General
-
Target
c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe
-
Size
2.9MB
-
Sample
240520-g47afafh6w
-
MD5
c3f343dc0c85c7c69cddda419d8c05d0
-
SHA1
53db2f74bda7d4d384a9642df96bb6a01d5460f2
-
SHA256
e98ebc8c396a0e04671063ae02d112db7cc43360040380f48e49e75d5409d9f8
-
SHA512
0915abc02f12d6d4faf8fb37117079e441dd6cf5a9cc0c540b7fd8b0c49d9f70a333b2471f21121cfa0674cc51b77911710a94031e4859886d74c187793ee76c
-
SSDEEP
24576:7v97AXmZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eHp:7v97AXmw4gxeOw46fUbNecCCFbNec8
Behavioral task
behavioral1
Sample
c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
Malware Config
Targets
-
-
Target
c3f343dc0c85c7c69cddda419d8c05d0_NeikiAnalytics.exe
-
Size
2.9MB
-
MD5
c3f343dc0c85c7c69cddda419d8c05d0
-
SHA1
53db2f74bda7d4d384a9642df96bb6a01d5460f2
-
SHA256
e98ebc8c396a0e04671063ae02d112db7cc43360040380f48e49e75d5409d9f8
-
SHA512
0915abc02f12d6d4faf8fb37117079e441dd6cf5a9cc0c540b7fd8b0c49d9f70a333b2471f21121cfa0674cc51b77911710a94031e4859886d74c187793ee76c
-
SSDEEP
24576:7v97AXmZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eHp:7v97AXmw4gxeOw46fUbNecCCFbNec8
Score10/10-
Modifies WinLogon for persistence
-
Modifies visiblity of hidden/system files in Explorer
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload
-
Modifies Installed Components in the registry
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1