Analysis
-
max time kernel
150s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 06:52
Behavioral task
behavioral1
Sample
8c07110e7456b184a2009199f5adba90_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
8c07110e7456b184a2009199f5adba90_NeikiAnalytics.exe
-
Size
74KB
-
MD5
8c07110e7456b184a2009199f5adba90
-
SHA1
c30e8f19d3eddf941e2b622dc0a211c46211f9b2
-
SHA256
9d879d5db065bb5f76079a4b9fbbb5d0b4ebb66a1a0f58666e2795564c884108
-
SHA512
83ea5dd5eeab6680fc90b79f83e6e11d861511efd4332be42992ddb7f2887641ef0410607fb7afe1726698adb0968a256b29be0b3f441d2521dac81c93d85e23
-
SSDEEP
1536:jUyccxAYZCV6PMVTfxreL2+I6H1b+93oW7Qzc+LVclN:jUjcxAS66PMVdhyH1b+hoW7QXBY
Malware Config
Extracted
asyncrat
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Default
146.70.34.130:7812
teeh
-
delay
1
-
install
true
-
install_file
Windows Defender Security Service.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\Windows Defender Security Service.exe family_asyncrat -
Executes dropped EXE 1 IoCs
Processes:
Windows Defender Security Service.exepid process 2576 Windows Defender Security Service.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 2592 timeout.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
8c07110e7456b184a2009199f5adba90_NeikiAnalytics.exeWindows Defender Security Service.exepid process 1832 8c07110e7456b184a2009199f5adba90_NeikiAnalytics.exe 1832 8c07110e7456b184a2009199f5adba90_NeikiAnalytics.exe 1832 8c07110e7456b184a2009199f5adba90_NeikiAnalytics.exe 2576 Windows Defender Security Service.exe 2576 Windows Defender Security Service.exe 2576 Windows Defender Security Service.exe 2576 Windows Defender Security Service.exe 2576 Windows Defender Security Service.exe 2576 Windows Defender Security Service.exe 2576 Windows Defender Security Service.exe 2576 Windows Defender Security Service.exe 2576 Windows Defender Security Service.exe 2576 Windows Defender Security Service.exe 2576 Windows Defender Security Service.exe 2576 Windows Defender Security Service.exe 2576 Windows Defender Security Service.exe 2576 Windows Defender Security Service.exe 2576 Windows Defender Security Service.exe 2576 Windows Defender Security Service.exe 2576 Windows Defender Security Service.exe 2576 Windows Defender Security Service.exe 2576 Windows Defender Security Service.exe 2576 Windows Defender Security Service.exe 2576 Windows Defender Security Service.exe 2576 Windows Defender Security Service.exe 2576 Windows Defender Security Service.exe 2576 Windows Defender Security Service.exe 2576 Windows Defender Security Service.exe 2576 Windows Defender Security Service.exe 2576 Windows Defender Security Service.exe 2576 Windows Defender Security Service.exe 2576 Windows Defender Security Service.exe 2576 Windows Defender Security Service.exe 2576 Windows Defender Security Service.exe 2576 Windows Defender Security Service.exe 2576 Windows Defender Security Service.exe 2576 Windows Defender Security Service.exe 2576 Windows Defender Security Service.exe 2576 Windows Defender Security Service.exe 2576 Windows Defender Security Service.exe 2576 Windows Defender Security Service.exe 2576 Windows Defender Security Service.exe 2576 Windows Defender Security Service.exe 2576 Windows Defender Security Service.exe 2576 Windows Defender Security Service.exe 2576 Windows Defender Security Service.exe 2576 Windows Defender Security Service.exe 2576 Windows Defender Security Service.exe 2576 Windows Defender Security Service.exe 2576 Windows Defender Security Service.exe 2576 Windows Defender Security Service.exe 2576 Windows Defender Security Service.exe 2576 Windows Defender Security Service.exe 2576 Windows Defender Security Service.exe 2576 Windows Defender Security Service.exe 2576 Windows Defender Security Service.exe 2576 Windows Defender Security Service.exe 2576 Windows Defender Security Service.exe 2576 Windows Defender Security Service.exe 2576 Windows Defender Security Service.exe 2576 Windows Defender Security Service.exe 2576 Windows Defender Security Service.exe 2576 Windows Defender Security Service.exe 2576 Windows Defender Security Service.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
8c07110e7456b184a2009199f5adba90_NeikiAnalytics.exeWindows Defender Security Service.exedescription pid process Token: SeDebugPrivilege 1832 8c07110e7456b184a2009199f5adba90_NeikiAnalytics.exe Token: SeDebugPrivilege 1832 8c07110e7456b184a2009199f5adba90_NeikiAnalytics.exe Token: SeDebugPrivilege 2576 Windows Defender Security Service.exe Token: SeDebugPrivilege 2576 Windows Defender Security Service.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Windows Defender Security Service.exepid process 2576 Windows Defender Security Service.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
8c07110e7456b184a2009199f5adba90_NeikiAnalytics.execmd.execmd.exedescription pid process target process PID 1832 wrote to memory of 1964 1832 8c07110e7456b184a2009199f5adba90_NeikiAnalytics.exe cmd.exe PID 1832 wrote to memory of 1964 1832 8c07110e7456b184a2009199f5adba90_NeikiAnalytics.exe cmd.exe PID 1832 wrote to memory of 1964 1832 8c07110e7456b184a2009199f5adba90_NeikiAnalytics.exe cmd.exe PID 1832 wrote to memory of 2616 1832 8c07110e7456b184a2009199f5adba90_NeikiAnalytics.exe cmd.exe PID 1832 wrote to memory of 2616 1832 8c07110e7456b184a2009199f5adba90_NeikiAnalytics.exe cmd.exe PID 1832 wrote to memory of 2616 1832 8c07110e7456b184a2009199f5adba90_NeikiAnalytics.exe cmd.exe PID 1964 wrote to memory of 2584 1964 cmd.exe schtasks.exe PID 1964 wrote to memory of 2584 1964 cmd.exe schtasks.exe PID 1964 wrote to memory of 2584 1964 cmd.exe schtasks.exe PID 2616 wrote to memory of 2592 2616 cmd.exe timeout.exe PID 2616 wrote to memory of 2592 2616 cmd.exe timeout.exe PID 2616 wrote to memory of 2592 2616 cmd.exe timeout.exe PID 2616 wrote to memory of 2576 2616 cmd.exe Windows Defender Security Service.exe PID 2616 wrote to memory of 2576 2616 cmd.exe Windows Defender Security Service.exe PID 2616 wrote to memory of 2576 2616 cmd.exe Windows Defender Security Service.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\8c07110e7456b184a2009199f5adba90_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\8c07110e7456b184a2009199f5adba90_NeikiAnalytics.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Windows Defender Security Service" /tr '"C:\Users\Admin\AppData\Roaming\Windows Defender Security Service.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "Windows Defender Security Service" /tr '"C:\Users\Admin\AppData\Roaming\Windows Defender Security Service.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp2A3C.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\Windows Defender Security Service.exe"C:\Users\Admin\AppData\Roaming\Windows Defender Security Service.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp2A3C.tmp.batFilesize
177B
MD5bafadd9b7263bcc1bf61146d515675ca
SHA10fa011dc4f4b4d1707952812a38dc30272ea6f95
SHA256774be4d9d9a3648acbe843fbb9267855fd1a55845b962b5abade5333a4a380c2
SHA512a04bebe4ea9c6a1d51fdd9d23b6e13fe464438bc9313028d3cf938349d628a58064cbd85e0b8566f435704e83087f2dc731ba5908dcb1b340aac4592005bf6e0
-
C:\Users\Admin\AppData\Roaming\MyData\DataLogs.confFilesize
8B
MD5cf759e4c5f14fe3eec41b87ed756cea8
SHA1c27c796bb3c2fac929359563676f4ba1ffada1f5
SHA256c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761
SHA512c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b
-
C:\Users\Admin\AppData\Roaming\Windows Defender Security Service.exeFilesize
74KB
MD58c07110e7456b184a2009199f5adba90
SHA1c30e8f19d3eddf941e2b622dc0a211c46211f9b2
SHA2569d879d5db065bb5f76079a4b9fbbb5d0b4ebb66a1a0f58666e2795564c884108
SHA51283ea5dd5eeab6680fc90b79f83e6e11d861511efd4332be42992ddb7f2887641ef0410607fb7afe1726698adb0968a256b29be0b3f441d2521dac81c93d85e23
-
memory/1832-0-0x000007FEF5B73000-0x000007FEF5B74000-memory.dmpFilesize
4KB
-
memory/1832-1-0x0000000001220000-0x0000000001238000-memory.dmpFilesize
96KB
-
memory/1832-3-0x000007FEF5B70000-0x000007FEF655C000-memory.dmpFilesize
9.9MB
-
memory/1832-11-0x000007FEF5B70000-0x000007FEF655C000-memory.dmpFilesize
9.9MB
-
memory/1832-13-0x000007FEF5B70000-0x000007FEF655C000-memory.dmpFilesize
9.9MB
-
memory/2576-18-0x0000000000260000-0x0000000000278000-memory.dmpFilesize
96KB