Overview

overview

8

Static

static

3

e23f4ad614...cs.dll

windows7-x64

8

e23f4ad614...cs.dll

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e23f4ad614f78dcb3f764230cf7dcac0_NeikiAnalytics

  • Size

    132KB

  • Sample

    240516-ryctrahc8y

  • MD5

    e23f4ad614f78dcb3f764230cf7dcac0

  • SHA1

    b3cc813950096b67918d2390bdc44cd2fd7690c0

  • SHA256

    5f60494ac4b93c4fae27a7d1d02dea2bfaa8ace8e4dcf89b08bc4ac5030348d1

  • SHA512

    a7c56df4a85b17fb69bd42c953beb751c187a510526c1be31ffb1c71359c6925555fc21a831b0af793cb428f42204104db754a57baf826895a831074ffbfe76b

  • SSDEEP

    3072:uaBrGi1vPTm3cf2q7QM0tYwk/cUJNVYRQ2OzSJGbBx3DeUaoc/Q7e2K:VHK6h7QMRhLF2eSIbBx3W47HK

Score
8/10
bootkitpersistencespywarestealer

Malware Config

Targets

    • Target

      e23f4ad614f78dcb3f764230cf7dcac0_NeikiAnalytics

    • Size

      132KB

    • MD5

      e23f4ad614f78dcb3f764230cf7dcac0

    • SHA1

      b3cc813950096b67918d2390bdc44cd2fd7690c0

    • SHA256

      5f60494ac4b93c4fae27a7d1d02dea2bfaa8ace8e4dcf89b08bc4ac5030348d1

    • SHA512

      a7c56df4a85b17fb69bd42c953beb751c187a510526c1be31ffb1c71359c6925555fc21a831b0af793cb428f42204104db754a57baf826895a831074ffbfe76b

    • SSDEEP

      3072:uaBrGi1vPTm3cf2q7QM0tYwk/cUJNVYRQ2OzSJGbBx3DeUaoc/Q7e2K:VHK6h7QMRhLF2eSIbBx3W47HK

    Score
    8/10
    bootkitpersistencespywarestealer

    • Blocklisted process makes network request

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks