General
-
Target
f1a2f89c9b672d215c0ab2c3120beae0_NeikiAnalytics.exe
-
Size
4.1MB
-
Sample
240520-nb43yagh73
-
MD5
f1a2f89c9b672d215c0ab2c3120beae0
-
SHA1
6d3c7d3fed9f75366705c8903909bdfdcc47e8de
-
SHA256
417a979223fdeecc4f3d956eb53476fd604458e845173efb9c6df5d2e9b7770e
-
SHA512
2d085f492679364daee78cc6a825e355d189c455fc5a311cfa79d4be843da6e65712dd76acb9c06074002d65cfa541b06a99c0e2da865302c43a9e47e427c5a5
-
SSDEEP
98304:nQx32Mq02zAeaet/0/YHlEVnWsL/fnVsJseCa8CK6QwXNx08FM:Qx32Mq02zAeLCVnWszfVfeCa8CLXv/m
Static task
static1
Behavioral task
behavioral1
Sample
f1a2f89c9b672d215c0ab2c3120beae0_NeikiAnalytics.exe
Resource
win7-20240220-en
Malware Config
Targets
-
-
Target
f1a2f89c9b672d215c0ab2c3120beae0_NeikiAnalytics.exe
-
Size
4.1MB
-
MD5
f1a2f89c9b672d215c0ab2c3120beae0
-
SHA1
6d3c7d3fed9f75366705c8903909bdfdcc47e8de
-
SHA256
417a979223fdeecc4f3d956eb53476fd604458e845173efb9c6df5d2e9b7770e
-
SHA512
2d085f492679364daee78cc6a825e355d189c455fc5a311cfa79d4be843da6e65712dd76acb9c06074002d65cfa541b06a99c0e2da865302c43a9e47e427c5a5
-
SSDEEP
98304:nQx32Mq02zAeaet/0/YHlEVnWsL/fnVsJseCa8CK6QwXNx08FM:Qx32Mq02zAeLCVnWszfVfeCa8CLXv/m
-
Glupteba payload
-
Modifies boot configuration data using bcdedit
-
Drops file in Drivers directory
-
Modifies Windows Firewall
-
Possible attempt to disable PatchGuard
Rootkits can use kernel patching to embed themselves in an operating system.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1