Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
28/05/2024, 21:39
Behavioral task
behavioral1
Sample
0aa0dd946e722343b08540a7a0cf1c40_NeikiAnalytics.exe
Resource
win7-20240215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
0aa0dd946e722343b08540a7a0cf1c40_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
13 signatures
150 seconds
General
- Target 0aa0dd946e722343b08540a7a0cf1c40_NeikiAnalytics.exe
- Size 5.8MB
- Sample240528-1ht8jaef45
- SHA256 8ae39d58cf11900e7c6ddfcfce20c37e6e1820bd81b47787f8d47bab83e986ef
- MD5 0aa0dd946e722343b08540a7a0cf1c40
- SHA1 8db0fc9b7e24f6c73aba7c54dea94569e6c5c615
- SHA512 c39f4c257a8faf6a2a0d6bdb05ab6c497750a22db88febbfe3c2e3c44776b7201ea23c0fe2ae2f4d0f7d001130b8d3372cd1adbd56ba1eea69ce793466ad7873
- SSDEEP 98304:WvwH6P2uW5MI079g+DgeFahftplflf6dUwOEH6d8e6b0+hb5y94kAFq:WvwH6eL2V76+DgTNfwZHYY17Y4hw
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
njrat
Version
-
im523
Botnet
-
Xbox Game Studios
C2
-
kids-notified.at.ply.gg:3845
Mutex
-
28025540980d0ce611318033102f9151
Attributes
-
reg_key
28025540980d0ce611318033102f9151
-
splitter
|'|'|
Signatures
- Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 3672 netsh.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation INST.exe - Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\28025540980d0ce611318033102f9151.exe groundedactivator.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\28025540980d0ce611318033102f9151.exe groundedactivator.exe - Executes dropped EXE 2 IoCs
pid Process 1832 INST.exe 3108 groundedactivator.exe - Loads dropped DLL 2 IoCs
pid Process 4328 0aa0dd946e722343b08540a7a0cf1c40_NeikiAnalytics.exe 4328 0aa0dd946e722343b08540a7a0cf1c40_NeikiAnalytics.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\28025540980d0ce611318033102f9151 = "\"C:\\Users\\Admin\\AppData\\Roaming\\groundedactivator.exe\" .." groundedactivator.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\28025540980d0ce611318033102f9151 = "\"C:\\Users\\Admin\\AppData\\Roaming\\groundedactivator.exe\" .." groundedactivator.exe - Drops autorun.inf file 1 TTPs 5 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created C:\autorun.inf groundedactivator.exe File opened for modification C:\autorun.inf groundedactivator.exe File created D:\autorun.inf groundedactivator.exe File created F:\autorun.inf groundedactivator.exe File opened for modification F:\autorun.inf groundedactivator.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3108 groundedactivator.exe 3108 groundedactivator.exe 3108 groundedactivator.exe 3108 groundedactivator.exe 3108 groundedactivator.exe 3108 groundedactivator.exe 3108 groundedactivator.exe 3108 groundedactivator.exe 3108 groundedactivator.exe 3108 groundedactivator.exe 3108 groundedactivator.exe 3108 groundedactivator.exe 3108 groundedactivator.exe 3108 groundedactivator.exe 3108 groundedactivator.exe 3108 groundedactivator.exe 3108 groundedactivator.exe 3108 groundedactivator.exe 3108 groundedactivator.exe 3108 groundedactivator.exe 3108 groundedactivator.exe 3108 groundedactivator.exe 3108 groundedactivator.exe 3108 groundedactivator.exe 3108 groundedactivator.exe 3108 groundedactivator.exe 3108 groundedactivator.exe 3108 groundedactivator.exe 3108 groundedactivator.exe 3108 groundedactivator.exe 3108 groundedactivator.exe 3108 groundedactivator.exe 3108 groundedactivator.exe 3108 groundedactivator.exe 3108 groundedactivator.exe 3108 groundedactivator.exe 3108 groundedactivator.exe 3108 groundedactivator.exe 3108 groundedactivator.exe 3108 groundedactivator.exe 3108 groundedactivator.exe 3108 groundedactivator.exe 3108 groundedactivator.exe 3108 groundedactivator.exe 3108 groundedactivator.exe 3108 groundedactivator.exe 3108 groundedactivator.exe 3108 groundedactivator.exe 3108 groundedactivator.exe 3108 groundedactivator.exe 3108 groundedactivator.exe 3108 groundedactivator.exe 3108 groundedactivator.exe 3108 groundedactivator.exe 3108 groundedactivator.exe 3108 groundedactivator.exe 3108 groundedactivator.exe 3108 groundedactivator.exe 3108 groundedactivator.exe 3108 groundedactivator.exe 3108 groundedactivator.exe 3108 groundedactivator.exe 3108 groundedactivator.exe 3108 groundedactivator.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3108 groundedactivator.exe - Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeDebugPrivilege 3108 groundedactivator.exe Token: 33 3108 groundedactivator.exe Token: SeIncBasePriorityPrivilege 3108 groundedactivator.exe Token: 33 3108 groundedactivator.exe Token: SeIncBasePriorityPrivilege 3108 groundedactivator.exe Token: 33 3108 groundedactivator.exe Token: SeIncBasePriorityPrivilege 3108 groundedactivator.exe Token: 33 3108 groundedactivator.exe Token: SeIncBasePriorityPrivilege 3108 groundedactivator.exe Token: 33 3108 groundedactivator.exe Token: SeIncBasePriorityPrivilege 3108 groundedactivator.exe Token: 33 3108 groundedactivator.exe Token: SeIncBasePriorityPrivilege 3108 groundedactivator.exe Token: 33 3108 groundedactivator.exe Token: SeIncBasePriorityPrivilege 3108 groundedactivator.exe Token: 33 3108 groundedactivator.exe Token: SeIncBasePriorityPrivilege 3108 groundedactivator.exe Token: 33 3108 groundedactivator.exe Token: SeIncBasePriorityPrivilege 3108 groundedactivator.exe Token: 33 3108 groundedactivator.exe Token: SeIncBasePriorityPrivilege 3108 groundedactivator.exe Token: 33 3108 groundedactivator.exe Token: SeIncBasePriorityPrivilege 3108 groundedactivator.exe Token: 33 3108 groundedactivator.exe Token: SeIncBasePriorityPrivilege 3108 groundedactivator.exe Token: 33 3108 groundedactivator.exe Token: SeIncBasePriorityPrivilege 3108 groundedactivator.exe Token: 33 3108 groundedactivator.exe Token: SeIncBasePriorityPrivilege 3108 groundedactivator.exe Token: 33 3108 groundedactivator.exe Token: SeIncBasePriorityPrivilege 3108 groundedactivator.exe Token: 33 3108 groundedactivator.exe Token: SeIncBasePriorityPrivilege 3108 groundedactivator.exe Token: 33 3108 groundedactivator.exe Token: SeIncBasePriorityPrivilege 3108 groundedactivator.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3008 wrote to memory of 4328 3008 0aa0dd946e722343b08540a7a0cf1c40_NeikiAnalytics.exe 91 PID 3008 wrote to memory of 4328 3008 0aa0dd946e722343b08540a7a0cf1c40_NeikiAnalytics.exe 91 PID 4328 wrote to memory of 4520 4328 0aa0dd946e722343b08540a7a0cf1c40_NeikiAnalytics.exe 95 PID 4328 wrote to memory of 4520 4328 0aa0dd946e722343b08540a7a0cf1c40_NeikiAnalytics.exe 95 PID 4328 wrote to memory of 3032 4328 0aa0dd946e722343b08540a7a0cf1c40_NeikiAnalytics.exe 96 PID 4328 wrote to memory of 3032 4328 0aa0dd946e722343b08540a7a0cf1c40_NeikiAnalytics.exe 96 PID 3032 wrote to memory of 1832 3032 cmd.exe 97 PID 3032 wrote to memory of 1832 3032 cmd.exe 97 PID 3032 wrote to memory of 1832 3032 cmd.exe 97 PID 1832 wrote to memory of 3108 1832 INST.exe 108 PID 1832 wrote to memory of 3108 1832 INST.exe 108 PID 1832 wrote to memory of 3108 1832 INST.exe 108 PID 3108 wrote to memory of 3672 3108 groundedactivator.exe 111 PID 3108 wrote to memory of 3672 3108 groundedactivator.exe 111 PID 3108 wrote to memory of 3672 3108 groundedactivator.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\0aa0dd946e722343b08540a7a0cf1c40_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0aa0dd946e722343b08540a7a0cf1c40_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\0aa0dd946e722343b08540a7a0cf1c40_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0aa0dd946e722343b08540a7a0cf1c40_NeikiAnalytics.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Windows\SYSTEM32\cmd.execmd /c echo %temp%3⤵PID:4520
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\INST.exe3⤵
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\INST.exeC:\Users\Admin\AppData\Local\Temp\INST.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Users\Admin\AppData\Roaming\groundedactivator.exe"C:\Users\Admin\AppData\Roaming\groundedactivator.exe"5⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\groundedactivator.exe" "groundedactivator.exe" ENABLE6⤵
- Modifies Windows Firewall
PID:3672
-
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4356,i,5047420736443372512,9747851268033796534,262144 --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:81⤵PID:264
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\INST.exe
- Size 37KB
- SHA256 d117884a2b2ccfc147f8c667874feeb70335fb88e6a3d03584083d975c00c83e
- MD5 fd24c519c72937a7f150745ccacc9b1b
- SHA1 23677305457d245f5104bb3ecd4c562d52e052e6
- SHA512 d430e545d524634e6ea7989777ed4a75857689bbdb0fa5451dd9e99990323b3ed82588d91d85a980e0e76a804117c0281443716b4072f97e0fc8f628a2889d3c
- SSDEEP 384:l/s1QzCiszUiieQJExytPgHPDnRwSoZprAF+rMRTyN/0L+EcoinblneHQM3epzX6:RsO0OJftPgHd1oDrM+rMRa8Nutyt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI30082\VCRUNTIME140.dll
- Size 95KB
- SHA256 9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1
- MD5 f34eb034aa4a9735218686590cba2e8b
- SHA1 2bc20acdcb201676b77a66fa7ec6b53fa2644713
- SHA512 d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af
- SSDEEP 1536:ywqHLG4SsAzAvadZw+1Hcx8uIYNUzUoHA4decbK/zJNuw6z5U:ytrfZ+jPYNzoHA4decbK/FNu51U
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI30082\base_library.zip
- Size 1.0MB
- SHA256 0580066426cc1e4cbea64c459ec9a951fd6d62d93c1149c11386e96f32b7e345
- MD5 e75eb8bcc934a2f3ca49a0a9227f2edf
- SHA1 b47a41bc9dab963ea89d679b02a7ede92c6c7516
- SHA512 69cd7ecf412e006cdb9115ca93fd0103c236a36268478fbdd2777fb8c368f636d705b24f30095ae5854bc2b432660e12ead41621f4b031341ce4cb695349ef73
- SSDEEP 12288:EEHYKmIpWyxC6SacpInA4a2Y8JdOVwx/fpE94raEuR6O98SLMNOj:EEHYoVxXLa2jeVwx/fpE941uR/9HMNOj
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI30082\python310.dll
- Size 4.2MB
- SHA256 5783c5c5a3ffce181691f19d27de376a03010d32e41360b72bcdbd28467cfcc5
- MD5 e9c0fbc99d19eeedad137557f4a0ab21
- SHA1 8945e1811ceb4b26f21edcc7a36dcf2b1d34f0bf
- SHA512 74e1289683642ae2bc3cf780a07af1f27fed2011ef6cc67380f9c066c59d17a2fb2394a45a5c6cd75dad812a61093fdbd0f2108925f5c58fc6644c1c98be5c0b
- SSDEEP 49152:sjpL4R07dkqlAC+j5mum37j64+QNdhIomafXXPoMpBdr3AtoD1s3tvVIdHwHasMD:sjpPkqe1t4zf3Ty9ydQHvMl/SE98EL
- MD5 SHA1 SHA512 SSDEEP