Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
24-05-2024 04:55
General
-
Target
acf4f6436107ff4464c5fbbdaef89230_NeikiAnalytics.exe
-
Size
110KB
-
MD5
acf4f6436107ff4464c5fbbdaef89230
-
SHA1
fe63580d3d51eaccae3eb68636109f71c2ff173d
-
SHA256
18fcc70652f677db73b31574f880a3003f27361df9c4774ce4d0ec0d0852b992
-
SHA512
c7b08183b64ff0e24fdce773114af4744a807e02bf9bb27dc67039b0257b92f8f4b59aeaa7f2b602dc85522aab4eedd2b9ccfd5194bfd6ad5420b23754aa486f
-
SSDEEP
1536:lUYNwcxKHXwzCtmPMVhEP/D1IIiH1br/oWHeLtTJwQzcJKBBFFx0Gmvs9gfgiLVS:lUYicxK8WmPMV4/DOH1brCLtVwQPiBY
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Botnet
Drogo
C2
127.0.0.1:4449
Mutex
Drogo
Attributes
-
delay
1
-
install
true
-
install_file
ColdFusion_2018_WWEJ_win64.exe
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Suspicious use of AdjustPrivilegeToken 41 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\acf4f6436107ff4464c5fbbdaef89230_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\acf4f6436107ff4464c5fbbdaef89230_NeikiAnalytics.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
128KB
-
Filesize
9.9MB
-
Filesize
9.9MB