Overview

overview

10

Static

static

10

4e3f1aff03...cs.exe

windows7-x64

10

4e3f1aff03...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4e3f1aff03d0d1ea400ec40aedca3cd0_NeikiAnalytics.exe

  • Size

    3.4MB

  • Sample

    240516-2rs79sce2z

  • MD5

    4e3f1aff03d0d1ea400ec40aedca3cd0

  • SHA1

    1e2db80e2e701545758553a9db90b3ccde8749fc

  • SHA256

    fc4fc051d9da8c2fa1548e071293d1240f2525d94774d8cbaef2ad8e5983a928

  • SHA512

    993307b2435ba698a8ec82eb1f9c22c26c8ed61c3f1f44bad999d578505e94176c77f65d928b491f7ef3284693aee2be39eb49b22c62ef97f8976cdb5a66dab5

  • SSDEEP

    49152:67N1ahCa0V7N1ahCL0V7N1ahCU0V7N1ahC/0V7N1ahCh:67n7+7B7C7h

Score
10/10
fakeavfakeavpersistencespyware

Malware Config

Targets

    • Target

      4e3f1aff03d0d1ea400ec40aedca3cd0_NeikiAnalytics.exe

    • Size

      3.4MB

    • MD5

      4e3f1aff03d0d1ea400ec40aedca3cd0

    • SHA1

      1e2db80e2e701545758553a9db90b3ccde8749fc

    • SHA256

      fc4fc051d9da8c2fa1548e071293d1240f2525d94774d8cbaef2ad8e5983a928

    • SHA512

      993307b2435ba698a8ec82eb1f9c22c26c8ed61c3f1f44bad999d578505e94176c77f65d928b491f7ef3284693aee2be39eb49b22c62ef97f8976cdb5a66dab5

    • SSDEEP

      49152:67N1ahCa0V7N1ahCL0V7N1ahCU0V7N1ahC/0V7N1ahCh:67n7+7B7C7h

    Score
    10/10
    fakeavfakeavpersistencespyware

    • FakeAV, RogueAntivirus

      FakeAV or Rogue AntiVirus is a class of malware that displays false alert messages.

      fakeavspywarefakeav

    • FakeAV payload

      fakeavspyware

    • Sets file execution options in registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks