Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-05-2024 02:41

General

  • Target

    7a3371af26d62dfdad19cc434531ae30_NeikiAnalytics.exe

  • Size

    8.7MB

  • MD5

    7a3371af26d62dfdad19cc434531ae30

  • SHA1

    c0bf27756bf9b8b6164ec41a3029eb931886955a

  • SHA256

    77af1c5d89e5426091051fc29887cce021a4bc4110f94aedc5342cbd5e49c300

  • SHA512

    773a6e66ae40f2a80f142b9621cb1ff0076cb05dcc63c4398a1c5ae60e4fca6f73f2f4882469d4230099ec11eb5bf44c4bbcca2870702f831e8b6b88d54f6f83

  • SSDEEP

    196608:hCbGPZmVfjsCbGPZmVfjiCbGPZmVfjsCbGPZmVfj2CbGPZmVfjsCbGPZmVfjiCbd:0GmVNGmVrGmVNGmVnGmVNGmVrGmVNGmR

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

jjj

C2

youri.mooo.com:1605

Mutex

e936a10f968ac948cd351c9629dbd36d

Attributes
  • reg_key

    e936a10f968ac948cd351c9629dbd36d

  • splitter

    |'|'|

Signatures

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 25 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry class 1 IoCs
  • NTFS ADS 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 58 IoCs
  • Suspicious use of AdjustPrivilegeToken 29 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7a3371af26d62dfdad19cc434531ae30_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\7a3371af26d62dfdad19cc434531ae30_NeikiAnalytics.exe"
    1⤵
    • Adds Run key to start application
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:540
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c start C:\PROGRA~3\7A3371~1.TXT
      2⤵
      • Checks computer location settings
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:3592
      • C:\Windows\SysWOW64\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\PROGRA~3\7a3371af26d62dfdad19cc434531ae30_NeikiAnalytics.exe.txt
        3⤵
          PID:3880
      • C:\ProgramData\winmgr107.exe
        C:\ProgramData\winmgr107.exe
        2⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • NTFS ADS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4444
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
          0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3736
          • C:\Windows\SysWOW64\netsh.exe
            netsh firewall add allowedprogram "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "RegAsm.exe" ENABLE
            4⤵
            • Modifies Windows Firewall
            PID:1620
        • C:\Windows\SysWOW64\schtasks.exe
          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
          3⤵
          • Creates scheduled task(s)
          PID:4372
        • C:\Windows\SysWOW64\schtasks.exe
          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
          3⤵
          • Creates scheduled task(s)
          PID:900
        • C:\Windows\SysWOW64\schtasks.exe
          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
          3⤵
          • Creates scheduled task(s)
          PID:632
        • C:\Windows\SysWOW64\schtasks.exe
          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
          3⤵
          • Creates scheduled task(s)
          PID:2696
        • C:\Windows\SysWOW64\schtasks.exe
          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
          3⤵
          • Creates scheduled task(s)
          PID:2764
        • C:\Windows\SysWOW64\schtasks.exe
          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
          3⤵
          • Creates scheduled task(s)
          PID:1460
        • C:\Windows\SysWOW64\schtasks.exe
          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
          3⤵
          • Creates scheduled task(s)
          PID:3972
        • C:\Windows\SysWOW64\schtasks.exe
          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
          3⤵
          • Creates scheduled task(s)
          PID:3868
        • C:\Windows\SysWOW64\schtasks.exe
          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
          3⤵
          • Creates scheduled task(s)
          PID:3592
        • C:\Windows\SysWOW64\schtasks.exe
          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
          3⤵
          • Creates scheduled task(s)
          PID:2896
        • C:\Windows\SysWOW64\schtasks.exe
          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
          3⤵
          • Creates scheduled task(s)
          PID:728
        • C:\Windows\SysWOW64\schtasks.exe
          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
          3⤵
          • Creates scheduled task(s)
          PID:2112
        • C:\Windows\SysWOW64\schtasks.exe
          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
          3⤵
          • Creates scheduled task(s)
          PID:1644
        • C:\Windows\SysWOW64\schtasks.exe
          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
          3⤵
          • Creates scheduled task(s)
          PID:1392
        • C:\Windows\SysWOW64\schtasks.exe
          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
          3⤵
          • Creates scheduled task(s)
          PID:2492
        • C:\Windows\SysWOW64\schtasks.exe
          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
          3⤵
          • Creates scheduled task(s)
          PID:1436
        • C:\Windows\SysWOW64\schtasks.exe
          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
          3⤵
          • Creates scheduled task(s)
          PID:3624
        • C:\Windows\SysWOW64\schtasks.exe
          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
          3⤵
          • Creates scheduled task(s)
          PID:2016
        • C:\Windows\SysWOW64\schtasks.exe
          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
          3⤵
          • Creates scheduled task(s)
          PID:2368
        • C:\Windows\SysWOW64\schtasks.exe
          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
          3⤵
          • Creates scheduled task(s)
          PID:1896
        • C:\Windows\SysWOW64\schtasks.exe
          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
          3⤵
          • Creates scheduled task(s)
          PID:2496
        • C:\Windows\SysWOW64\schtasks.exe
          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
          3⤵
          • Creates scheduled task(s)
          PID:1184
        • C:\Windows\SysWOW64\schtasks.exe
          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
          3⤵
          • Creates scheduled task(s)
          PID:1644
        • C:\Windows\SysWOW64\schtasks.exe
          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
          3⤵
          • Creates scheduled task(s)
          PID:3480
        • C:\Windows\SysWOW64\schtasks.exe
          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
          3⤵
          • Creates scheduled task(s)
          PID:2388
    • C:\ProgramData\winmgr107.exe
      C:\ProgramData\winmgr107.exe
      1⤵
      • Executes dropped EXE
      • NTFS ADS
      • Suspicious behavior: EnumeratesProcesses
      PID:100
    • C:\ProgramData\winmgr107.exe
      C:\ProgramData\winmgr107.exe
      1⤵
      • Executes dropped EXE
      • NTFS ADS
      • Suspicious behavior: EnumeratesProcesses
      PID:2156

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\PROGRA~3\7a3371af26d62dfdad19cc434531ae30_NeikiAnalytics.exe.txt

      Filesize

      992B

      MD5

      c8cf7247d4cfc99a7582a42d13df4c08

      SHA1

      317f5588af0b3b6374c436fb00084c522fd78a83

      SHA256

      78bd99781e971622f1573bccf2ae9cdd7a7498cf81c1875afc65913e1083b1d0

      SHA512

      5dd86b7ba388e5d2ad61b1c69589f42c36eec23a04b3cece0941133e0cf0e8a6f1f3aa2242d87af72db725b4b96032dadae72b3be98af3cfce5786ad8c08c357

    • C:\ProgramData\winmgr107.exe

      Filesize

      8.7MB

      MD5

      d1d2571c16a979f1faa143c5dbd02a04

      SHA1

      e2b0d6b05675cd9b7969ec5f4f60961451bd612d

      SHA256

      608d58a53408f7e333a86298bc64ddab87df383edda54b4cecb2dc13fd22f282

      SHA512

      9bb9f9aedc63940b42eb4c3bf062a0d7b73d9780e6e720fa46bcd8580d6b01318b6318f92136fe791dbad2f33d5ecd0f7d28c3b3d4453d0257364daa2d65ad70

    • C:\Users\Admin\AppData\Local\Temp\7a3371af26d62dfdad19cc434531ae30_NeikiAnalytics.exe

      Filesize

      8.7MB

      MD5

      7a3371af26d62dfdad19cc434531ae30

      SHA1

      c0bf27756bf9b8b6164ec41a3029eb931886955a

      SHA256

      77af1c5d89e5426091051fc29887cce021a4bc4110f94aedc5342cbd5e49c300

      SHA512

      773a6e66ae40f2a80f142b9621cb1ff0076cb05dcc63c4398a1c5ae60e4fca6f73f2f4882469d4230099ec11eb5bf44c4bbcca2870702f831e8b6b88d54f6f83

    • memory/3736-15-0x00000000009D0000-0x00000000009DC000-memory.dmp

      Filesize

      48KB