Overview

overview

10

Static

static

10

75380b5b1d...cs.exe

windows7-x64

10

75380b5b1d...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe

  • Size

    1.8MB

  • Sample

    240518-cq142sff6v

  • MD5

    75380b5b1da1c990356a411f5d38e290

  • SHA1

    d9b8aaf2f3f7ee8f93667b12025d1438e469f951

  • SHA256

    28ffab77a5afe13fdbce08d144f8aa1c750d4c6cf68760e5bcb1b5b4feafe84c

  • SHA512

    17636fe6f617cd42a0e7a1f21b70e2741260658883afd771f83c9db91ab19762b42d1b2418b104084dab33b2229b1c4cc437849378bbcf9a866ec7afb9d8f8c1

  • SSDEEP

    49152:0C+dFCIoUZaYpzp/XhuemO50mhWlMQWbjcREOWFXXUR:0CrQaY3/xuM50mCMQWbDOWFi

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      75380b5b1da1c990356a411f5d38e290_NeikiAnalytics.exe

    • Size

      1.8MB

    • MD5

      75380b5b1da1c990356a411f5d38e290

    • SHA1

      d9b8aaf2f3f7ee8f93667b12025d1438e469f951

    • SHA256

      28ffab77a5afe13fdbce08d144f8aa1c750d4c6cf68760e5bcb1b5b4feafe84c

    • SHA512

      17636fe6f617cd42a0e7a1f21b70e2741260658883afd771f83c9db91ab19762b42d1b2418b104084dab33b2229b1c4cc437849378bbcf9a866ec7afb9d8f8c1

    • SSDEEP

      49152:0C+dFCIoUZaYpzp/XhuemO50mhWlMQWbjcREOWFXXUR:0CrQaY3/xuM50mCMQWbDOWFi

    Score
    10/10
    neshtapersistencespywarestealer

    • Detect Neshta payload

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Privilege Escalation

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks