7b8a3ac938973ef60a7ff842bcfcb3319a8b23925752312b3387e74d6ec9cd9f | Triage

Sharing

General

Target

0d2451ac0e903faaee5bfa55abdc2080_NeikiAnalytics.exe
Size

99KB
Sample

240521-znqlvsab8x
MD5

0d2451ac0e903faaee5bfa55abdc2080
SHA1

cfaf443f73b359bed82c8e4f42e3865954c2e990
SHA256

7b8a3ac938973ef60a7ff842bcfcb3319a8b23925752312b3387e74d6ec9cd9f
SHA512

be59ffc553c992746d06f25dffb7fdefe6e24ae90103b0f4b13c143b19f897082dc2e0203d71ed4b46befa8b8535dc525034d47105e3834a574fe5076938107b
SSDEEP

1536:X7fbN3eEDhDPA/pICdUkbBtW7upvaLU0bI5taxKo0IOlnToIfvweJTdj+FuKo:L7DhdC6kzWypvaQ0FxyNTBfvtTdj+At

Score

10^/10

evasion trojan

Malware Config

Targets

- Target
  
  0d2451ac0e903faaee5bfa55abdc2080_NeikiAnalytics.exe
- Size
  
  99KB
- MD5
  
  0d2451ac0e903faaee5bfa55abdc2080
- SHA1
  
  cfaf443f73b359bed82c8e4f42e3865954c2e990
- SHA256
  
  7b8a3ac938973ef60a7ff842bcfcb3319a8b23925752312b3387e74d6ec9cd9f
- SHA512
  
  be59ffc553c992746d06f25dffb7fdefe6e24ae90103b0f4b13c143b19f897082dc2e0203d71ed4b46befa8b8535dc525034d47105e3834a574fe5076938107b
- SSDEEP
  
  1536:X7fbN3eEDhDPA/pICdUkbBtW7upvaLU0bI5taxKo0IOlnToIfvweJTdj+FuKo:L7DhdC6kzWypvaQ0FxyNTBfvtTdj+At
Score

10^/10

evasion trojan
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2