General

  • Target

    ea849e62ada93c7767054f58fcbca120_NeikiAnalytics.exe

  • Size

    116KB

  • Sample

    240517-njrsksfd4w

  • MD5

    ea849e62ada93c7767054f58fcbca120

  • SHA1

    e146842918f7261af367e87b5c592777a4055c16

  • SHA256

    1c248cd310faf27c13883256841a0e9690016cf3918c543d06dc64a685dd5e97

  • SHA512

    b89afce50c4dfcc8eec227f54b5db2503a656e7c6e51252969d3e1bd32ddffef7731779aa578682d9782955312d5b92e1b89a3c1f7582d4b68bcfe235d46b682

  • SSDEEP

    1536:aJUGCqveEeXdTeG4wu6oQuwEhQQWKXJR721rSTdk/cpAKdlaKrorkgA55ip:aHFveEyTAK7VKXXS1GT7AKzaKrtP55ip

Malware Config

Targets

    • Target

      ea849e62ada93c7767054f58fcbca120_NeikiAnalytics.exe

    • Size

      116KB

    • MD5

      ea849e62ada93c7767054f58fcbca120

    • SHA1

      e146842918f7261af367e87b5c592777a4055c16

    • SHA256

      1c248cd310faf27c13883256841a0e9690016cf3918c543d06dc64a685dd5e97

    • SHA512

      b89afce50c4dfcc8eec227f54b5db2503a656e7c6e51252969d3e1bd32ddffef7731779aa578682d9782955312d5b92e1b89a3c1f7582d4b68bcfe235d46b682

    • SSDEEP

      1536:aJUGCqveEeXdTeG4wu6oQuwEhQQWKXJR721rSTdk/cpAKdlaKrorkgA55ip:aHFveEyTAK7VKXXS1GT7AKzaKrtP55ip

    • Blocklisted process makes network request

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

MITRE ATT&CK Enterprise v15

Tasks