Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
4s -
max time network
78s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
11/06/2024, 22:16
Behavioral task
behavioral1
Sample
080838bbb30e9761da1c7ddc1b3d94c0_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
080838bbb30e9761da1c7ddc1b3d94c0_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
General
-
Target
080838bbb30e9761da1c7ddc1b3d94c0_NeikiAnalytics.exe
-
Size
2.0MB
-
MD5
080838bbb30e9761da1c7ddc1b3d94c0
-
SHA1
8c10f4b0f43000657158e737ea4600f1d8401e1e
-
SHA256
a01cee8febf5fdb2394b17f91c992a41226cae1b0ccdc459c3212ee548267d65
-
SHA512
0f0b0855044552d85fae30e798364278d0d87f6678f044c07047cc20df5559abb99800004658c9e4d74d8554cc92845419ce8fa72f4ed3f90da8f29e37d1c0b4
-
SSDEEP
24576:su6J33O0c+JY5UZ+XC0kGso6FaI1IXgM6YmenKKSUlmDaGJTA4Pqa6jUvOkQwKYR:2u0c++OCvkGs9Fap5aLKLkDl+dUvO9Yv
Malware Config
Extracted
azorult
http://0x21.in:8000/_az/
Extracted
quasar
1.3.0.0
EbayProfiles
5.8.88.191:443
sockartek.icu:443
QSR_MUTEX_0kBRNrRz5TDLEQouI0
-
encryption_key
MWhG6wsClMX8aJM2CVXT
-
install_name
winsock.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
win defender run
-
subdirectory
SubDir
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Quasar payload 3 IoCs
resource yara_rule behavioral2/files/0x000a00000002340e-12.dat family_quasar behavioral2/memory/904-30-0x0000000000B80000-0x0000000000BDE000-memory.dmp family_quasar behavioral2/files/0x0007000000023413-53.dat family_quasar -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation 080838bbb30e9761da1c7ddc1b3d94c0_NeikiAnalytics.exe -
Executes dropped EXE 3 IoCs
pid Process 3128 vnc.exe 904 windef.exe 4516 winsock.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\b: 080838bbb30e9761da1c7ddc1b3d94c0_NeikiAnalytics.exe File opened (read-only) \??\e: 080838bbb30e9761da1c7ddc1b3d94c0_NeikiAnalytics.exe File opened (read-only) \??\j: 080838bbb30e9761da1c7ddc1b3d94c0_NeikiAnalytics.exe File opened (read-only) \??\l: 080838bbb30e9761da1c7ddc1b3d94c0_NeikiAnalytics.exe File opened (read-only) \??\s: 080838bbb30e9761da1c7ddc1b3d94c0_NeikiAnalytics.exe File opened (read-only) \??\h: 080838bbb30e9761da1c7ddc1b3d94c0_NeikiAnalytics.exe File opened (read-only) \??\i: 080838bbb30e9761da1c7ddc1b3d94c0_NeikiAnalytics.exe File opened (read-only) \??\k: 080838bbb30e9761da1c7ddc1b3d94c0_NeikiAnalytics.exe File opened (read-only) \??\p: 080838bbb30e9761da1c7ddc1b3d94c0_NeikiAnalytics.exe File opened (read-only) \??\w: 080838bbb30e9761da1c7ddc1b3d94c0_NeikiAnalytics.exe File opened (read-only) \??\x: 080838bbb30e9761da1c7ddc1b3d94c0_NeikiAnalytics.exe File opened (read-only) \??\a: 080838bbb30e9761da1c7ddc1b3d94c0_NeikiAnalytics.exe File opened (read-only) \??\g: 080838bbb30e9761da1c7ddc1b3d94c0_NeikiAnalytics.exe File opened (read-only) \??\n: 080838bbb30e9761da1c7ddc1b3d94c0_NeikiAnalytics.exe File opened (read-only) \??\o: 080838bbb30e9761da1c7ddc1b3d94c0_NeikiAnalytics.exe File opened (read-only) \??\t: 080838bbb30e9761da1c7ddc1b3d94c0_NeikiAnalytics.exe File opened (read-only) \??\u: 080838bbb30e9761da1c7ddc1b3d94c0_NeikiAnalytics.exe File opened (read-only) \??\v: 080838bbb30e9761da1c7ddc1b3d94c0_NeikiAnalytics.exe File opened (read-only) \??\m: 080838bbb30e9761da1c7ddc1b3d94c0_NeikiAnalytics.exe File opened (read-only) \??\q: 080838bbb30e9761da1c7ddc1b3d94c0_NeikiAnalytics.exe File opened (read-only) \??\r: 080838bbb30e9761da1c7ddc1b3d94c0_NeikiAnalytics.exe File opened (read-only) \??\y: 080838bbb30e9761da1c7ddc1b3d94c0_NeikiAnalytics.exe File opened (read-only) \??\z: 080838bbb30e9761da1c7ddc1b3d94c0_NeikiAnalytics.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 5 ip-api.com -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/files/0x0007000000023413-53.dat autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3908 set thread context of 4632 3908 080838bbb30e9761da1c7ddc1b3d94c0_NeikiAnalytics.exe 88 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 4 IoCs
pid pid_target Process procid_target 1512 3128 WerFault.exe 81 2752 4516 WerFault.exe 96 4424 5060 WerFault.exe 110 3392 3756 WerFault.exe 106 -
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3000 schtasks.exe 5008 schtasks.exe 2380 schtasks.exe 2608 schtasks.exe -
Runs ping.exe 1 TTPs 2 IoCs
pid Process 992 PING.EXE 3856 PING.EXE -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3908 080838bbb30e9761da1c7ddc1b3d94c0_NeikiAnalytics.exe 3908 080838bbb30e9761da1c7ddc1b3d94c0_NeikiAnalytics.exe 3908 080838bbb30e9761da1c7ddc1b3d94c0_NeikiAnalytics.exe 3908 080838bbb30e9761da1c7ddc1b3d94c0_NeikiAnalytics.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 904 windef.exe Token: SeDebugPrivilege 4516 winsock.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4516 winsock.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 3908 wrote to memory of 3128 3908 080838bbb30e9761da1c7ddc1b3d94c0_NeikiAnalytics.exe 81 PID 3908 wrote to memory of 3128 3908 080838bbb30e9761da1c7ddc1b3d94c0_NeikiAnalytics.exe 81 PID 3908 wrote to memory of 3128 3908 080838bbb30e9761da1c7ddc1b3d94c0_NeikiAnalytics.exe 81 PID 3128 wrote to memory of 3424 3128 vnc.exe 84 PID 3128 wrote to memory of 3424 3128 vnc.exe 84 PID 3128 wrote to memory of 3424 3128 vnc.exe 84 PID 3908 wrote to memory of 904 3908 080838bbb30e9761da1c7ddc1b3d94c0_NeikiAnalytics.exe 85 PID 3908 wrote to memory of 904 3908 080838bbb30e9761da1c7ddc1b3d94c0_NeikiAnalytics.exe 85 PID 3908 wrote to memory of 904 3908 080838bbb30e9761da1c7ddc1b3d94c0_NeikiAnalytics.exe 85 PID 3908 wrote to memory of 4632 3908 080838bbb30e9761da1c7ddc1b3d94c0_NeikiAnalytics.exe 88 PID 3908 wrote to memory of 4632 3908 080838bbb30e9761da1c7ddc1b3d94c0_NeikiAnalytics.exe 88 PID 3908 wrote to memory of 4632 3908 080838bbb30e9761da1c7ddc1b3d94c0_NeikiAnalytics.exe 88 PID 3908 wrote to memory of 4632 3908 080838bbb30e9761da1c7ddc1b3d94c0_NeikiAnalytics.exe 88 PID 3908 wrote to memory of 4632 3908 080838bbb30e9761da1c7ddc1b3d94c0_NeikiAnalytics.exe 88 PID 3908 wrote to memory of 2608 3908 080838bbb30e9761da1c7ddc1b3d94c0_NeikiAnalytics.exe 90 PID 3908 wrote to memory of 2608 3908 080838bbb30e9761da1c7ddc1b3d94c0_NeikiAnalytics.exe 90 PID 3908 wrote to memory of 2608 3908 080838bbb30e9761da1c7ddc1b3d94c0_NeikiAnalytics.exe 90 PID 904 wrote to memory of 3000 904 windef.exe 94 PID 904 wrote to memory of 3000 904 windef.exe 94 PID 904 wrote to memory of 3000 904 windef.exe 94 PID 904 wrote to memory of 4516 904 windef.exe 96 PID 904 wrote to memory of 4516 904 windef.exe 96 PID 904 wrote to memory of 4516 904 windef.exe 96 PID 4516 wrote to memory of 5008 4516 winsock.exe 97 PID 4516 wrote to memory of 5008 4516 winsock.exe 97 PID 4516 wrote to memory of 5008 4516 winsock.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\080838bbb30e9761da1c7ddc1b3d94c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\080838bbb30e9761da1c7ddc1b3d94c0_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Enumerates connected drives
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\vnc.exe"C:\Users\Admin\AppData\Local\Temp\vnc.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k3⤵PID:3424
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3128 -s 5483⤵
- Program crash
PID:1512
-
-
-
C:\Users\Admin\AppData\Local\Temp\windef.exe"C:\Users\Admin\AppData\Local\Temp\windef.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:904 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\windef.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
PID:3000
-
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f4⤵
- Creates scheduled task(s)
PID:5008
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SzEflEjBVNzn.bat" "4⤵PID:528
-
C:\Windows\SysWOW64\chcp.comchcp 650015⤵PID:996
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost5⤵
- Runs ping.exe
PID:992
-
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"5⤵PID:3756
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f6⤵
- Creates scheduled task(s)
PID:2380
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DjszApuit2nF.bat" "6⤵PID:4400
-
C:\Windows\SysWOW64\chcp.comchcp 650017⤵PID:616
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost7⤵
- Runs ping.exe
PID:3856
-
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"7⤵PID:4620
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3756 -s 19766⤵
- Program crash
PID:3392
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4516 -s 22244⤵
- Program crash
PID:2752
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\080838bbb30e9761da1c7ddc1b3d94c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\080838bbb30e9761da1c7ddc1b3d94c0_NeikiAnalytics.exe"2⤵PID:4632
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:2608
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3128 -ip 31281⤵PID:1144
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4516 -ip 45161⤵PID:1188
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exeC:\Users\Admin\btpanui\SystemPropertiesPerformance.exe1⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\vnc.exe"C:\Users\Admin\AppData\Local\Temp\vnc.exe"2⤵PID:5060
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k3⤵PID:4780
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 5283⤵
- Program crash
PID:4424
-
-
-
C:\Users\Admin\AppData\Local\Temp\windef.exe"C:\Users\Admin\AppData\Local\Temp\windef.exe"2⤵PID:3356
-
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe"C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe"2⤵PID:1120
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 5060 -ip 50601⤵PID:4332
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3756 -ip 37561⤵PID:3804
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:4268
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:2788
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:1616
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:4008
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:3684
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:3732
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵PID:4552
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵PID:3948
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
208B
MD56d4eca7cc3dba6719eb92f49e167a76f
SHA12f8b7d39183fab98f9eae2663671ced5bd770f0e
SHA256eb3cdd554ca182722abe785a43c36ce7bbe880a3d0540350a992f2508b462e6b
SHA512ca6c204bfc7489af0e90423da4817f408c86046eabe5e9701bd91356ed14100113f3c4dcbc6494765f85caa82b939d8a526d0c112709d82ab82654800db1a4a0
-
Filesize
208B
MD5a15977dfa178f66c024c6d77702b5317
SHA1d5eb27236cb13b50db4f1baa5890825b418bd479
SHA256956673acfff8df1317cf7277c79d24f593f3401fac7e128fca5cd15abbb672cf
SHA512e4b0309ff254622a3cc4a362e09683b46d06fa74ff2a5a73effeebf3940b0f94c78702c934157480f805e12125d70c5e7033ed2312733b26abfbfd2021d5771c
-
Filesize
405KB
MD5b8ba87ee4c3fc085a2fed0d839aadce1
SHA1b3a2e3256406330e8b1779199bb2b9865122d766
SHA2564e8a99cd33c9e5c747a3ce8f1a3e17824846f4a8f7cb0631aebd0815db2ce3a4
SHA5127a775a12cd5bcd182d64be0d31f800b456ca6d1b531189cea9c72e1940871cfe92ccd005938f67bfa4784ae44c54b3a7ea29a5bb59766e98c78bf53b680f2ab2
-
Filesize
349KB
MD5b4a202e03d4135484d0e730173abcc72
SHA101b30014545ea526c15a60931d676f9392ea0c70
SHA2567050608d53f80269df951d00883ed79815c060ce7678a76b5c3f6a2a985beea9
SHA512632a035a3b722ea29b02aad1f0da3df5bdc38abc7e6617223790955c6c0830f1070b528680416d5c63ea5e846074cdad87f06c21c35a77b1ccc4edc089d8b1fb
-
Filesize
224B
MD544d5580a8cfce209365c4aa493cd63bb
SHA15b0ece7cebba269f8821bf4da761e70782de6f23
SHA256ed9ee1b2887c836050ddb42c6b7e3990656c2f0c2805829dc4c8138c4e4981d8
SHA51278cfb71e98b34e8c9c69dab8103cc2c2dd801f50fc4548e7897e7d219e9a00ec56fdb7da4a102a72abc1e655ab7235ab8a2eddf2f88396e4b7d575acc27e6018
-
Filesize
2.0MB
MD5ff2e4fa300e443dec11ed867601903f2
SHA1f039c0da59d23eada0e0c3664e29cabb3d6ea28e
SHA25677ae23913d02daca375c8ce6d05b5f6250bb86d9a484416858990c0078e13f3d
SHA512a6e7a6670e47d87895f6c5c861045616da17729691c7eb9df2f443d842debbed24544d6654d131e3e6756fde2b59ed3ed929170d013db2c486ea603062c95891