Overview

overview

10

Static

static

3

c09c46023f...cs.exe

windows7-x64

10

c09c46023f...cs.exe

windows10-2004-x64

7

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows7-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

uninst.exe

windows7-x64

7

uninst.exe

windows10-2004-x64

7

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c09c46023f6168d6a7a187c0b3825f90_NeikiAnalytics

  • Size

    568KB

  • Sample

    240514-ln9svaaf3z

  • MD5

    c09c46023f6168d6a7a187c0b3825f90

  • SHA1

    a164c14092bdf0a6598b3b626bde703e4033842b

  • SHA256

    a469d8ec35c86e1e94f31c37c3008a3e445fee8c62a0f855716e2fe6bd906e19

  • SHA512

    aebe54f29cb84f54de7a75553caaba3737adaef18551a53f58126edb1a22efa3a318a4f0a5c16c2e1be5133b3286c116ca81b113bfa83f6314ea286d09cc1de9

  • SSDEEP

    12288:Z2yY+WSQP0Wp4xvOKcmKYVI8hKR5QFMjGH8SeawPT/ac/HttL4if1:Z2yY+4P7pIjc/YVThQcH8SeNTLn1

Score
10/10
imminentpersistencespywaretrojan

Malware Config

Targets

    • Target

      c09c46023f6168d6a7a187c0b3825f90_NeikiAnalytics

    • Size

      568KB

    • MD5

      c09c46023f6168d6a7a187c0b3825f90

    • SHA1

      a164c14092bdf0a6598b3b626bde703e4033842b

    • SHA256

      a469d8ec35c86e1e94f31c37c3008a3e445fee8c62a0f855716e2fe6bd906e19

    • SHA512

      aebe54f29cb84f54de7a75553caaba3737adaef18551a53f58126edb1a22efa3a318a4f0a5c16c2e1be5133b3286c116ca81b113bfa83f6314ea286d09cc1de9

    • SSDEEP

      12288:Z2yY+WSQP0Wp4xvOKcmKYVI8hKR5QFMjGH8SeawPT/ac/HttL4if1:Z2yY+4P7pIjc/YVThQcH8SeNTLn1

    Score
    10/10
    imminentpersistencespywaretrojan

    • Imminent RAT

      Remote-access trojan based on Imminent Monitor remote admin software.

      trojanspywareimminent

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/LangDLL.dll

    • Size

      5KB

    • MD5

      ea60c7bd5edd6048601729bd31362c16

    • SHA1

      6e6919d969eb61a141595014395b6c3f44139073

    • SHA256

      4e72c8b4d36f128b25281440e59e39af7ec2080d02e024f35ac413d769d91f39

    • SHA512

      f9dc35220697153bb06e3a06caf645079881cb75aed008dbe5381ecaf3442d5be03500b36bbca8b3d114845fac3d667ddf4063c16bc35d29bbea862930939993

    • SSDEEP

      48:im1nEhqneMPUptuMMNvimk2BAZuMTRCpYEvJdUJvR0J6of5dwe:F1jpl9NLBAZuYtR0xd

    Score
    3/10
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      55a26d7800446f1373056064c64c3ce8

    • SHA1

      80256857e9a0a9c8897923b717f3435295a76002

    • SHA256

      904fd5481d72f4e03b01a455f848dedd095d0fb17e33608e0d849f5196fb6ff8

    • SHA512

      04b8ab7a85c26f188c0a06f524488d6f2ac2884bf107c860c82e94ae12c3859f825133d78338fd2b594dfc48f7dc9888ae76fee786c6252a5c77c88755128a5b

    • SSDEEP

      192:MPtkumJX7zBE2kGwfy9S9VkPsFQ1Mx1c:97O2k5q9wA1Mxa

    Score
    3/10
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/nsDialogs.dll

    • Size

      9KB

    • MD5

      ee449b0adce56fbfa433b0239f3f81be

    • SHA1

      ec1e4f9815ea592a3f19b1fe473329b8ddfa201c

    • SHA256

      c1cc3aa4326e83a73a778dee0cf9afcc03a6bafb0a32cea791a27eb9c2288985

    • SHA512

      22fb25bc7628946213e6e970a865d3fbd50d12ce559c37d6848a82c28fa6be09fedffc3b87d5aea8dcfe8dfc4e0f129d9f02e32dae764b8e6a08332b42386686

    • SSDEEP

      96:oCqZ4zC5RH3cXX1LlYlRowycxM2DjDf3GEst+Nt+jvDYx4iqndYHnxss:oCq+CP3uKrpyREs06Yx+dGn

    Score
    3/10
    behavioral7behavioral8

    • Target

      $PLUGINSDIR/nsExec.dll

    • Size

      6KB

    • MD5

      b38561661a7164e3bbb04edc3718fe89

    • SHA1

      f13c873c8db121ba21244b1e9a457204360d543f

    • SHA256

      c2c88e4a32c734b0cb4ae507c1a9a1b417a2375079111fb1b35fab23aedd41d9

    • SHA512

      fedcaac20722de3519382011ccf22314af3edcd11b69f814db14710966853b69b9b5fc98383edcdb64d050ff825264eaba27b1c5adfe61d1fc9d77f13a052ced

    • SSDEEP

      96:f7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNPS3e:zXhHR0aTQN4gRHdMqJVgNPR

    Score
    3/10
    behavioral10behavioral9

    • Target

      uninst.exe

    • Size

      77KB

    • MD5

      3480cddfab2ad4fb9166adb1d1bfa37a

    • SHA1

      9004b51c1c6855ebae9dbf15a13ed9856637c872

    • SHA256

      c4b87136cac18013c7e218730481542d3f68f67a3ec830018517802872996084

    • SHA512

      e2052bbeb1ff67dc1c2be223f6d26d29a04ba4c24f287e7e251600d4eb9849953eee105e3a61d46b08ee683c3693363df08513dc04fdfcbfa335e387cf882375

    • SSDEEP

      1536:fU+dcy3fxBk9UmZHs/hc/UYRN6QcIG3jAH5Hskb4:fNzPHk9Mpc/UqSo6kc

    Score
    7/10

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral11behavioral12

    • Target

      $PLUGINSDIR/LangDLL.dll

    • Size

      5KB

    • MD5

      ea60c7bd5edd6048601729bd31362c16

    • SHA1

      6e6919d969eb61a141595014395b6c3f44139073

    • SHA256

      4e72c8b4d36f128b25281440e59e39af7ec2080d02e024f35ac413d769d91f39

    • SHA512

      f9dc35220697153bb06e3a06caf645079881cb75aed008dbe5381ecaf3442d5be03500b36bbca8b3d114845fac3d667ddf4063c16bc35d29bbea862930939993

    • SSDEEP

      48:im1nEhqneMPUptuMMNvimk2BAZuMTRCpYEvJdUJvR0J6of5dwe:F1jpl9NLBAZuYtR0xd

    Score
    3/10
    behavioral13behavioral14

MITRE ATT&CK Enterprise v15

Tasks