Overview

overview

9

Static

static

3

f32311593d...cs.exe

windows7-x64

3

f32311593d...cs.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f32311593d5a1f714570a7b91d9100e0_NeikiAnalytics.exe

  • Size

    455KB

  • Sample

    240525-hlvdlahh26

  • MD5

    f32311593d5a1f714570a7b91d9100e0

  • SHA1

    c343c18f3f208cf7719550fa4aaec1d77840e7da

  • SHA256

    d87963dfe40f497ee7d3d94e57cd5738ecc61f3cf843873133a6cbddb0a7b359

  • SHA512

    794b86df535b509b2bc442fb04475b8a113f7e568e8c9b5d9ffaa54ca7b9a71db84af163189ddd75175be84214571355bdd21becffc2b3c3b909a22ba10e6b5c

  • SSDEEP

    12288:WVEue/UNolyeWYB0kGZFdLagJdF0S/xPaG9:WVEuegLagJdF0S5PaG9

Score
9/10
persistenceransomwarespywarestealer

Malware Config

Targets

    • Target

      f32311593d5a1f714570a7b91d9100e0_NeikiAnalytics.exe

    • Size

      455KB

    • MD5

      f32311593d5a1f714570a7b91d9100e0

    • SHA1

      c343c18f3f208cf7719550fa4aaec1d77840e7da

    • SHA256

      d87963dfe40f497ee7d3d94e57cd5738ecc61f3cf843873133a6cbddb0a7b359

    • SHA512

      794b86df535b509b2bc442fb04475b8a113f7e568e8c9b5d9ffaa54ca7b9a71db84af163189ddd75175be84214571355bdd21becffc2b3c3b909a22ba10e6b5c

    • SSDEEP

      12288:WVEue/UNolyeWYB0kGZFdLagJdF0S/xPaG9:WVEuegLagJdF0S5PaG9

    Score
    9/10
    persistenceransomwarespywarestealer

    • Renames multiple (220) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Drops file in Drivers directory

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks