Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
01/07/2024, 11:28
General
- Target 4e61c25d6ef620a0b4c800091860cdc38928f2ec75e2097700d4d94cc0f87265_NeikiAnalytics.exe
- Size 232KB
- Sample240701-nlal3sscql
- SHA256 4e61c25d6ef620a0b4c800091860cdc38928f2ec75e2097700d4d94cc0f87265
Malware Config
Extracted
-
asyncrat
-
Default
-
127.0.0.1:6606
-
127.0.0.1:7707
-
127.0.0.1:8808
-
https://api.telegram.org/bot7423164379:AAFflVsuq0BrKEG_Lh8KPIRPN6rHeW4a7oo/sendMessage?chat_id=7472532856
-
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- StormKitty
StormKitty is an open source info stealer written in C#.
- StormKitty payload 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 7 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 24 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4e61c25d6ef620a0b4c800091860cdc38928f2ec75e2097700d4d94cc0f87265_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4e61c25d6ef620a0b4c800091860cdc38928f2ec75e2097700d4d94cc0f87265_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Drops desktop.ini file(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 650013⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile3⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\findstr.exefindstr All3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 650013⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid3⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\Admin\AppData\Local\Temp\4e61c25d6ef620a0b4c800091860cdc38928f2ec75e2097700d4d94cc0f87265_NeikiAnalytics.exe"2⤵
- Scheduled Task/Job: Scheduled Task
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Bookmarks.txt
Process.txt
msgid.dat
memory/2208-145-0x0000000075320000-0x0000000075AD0000-memory.dmp
memory/2208-4-0x0000000006410000-0x00000000069B4000-memory.dmp
memory/2208-5-0x0000000006040000-0x00000000060D2000-memory.dmp
memory/2208-3-0x0000000075320000-0x0000000075AD0000-memory.dmp
memory/2208-2-0x0000000005730000-0x0000000005796000-memory.dmp
memory/2208-0-0x000000007532E000-0x000000007532F000-memory.dmp
memory/2208-150-0x00000000063E0000-0x00000000063EA000-memory.dmp
memory/2208-1-0x0000000000CB0000-0x0000000000CF0000-memory.dmp
memory/2208-156-0x00000000074C0000-0x00000000074D2000-memory.dmp
memory/2208-181-0x00000000080C0000-0x00000000080CA000-memory.dmp
memory/2208-182-0x000000007532E000-0x000000007532F000-memory.dmp
memory/2208-183-0x0000000075320000-0x0000000075AD0000-memory.dmp
memory/2208-184-0x0000000075320000-0x0000000075AD0000-memory.dmp