General

  • Target

    cf7c76f1928cad9e45cb41b005a95b60_NeikiAnalytics

  • Size

    179KB

  • Sample

    240515-nd5ggseh95

  • MD5

    cf7c76f1928cad9e45cb41b005a95b60

  • SHA1

    2de2ab641fd99554acac35ab9d1963a2d8855a47

  • SHA256

    d61c947c5ff52bf474c5cc099f8c1b6b80ba074a7bfab6528ec4c4e507acaa40

  • SHA512

    526eb5a86d7ad46025056a9ddbc3084ce2033860281155f550c09f94b57c2552f3086b7496a72abc2e2791518271380501f58e741eb5fe79d4814be0c066d760

  • SSDEEP

    3072:FuOFvvJwfNJxrt0YVDXz+uUsI2E9yRdl6PNEh2aOUQS7bhfNH6i:FfvvJa5t0ez+u9I6SV+ySfhf

Malware Config

Targets

    • Target

      cf7c76f1928cad9e45cb41b005a95b60_NeikiAnalytics

    • Size

      179KB

    • MD5

      cf7c76f1928cad9e45cb41b005a95b60

    • SHA1

      2de2ab641fd99554acac35ab9d1963a2d8855a47

    • SHA256

      d61c947c5ff52bf474c5cc099f8c1b6b80ba074a7bfab6528ec4c4e507acaa40

    • SHA512

      526eb5a86d7ad46025056a9ddbc3084ce2033860281155f550c09f94b57c2552f3086b7496a72abc2e2791518271380501f58e741eb5fe79d4814be0c066d760

    • SSDEEP

      3072:FuOFvvJwfNJxrt0YVDXz+uUsI2E9yRdl6PNEh2aOUQS7bhfNH6i:FfvvJa5t0ez+u9I6SV+ySfhf

    • Blocklisted process makes network request

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

MITRE ATT&CK Enterprise v15

Tasks