Analysis

  • max time kernel
    147s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-05-2024 03:30

General

  • Target

    828849f08b62df77ea83d35202ef5210_NeikiAnalytics.exe

  • Size

    534KB

  • MD5

    828849f08b62df77ea83d35202ef5210

  • SHA1

    a44599acea03322dee6129e8bc28da56a7edfc8f

  • SHA256

    828174bf347381e23da462e1d7532958389ecfb00639f6eb5f6001d9f6ac199b

  • SHA512

    54dfb7f51ce2fe101ec9033b66be916f0b08052da50c5134f5f8dcc96b5cc250c88679337b6a3a5265c58955d2f8bbfda9d4fd364088635cd6e2201585b5513a

  • SSDEEP

    6144:W8fGYJngzxsoIasFzFMkb7ShY97hNbE/55qiIqtqVh06vOGy3V8/GV0jivyabBYv:rkxfIayFMLqheh8KqVh06vDv

Malware Config

Extracted

Family

quasar

Version

2.1.0.0

Botnet

Office04

C2

0.tcp.sa.ngrok.io:19439

Mutex

VNM_MUTEX_c2q7y2ayYutZ2XaYe7

Attributes
  • encryption_key

    xzHeU68ynlwXnJHWc12M

  • install_name

    $77lol.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    $77lol

  • subdirectory

    SubDir

Signatures

  • Contains code to disable Windows Defender 2 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar payload 2 IoCs
  • VenomRAT

    VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\828849f08b62df77ea83d35202ef5210_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\828849f08b62df77ea83d35202ef5210_NeikiAnalytics.exe"
    1⤵
    • Modifies Windows Defender Real-time Protection settings
    • Checks computer location settings
    • Windows security modification
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2532
    • C:\Windows\SysWOW64\schtasks.exe
      "schtasks" /create /tn "$77lol" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\828849f08b62df77ea83d35202ef5210_NeikiAnalytics.exe" /rl HIGHEST /f
      2⤵
      • Creates scheduled task(s)
      PID:3596
    • C:\Users\Admin\AppData\Roaming\SubDir\$77lol.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\$77lol.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:536
      • C:\Windows\SysWOW64\schtasks.exe
        "schtasks" /create /tn "$77lol" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\$77lol.exe" /rl HIGHEST /f
        3⤵
        • Creates scheduled task(s)
        PID:3944
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" Get-MpPreference -verbose
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4736
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k start /b del /q/f/s %TEMP%\* & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1656
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /K del /q/f/s C:\Users\Admin\AppData\Local\Temp\*
        3⤵
          PID:5040
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UPJd1GJOGNfo.bat" "
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3332
        • C:\Windows\SysWOW64\chcp.com
          chcp 65001
          3⤵
            PID:2596
          • C:\Windows\SysWOW64\PING.EXE
            ping -n 10 localhost
            3⤵
            • Runs ping.exe
            PID:3628
          • C:\Users\Admin\AppData\Local\Temp\828849f08b62df77ea83d35202ef5210_NeikiAnalytics.exe
            "C:\Users\Admin\AppData\Local\Temp\828849f08b62df77ea83d35202ef5210_NeikiAnalytics.exe"
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:832

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\828849f08b62df77ea83d35202ef5210_NeikiAnalytics.exe.log

        Filesize

        1KB

        MD5

        10eab9c2684febb5327b6976f2047587

        SHA1

        a12ed54146a7f5c4c580416aecb899549712449e

        SHA256

        f49dbd55029bfbc15134f7c6a4f967d6c39142c63f2e8f1f8c78fab108a2c928

        SHA512

        7e5fd90fffae723bd0c662a90e0730b507805f072771ee673d1d8c262dbf60c8a03ba5fe088f699a97c2e886380de158b2ccd59ee62e3d012dd6dd14ea9d0e50

      • C:\Users\Admin\AppData\Local\Temp\UPJd1GJOGNfo.bat

        Filesize

        244B

        MD5

        6772c3f2ecee5cc657017a506a5deffb

        SHA1

        4402f0d7cdf26e446b6bd246b6284c8c4bf57ffe

        SHA256

        50ddf26cc1c71b6a850e5e8ae8eea884aa48b0d2fc6f57c790aec48a6c4c7e28

        SHA512

        8890fa7f04796fc2db6451cb40cfd8044e5e799166cf5472f3b8744ceefd19c4cc5ed936098b418681e0162c10f415eab99af3d9605c0ffe31ae79e97f67679a

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pyw5izi4.mkk.ps1

        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      • C:\Users\Admin\AppData\Roaming\SubDir\$77lol.exe

        Filesize

        534KB

        MD5

        828849f08b62df77ea83d35202ef5210

        SHA1

        a44599acea03322dee6129e8bc28da56a7edfc8f

        SHA256

        828174bf347381e23da462e1d7532958389ecfb00639f6eb5f6001d9f6ac199b

        SHA512

        54dfb7f51ce2fe101ec9033b66be916f0b08052da50c5134f5f8dcc96b5cc250c88679337b6a3a5265c58955d2f8bbfda9d4fd364088635cd6e2201585b5513a

      • memory/536-15-0x00000000751C0000-0x0000000075970000-memory.dmp

        Filesize

        7.7MB

      • memory/536-12-0x00000000751C0000-0x0000000075970000-memory.dmp

        Filesize

        7.7MB

      • memory/536-34-0x0000000006250000-0x000000000625A000-memory.dmp

        Filesize

        40KB

      • memory/536-62-0x00000000751C0000-0x0000000075970000-memory.dmp

        Filesize

        7.7MB

      • memory/2532-4-0x00000000751C0000-0x0000000075970000-memory.dmp

        Filesize

        7.7MB

      • memory/2532-5-0x0000000004F10000-0x0000000004F76000-memory.dmp

        Filesize

        408KB

      • memory/2532-3-0x0000000004E00000-0x0000000004E92000-memory.dmp

        Filesize

        584KB

      • memory/2532-2-0x00000000054C0000-0x0000000005A64000-memory.dmp

        Filesize

        5.6MB

      • memory/2532-0-0x00000000751CE000-0x00000000751CF000-memory.dmp

        Filesize

        4KB

      • memory/2532-67-0x00000000751C0000-0x0000000075970000-memory.dmp

        Filesize

        7.7MB

      • memory/2532-7-0x0000000006050000-0x000000000608C000-memory.dmp

        Filesize

        240KB

      • memory/2532-61-0x00000000751C0000-0x0000000075970000-memory.dmp

        Filesize

        7.7MB

      • memory/2532-60-0x00000000751CE000-0x00000000751CF000-memory.dmp

        Filesize

        4KB

      • memory/2532-6-0x0000000004EE0000-0x0000000004EF2000-memory.dmp

        Filesize

        72KB

      • memory/2532-1-0x00000000004F0000-0x000000000057C000-memory.dmp

        Filesize

        560KB

      • memory/4736-31-0x0000000005EF0000-0x0000000005F0E000-memory.dmp

        Filesize

        120KB

      • memory/4736-51-0x00000000074E0000-0x0000000007576000-memory.dmp

        Filesize

        600KB

      • memory/4736-32-0x0000000005F40000-0x0000000005F8C000-memory.dmp

        Filesize

        304KB

      • memory/4736-20-0x0000000005740000-0x00000000057A6000-memory.dmp

        Filesize

        408KB

      • memory/4736-35-0x0000000006EC0000-0x0000000006EF2000-memory.dmp

        Filesize

        200KB

      • memory/4736-36-0x00000000705C0000-0x000000007060C000-memory.dmp

        Filesize

        304KB

      • memory/4736-46-0x00000000064E0000-0x00000000064FE000-memory.dmp

        Filesize

        120KB

      • memory/4736-47-0x0000000006F00000-0x0000000006FA3000-memory.dmp

        Filesize

        652KB

      • memory/4736-48-0x00000000078E0000-0x0000000007F5A000-memory.dmp

        Filesize

        6.5MB

      • memory/4736-49-0x0000000007260000-0x000000000727A000-memory.dmp

        Filesize

        104KB

      • memory/4736-50-0x00000000072D0000-0x00000000072DA000-memory.dmp

        Filesize

        40KB

      • memory/4736-30-0x00000000059D0000-0x0000000005D24000-memory.dmp

        Filesize

        3.3MB

      • memory/4736-52-0x0000000007460000-0x0000000007471000-memory.dmp

        Filesize

        68KB

      • memory/4736-53-0x0000000007490000-0x000000000749E000-memory.dmp

        Filesize

        56KB

      • memory/4736-54-0x00000000074A0000-0x00000000074B4000-memory.dmp

        Filesize

        80KB

      • memory/4736-55-0x00000000075A0000-0x00000000075BA000-memory.dmp

        Filesize

        104KB

      • memory/4736-56-0x0000000007580000-0x0000000007588000-memory.dmp

        Filesize

        32KB

      • memory/4736-59-0x00000000751C0000-0x0000000075970000-memory.dmp

        Filesize

        7.7MB

      • memory/4736-19-0x0000000004F70000-0x0000000004F92000-memory.dmp

        Filesize

        136KB

      • memory/4736-18-0x00000000751C0000-0x0000000075970000-memory.dmp

        Filesize

        7.7MB

      • memory/4736-17-0x00000000751C0000-0x0000000075970000-memory.dmp

        Filesize

        7.7MB

      • memory/4736-14-0x0000000002620000-0x0000000002656000-memory.dmp

        Filesize

        216KB

      • memory/4736-16-0x00000000050A0000-0x00000000056C8000-memory.dmp

        Filesize

        6.2MB

      • memory/4736-13-0x00000000751C0000-0x0000000075970000-memory.dmp

        Filesize

        7.7MB