Analysis
-
max time kernel
141s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 06:25
Behavioral task
behavioral1
Sample
a2a4e83e35f7cafbc1c73fd179737e80_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
a2a4e83e35f7cafbc1c73fd179737e80_NeikiAnalytics.exe
-
Size
45KB
-
MD5
a2a4e83e35f7cafbc1c73fd179737e80
-
SHA1
94f0660549221c8bf48184ea39324ece80053935
-
SHA256
5244f2ca07b186c6bd6c0ac80a5c8db94bb49ebfc920ce6b2c73e23568aff396
-
SHA512
426211ae1ee5f20f338613bc3c83afe51481110cc7f6d4fd32b869cdc5f927c831e4596de4ff60c905bc33e314ef8f64896df0681e4b4c380f34c61504ba8052
-
SSDEEP
768:VdhO/poiiUcjlJIniwzH9Xqk5nWEZ5SbTDahWI7CPW5z:rw+jjgniyH9XqcnW85SbToWI7
Malware Config
Extracted
xenorat
damizk.ddns.net
Xeno_rat_ndsszcv
-
delay
5000
-
install_path
appdata
-
port
7628
-
startup_name
nothingset
Signatures
-
Detects XenoRAT malware 3 IoCs
XenoRAT is an open-source remote access tool (RAT) developed in C#.
resource yara_rule behavioral1/memory/2088-1-0x0000000000C80000-0x0000000000C92000-memory.dmp XenoRAT behavioral1/files/0x003a000000013a84-4.dat XenoRAT behavioral1/memory/2480-9-0x0000000001380000-0x0000000001392000-memory.dmp XenoRAT -
Executes dropped EXE 1 IoCs
pid Process 2480 a2a4e83e35f7cafbc1c73fd179737e80_NeikiAnalytics.exe -
Loads dropped DLL 1 IoCs
pid Process 2088 a2a4e83e35f7cafbc1c73fd179737e80_NeikiAnalytics.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2088 wrote to memory of 2480 2088 a2a4e83e35f7cafbc1c73fd179737e80_NeikiAnalytics.exe 28 PID 2088 wrote to memory of 2480 2088 a2a4e83e35f7cafbc1c73fd179737e80_NeikiAnalytics.exe 28 PID 2088 wrote to memory of 2480 2088 a2a4e83e35f7cafbc1c73fd179737e80_NeikiAnalytics.exe 28 PID 2088 wrote to memory of 2480 2088 a2a4e83e35f7cafbc1c73fd179737e80_NeikiAnalytics.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\a2a4e83e35f7cafbc1c73fd179737e80_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a2a4e83e35f7cafbc1c73fd179737e80_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Roaming\XenoManager\a2a4e83e35f7cafbc1c73fd179737e80_NeikiAnalytics.exe"C:\Users\Admin\AppData\Roaming\XenoManager\a2a4e83e35f7cafbc1c73fd179737e80_NeikiAnalytics.exe"2⤵
- Executes dropped EXE
PID:2480
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
45KB
MD5a2a4e83e35f7cafbc1c73fd179737e80
SHA194f0660549221c8bf48184ea39324ece80053935
SHA2565244f2ca07b186c6bd6c0ac80a5c8db94bb49ebfc920ce6b2c73e23568aff396
SHA512426211ae1ee5f20f338613bc3c83afe51481110cc7f6d4fd32b869cdc5f927c831e4596de4ff60c905bc33e314ef8f64896df0681e4b4c380f34c61504ba8052