General
-
Target
4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics
-
Size
744KB
-
Sample
240521-phpr9sde22
-
MD5
d26dc22db6445c1ce36114677a5e7240
-
SHA1
97a7668972f7fc8c33eef6ea828b597203470085
-
SHA256
4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4
-
SHA512
b21747d8d0ab194429d03118e824b061bb7619eabd45e5f687cf715b2bdb836de550019d1447cf6ac84d3e7060c5153b8d976317199f45e2280329a4313846a1
-
SSDEEP
12288:kTyjXW+48qWywrU4kGFezOAVuJ5PIQww7F5DO3HYffXXjYBw:SIXW/8yw1ez54lImF5SXYHn8y
Static task
static1
Behavioral task
behavioral1
Sample
4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe
Resource
win7-20240419-en
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Targets
-
-
Target
4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics
-
Size
744KB
-
MD5
d26dc22db6445c1ce36114677a5e7240
-
SHA1
97a7668972f7fc8c33eef6ea828b597203470085
-
SHA256
4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4
-
SHA512
b21747d8d0ab194429d03118e824b061bb7619eabd45e5f687cf715b2bdb836de550019d1447cf6ac84d3e7060c5153b8d976317199f45e2280329a4313846a1
-
SSDEEP
12288:kTyjXW+48qWywrU4kGFezOAVuJ5PIQww7F5DO3HYffXXjYBw:SIXW/8yw1ez54lImF5SXYHn8y
-
Modifies firewall policy service
-
Modifies visibility of file extensions in Explorer
-
Modifies visiblity of hidden/system files in Explorer
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
8Hide Artifacts
2Hidden Files and Directories
2Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3