Overview

overview

10

Static

static

10

a53b5348e5...cs.exe

windows7-x64

10

a53b5348e5...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a53b5348e5ae18479d37ad85c9f2cee0_NeikiAnalytics.exe

  • Size

    1.4MB

  • Sample

    240518-hfxlrsgc38

  • MD5

    a53b5348e5ae18479d37ad85c9f2cee0

  • SHA1

    b0b84d13dfc21409941603abe672869de46b7500

  • SHA256

    f699708fb6295eb6d33b1d266771687b1e35a7c2d405d2461effd6cc4dfbd021

  • SHA512

    715b84b8890e71c7ad68a43775bba2e737fd398f25370f46c92a66b6698565001ca8730f465cec3a78d4901e4ea0e1c2dbce71c0e3eae1eae0cf003a28138c6e

  • SSDEEP

    24576:GYiJzNebIimJcKO6uNXq36SyAZkh8+TMF1kW:G39NebIxvzUq3ZZkh8l1kW

Score
10/10
neshtaaspackv2persistencespywarestealer

Malware Config

Targets

    • Target

      a53b5348e5ae18479d37ad85c9f2cee0_NeikiAnalytics.exe

    • Size

      1.4MB

    • MD5

      a53b5348e5ae18479d37ad85c9f2cee0

    • SHA1

      b0b84d13dfc21409941603abe672869de46b7500

    • SHA256

      f699708fb6295eb6d33b1d266771687b1e35a7c2d405d2461effd6cc4dfbd021

    • SHA512

      715b84b8890e71c7ad68a43775bba2e737fd398f25370f46c92a66b6698565001ca8730f465cec3a78d4901e4ea0e1c2dbce71c0e3eae1eae0cf003a28138c6e

    • SSDEEP

      24576:GYiJzNebIimJcKO6uNXq36SyAZkh8+TMF1kW:G39NebIxvzUq3ZZkh8l1kW

    Score
    10/10
    neshtaaspackv2persistencespywarestealer

    • Detect Neshta payload

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

      aspackv2

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Privilege Escalation

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks