151edc0f964679e460a1e8e2f2e4635b0df82f698a813911ba8d1379149d2919 | Triage

Submit
Reports

Overview

overview

Static

static

7

4b8f0c2890...cs.exe

windows7-x64

4b8f0c2890...cs.exe

windows10-2004-x64

Sharing

General

Target

4b8f0c28907d5b2aa8ba0ee3adc06d80_NeikiAnalytics
Size

63KB
Sample

240515-2sbdvagb2y
MD5

4b8f0c28907d5b2aa8ba0ee3adc06d80
SHA1

c8b95cc08f22ad1e8140fe93da6fdcc929880f43
SHA256

151edc0f964679e460a1e8e2f2e4635b0df82f698a813911ba8d1379149d2919
SHA512

36514df502a69a4814a38852616696eac9b3b5845ce66dac90392945908e4cadb54b31f30f56441838afae5ae888fcbc29bd64d16e669eabb8bfcc711b90eb55
SSDEEP

768:jSxam3Usjr3REXXr8yxFChMp7v9DLKrzCnbcuyD7UVeQI5noRmcAvcV4RP0U+t6:jRsjdEIUFC2p79OCnouy8VDvAG4RsfU

Score

10^/10

evasion persistence upx

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

4b8f0c28907d5b2aa8ba0ee3adc06d80_NeikiAnalytics.exe

Resource

win7-20240215-en

evasion persistence upx

windows7-x64

19 signatures

150 seconds

Behavioral task

behavioral2

Sample

4b8f0c28907d5b2aa8ba0ee3adc06d80_NeikiAnalytics.exe

Resource

win10v2004-20240426-en

evasion persistence upx

windows10-2004-x64

17 signatures

150 seconds

Malware Config

Targets

- Target
  
  4b8f0c28907d5b2aa8ba0ee3adc06d80_NeikiAnalytics
- Size
  
  63KB
- MD5
  
  4b8f0c28907d5b2aa8ba0ee3adc06d80
- SHA1
  
  c8b95cc08f22ad1e8140fe93da6fdcc929880f43
- SHA256
  
  151edc0f964679e460a1e8e2f2e4635b0df82f698a813911ba8d1379149d2919
- SHA512
  
  36514df502a69a4814a38852616696eac9b3b5845ce66dac90392945908e4cadb54b31f30f56441838afae5ae888fcbc29bd64d16e669eabb8bfcc711b90eb55
- SSDEEP
  
  768:jSxam3Usjr3REXXr8yxFChMp7v9DLKrzCnbcuyD7UVeQI5noRmcAvcV4RP0U+t6:jRsjdEIUFC2p79OCnouy8VDvAG4RsfU
Score

10^/10

evasion persistence upx
- Modifies WinLogon for persistence
  persistence
- Modifies visibility of file extensions in Explorer
  evasion
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Disables RegEdit via registry modification
  evasion
- Disables use of System Restore points
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Event Triggered Execution

Change Default File Association

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Event Triggered Execution

Change Default File Association

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

evasionpersistenceupx

behavioral2

evasionpersistenceupx

© 2018-2025

Terms | Privacy