Overview

overview

10

Static

static

7

6ae576599d...cs.exe

windows7-x64

10

6ae576599d...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6ae576599df129801c1d688383cc7b30_NeikiAnalytics.exe

  • Size

    676KB

  • Sample

    240523-bmtecsgb4v

  • MD5

    6ae576599df129801c1d688383cc7b30

  • SHA1

    9af7ab3a09dae1c17a8b9a29cbcfbd4b0d0773c9

  • SHA256

    07a253f3701752b8e7ea37878a4dcc3dbb58eb35a20d954f13a57c7af3b55db8

  • SHA512

    a89ced72bd6f3e43e93d3820cd5f561edc31b73d0a80c6361ae382d565559149a58ced363ad5e8e892b98feb8fdadbbdcff691a1467c8d8ac0371db18e4b4fa1

  • SSDEEP

    12288:9kiL11aPKT1F5Vs+TVonB7krqRTUWfIVzJVUYMiGx/OHWtWOaC:9ki+PKT1F5S7BgORTWJOXBSC

Score
10/10
evasionpersistenceupx

Malware Config

Targets

    • Target

      6ae576599df129801c1d688383cc7b30_NeikiAnalytics.exe

    • Size

      676KB

    • MD5

      6ae576599df129801c1d688383cc7b30

    • SHA1

      9af7ab3a09dae1c17a8b9a29cbcfbd4b0d0773c9

    • SHA256

      07a253f3701752b8e7ea37878a4dcc3dbb58eb35a20d954f13a57c7af3b55db8

    • SHA512

      a89ced72bd6f3e43e93d3820cd5f561edc31b73d0a80c6361ae382d565559149a58ced363ad5e8e892b98feb8fdadbbdcff691a1467c8d8ac0371db18e4b4fa1

    • SSDEEP

      12288:9kiL11aPKT1F5Vs+TVonB7krqRTUWfIVzJVUYMiGx/OHWtWOaC:9ki+PKT1F5S7BgORTWJOXBSC

    Score
    10/10
    evasionpersistenceupx

    • Modifies firewall policy service

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

3
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks