Overview
overview
10Static
static
3c5568321b4...cs.exe
windows7-x64
10c5568321b4...cs.exe
windows10-2004-x64
10$PLUGINSDI...er.dll
windows7-x64
1$PLUGINSDI...er.dll
windows10-2004-x64
1$PLUGINSDI...ge.dll
windows7-x64
1$PLUGINSDI...ge.dll
windows10-2004-x64
1$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3Milieubesk...rs.com
windows7-x64
Milieubesk...rs.com
windows10-2004-x64
Sabbatters.app
macos-10.15-amd64
1Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 15:20
Static task
static1
Behavioral task
behavioral1
Sample
c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/Banner.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/Banner.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/BgImage.dll
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/BgImage.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
Milieubeskyttelseskonventioners.com
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
Milieubeskyttelseskonventioners.com
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
Sabbatters.app
Resource
macos-20240410-en
General
-
Target
c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exe
-
Size
349KB
-
MD5
c5568321b40f1d51afac49234d2de480
-
SHA1
c5169e1d05419bb698b86704ae8f3cbe7011d42e
-
SHA256
560b3bba2f6d3e74b1901904c7ea9e7c61f94c754e648cb6503abaa233d7c485
-
SHA512
f15d0141a89e1a6d89b030d10f2e7e60efbf5d2b21a905335f6ba79de8908796bfd4df928f398e984e06a86d3023cde783690843871f222432677dd5a848674e
-
SSDEEP
6144:wQ606xhLK0o+/zqdPCb3m2aOmjpygIb20PM+Drhvnv/6:wK0bqdM2EVbv3hvnH6
Malware Config
Extracted
remcos
CLIENT
107.150.18.202:2404
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-J3QQTH
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
NirSoft MailPassView 3 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral1/memory/1168-75-0x0000000000400000-0x0000000000462000-memory.dmp MailPassView behavioral1/memory/1168-72-0x0000000000400000-0x0000000000462000-memory.dmp MailPassView behavioral1/memory/1168-87-0x0000000000400000-0x0000000000462000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 2 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral1/memory/576-70-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView behavioral1/memory/576-83-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView -
Nirsoft 8 IoCs
Processes:
resource yara_rule behavioral1/memory/1648-74-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral1/memory/1648-77-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral1/memory/1648-76-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral1/memory/1168-75-0x0000000000400000-0x0000000000462000-memory.dmp Nirsoft behavioral1/memory/1168-72-0x0000000000400000-0x0000000000462000-memory.dmp Nirsoft behavioral1/memory/576-70-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral1/memory/576-83-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral1/memory/1168-87-0x0000000000400000-0x0000000000462000-memory.dmp Nirsoft -
Loads dropped DLL 3 IoCs
Processes:
c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exepid process 2064 c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exe 2064 c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exe 2064 c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Jansenize = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Hydrometeorological\\Fedayeen.exe" c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes:
c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exepid process 2624 c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exec5568321b40f1d51afac49234d2de480_NeikiAnalytics.exepid process 2064 c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exe 2624 c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exec5568321b40f1d51afac49234d2de480_NeikiAnalytics.exedescription pid process target process PID 2064 set thread context of 2624 2064 c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exe c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exe PID 2624 set thread context of 576 2624 c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exe c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exe PID 2624 set thread context of 1168 2624 c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exe c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exe PID 2624 set thread context of 1648 2624 c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exe c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exepid process 576 c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exe 576 c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exe -
Suspicious behavior: MapViewOfSection 4 IoCs
Processes:
c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exec5568321b40f1d51afac49234d2de480_NeikiAnalytics.exepid process 2064 c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exe 2624 c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exe 2624 c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exe 2624 c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exedescription pid process Token: SeDebugPrivilege 1648 c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exec5568321b40f1d51afac49234d2de480_NeikiAnalytics.exedescription pid process target process PID 2064 wrote to memory of 2624 2064 c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exe c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exe PID 2064 wrote to memory of 2624 2064 c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exe c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exe PID 2064 wrote to memory of 2624 2064 c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exe c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exe PID 2064 wrote to memory of 2624 2064 c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exe c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exe PID 2064 wrote to memory of 2624 2064 c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exe c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exe PID 2064 wrote to memory of 2624 2064 c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exe c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exe PID 2624 wrote to memory of 576 2624 c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exe c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exe PID 2624 wrote to memory of 576 2624 c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exe c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exe PID 2624 wrote to memory of 576 2624 c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exe c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exe PID 2624 wrote to memory of 576 2624 c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exe c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exe PID 2624 wrote to memory of 1168 2624 c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exe c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exe PID 2624 wrote to memory of 1168 2624 c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exe c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exe PID 2624 wrote to memory of 1168 2624 c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exe c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exe PID 2624 wrote to memory of 1168 2624 c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exe c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exe PID 2624 wrote to memory of 1648 2624 c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exe c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exe PID 2624 wrote to memory of 1648 2624 c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exe c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exe PID 2624 wrote to memory of 1648 2624 c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exe c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exe PID 2624 wrote to memory of 1648 2624 c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exe c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exe"2⤵
- Adds Run key to start application
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exe /stext "C:\Users\Admin\AppData\Local\Temp\sukdrulxoiakgejkcox"3⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exe /stext "C:\Users\Admin\AppData\Local\Temp\dwpvjnwrcqspqsfwlzkttg"3⤵
- Accesses Microsoft Outlook accounts
-
C:\Users\Admin\AppData\Local\Temp\c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exe /stext "C:\Users\Admin\AppData\Local\Temp\fqugkfgtyykctytadjfvetogj"3⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\App.iniFilesize
77B
MD5b6426bec11f84c1f71550c69d67350af
SHA1d176738b6178b6808fcc776012b7a9173a7238ae
SHA25655e72cf4659db890eb479be4af56d891d73c877b7588ddfd475393990177fef1
SHA51238180b8da332ec9202c25c9e0b3c528af6227de68ad46b9bdb00289fd1fcd5eb11aca88969f83a1761c2b6beb96262b3a9e2f08fbbce0b4efe7fd3a7ac16730a
-
C:\Users\Admin\AppData\Local\Temp\sukdrulxoiakgejkcoxFilesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\Krydsrevisionernes.lnkFilesize
890B
MD5d3bc8c76f5bff73aec6293ca6c6e9ab1
SHA12b5e17ec0f2190aeb50e80644357aee1c219daa5
SHA256c6aa00bf0e9f89d5d6a5b3294a50b1c23f8645b6581f7884f58b80db783fc9c7
SHA51293e0ff770b74c924be8e4724c18059f47b77a6f20fc07b9ef3902cb183ab3fd31467bf76b57e05f908e160bfe4e1ecc95d3b8c11d3173371f975399c75fc86ae
-
\Users\Admin\AppData\Local\Temp\nso2E81.tmp\BgImage.dllFilesize
7KB
MD59436196007f65f0ae96f64b1c8b2572e
SHA14b004b5c2865c9450876be83faa8cc96e1d12c01
SHA256286f246ee18bf91c4a80fa2cdb61077a4bcf0a3fd6582be4b4ab6a5cb3de44c9
SHA5125c172675fbbea214471ac35eebaa6ab9bd1306268144085adbad3bba4a815430ed028cac169e8b5a6fd00818684f65d7bdd32f11773bc6152e62ef80f895d35e
-
\Users\Admin\AppData\Local\Temp\nso2E81.tmp\System.dllFilesize
11KB
MD58b3830b9dbf87f84ddd3b26645fed3a0
SHA1223bef1f19e644a610a0877d01eadc9e28299509
SHA256f004c568d305cd95edbd704166fcd2849d395b595dff814bcc2012693527ac37
SHA512d13cfd98db5ca8dc9c15723eee0e7454975078a776bce26247228be4603a0217e166058ebadc68090afe988862b7514cb8cb84de13b3de35737412a6f0a8ac03
-
\Users\Admin\AppData\Local\Temp\nso2E81.tmp\nsDialogs.dllFilesize
9KB
MD582c3f38cd34739872af07443c65d0bd8
SHA11f4ee2d394404a291eda6419f856adaf4b960237
SHA25659cdb2c12d5635fd25af4007b70222507948be41fa9885b7f07967c2510a5311
SHA5123a81c0613b1ea906ad4f103b02620217de69a8676dbb7ec41cf31f342a0a74562815a8d4f2efe9866fc16365f58524ac71652e99920acea355f020028775743d
-
memory/576-65-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/576-83-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/576-66-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/576-70-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/576-63-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/576-67-0x00000000776A0000-0x0000000077849000-memory.dmpFilesize
1.7MB
-
memory/1168-69-0x0000000000400000-0x0000000000462000-memory.dmpFilesize
392KB
-
memory/1168-72-0x0000000000400000-0x0000000000462000-memory.dmpFilesize
392KB
-
memory/1168-75-0x0000000000400000-0x0000000000462000-memory.dmpFilesize
392KB
-
memory/1168-68-0x0000000000400000-0x0000000000462000-memory.dmpFilesize
392KB
-
memory/1168-87-0x0000000000400000-0x0000000000462000-memory.dmpFilesize
392KB
-
memory/1648-76-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/1648-74-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/1648-73-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/1648-71-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/1648-77-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2064-49-0x00000000776A0000-0x0000000077849000-memory.dmpFilesize
1.7MB
-
memory/2064-48-0x00000000776A1000-0x00000000777A2000-memory.dmpFilesize
1.0MB
-
memory/2624-86-0x0000000000470000-0x00000000014D2000-memory.dmpFilesize
16.4MB
-
memory/2624-93-0x0000000036F00000-0x0000000036F19000-memory.dmpFilesize
100KB
-
memory/2624-50-0x00000000776A0000-0x0000000077849000-memory.dmpFilesize
1.7MB
-
memory/2624-56-0x0000000000470000-0x00000000014D2000-memory.dmpFilesize
16.4MB
-
memory/2624-60-0x0000000000470000-0x00000000014D2000-memory.dmpFilesize
16.4MB
-
memory/2624-62-0x0000000000470000-0x00000000014D2000-memory.dmpFilesize
16.4MB
-
memory/2624-92-0x0000000036F00000-0x0000000036F19000-memory.dmpFilesize
100KB
-
memory/2624-52-0x0000000000470000-0x00000000014D2000-memory.dmpFilesize
16.4MB
-
memory/2624-89-0x0000000036F00000-0x0000000036F19000-memory.dmpFilesize
100KB
-
memory/2624-94-0x0000000000470000-0x00000000014D2000-memory.dmpFilesize
16.4MB
-
memory/2624-95-0x0000000000470000-0x00000000014D2000-memory.dmpFilesize
16.4MB
-
memory/2624-96-0x0000000000470000-0x00000000014D2000-memory.dmpFilesize
16.4MB
-
memory/2624-97-0x0000000000470000-0x00000000014D2000-memory.dmpFilesize
16.4MB
-
memory/2624-98-0x0000000000470000-0x00000000014D2000-memory.dmpFilesize
16.4MB
-
memory/2624-99-0x0000000000470000-0x00000000014D2000-memory.dmpFilesize
16.4MB