Overview

overview

10

Static

static

10

cd9f41f354...cs.exe

windows7-x64

10

cd9f41f354...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cd9f41f35413c358e9c4ae9831dc5450_NeikiAnalytics.exe

  • Size

    145KB

  • Sample

    240517-h7fsbsfc4w

  • MD5

    cd9f41f35413c358e9c4ae9831dc5450

  • SHA1

    897a7dcc7a5c8d9e0a51c15d7c37aa4894630fc9

  • SHA256

    0d3e02182e08e00610ad2c397281a1c85e5c110ebf22f419ced4bb0010154f12

  • SHA512

    4dadf3bec190f27aa56926eb44f0c683dfc967b71cd6b047b76232aac4727f60a3d279842e93cf90d37ff3099461291316bea82cbbd87b94f99c815020215739

  • SSDEEP

    3072:sr85C0EFYJE3nwzPdCNU/efHYTo+i9JStVS1/eI4pnTq:k9pFYOXwJigTZvEHGnTq

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      cd9f41f35413c358e9c4ae9831dc5450_NeikiAnalytics.exe

    • Size

      145KB

    • MD5

      cd9f41f35413c358e9c4ae9831dc5450

    • SHA1

      897a7dcc7a5c8d9e0a51c15d7c37aa4894630fc9

    • SHA256

      0d3e02182e08e00610ad2c397281a1c85e5c110ebf22f419ced4bb0010154f12

    • SHA512

      4dadf3bec190f27aa56926eb44f0c683dfc967b71cd6b047b76232aac4727f60a3d279842e93cf90d37ff3099461291316bea82cbbd87b94f99c815020215739

    • SSDEEP

      3072:sr85C0EFYJE3nwzPdCNU/efHYTo+i9JStVS1/eI4pnTq:k9pFYOXwJigTZvEHGnTq

    Score
    10/10
    neshtapersistencespywarestealer

    • Detect Neshta payload

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Privilege Escalation

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks