Overview

overview

7

Static

static

3

35a1e6edfb...cs.exe

windows7-x64

7

35a1e6edfb...cs.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    35a1e6edfbb594a21e5daede5c63e590_NeikiAnalytics.exe

  • Size

    12KB

  • Sample

    240522-zdpltafg59

  • MD5

    35a1e6edfbb594a21e5daede5c63e590

  • SHA1

    6d1236953a53d76cf81bf7b82bae34de85d59c66

  • SHA256

    bc56d02cab262bc61ddf93b168d4d8570607d9ef55de663195459ddf3e779bfb

  • SHA512

    3d5b43b48f190d2876f674bf40e53975f5229e773f399b93c571021244bff5507b4e9acf269bf52748050e84510417a374da246445cc0a272d2ba7f7014c6a55

  • SSDEEP

    384:zL7li/2zGq2DcEQvdQcJKLTp/NK9xaX4:XuMCQ9cX4

Score
7/10

Malware Config

Targets

    • Target

      35a1e6edfbb594a21e5daede5c63e590_NeikiAnalytics.exe

    • Size

      12KB

    • MD5

      35a1e6edfbb594a21e5daede5c63e590

    • SHA1

      6d1236953a53d76cf81bf7b82bae34de85d59c66

    • SHA256

      bc56d02cab262bc61ddf93b168d4d8570607d9ef55de663195459ddf3e779bfb

    • SHA512

      3d5b43b48f190d2876f674bf40e53975f5229e773f399b93c571021244bff5507b4e9acf269bf52748050e84510417a374da246445cc0a272d2ba7f7014c6a55

    • SSDEEP

      384:zL7li/2zGq2DcEQvdQcJKLTp/NK9xaX4:XuMCQ9cX4

    Score
    7/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scripting

1
T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks