Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
5s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
03/06/2024, 01:51
Behavioral task
behavioral1
Sample
9753fb88532e9ed46a082afb10f36f20_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
9753fb88532e9ed46a082afb10f36f20_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
9753fb88532e9ed46a082afb10f36f20_NeikiAnalytics.exe
-
Size
2.0MB
-
MD5
9753fb88532e9ed46a082afb10f36f20
-
SHA1
a4518f850c9fbc2250e155db55b8ab744e10e65d
-
SHA256
94943a153ee9a5d384f4f94218b3bdcbef9fe3a0a885386d53043ef96abc3c4f
-
SHA512
4b46378485ebe4ac454feec2e2d5f2a84868d6b88137eb532831740b63f7796e485a5462665b57aac2a792521fb0d1867d29f16784fd2914fd78d50d89277817
-
SSDEEP
24576:su6J33O0c+JY5UZ+XC0kGso6FaI1IXgM6YmenKKSUlmDaGJTA4Pqa6jUvOkQwKYO:2u0c++OCvkGs9Fap5aLKLkDl+dUvO9Yk
Malware Config
Extracted
azorult
http://0x21.in:8000/_az/
Extracted
quasar
1.3.0.0
EbayProfiles
5.8.88.191:443
sockartek.icu:443
QSR_MUTEX_0kBRNrRz5TDLEQouI0
-
encryption_key
MWhG6wsClMX8aJM2CVXT
-
install_name
winsock.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
win defender run
-
subdirectory
SubDir
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Quasar payload 3 IoCs
resource yara_rule behavioral2/files/0x000700000002341e-12.dat family_quasar behavioral2/memory/3100-30-0x0000000000DC0000-0x0000000000E1E000-memory.dmp family_quasar behavioral2/files/0x0008000000023421-54.dat family_quasar -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation 9753fb88532e9ed46a082afb10f36f20_NeikiAnalytics.exe -
Executes dropped EXE 3 IoCs
pid Process 3808 vnc.exe 3100 windef.exe 3732 winsock.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\a: 9753fb88532e9ed46a082afb10f36f20_NeikiAnalytics.exe File opened (read-only) \??\j: 9753fb88532e9ed46a082afb10f36f20_NeikiAnalytics.exe File opened (read-only) \??\p: 9753fb88532e9ed46a082afb10f36f20_NeikiAnalytics.exe File opened (read-only) \??\b: 9753fb88532e9ed46a082afb10f36f20_NeikiAnalytics.exe File opened (read-only) \??\e: 9753fb88532e9ed46a082afb10f36f20_NeikiAnalytics.exe File opened (read-only) \??\g: 9753fb88532e9ed46a082afb10f36f20_NeikiAnalytics.exe File opened (read-only) \??\i: 9753fb88532e9ed46a082afb10f36f20_NeikiAnalytics.exe File opened (read-only) \??\l: 9753fb88532e9ed46a082afb10f36f20_NeikiAnalytics.exe File opened (read-only) \??\v: 9753fb88532e9ed46a082afb10f36f20_NeikiAnalytics.exe File opened (read-only) \??\y: 9753fb88532e9ed46a082afb10f36f20_NeikiAnalytics.exe File opened (read-only) \??\k: 9753fb88532e9ed46a082afb10f36f20_NeikiAnalytics.exe File opened (read-only) \??\m: 9753fb88532e9ed46a082afb10f36f20_NeikiAnalytics.exe File opened (read-only) \??\n: 9753fb88532e9ed46a082afb10f36f20_NeikiAnalytics.exe File opened (read-only) \??\s: 9753fb88532e9ed46a082afb10f36f20_NeikiAnalytics.exe File opened (read-only) \??\t: 9753fb88532e9ed46a082afb10f36f20_NeikiAnalytics.exe File opened (read-only) \??\w: 9753fb88532e9ed46a082afb10f36f20_NeikiAnalytics.exe File opened (read-only) \??\x: 9753fb88532e9ed46a082afb10f36f20_NeikiAnalytics.exe File opened (read-only) \??\h: 9753fb88532e9ed46a082afb10f36f20_NeikiAnalytics.exe File opened (read-only) \??\o: 9753fb88532e9ed46a082afb10f36f20_NeikiAnalytics.exe File opened (read-only) \??\q: 9753fb88532e9ed46a082afb10f36f20_NeikiAnalytics.exe File opened (read-only) \??\r: 9753fb88532e9ed46a082afb10f36f20_NeikiAnalytics.exe File opened (read-only) \??\u: 9753fb88532e9ed46a082afb10f36f20_NeikiAnalytics.exe File opened (read-only) \??\z: 9753fb88532e9ed46a082afb10f36f20_NeikiAnalytics.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 11 ip-api.com -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/files/0x0008000000023421-54.dat autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 528 set thread context of 2028 528 9753fb88532e9ed46a082afb10f36f20_NeikiAnalytics.exe 87 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 4 IoCs
pid pid_target Process procid_target 1196 3808 WerFault.exe 81 4460 3732 WerFault.exe 94 3388 2672 WerFault.exe 117 4548 3216 WerFault.exe 113 -
Creates scheduled task(s) 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 640 schtasks.exe 4452 schtasks.exe 2964 schtasks.exe 5116 schtasks.exe 3416 schtasks.exe -
Runs ping.exe 1 TTPs 2 IoCs
pid Process 996 PING.EXE 1432 PING.EXE -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 528 9753fb88532e9ed46a082afb10f36f20_NeikiAnalytics.exe 528 9753fb88532e9ed46a082afb10f36f20_NeikiAnalytics.exe 528 9753fb88532e9ed46a082afb10f36f20_NeikiAnalytics.exe 528 9753fb88532e9ed46a082afb10f36f20_NeikiAnalytics.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3100 windef.exe Token: SeDebugPrivilege 3732 winsock.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3732 winsock.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 528 wrote to memory of 3808 528 9753fb88532e9ed46a082afb10f36f20_NeikiAnalytics.exe 81 PID 528 wrote to memory of 3808 528 9753fb88532e9ed46a082afb10f36f20_NeikiAnalytics.exe 81 PID 528 wrote to memory of 3808 528 9753fb88532e9ed46a082afb10f36f20_NeikiAnalytics.exe 81 PID 3808 wrote to memory of 4204 3808 vnc.exe 84 PID 3808 wrote to memory of 4204 3808 vnc.exe 84 PID 528 wrote to memory of 3100 528 9753fb88532e9ed46a082afb10f36f20_NeikiAnalytics.exe 83 PID 528 wrote to memory of 3100 528 9753fb88532e9ed46a082afb10f36f20_NeikiAnalytics.exe 83 PID 528 wrote to memory of 3100 528 9753fb88532e9ed46a082afb10f36f20_NeikiAnalytics.exe 83 PID 3808 wrote to memory of 4204 3808 vnc.exe 84 PID 528 wrote to memory of 2028 528 9753fb88532e9ed46a082afb10f36f20_NeikiAnalytics.exe 87 PID 528 wrote to memory of 2028 528 9753fb88532e9ed46a082afb10f36f20_NeikiAnalytics.exe 87 PID 528 wrote to memory of 2028 528 9753fb88532e9ed46a082afb10f36f20_NeikiAnalytics.exe 87 PID 528 wrote to memory of 2028 528 9753fb88532e9ed46a082afb10f36f20_NeikiAnalytics.exe 87 PID 528 wrote to memory of 2028 528 9753fb88532e9ed46a082afb10f36f20_NeikiAnalytics.exe 87 PID 528 wrote to memory of 640 528 9753fb88532e9ed46a082afb10f36f20_NeikiAnalytics.exe 89 PID 528 wrote to memory of 640 528 9753fb88532e9ed46a082afb10f36f20_NeikiAnalytics.exe 89 PID 528 wrote to memory of 640 528 9753fb88532e9ed46a082afb10f36f20_NeikiAnalytics.exe 89 PID 3100 wrote to memory of 4452 3100 windef.exe 92 PID 3100 wrote to memory of 4452 3100 windef.exe 92 PID 3100 wrote to memory of 4452 3100 windef.exe 92 PID 3100 wrote to memory of 3732 3100 windef.exe 94 PID 3100 wrote to memory of 3732 3100 windef.exe 94 PID 3100 wrote to memory of 3732 3100 windef.exe 94 PID 3732 wrote to memory of 2964 3732 winsock.exe 95 PID 3732 wrote to memory of 2964 3732 winsock.exe 95 PID 3732 wrote to memory of 2964 3732 winsock.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\9753fb88532e9ed46a082afb10f36f20_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\9753fb88532e9ed46a082afb10f36f20_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Enumerates connected drives
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:528 -
C:\Users\Admin\AppData\Local\Temp\vnc.exe"C:\Users\Admin\AppData\Local\Temp\vnc.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k3⤵PID:4204
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3808 -s 5483⤵
- Program crash
PID:1196
-
-
-
C:\Users\Admin\AppData\Local\Temp\windef.exe"C:\Users\Admin\AppData\Local\Temp\windef.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\windef.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
PID:4452
-
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f4⤵
- Creates scheduled task(s)
PID:2964
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4yErJDhWHUQp.bat" "4⤵PID:740
-
C:\Windows\SysWOW64\chcp.comchcp 650015⤵PID:432
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost5⤵
- Runs ping.exe
PID:996
-
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"5⤵PID:3216
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f6⤵
- Creates scheduled task(s)
PID:5116
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\soq6EsdQN3eL.bat" "6⤵PID:4888
-
C:\Windows\SysWOW64\chcp.comchcp 650017⤵PID:440
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost7⤵
- Runs ping.exe
PID:1432
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3216 -s 22366⤵
- Program crash
PID:4548
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3732 -s 22364⤵
- Program crash
PID:4460
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\9753fb88532e9ed46a082afb10f36f20_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\9753fb88532e9ed46a082afb10f36f20_NeikiAnalytics.exe"2⤵PID:2028
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:640
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3808 -ip 38081⤵PID:3684
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3732 -ip 37321⤵PID:64
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exeC:\Users\Admin\btpanui\SystemPropertiesPerformance.exe1⤵PID:3572
-
C:\Users\Admin\AppData\Local\Temp\vnc.exe"C:\Users\Admin\AppData\Local\Temp\vnc.exe"2⤵PID:2672
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k3⤵PID:3548
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 5203⤵
- Program crash
PID:3388
-
-
-
C:\Users\Admin\AppData\Local\Temp\windef.exe"C:\Users\Admin\AppData\Local\Temp\windef.exe"2⤵PID:976
-
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe"C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe"2⤵PID:4348
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:3416
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2672 -ip 26721⤵PID:208
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3216 -ip 32161⤵PID:4852
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵PID:4896
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵PID:2276
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD510eab9c2684febb5327b6976f2047587
SHA1a12ed54146a7f5c4c580416aecb899549712449e
SHA256f49dbd55029bfbc15134f7c6a4f967d6c39142c63f2e8f1f8c78fab108a2c928
SHA5127e5fd90fffae723bd0c662a90e0730b507805f072771ee673d1d8c262dbf60c8a03ba5fe088f699a97c2e886380de158b2ccd59ee62e3d012dd6dd14ea9d0e50
-
Filesize
208B
MD5e798c15b95df1c0ccc13c58f9c851cdd
SHA12f4b199f7e6cef2efc72e6d858abee9fe314a666
SHA2561e71701fa795d1d646e5806d0843e0dba6f4894159def1f3714cfb6a8bb4ead6
SHA51216d714d0c7513b5ed99bf7aafa03b11451447c86d3f65098e90265eb0eb11fb659e0bce037e57a7db5822fea1c548310c393e3cbe7d67cd38e2322532c35aaa3
-
Filesize
208B
MD5ad93d32723a67572c5892d07b5cf5b6d
SHA1710faa32aa28a3e5bfd4e6bdf391f7ed9150561c
SHA25663df69fb8edbc444e51e79f5523181295e9277ff92ec5705f3829cb658e19213
SHA512cee45316583dba5c058dd2a7c669683cd5faa203541fb69215703ac930c2e92f5ffa2500a716a16987b495d63b9fbefef1dc3822c17d8af5d1b079885d0e15e1
-
Filesize
405KB
MD5b8ba87ee4c3fc085a2fed0d839aadce1
SHA1b3a2e3256406330e8b1779199bb2b9865122d766
SHA2564e8a99cd33c9e5c747a3ce8f1a3e17824846f4a8f7cb0631aebd0815db2ce3a4
SHA5127a775a12cd5bcd182d64be0d31f800b456ca6d1b531189cea9c72e1940871cfe92ccd005938f67bfa4784ae44c54b3a7ea29a5bb59766e98c78bf53b680f2ab2
-
Filesize
349KB
MD5b4a202e03d4135484d0e730173abcc72
SHA101b30014545ea526c15a60931d676f9392ea0c70
SHA2567050608d53f80269df951d00883ed79815c060ce7678a76b5c3f6a2a985beea9
SHA512632a035a3b722ea29b02aad1f0da3df5bdc38abc7e6617223790955c6c0830f1070b528680416d5c63ea5e846074cdad87f06c21c35a77b1ccc4edc089d8b1fb
-
Filesize
224B
MD5b39aae1be02bd393d7a9e9a6b5921095
SHA1e37248911aec960d79d6bf02e2cebe9d843c3c49
SHA256ab5d3b43a2c00485a94191438bd47fa141debc545fdb11bbe8a7c53d2525d6cd
SHA512977d2552fc0beb4ba961ca4b91c778b9ad144db05d78f07fe1db3f49ecef33af9ed1259c50e5ad7dead9c66289ff2af4e8e8e58195fab603d7c0fd584af0d6bc
-
Filesize
2.0MB
MD5e5bf0acc902d166893e8059049d400fc
SHA19601f0dd61da700322b0b9ab609b8c68681c18dc
SHA2562456b9347d6467f8a288bf76a79f77237079af6b8883114764ab6d3b8f6e6820
SHA5129608bdb26a27deeb83f8a3e031402e314e815c680a75c5a3eb39e53cc10e8acfe65e8d7199360f324b57087ad288c509945d08394905545cfb15cbb2df2f9c49