-
SHA512
e741c82159078d54347c96684aff6525ef1c2d48f71a16b77dde6ad06016c9ab74d3e3fd4a249453bf2339eb15e255927d7ceee03541d61031b5c09814684d3b
-
SSDEEP
6144:CE4rib+K6Zpa4C4jLvkjbtMjvpbYZ651NN+uBSTZ5D:ClibsZpa4Nkje9j2Yat
Malware Config
Signatures
-
Gh0st RAT payload 11 IoCs
resource yara_rule behavioral2/memory/4008-4-0x0000000010000000-0x0000000010146000-memory.dmp family_gh0strat behavioral2/memory/4008-3-0x0000000010000000-0x0000000010146000-memory.dmp family_gh0strat behavioral2/memory/4008-6-0x0000000010000000-0x0000000010146000-memory.dmp family_gh0strat behavioral2/memory/2512-23-0x0000000010000000-0x0000000010146000-memory.dmp family_gh0strat behavioral2/memory/2580-28-0x0000000010000000-0x0000000010146000-memory.dmp family_gh0strat behavioral2/memory/2580-30-0x0000000010000000-0x0000000010146000-memory.dmp family_gh0strat behavioral2/memory/2512-22-0x0000000010000000-0x0000000010146000-memory.dmp family_gh0strat behavioral2/memory/2580-29-0x0000000010000000-0x0000000010146000-memory.dmp family_gh0strat behavioral2/memory/2580-43-0x0000000010000000-0x0000000010146000-memory.dmp family_gh0strat behavioral2/memory/2684-44-0x0000000010000000-0x0000000010146000-memory.dmp family_gh0strat behavioral2/memory/2684-45-0x0000000010000000-0x0000000010146000-memory.dmp family_gh0strat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 1065005c1e4f2e65aaab7c6a4187a8b0_NeikiAnalytics.exe -
Deletes itself 1 IoCs
pid Process 2684 Terms.exe -
Executes dropped EXE 4 IoCs
pid Process 2512 Terms.exe 2580 Terms.exe 1824 Terms.exe 2684 Terms.exe -
resource yara_rule behavioral2/memory/4008-4-0x0000000010000000-0x0000000010146000-memory.dmp upx behavioral2/memory/4008-3-0x0000000010000000-0x0000000010146000-memory.dmp upx behavioral2/memory/4008-0-0x0000000010000000-0x0000000010146000-memory.dmp upx behavioral2/memory/4008-6-0x0000000010000000-0x0000000010146000-memory.dmp upx behavioral2/memory/2512-23-0x0000000010000000-0x0000000010146000-memory.dmp upx behavioral2/memory/2580-25-0x0000000010000000-0x0000000010146000-memory.dmp upx behavioral2/memory/2580-28-0x0000000010000000-0x0000000010146000-memory.dmp upx behavioral2/memory/2580-30-0x0000000010000000-0x0000000010146000-memory.dmp upx behavioral2/memory/2512-22-0x0000000010000000-0x0000000010146000-memory.dmp upx behavioral2/memory/2580-29-0x0000000010000000-0x0000000010146000-memory.dmp upx behavioral2/memory/2580-43-0x0000000010000000-0x0000000010146000-memory.dmp upx behavioral2/memory/2684-44-0x0000000010000000-0x0000000010146000-memory.dmp upx behavioral2/memory/2684-45-0x0000000010000000-0x0000000010146000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 1212 2580 WerFault.exe 84 -
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Terms.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Terms.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 Terms.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString Terms.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 Terms.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 4008 1065005c1e4f2e65aaab7c6a4187a8b0_NeikiAnalytics.exe Token: SeDebugPrivilege 2512 Terms.exe Token: SeDebugPrivilege 2580 Terms.exe Token: SeDebugPrivilege 2580 Terms.exe Token: SeDebugPrivilege 2580 Terms.exe Token: SeDebugPrivilege 1824 Terms.exe Token: SeDebugPrivilege 2684 Terms.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4008 wrote to memory of 2512 4008 1065005c1e4f2e65aaab7c6a4187a8b0_NeikiAnalytics.exe 83 PID 4008 wrote to memory of 2512 4008 1065005c1e4f2e65aaab7c6a4187a8b0_NeikiAnalytics.exe 83 PID 4008 wrote to memory of 2512 4008 1065005c1e4f2e65aaab7c6a4187a8b0_NeikiAnalytics.exe 83 PID 2580 wrote to memory of 1824 2580 Terms.exe 89 PID 2580 wrote to memory of 1824 2580 Terms.exe 89 PID 2580 wrote to memory of 1824 2580 Terms.exe 89 PID 2580 wrote to memory of 2684 2580 Terms.exe 90 PID 2580 wrote to memory of 2684 2580 Terms.exe 90 PID 2580 wrote to memory of 2684 2580 Terms.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\1065005c1e4f2e65aaab7c6a4187a8b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1065005c1e4f2e65aaab7c6a4187a8b0_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\Users\Public\baseclass\Terms.exe"C:\Users\Public\baseclass\Terms.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2512
-
-
C:\Users\Public\baseclass\Terms.exeC:\Users\Public\baseclass\Terms.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Public\baseclass\Terms.exeC:\Users\Public\baseclass\Terms.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1824
-
-
C:\Users\Public\baseclass\Terms.exeC:\Users\Public\baseclass\Terms.exe2⤵
- Deletes itself
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2684
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2580 -s 6642⤵
- Program crash
PID:1212
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2580 -ip 25801⤵PID:3696
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
276KB
MD51065005c1e4f2e65aaab7c6a4187a8b0
SHA17bcdb9505c6c13dffdf5e1ac7b8bd371a46ba627
SHA2567ab3eb25abe219404418d6ab09c5da0780b1f1654320e25e2d217b0e01abb229
SHA512e741c82159078d54347c96684aff6525ef1c2d48f71a16b77dde6ad06016c9ab74d3e3fd4a249453bf2339eb15e255927d7ceee03541d61031b5c09814684d3b