Analysis

  • max time kernel
    122s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    14-05-2024 01:01

General

  • Target

    471dcea0354a72ac93b2b80989ce8560_NeikiAnalytics.exe

  • Size

    722KB

  • MD5

    471dcea0354a72ac93b2b80989ce8560

  • SHA1

    8ab39f9b74dddb0202e32e2eb3a7252e86de18b0

  • SHA256

    f304fe09810d864e0dfcc2c42da345a601079a9dc335179729296aaf08a718ab

  • SHA512

    13afd53b5760d98ade6c2dcd2ecf50fe6eef1a906c735d76376402eb038b0990065c3fc90af3731d480671437a18461180ef5779ae5c4dbbca8d1aa8873bd936

  • SSDEEP

    12288:DquErHF6xC9D6DmR1J98w4oknqOKw/zTd1RVaHvymUi6rjXrm62iU952aLovi75C:arl6kD68JmloO7TdNaPymUi63i62xHLm

Malware Config

Extracted

Family

azorult

C2

http://185.79.156.23/j0n0/index.php

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

  • Deletes itself 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\471dcea0354a72ac93b2b80989ce8560_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\471dcea0354a72ac93b2b80989ce8560_NeikiAnalytics.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1948
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
      2⤵
        PID:1736
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c TimeOut 1 & Del /F "C:\Users\Admin\AppData\Local\Temp\471dcea0354a72ac93b2b80989ce8560_NeikiAnalytics.exe"
        2⤵
        • Deletes itself
        • Suspicious use of WriteProcessMemory
        PID:2604
        • C:\Windows\SysWOW64\timeout.exe
          TimeOut 1
          3⤵
          • Delays execution with timeout.exe
          PID:2636

    Network

      No results found
    • 185.79.156.23:80
      RegAsm.exe
      152 B
      3
    • 185.79.156.23:80
      RegAsm.exe
      152 B
      3
    • 185.79.156.23:80
      RegAsm.exe
      152 B
      3
    No results found

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1736-4-0x0000000000400000-0x0000000000420000-memory.dmp

      Filesize

      128KB

    • memory/1736-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/1736-14-0x0000000000400000-0x0000000000420000-memory.dmp

      Filesize

      128KB

    • memory/1736-5-0x0000000000400000-0x0000000000420000-memory.dmp

      Filesize

      128KB

    • memory/1736-22-0x0000000000400000-0x0000000000420000-memory.dmp

      Filesize

      128KB

    • memory/1736-24-0x0000000000400000-0x0000000000420000-memory.dmp

      Filesize

      128KB

    • memory/1736-20-0x0000000000400000-0x0000000000420000-memory.dmp

      Filesize

      128KB

    • memory/1736-18-0x0000000000400000-0x0000000000420000-memory.dmp

      Filesize

      128KB

    • memory/1736-16-0x0000000000400000-0x0000000000420000-memory.dmp

      Filesize

      128KB

    • memory/1948-0-0x0000000000AA0000-0x0000000000C34000-memory.dmp

      Filesize

      1.6MB

    • memory/1948-3-0x0000000000120000-0x0000000000121000-memory.dmp

      Filesize

      4KB

    • memory/1948-26-0x0000000000AA0000-0x0000000000C34000-memory.dmp

      Filesize

      1.6MB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.