General
-
Target
59b45968b36f7b7f53fa3c3119a5b480_NeikiAnalytics.exe
-
Size
1.8MB
-
Sample
240526-dq1zqacg9y
-
MD5
59b45968b36f7b7f53fa3c3119a5b480
-
SHA1
f05e1174215ee2a8d3dac906d9067473bbcad32b
-
SHA256
e0da3a904076b8a628f9888513539fc1613e9dbf0b094a0ffdc2b7d947b1497a
-
SHA512
b716e396702d8f17189b48cd96937ab3c13fc4b99ee1bafaf4da07f31fbbaa0794ace6480240fbc1b0b120981b11ae4c85d6cf803218b520b1b653c8a92316d9
-
SSDEEP
12288:L99Vbpgx4OuE+aCpBPY0PkI686WNUfWO6yuXzT5SPlSGN5A7W2FeDSIGVH/KIDgZ:J1gg4CppEI6GGfWDkIQDbGV6eH81kA
Behavioral task
behavioral1
Sample
59b45968b36f7b7f53fa3c3119a5b480_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
59b45968b36f7b7f53fa3c3119a5b480_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
Malware Config
Targets
-
-
Target
59b45968b36f7b7f53fa3c3119a5b480_NeikiAnalytics.exe
-
Size
1.8MB
-
MD5
59b45968b36f7b7f53fa3c3119a5b480
-
SHA1
f05e1174215ee2a8d3dac906d9067473bbcad32b
-
SHA256
e0da3a904076b8a628f9888513539fc1613e9dbf0b094a0ffdc2b7d947b1497a
-
SHA512
b716e396702d8f17189b48cd96937ab3c13fc4b99ee1bafaf4da07f31fbbaa0794ace6480240fbc1b0b120981b11ae4c85d6cf803218b520b1b653c8a92316d9
-
SSDEEP
12288:L99Vbpgx4OuE+aCpBPY0PkI686WNUfWO6yuXzT5SPlSGN5A7W2FeDSIGVH/KIDgZ:J1gg4CppEI6GGfWDkIQDbGV6eH81kA
Score10/10-
Modifies WinLogon for persistence
-
Modifies visiblity of hidden/system files in Explorer
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload
-
Modifies Installed Components in the registry
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1