Overview

overview

10

Static

static

10

4b711fec53...cs.exe

windows7-x64

10

4b711fec53...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4b711fec536f7529a8f93657b8b4a4a0_NeikiAnalytics.exe

  • Size

    3.5MB

  • Sample

    240523-hh1ffagf36

  • MD5

    4b711fec536f7529a8f93657b8b4a4a0

  • SHA1

    daf7c29d2f876d1f451dc23a12427561c001f0ad

  • SHA256

    6daa61ce2492a4d4993796fc37c632466e7cc3fe681def68892c56fca32e7521

  • SHA512

    f24054ca3ed709a56a872711ac3c540159f694aa8a15a403ac3dc8457615d9d9d1e37948c7b439aeb23eea9af126e6e1f2d491ce8f27e710836cac19db945164

  • SSDEEP

    49152:6Q9tuyfjI6S2Hras/sXBIqY4Re8q7nShEI9Z5aKXuyd2AZ4cjj:NGWa5S7Ksvyd2AZ4cv

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      4b711fec536f7529a8f93657b8b4a4a0_NeikiAnalytics.exe

    • Size

      3.5MB

    • MD5

      4b711fec536f7529a8f93657b8b4a4a0

    • SHA1

      daf7c29d2f876d1f451dc23a12427561c001f0ad

    • SHA256

      6daa61ce2492a4d4993796fc37c632466e7cc3fe681def68892c56fca32e7521

    • SHA512

      f24054ca3ed709a56a872711ac3c540159f694aa8a15a403ac3dc8457615d9d9d1e37948c7b439aeb23eea9af126e6e1f2d491ce8f27e710836cac19db945164

    • SSDEEP

      49152:6Q9tuyfjI6S2Hras/sXBIqY4Re8q7nShEI9Z5aKXuyd2AZ4cjj:NGWa5S7Ksvyd2AZ4cv

    Score
    10/10
    neshtapersistencespywarestealer

    • Detect Neshta payload

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Privilege Escalation

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks