Analysis
-
max time kernel
145s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
-
submitted
17-06-2024 06:03
General
-
Target
5626576397b25c9f30078366b11396a0_NeikiAnalytics.exe
-
Size
279KB
-
MD5
5626576397b25c9f30078366b11396a0
-
SHA1
384ce5194afef71c5b02ff334c04261c7a247e94
-
SHA256
93da3e400e792d52b0274418924463d3828da1d17712746781dc003fffdb70ec
-
SHA512
fc84bf3872d300f8069a89169b0c875d9f43ff602f01605189b84a28f1323638b74484826cbe7d4d59dbad7c69d8c48ae04a70352a9f846d7456fa5a7e602c4d
-
SSDEEP
6144:vaaXMzUmOZoqfzV6/F+lDfbt1o+1E6CVQQQQQQQQ:CachqrG0lDo+1c
Score
10/10
Malware Config
Signatures
-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar payload 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5626576397b25c9f30078366b11396a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5626576397b25c9f30078366b11396a0_NeikiAnalytics.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2948-0-0x000000007487E000-0x000000007487F000-memory.dmpFilesize
4KB
-
memory/2948-1-0x00000000008F0000-0x000000000093C000-memory.dmpFilesize
304KB
-
memory/2948-2-0x0000000074870000-0x0000000074F5E000-memory.dmpFilesize
6.9MB
-
memory/2948-3-0x000000007487E000-0x000000007487F000-memory.dmpFilesize
4KB
-
memory/2948-4-0x0000000074870000-0x0000000074F5E000-memory.dmpFilesize
6.9MB