101f8e1d63499178f1332aca65aef78c7390b4fde173ce1ca1a9de05b1ad034a | Triage

Sharing

General

Target

2ed8303397a8aa834fa56aa41ec31820_NeikiAnalytics.exe
Size

171KB
Sample

240525-2sdh7sdd3y
MD5

2ed8303397a8aa834fa56aa41ec31820
SHA1

e5d247cff6e190dd6ce17cc3830082dd67226333
SHA256

101f8e1d63499178f1332aca65aef78c7390b4fde173ce1ca1a9de05b1ad034a
SHA512

78eae7dd88ea83ddd74b12b71aa7f5f517a0d243032aa47e982a5afc818759197cb8197a70a2b07b87f6c5ce7eb70658e0a27b83ffd869f8d1b9f8c6acac0788
SSDEEP

3072:sCx969mf1oCBEyUmY8Hb6smCDpDjL0dbKKHwYLWekmRaMBQoVqy8j2GEctsMYDCq:sCzn9BVUmFH5hpDiqY/LHVl8yhxJg2

Score

8^/10

bootkit persistence spyware stealer

Malware Config

Targets

- Target
  
  2ed8303397a8aa834fa56aa41ec31820_NeikiAnalytics.exe
- Size
  
  171KB
- MD5
  
  2ed8303397a8aa834fa56aa41ec31820
- SHA1
  
  e5d247cff6e190dd6ce17cc3830082dd67226333
- SHA256
  
  101f8e1d63499178f1332aca65aef78c7390b4fde173ce1ca1a9de05b1ad034a
- SHA512
  
  78eae7dd88ea83ddd74b12b71aa7f5f517a0d243032aa47e982a5afc818759197cb8197a70a2b07b87f6c5ce7eb70658e0a27b83ffd869f8d1b9f8c6acac0788
- SSDEEP
  
  3072:sCx969mf1oCBEyUmY8Hb6smCDpDjL0dbKKHwYLWekmRaMBQoVqy8j2GEctsMYDCq:sCzn9BVUmFH5hpDiqY/LHVl8yhxJg2
Score

8^/10

bootkit persistence spyware stealer
- Blocklisted process makes network request
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Pre-OS Boot

Bootkit

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Pre-OS Boot

Bootkit

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bootkitpersistencespywarestealer

behavioral2

bootkitpersistencespywarestealer