Overview

overview

10

Static

static

7

0e804542da...cs.exe

windows7-x64

10

0e804542da...cs.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    0e804542da7a57970b1f172c0c8a9270_NeikiAnalytics.exe

  • Size

    2.5MB

  • Sample

    240527-abjkcahh48

  • MD5

    0e804542da7a57970b1f172c0c8a9270

  • SHA1

    800d9d626bed009ba35bd343a18b3b89ec5e3f41

  • SHA256

    93d839ef139cbf96de1bac7818ca26b8f03c2941c142d7c6df3415cba69c64c0

  • SHA512

    568f207d81cb6d06b01518d85c509b0b8958e5674e04f2e66c4b2e7e3c668c7049e816e35846a6e2dc4b0ec32720b97ef8b2d257787ad9362ac68028fb5f1899

  • SSDEEP

    49152:dxmvumkQ9lY9sgUXdTPSxdQ8KX75IyuWuCjcCqWOyx2:dxx9NUFkQx753uWuCyyx2

Score
10/10
evasionpersistencethemidatrojan

Malware Config

Targets

    • Target

      0e804542da7a57970b1f172c0c8a9270_NeikiAnalytics.exe

    • Size

      2.5MB

    • MD5

      0e804542da7a57970b1f172c0c8a9270

    • SHA1

      800d9d626bed009ba35bd343a18b3b89ec5e3f41

    • SHA256

      93d839ef139cbf96de1bac7818ca26b8f03c2941c142d7c6df3415cba69c64c0

    • SHA512

      568f207d81cb6d06b01518d85c509b0b8958e5674e04f2e66c4b2e7e3c668c7049e816e35846a6e2dc4b0ec32720b97ef8b2d257787ad9362ac68028fb5f1899

    • SSDEEP

      49152:dxmvumkQ9lY9sgUXdTPSxdQ8KX75IyuWuCjcCqWOyx2:dxx9NUFkQx753uWuCyyx2

    Score
    10/10
    evasionpersistencethemidatrojan

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Executes dropped EXE

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks