Analysis
-
max time kernel
140s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 05:17
Static task
static1
Behavioral task
behavioral1
Sample
b6bec0853953bafc210ceeeec5787660_NeikiAnalytics.exe
Resource
win7-20240215-en
General
-
Target
b6bec0853953bafc210ceeeec5787660_NeikiAnalytics.exe
-
Size
1.5MB
-
MD5
b6bec0853953bafc210ceeeec5787660
-
SHA1
cf4990f7c4bc28c178b52ec6d5d62a9de3e314ad
-
SHA256
b53cdf78114b979193e33a4be762b9c01dc1bc76e09750edb47b0fefe55bcc47
-
SHA512
df676ed5468815a46a5300980e889370d7b9927db917ce06d71b942c268e445067c70da5dcfdc9430d3430fca9f44a58ccfeb499f3d235787f8d85a005281c52
-
SSDEEP
24576:mD39v74lfGQrFUspugRNJI2DJ53J/J/L56+JJJ+R:mp7E+QrFUBgq2o
Malware Config
Extracted
remcos
1.7 Pro
Host
213.183.58.19:4000
-
audio_folder
audio
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
5
-
copy_file
remcos.exe
-
copy_folder
remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
true
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
true
-
keylog_file
read.dat
-
keylog_flag
false
-
keylog_folder
CastC
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
remcos_sccafsoidz
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screens
-
screenshot_path
%AppData%
-
screenshot_time
1
-
startup_value
remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
b6bec0853953bafc210ceeeec5787660_NeikiAnalytics.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation b6bec0853953bafc210ceeeec5787660_NeikiAnalytics.exe -
Executes dropped EXE 2 IoCs
Processes:
sbietrcl.exesbietrcl.exepid process 3176 sbietrcl.exe 4920 sbietrcl.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
b6bec0853953bafc210ceeeec5787660_NeikiAnalytics.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Application = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\sbietrcl.exe" b6bec0853953bafc210ceeeec5787660_NeikiAnalytics.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
sbietrcl.exedescription pid process target process PID 3176 set thread context of 4920 3176 sbietrcl.exe sbietrcl.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
b6bec0853953bafc210ceeeec5787660_NeikiAnalytics.exesbietrcl.exepid process 2300 b6bec0853953bafc210ceeeec5787660_NeikiAnalytics.exe 2300 b6bec0853953bafc210ceeeec5787660_NeikiAnalytics.exe 2300 b6bec0853953bafc210ceeeec5787660_NeikiAnalytics.exe 2300 b6bec0853953bafc210ceeeec5787660_NeikiAnalytics.exe 2300 b6bec0853953bafc210ceeeec5787660_NeikiAnalytics.exe 2300 b6bec0853953bafc210ceeeec5787660_NeikiAnalytics.exe 3176 sbietrcl.exe 3176 sbietrcl.exe 3176 sbietrcl.exe 3176 sbietrcl.exe 3176 sbietrcl.exe 3176 sbietrcl.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
b6bec0853953bafc210ceeeec5787660_NeikiAnalytics.exesbietrcl.exedescription pid process Token: SeDebugPrivilege 2300 b6bec0853953bafc210ceeeec5787660_NeikiAnalytics.exe Token: SeDebugPrivilege 3176 sbietrcl.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
sbietrcl.exepid process 4920 sbietrcl.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
b6bec0853953bafc210ceeeec5787660_NeikiAnalytics.exesbietrcl.exedescription pid process target process PID 2300 wrote to memory of 3176 2300 b6bec0853953bafc210ceeeec5787660_NeikiAnalytics.exe sbietrcl.exe PID 2300 wrote to memory of 3176 2300 b6bec0853953bafc210ceeeec5787660_NeikiAnalytics.exe sbietrcl.exe PID 2300 wrote to memory of 3176 2300 b6bec0853953bafc210ceeeec5787660_NeikiAnalytics.exe sbietrcl.exe PID 3176 wrote to memory of 4920 3176 sbietrcl.exe sbietrcl.exe PID 3176 wrote to memory of 4920 3176 sbietrcl.exe sbietrcl.exe PID 3176 wrote to memory of 4920 3176 sbietrcl.exe sbietrcl.exe PID 3176 wrote to memory of 4920 3176 sbietrcl.exe sbietrcl.exe PID 3176 wrote to memory of 4920 3176 sbietrcl.exe sbietrcl.exe PID 3176 wrote to memory of 4920 3176 sbietrcl.exe sbietrcl.exe PID 3176 wrote to memory of 4920 3176 sbietrcl.exe sbietrcl.exe PID 3176 wrote to memory of 4920 3176 sbietrcl.exe sbietrcl.exe PID 3176 wrote to memory of 4920 3176 sbietrcl.exe sbietrcl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b6bec0853953bafc210ceeeec5787660_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\b6bec0853953bafc210ceeeec5787660_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4920
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exeFilesize
1.5MB
MD5e39f749934ab92f68f1d9f6c5178f7c4
SHA1595e171a7a684de6a3add8fe99089ffd7334fe6b
SHA256ee858fb5b9296da7f6411d8b57e968d5c7069139ee4cf3da0b05074bef09e0a4
SHA512e47eb395e5a3925b1454f2c4deaa0f0a4c2a62732059cec3765c32f7dd54345522b04aab2f24d44d09f3832eff7e6b7f5f7cc4275b32c928feb38875806832a0
-
memory/2300-0-0x00000000754A2000-0x00000000754A3000-memory.dmpFilesize
4KB
-
memory/2300-1-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/2300-2-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/2300-5-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/2300-6-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/2300-28-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/3176-30-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/3176-29-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/3176-31-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/3176-32-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/3176-44-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/4920-33-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/4920-41-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/4920-42-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/4920-43-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/4920-37-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/4920-38-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/4920-47-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB