Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
11/06/2024, 14:34
Behavioral task
behavioral1
Sample
38223cc915973e60797c40de181a3ea0_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
38223cc915973e60797c40de181a3ea0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
38223cc915973e60797c40de181a3ea0_NeikiAnalytics.exe
-
Size
1.3MB
-
MD5
38223cc915973e60797c40de181a3ea0
-
SHA1
4dbec03e9f76482f9eafdd2a4a6792bc72e9e0f0
-
SHA256
402f4d3c271c43e70187f70a37a7379465b8b3fa57df70d1aeac04b190a6104c
-
SHA512
1f4186bc37e82d8364a1ebeb0f6556255307af00b667af6a238aba7f69d5faedd450ff4cfed16ecc0e8b4d45a47e60660d606eff8a0cf778ce0e6d8ce83a2678
-
SSDEEP
24576:Ku6J33O0c+JY5UZ+XC0kGso6Fa720W4njUprvVcC1f2o5RRfgUWYn:8u0c++OCvkGs9Fa+rd1f26RaYn
Malware Config
Extracted
netwire
Wealthy2019.com.strangled.net:20190
wealthyme.ddns.net:20190
-
activex_autorun
false
-
copy_executable
true
-
delete_original
false
-
host_id
sunshineslisa
-
install_path
%AppData%\Imgburn\Host.exe
-
keylogger_dir
%AppData%\Logs\Imgburn\
-
lock_executable
false
-
offline_keylogger
true
-
password
sucess
-
registry_autorun
false
-
use_mutex
false
Extracted
warzonerat
wealth.warzonedns.com:5202
Signatures
-
NetWire RAT payload 7 IoCs
resource yara_rule behavioral1/files/0x000a0000000122ec-2.dat netwire behavioral1/memory/2456-23-0x0000000000400000-0x000000000042C000-memory.dmp netwire behavioral1/files/0x0007000000016d45-45.dat netwire behavioral1/memory/2040-80-0x0000000000400000-0x000000000042C000-memory.dmp netwire behavioral1/memory/2344-82-0x0000000000400000-0x000000000042C000-memory.dmp netwire behavioral1/memory/2040-83-0x0000000000400000-0x000000000042C000-memory.dmp netwire behavioral1/memory/2344-84-0x0000000000400000-0x000000000042C000-memory.dmp netwire -
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload 4 IoCs
resource yara_rule behavioral1/memory/2176-37-0x0000000000080000-0x000000000009D000-memory.dmp warzonerat behavioral1/memory/2176-27-0x0000000000080000-0x000000000009D000-memory.dmp warzonerat behavioral1/memory/2968-65-0x00000000001E0000-0x00000000001FD000-memory.dmp warzonerat behavioral1/memory/2968-74-0x00000000001E0000-0x00000000001FD000-memory.dmp warzonerat -
Executes dropped EXE 11 IoCs
pid Process 2456 Blasthost.exe 2040 Host.exe 2596 RtDCpl64.exe 2344 Blasthost.exe 2968 RtDCpl64.exe 2508 RtDCpl64.exe 748 Blasthost.exe 1480 RtDCpl64.exe 2200 RtDCpl64.exe 1540 Blasthost.exe 2008 RtDCpl64.exe -
Loads dropped DLL 16 IoCs
pid Process 3068 38223cc915973e60797c40de181a3ea0_NeikiAnalytics.exe 3068 38223cc915973e60797c40de181a3ea0_NeikiAnalytics.exe 3068 38223cc915973e60797c40de181a3ea0_NeikiAnalytics.exe 3068 38223cc915973e60797c40de181a3ea0_NeikiAnalytics.exe 2456 Blasthost.exe 2456 Blasthost.exe 2596 RtDCpl64.exe 2596 RtDCpl64.exe 2596 RtDCpl64.exe 2596 RtDCpl64.exe 2508 RtDCpl64.exe 2508 RtDCpl64.exe 2508 RtDCpl64.exe 2200 RtDCpl64.exe 2200 RtDCpl64.exe 2200 RtDCpl64.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/files/0x0007000000016d45-45.dat autoit_exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 3068 set thread context of 2176 3068 38223cc915973e60797c40de181a3ea0_NeikiAnalytics.exe 30 PID 2596 set thread context of 2968 2596 RtDCpl64.exe 38 PID 2508 set thread context of 1480 2508 RtDCpl64.exe 47 PID 2200 set thread context of 2008 2200 RtDCpl64.exe 54 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1608 schtasks.exe 2452 schtasks.exe 2720 schtasks.exe 3036 schtasks.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3068 wrote to memory of 2456 3068 38223cc915973e60797c40de181a3ea0_NeikiAnalytics.exe 28 PID 3068 wrote to memory of 2456 3068 38223cc915973e60797c40de181a3ea0_NeikiAnalytics.exe 28 PID 3068 wrote to memory of 2456 3068 38223cc915973e60797c40de181a3ea0_NeikiAnalytics.exe 28 PID 3068 wrote to memory of 2456 3068 38223cc915973e60797c40de181a3ea0_NeikiAnalytics.exe 28 PID 2456 wrote to memory of 2040 2456 Blasthost.exe 29 PID 2456 wrote to memory of 2040 2456 Blasthost.exe 29 PID 2456 wrote to memory of 2040 2456 Blasthost.exe 29 PID 2456 wrote to memory of 2040 2456 Blasthost.exe 29 PID 3068 wrote to memory of 2176 3068 38223cc915973e60797c40de181a3ea0_NeikiAnalytics.exe 30 PID 3068 wrote to memory of 2176 3068 38223cc915973e60797c40de181a3ea0_NeikiAnalytics.exe 30 PID 3068 wrote to memory of 2176 3068 38223cc915973e60797c40de181a3ea0_NeikiAnalytics.exe 30 PID 3068 wrote to memory of 2176 3068 38223cc915973e60797c40de181a3ea0_NeikiAnalytics.exe 30 PID 3068 wrote to memory of 2176 3068 38223cc915973e60797c40de181a3ea0_NeikiAnalytics.exe 30 PID 3068 wrote to memory of 2176 3068 38223cc915973e60797c40de181a3ea0_NeikiAnalytics.exe 30 PID 3068 wrote to memory of 2720 3068 38223cc915973e60797c40de181a3ea0_NeikiAnalytics.exe 31 PID 3068 wrote to memory of 2720 3068 38223cc915973e60797c40de181a3ea0_NeikiAnalytics.exe 31 PID 3068 wrote to memory of 2720 3068 38223cc915973e60797c40de181a3ea0_NeikiAnalytics.exe 31 PID 3068 wrote to memory of 2720 3068 38223cc915973e60797c40de181a3ea0_NeikiAnalytics.exe 31 PID 2176 wrote to memory of 2828 2176 38223cc915973e60797c40de181a3ea0_NeikiAnalytics.exe 32 PID 2176 wrote to memory of 2828 2176 38223cc915973e60797c40de181a3ea0_NeikiAnalytics.exe 32 PID 2176 wrote to memory of 2828 2176 38223cc915973e60797c40de181a3ea0_NeikiAnalytics.exe 32 PID 2176 wrote to memory of 2828 2176 38223cc915973e60797c40de181a3ea0_NeikiAnalytics.exe 32 PID 2176 wrote to memory of 2828 2176 38223cc915973e60797c40de181a3ea0_NeikiAnalytics.exe 32 PID 2176 wrote to memory of 2828 2176 38223cc915973e60797c40de181a3ea0_NeikiAnalytics.exe 32 PID 2532 wrote to memory of 2596 2532 taskeng.exe 36 PID 2532 wrote to memory of 2596 2532 taskeng.exe 36 PID 2532 wrote to memory of 2596 2532 taskeng.exe 36 PID 2532 wrote to memory of 2596 2532 taskeng.exe 36 PID 2596 wrote to memory of 2344 2596 RtDCpl64.exe 37 PID 2596 wrote to memory of 2344 2596 RtDCpl64.exe 37 PID 2596 wrote to memory of 2344 2596 RtDCpl64.exe 37 PID 2596 wrote to memory of 2344 2596 RtDCpl64.exe 37 PID 2596 wrote to memory of 2968 2596 RtDCpl64.exe 38 PID 2596 wrote to memory of 2968 2596 RtDCpl64.exe 38 PID 2596 wrote to memory of 2968 2596 RtDCpl64.exe 38 PID 2596 wrote to memory of 2968 2596 RtDCpl64.exe 38 PID 2596 wrote to memory of 2968 2596 RtDCpl64.exe 38 PID 2596 wrote to memory of 2968 2596 RtDCpl64.exe 38 PID 2596 wrote to memory of 3036 2596 RtDCpl64.exe 39 PID 2596 wrote to memory of 3036 2596 RtDCpl64.exe 39 PID 2596 wrote to memory of 3036 2596 RtDCpl64.exe 39 PID 2596 wrote to memory of 3036 2596 RtDCpl64.exe 39 PID 2968 wrote to memory of 1496 2968 RtDCpl64.exe 41 PID 2968 wrote to memory of 1496 2968 RtDCpl64.exe 41 PID 2968 wrote to memory of 1496 2968 RtDCpl64.exe 41 PID 2968 wrote to memory of 1496 2968 RtDCpl64.exe 41 PID 2968 wrote to memory of 1496 2968 RtDCpl64.exe 41 PID 2968 wrote to memory of 1496 2968 RtDCpl64.exe 41 PID 2532 wrote to memory of 2508 2532 taskeng.exe 45 PID 2532 wrote to memory of 2508 2532 taskeng.exe 45 PID 2532 wrote to memory of 2508 2532 taskeng.exe 45 PID 2532 wrote to memory of 2508 2532 taskeng.exe 45 PID 2508 wrote to memory of 748 2508 RtDCpl64.exe 46 PID 2508 wrote to memory of 748 2508 RtDCpl64.exe 46 PID 2508 wrote to memory of 748 2508 RtDCpl64.exe 46 PID 2508 wrote to memory of 748 2508 RtDCpl64.exe 46 PID 2508 wrote to memory of 1480 2508 RtDCpl64.exe 47 PID 2508 wrote to memory of 1480 2508 RtDCpl64.exe 47 PID 2508 wrote to memory of 1480 2508 RtDCpl64.exe 47 PID 2508 wrote to memory of 1480 2508 RtDCpl64.exe 47 PID 2508 wrote to memory of 1480 2508 RtDCpl64.exe 47 PID 2508 wrote to memory of 1480 2508 RtDCpl64.exe 47 PID 2508 wrote to memory of 1608 2508 RtDCpl64.exe 48 PID 2508 wrote to memory of 1608 2508 RtDCpl64.exe 48
Processes
-
C:\Users\Admin\AppData\Local\Temp\38223cc915973e60797c40de181a3ea0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\38223cc915973e60797c40de181a3ea0_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Roaming\Blasthost.exe"C:\Users\Admin\AppData\Roaming\Blasthost.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe"C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe"3⤵
- Executes dropped EXE
PID:2040
-
-
-
C:\Users\Admin\AppData\Local\Temp\38223cc915973e60797c40de181a3ea0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\38223cc915973e60797c40de181a3ea0_NeikiAnalytics.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"3⤵PID:2828
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:2720
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {FFD09C44-6633-4302-B65F-A88D94CAE291} S-1-5-21-268080393-3149932598-1824759070-1000:UHRQKJCP\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exeC:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Roaming\Blasthost.exe"C:\Users\Admin\AppData\Roaming\Blasthost.exe"3⤵
- Executes dropped EXE
PID:2344
-
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"4⤵PID:1496
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F3⤵
- Creates scheduled task(s)
PID:3036
-
-
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exeC:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Roaming\Blasthost.exe"C:\Users\Admin\AppData\Roaming\Blasthost.exe"3⤵
- Executes dropped EXE
PID:748
-
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"3⤵
- Executes dropped EXE
PID:1480 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"4⤵PID:448
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F3⤵
- Creates scheduled task(s)
PID:1608
-
-
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exeC:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:2200 -
C:\Users\Admin\AppData\Roaming\Blasthost.exe"C:\Users\Admin\AppData\Roaming\Blasthost.exe"3⤵
- Executes dropped EXE
PID:1540
-
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"3⤵
- Executes dropped EXE
PID:2008 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"4⤵PID:2884
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F3⤵
- Creates scheduled task(s)
PID:2452
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD52a674cc07f23e2b9d472295ca5a046ac
SHA1a2eff27fe7330588fd7f7a95ed3aab57544b6770
SHA256a89138c360e651833783cbfec70a77bb8b7eb0512bd5e29c585114cb0889b38a
SHA512bfb4b69ece11498ed71f07ffa13e8bddc5a0ebdbed78cdb6bbc792f77e2871ca6152bcf102b7421fbe393bde63a6ee68f1ef95f92a8be23122d0ea75963987cb
-
Filesize
132KB
MD56087bf6af59b9c531f2c9bb421d5e902
SHA18bc0f1596c986179b82585c703bacae6d2a00316
SHA2563a8ffff8485c9ed35dae82574ea1a455ea2ead532251cebea19149d78dfd682c
SHA512c8ed34470a874ce21c91cb7843521d66decc32c3f0a9c8d5b55889a7b990dfe5199ade8b6c6ef94b1bced6d3b5f0721e14bcc06320e8efe73ca3fe27fd6b9292