Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
15-05-2024 04:26
General
-
Target
7c12d48df8f08a95701197c514269a50_NeikiAnalytics.exe
-
Size
1.7MB
-
MD5
7c12d48df8f08a95701197c514269a50
-
SHA1
4f99360c54ad2cce0afe14ddb37697f6777795c8
-
SHA256
6ef54df3017339537b7649647096dcbc2b9fefea5b49776d8c80c38726b3698f
-
SHA512
37ed65a444ceba50af00e7570856cf3ae275bdbcb2acf6b72e0c3d3a6ba0361f0e1bf93ef1ae7a011dfc670c9840c43d88978c114f9f688bac1eff8f6d83b80d
-
SSDEEP
24576:YciyxcGgPmGJ5CNvo3h9Uzt/RUr0YOnWiqj+7A/X0Vp6W5GuqSD5bdGjPIT9z:YsgB2yoQ4k/ECW5Gu5xdGjPIT9
Malware Config
Signatures
-
Detect ZGRat V1 2 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Drops file in Program Files directory 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 45 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7c12d48df8f08a95701197c514269a50_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\7c12d48df8f08a95701197c514269a50_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\FF4TW08Jzh.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost3⤵
- Runs ping.exe
-
-
C:\Recovery\WindowsRE\7c12d48df8f08a95701197c514269a50_NeikiAnalytics.exe"C:\Recovery\WindowsRE\7c12d48df8f08a95701197c514269a50_NeikiAnalytics.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1040,i,4686244434963378549,11462511444150484980,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD51eff74e45bb1f7104e691358cb209546
SHA1253b13ffad516cc34704f5b882c6fa36953a953f
SHA2567ad96be486e6058b19446b95bb734acdaf4addc557b2d059a66ee1acfe19b3fc
SHA51244163ed001baf697ce66d3b386e13bf5cb94bc24ce6b1ae98665d766d5fcdf0ca28b41ecc26c5f11bbea117ac17099e87f204f9d5469bb102a769548edeead7e
-
Filesize
201B
MD54697e65d16a42f8595b45b47670027fb
SHA100e3c791130efb31d77fc1a5234a0fabde8bc48a
SHA2565bf856e5eab479d60524d9260d744c10af368ea8c3bb4d6a46c0b206ed5c0bd1
SHA51296ca4a8a1e5846b5e66fb61c65100f4b8951ab45297be07deb768a4c6e77c2d6ada3c702bfb9a6c8fbc4bdd32618e0c8486de65cffea0c99c2d9777c4dacfe36
-
Filesize
1.7MB
MD57c12d48df8f08a95701197c514269a50
SHA14f99360c54ad2cce0afe14ddb37697f6777795c8
SHA2566ef54df3017339537b7649647096dcbc2b9fefea5b49776d8c80c38726b3698f
SHA51237ed65a444ceba50af00e7570856cf3ae275bdbcb2acf6b72e0c3d3a6ba0361f0e1bf93ef1ae7a011dfc670c9840c43d88978c114f9f688bac1eff8f6d83b80d
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
32KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
112KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
320KB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
1.7MB