General
-
Target
bebb67767b53cd13f67283cdc9bd9570_NeikiAnalytics.exe
-
Size
732KB
-
Sample
240517-g3j4hsdd78
-
MD5
bebb67767b53cd13f67283cdc9bd9570
-
SHA1
b02fe6f21cdf9a6377c2cf0b3de608f7117f6d90
-
SHA256
0c1c157c24d9fe99e7dadd695926dd3d61dfa973a8c7a755968b730b8815d1d2
-
SHA512
c2be48ff93f5645ccf5fc7305382c5ab4a803bd39d4165f6bd3a73e7daa8db6047708485b2f54c5eefb3637946b4e3eeece77c4ae9a507bcd88de1422770b7fa
-
SSDEEP
12288:WTyjXW+48qWywrU4kGFezOAVuJ5PIzww7F5DO3HYffIERagUj7K:MIXW/8yw1ez54lIvF5SXYHIMa/j7K
Static task
static1
Behavioral task
behavioral1
Sample
bebb67767b53cd13f67283cdc9bd9570_NeikiAnalytics.exe
Resource
win7-20240220-en
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Targets
-
-
Target
bebb67767b53cd13f67283cdc9bd9570_NeikiAnalytics.exe
-
Size
732KB
-
MD5
bebb67767b53cd13f67283cdc9bd9570
-
SHA1
b02fe6f21cdf9a6377c2cf0b3de608f7117f6d90
-
SHA256
0c1c157c24d9fe99e7dadd695926dd3d61dfa973a8c7a755968b730b8815d1d2
-
SHA512
c2be48ff93f5645ccf5fc7305382c5ab4a803bd39d4165f6bd3a73e7daa8db6047708485b2f54c5eefb3637946b4e3eeece77c4ae9a507bcd88de1422770b7fa
-
SSDEEP
12288:WTyjXW+48qWywrU4kGFezOAVuJ5PIzww7F5DO3HYffIERagUj7K:MIXW/8yw1ez54lIvF5SXYHIMa/j7K
-
Modifies firewall policy service
-
Modifies visibility of file extensions in Explorer
-
Modifies visiblity of hidden/system files in Explorer
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
8Hide Artifacts
2Hidden Files and Directories
2Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3