Overview

overview

9

Static

static

3

0b81ef03b3...KI.exe

windows10-2004-x64

9

Resubmissions

10-05-2024 16:59

240510-vhfr9aba52 9

08-05-2024 18:23

240508-w1wf4abe44 9

08-05-2024 18:19

240508-wx8l9abc89 9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0b81ef03b31814d3acedab5aaf5309e0_NEIKI

  • Size

    200KB

  • Sample

    240508-w1wf4abe44

  • MD5

    0b81ef03b31814d3acedab5aaf5309e0

  • SHA1

    d12cbb05fc6fe76ff93ffd65d570e5c524e03d8a

  • SHA256

    193a27032f87a4a94b31211d961ed4957f80ee0e1dae95a2be9d9c77e4cf1d70

  • SHA512

    a9209d36e125fc748e14cde58c7bdcfe419931a465328368bddd153482fb66abcb102fc74b0c78f950df083302b8aed9da71822f26d1fc879b082bc3d936bfd1

  • SSDEEP

    3072:6e7WpMNca3rytOkWpXfnYRl2l5Q2jEj626ZmZY:RqKB+tOkWKR0nQ2jEj626ZmZY

Score
9/10
ransomwarespywarestealer

Malware Config

Targets

    • Target

      0b81ef03b31814d3acedab5aaf5309e0_NEIKI

    • Size

      200KB

    • MD5

      0b81ef03b31814d3acedab5aaf5309e0

    • SHA1

      d12cbb05fc6fe76ff93ffd65d570e5c524e03d8a

    • SHA256

      193a27032f87a4a94b31211d961ed4957f80ee0e1dae95a2be9d9c77e4cf1d70

    • SHA512

      a9209d36e125fc748e14cde58c7bdcfe419931a465328368bddd153482fb66abcb102fc74b0c78f950df083302b8aed9da71822f26d1fc879b082bc3d936bfd1

    • SSDEEP

      3072:6e7WpMNca3rytOkWpXfnYRl2l5Q2jEj626ZmZY:RqKB+tOkWKR0nQ2jEj626ZmZY

    Score
    9/10
    ransomwarespywarestealer

    • Renames multiple (20181) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks