Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
29-06-2024 06:02
Static task
static1
Behavioral task
behavioral1
Sample
71c5aa29fc4e8f9f853d757e40984e5e6b6376f5d241c21571671efb08653c3c_NeikiAnalytics.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
71c5aa29fc4e8f9f853d757e40984e5e6b6376f5d241c21571671efb08653c3c_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
71c5aa29fc4e8f9f853d757e40984e5e6b6376f5d241c21571671efb08653c3c_NeikiAnalytics.exe
-
Size
685KB
-
MD5
89a8e2368f403528e58ea89fca2c4b30
-
SHA1
21f196ea418a5796125500483754cf09a8111bf6
-
SHA256
71c5aa29fc4e8f9f853d757e40984e5e6b6376f5d241c21571671efb08653c3c
-
SHA512
34cf94001566f2537f6433d7c4cbb89c780cc59c00a3fa4bcd3e9164553c4d0d651dbeb95ae439978890f74e00bded473eb46fb5e05cc2220abdc02a74b5f2a0
-
SSDEEP
12288:Lnci3+GaMl9th6MLlRJTpx6a33Y9vZ5dQZcXFSRUR/dy9DoXAkkAntgoMdTewyb:FJtRJpx+xje+F9eDoXOfdTeN
Malware Config
Extracted
quasar
1.3.0.0
USR
pv8stresser.xyz:45201
yzyrfG0e0ojtGuJLLm
-
encryption_key
MxiVBHqo0ITsYTvOCUNN6SV9XbYPIBwE
-
install_name
Client.exe
-
log_directory
Mozilla
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2604-72-0x00000000058B0000-0x000000000593C000-memory.dmp family_quasar -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
71c5aa29fc4e8f9f853d757e40984e5e6b6376f5d241c21571671efb08653c3c_NeikiAnalytics.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\isocket = "C:\\Users\\Admin\\isocket.pif" 71c5aa29fc4e8f9f853d757e40984e5e6b6376f5d241c21571671efb08653c3c_NeikiAnalytics.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
71c5aa29fc4e8f9f853d757e40984e5e6b6376f5d241c21571671efb08653c3c_NeikiAnalytics.exepid process 2604 71c5aa29fc4e8f9f853d757e40984e5e6b6376f5d241c21571671efb08653c3c_NeikiAnalytics.exe 2604 71c5aa29fc4e8f9f853d757e40984e5e6b6376f5d241c21571671efb08653c3c_NeikiAnalytics.exe 2604 71c5aa29fc4e8f9f853d757e40984e5e6b6376f5d241c21571671efb08653c3c_NeikiAnalytics.exe 2604 71c5aa29fc4e8f9f853d757e40984e5e6b6376f5d241c21571671efb08653c3c_NeikiAnalytics.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
71c5aa29fc4e8f9f853d757e40984e5e6b6376f5d241c21571671efb08653c3c_NeikiAnalytics.exedescription pid process Token: SeDebugPrivilege 2604 71c5aa29fc4e8f9f853d757e40984e5e6b6376f5d241c21571671efb08653c3c_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
71c5aa29fc4e8f9f853d757e40984e5e6b6376f5d241c21571671efb08653c3c_NeikiAnalytics.exedescription pid process target process PID 2604 wrote to memory of 3592 2604 71c5aa29fc4e8f9f853d757e40984e5e6b6376f5d241c21571671efb08653c3c_NeikiAnalytics.exe RegAsm.exe PID 2604 wrote to memory of 3592 2604 71c5aa29fc4e8f9f853d757e40984e5e6b6376f5d241c21571671efb08653c3c_NeikiAnalytics.exe RegAsm.exe PID 2604 wrote to memory of 3592 2604 71c5aa29fc4e8f9f853d757e40984e5e6b6376f5d241c21571671efb08653c3c_NeikiAnalytics.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\71c5aa29fc4e8f9f853d757e40984e5e6b6376f5d241c21571671efb08653c3c_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\71c5aa29fc4e8f9f853d757e40984e5e6b6376f5d241c21571671efb08653c3c_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:3592