njrat | d0b9c0c214261e1f03a95cd1e05451f7bb941a49fb8c2e0adeb05a2bcdf03038

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27-05-2024 09:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

07c47805c339555d52edc76e27515720_NeikiAnalytics.exe
Size

8.7MB
MD5

07c47805c339555d52edc76e27515720
SHA1

f44cbceeabe49ae6de56d8b57b763ab2b12cf0ed
SHA256

d0b9c0c214261e1f03a95cd1e05451f7bb941a49fb8c2e0adeb05a2bcdf03038
SHA512

a250d59944f2a460f96ba600602bcf23a53c0d8495e94355b2489825f81d7c481a29b490ca53691ecbbf0eb9a4b736b1586496120c75c4a18642338137031f9f
SSDEEP

196608:hCbGPZmVfjsCbGPZmVfjiCbGPZmVfjsCbGPZmVfj2CbGPZmVfjsCbGPZmVfjiCbj:0GmVNGmVrGmVNGmVnGmVNGmVrGmVNGmf

Score

10^/10

njrat jjj evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

jjj

youri.mooo.com:1605

Mutex

e936a10f968ac948cd351c9629dbd36d

Attributes

reg_key
e936a10f968ac948cd351c9629dbd36d
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

1692 netsh.exe
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

cmd.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation cmd.exe
Executes dropped EXE 1 IoCs

Processes:

winmgr107.exe

pid process

1624 winmgr107.exe

pid	process
1692	netsh.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	cmd.exe

pid	process
1624	winmgr107.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

07c47805c339555d52edc76e27515720_NeikiAnalytics.exewinmgr107.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2 = "C:\\ProgramData\\winmgr107.exe"	07c47805c339555d52edc76e27515720_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2 = "C:\\ProgramData\\winmgr107.exe"	winmgr107.exe

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
C:\ProgramData\winmgr107.exe	autoit_exe
C:\Users\Admin\AppData\Local\Temp\07c47805c339555d52edc76e27515720_NeikiAnalytics.exe	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

winmgr107.exe

description pid process target process

PID 1624 set thread context of 4472 1624 winmgr107.exe RegAsm.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	pid	process	target process
PID 1624 set thread context of 4472	1624	winmgr107.exe	RegAsm.exe

Creates scheduled task(s) 1 TTPs 22 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
1432	schtasks.exe
1576	schtasks.exe
3804	schtasks.exe
4132	schtasks.exe
2028	schtasks.exe
4820	schtasks.exe
4752	schtasks.exe
868	schtasks.exe
4960	schtasks.exe
5112	schtasks.exe
3520	schtasks.exe
1204	schtasks.exe
500	schtasks.exe
1740	schtasks.exe
2176	schtasks.exe
4948	schtasks.exe
1308	schtasks.exe
2556	schtasks.exe
2420	schtasks.exe
644	schtasks.exe
2972	schtasks.exe
3888	schtasks.exe

Modifies registry class 1 IoCs

Processes:

cmd.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings cmd.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	cmd.exe

NTFS ADS 2 IoCs

Processes:

07c47805c339555d52edc76e27515720_NeikiAnalytics.exewinmgr107.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Temp\07c47805c339555d52edc76e27515720_NeikiAnalytics.exe:Zone.Identifier:$DATA	07c47805c339555d52edc76e27515720_NeikiAnalytics.exe
File created	C:\ProgramData\winmgr107.exe:Zone.Identifier:$DATA	winmgr107.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

Processes:

07c47805c339555d52edc76e27515720_NeikiAnalytics.exewinmgr107.exe

pid	process
3352	07c47805c339555d52edc76e27515720_NeikiAnalytics.exe
3352	07c47805c339555d52edc76e27515720_NeikiAnalytics.exe
1624	winmgr107.exe
1624	winmgr107.exe
1624	winmgr107.exe
1624	winmgr107.exe
1624	winmgr107.exe
1624	winmgr107.exe
1624	winmgr107.exe
1624	winmgr107.exe
1624	winmgr107.exe
1624	winmgr107.exe
1624	winmgr107.exe
1624	winmgr107.exe
1624	winmgr107.exe
1624	winmgr107.exe
1624	winmgr107.exe
1624	winmgr107.exe
1624	winmgr107.exe
1624	winmgr107.exe
1624	winmgr107.exe
1624	winmgr107.exe
1624	winmgr107.exe
1624	winmgr107.exe
1624	winmgr107.exe
1624	winmgr107.exe
1624	winmgr107.exe
1624	winmgr107.exe
1624	winmgr107.exe
1624	winmgr107.exe
1624	winmgr107.exe
1624	winmgr107.exe
1624	winmgr107.exe
1624	winmgr107.exe
1624	winmgr107.exe
1624	winmgr107.exe
1624	winmgr107.exe
1624	winmgr107.exe
1624	winmgr107.exe
1624	winmgr107.exe
1624	winmgr107.exe
1624	winmgr107.exe
1624	winmgr107.exe
1624	winmgr107.exe
1624	winmgr107.exe
1624	winmgr107.exe
1624	winmgr107.exe
1624	winmgr107.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

Processes:

RegAsm.exe

description	pid	process
Token: SeDebugPrivilege	4472	RegAsm.exe
Token: 33	4472	RegAsm.exe
Token: SeIncBasePriorityPrivilege	4472	RegAsm.exe
Token: 33	4472	RegAsm.exe
Token: SeIncBasePriorityPrivilege	4472	RegAsm.exe
Token: 33	4472	RegAsm.exe
Token: SeIncBasePriorityPrivilege	4472	RegAsm.exe
Token: 33	4472	RegAsm.exe
Token: SeIncBasePriorityPrivilege	4472	RegAsm.exe
Token: 33	4472	RegAsm.exe
Token: SeIncBasePriorityPrivilege	4472	RegAsm.exe
Token: 33	4472	RegAsm.exe
Token: SeIncBasePriorityPrivilege	4472	RegAsm.exe
Token: 33	4472	RegAsm.exe
Token: SeIncBasePriorityPrivilege	4472	RegAsm.exe
Token: 33	4472	RegAsm.exe
Token: SeIncBasePriorityPrivilege	4472	RegAsm.exe
Token: 33	4472	RegAsm.exe
Token: SeIncBasePriorityPrivilege	4472	RegAsm.exe
Token: 33	4472	RegAsm.exe
Token: SeIncBasePriorityPrivilege	4472	RegAsm.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

07c47805c339555d52edc76e27515720_NeikiAnalytics.execmd.exewinmgr107.exeRegAsm.exe

description	pid	process	target process
PID 3352 wrote to memory of 3024	3352	07c47805c339555d52edc76e27515720_NeikiAnalytics.exe	cmd.exe
PID 3352 wrote to memory of 3024	3352	07c47805c339555d52edc76e27515720_NeikiAnalytics.exe	cmd.exe
PID 3352 wrote to memory of 3024	3352	07c47805c339555d52edc76e27515720_NeikiAnalytics.exe	cmd.exe
PID 3352 wrote to memory of 1624	3352	07c47805c339555d52edc76e27515720_NeikiAnalytics.exe	winmgr107.exe
PID 3352 wrote to memory of 1624	3352	07c47805c339555d52edc76e27515720_NeikiAnalytics.exe	winmgr107.exe
PID 3352 wrote to memory of 1624	3352	07c47805c339555d52edc76e27515720_NeikiAnalytics.exe	winmgr107.exe
PID 3024 wrote to memory of 2552	3024	cmd.exe	NOTEPAD.EXE
PID 3024 wrote to memory of 2552	3024	cmd.exe	NOTEPAD.EXE
PID 3024 wrote to memory of 2552	3024	cmd.exe	NOTEPAD.EXE
PID 1624 wrote to memory of 4472	1624	winmgr107.exe	RegAsm.exe
PID 1624 wrote to memory of 4472	1624	winmgr107.exe	RegAsm.exe
PID 1624 wrote to memory of 4472	1624	winmgr107.exe	RegAsm.exe
PID 1624 wrote to memory of 4472	1624	winmgr107.exe	RegAsm.exe
PID 1624 wrote to memory of 4472	1624	winmgr107.exe	RegAsm.exe
PID 1624 wrote to memory of 2028	1624	winmgr107.exe	schtasks.exe
PID 1624 wrote to memory of 2028	1624	winmgr107.exe	schtasks.exe
PID 1624 wrote to memory of 2028	1624	winmgr107.exe	schtasks.exe
PID 1624 wrote to memory of 4820	1624	winmgr107.exe	schtasks.exe
PID 1624 wrote to memory of 4820	1624	winmgr107.exe	schtasks.exe
PID 1624 wrote to memory of 4820	1624	winmgr107.exe	schtasks.exe
PID 1624 wrote to memory of 644	1624	winmgr107.exe	schtasks.exe
PID 1624 wrote to memory of 644	1624	winmgr107.exe	schtasks.exe
PID 1624 wrote to memory of 644	1624	winmgr107.exe	schtasks.exe
PID 1624 wrote to memory of 1432	1624	winmgr107.exe	schtasks.exe
PID 1624 wrote to memory of 1432	1624	winmgr107.exe	schtasks.exe
PID 1624 wrote to memory of 1432	1624	winmgr107.exe	schtasks.exe
PID 4472 wrote to memory of 1692	4472	RegAsm.exe	netsh.exe
PID 4472 wrote to memory of 1692	4472	RegAsm.exe	netsh.exe
PID 4472 wrote to memory of 1692	4472	RegAsm.exe	netsh.exe
PID 1624 wrote to memory of 500	1624	winmgr107.exe	schtasks.exe
PID 1624 wrote to memory of 500	1624	winmgr107.exe	schtasks.exe
PID 1624 wrote to memory of 500	1624	winmgr107.exe	schtasks.exe
PID 1624 wrote to memory of 1740	1624	winmgr107.exe	schtasks.exe
PID 1624 wrote to memory of 1740	1624	winmgr107.exe	schtasks.exe
PID 1624 wrote to memory of 1740	1624	winmgr107.exe	schtasks.exe
PID 1624 wrote to memory of 4752	1624	winmgr107.exe	schtasks.exe
PID 1624 wrote to memory of 4752	1624	winmgr107.exe	schtasks.exe
PID 1624 wrote to memory of 4752	1624	winmgr107.exe	schtasks.exe
PID 1624 wrote to memory of 2176	1624	winmgr107.exe	schtasks.exe
PID 1624 wrote to memory of 2176	1624	winmgr107.exe	schtasks.exe
PID 1624 wrote to memory of 2176	1624	winmgr107.exe	schtasks.exe
PID 1624 wrote to memory of 4948	1624	winmgr107.exe	schtasks.exe
PID 1624 wrote to memory of 4948	1624	winmgr107.exe	schtasks.exe
PID 1624 wrote to memory of 4948	1624	winmgr107.exe	schtasks.exe
PID 1624 wrote to memory of 1308	1624	winmgr107.exe	schtasks.exe
PID 1624 wrote to memory of 1308	1624	winmgr107.exe	schtasks.exe
PID 1624 wrote to memory of 1308	1624	winmgr107.exe	schtasks.exe
PID 1624 wrote to memory of 2556	1624	winmgr107.exe	schtasks.exe
PID 1624 wrote to memory of 2556	1624	winmgr107.exe	schtasks.exe
PID 1624 wrote to memory of 2556	1624	winmgr107.exe	schtasks.exe
PID 1624 wrote to memory of 868	1624	winmgr107.exe	schtasks.exe
PID 1624 wrote to memory of 868	1624	winmgr107.exe	schtasks.exe
PID 1624 wrote to memory of 868	1624	winmgr107.exe	schtasks.exe
PID 1624 wrote to memory of 4960	1624	winmgr107.exe	schtasks.exe
PID 1624 wrote to memory of 4960	1624	winmgr107.exe	schtasks.exe
PID 1624 wrote to memory of 4960	1624	winmgr107.exe	schtasks.exe
PID 1624 wrote to memory of 5112	1624	winmgr107.exe	schtasks.exe
PID 1624 wrote to memory of 5112	1624	winmgr107.exe	schtasks.exe
PID 1624 wrote to memory of 5112	1624	winmgr107.exe	schtasks.exe
PID 1624 wrote to memory of 2972	1624	winmgr107.exe	schtasks.exe
PID 1624 wrote to memory of 2972	1624	winmgr107.exe	schtasks.exe
PID 1624 wrote to memory of 2972	1624	winmgr107.exe	schtasks.exe
PID 1624 wrote to memory of 1576	1624	winmgr107.exe	schtasks.exe
PID 1624 wrote to memory of 1576	1624	winmgr107.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\07c47805c339555d52edc76e27515720_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\07c47805c339555d52edc76e27515720_NeikiAnalytics.exe"
1⤵
- Adds Run key to start application
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3352
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start C:\PROGRA~3\07C478~1.TXT
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3024
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\PROGRA~3\07c47805c339555d52edc76e27515720_NeikiAnalytics.exe.txt
    3⤵
    PID:2552
- C:\ProgramData\winmgr107.exe
  C:\ProgramData\winmgr107.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1624
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
    0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4472
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "RegAsm.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      PID:1692
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:2028
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:4820
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:644
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:1432
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:500
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:1740
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:4752
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:2176
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:4948
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:1308
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:2556
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:868
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:4960
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:5112
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:2972
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:1576
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:3520
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:3888
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:3804
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:4132
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:1204
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:2420

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4072 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:8
1⤵
PID:2416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\07c47805c339555d52edc76e27515720_NeikiAnalytics.exe.txt

Filesize
992B

MD5
c8cf7247d4cfc99a7582a42d13df4c08

SHA1
317f5588af0b3b6374c436fb00084c522fd78a83

SHA256
78bd99781e971622f1573bccf2ae9cdd7a7498cf81c1875afc65913e1083b1d0

SHA512
5dd86b7ba388e5d2ad61b1c69589f42c36eec23a04b3cece0941133e0cf0e8a6f1f3aa2242d87af72db725b4b96032dadae72b3be98af3cfce5786ad8c08c357

Download Submit
C:\ProgramData\winmgr107.exe

Filesize
8.7MB

MD5
977978cea2ed01bef324e54db27b0fcc

SHA1
56b145262e7f02b2de40a205aee8f20cca01598c

SHA256
32968fd1e28ab1b5a5c112e5d0e4ca818323d4bd6bf5f3e4f2cdb52de0802957

SHA512
d5b1f7d8c8a249b1d6c25445e9478a76d774cdfa0581d6051c033a6026e292becac895c443c4296cc85c364b07850f129e79082c8498ebe5296788cea30e5ef3

Download Submit
C:\Users\Admin\AppData\Local\Temp\07c47805c339555d52edc76e27515720_NeikiAnalytics.exe

Filesize
8.7MB

MD5
07c47805c339555d52edc76e27515720

SHA1
f44cbceeabe49ae6de56d8b57b763ab2b12cf0ed

SHA256
d0b9c0c214261e1f03a95cd1e05451f7bb941a49fb8c2e0adeb05a2bcdf03038

SHA512
a250d59944f2a460f96ba600602bcf23a53c0d8495e94355b2489825f81d7c481a29b490ca53691ecbbf0eb9a4b736b1586496120c75c4a18642338137031f9f

Download Submit
memory/4472-15-0x0000000000FC0000-0x0000000000FCC000-memory.dmp

Filesize
48KB

Download