General
-
Target
0bbb931a074cedbe1f6ccb5e57eb9940_NeikiAnalytics.exe
-
Size
5.7MB
-
Sample
240527-xacfzaeg39
-
MD5
0bbb931a074cedbe1f6ccb5e57eb9940
-
SHA1
7572e21383c936466554f23ab820d0f971b7b459
-
SHA256
f5d0b4c0ae4b1410fad3cdd51927d4597a8ce8fc4711ce221e2f6f4861d90eb9
-
SHA512
92eee60e6aed78e25a237ef48a5667b3c0a954ea0d75299d0f1bccc62d236187b4fc31a8aa4e15d2a9d9b26ab80a4fcf064a93d576fca32d73bc7058e1258646
-
SSDEEP
98304:k887H6P2uW5MI079g+DgeFahftplflf6dUwOEH6d8e6b0+hLVy9SkAMS:k8aH6eL2V76+DgTNfwZHYY1/YSh1
Behavioral task
behavioral1
Sample
0bbb931a074cedbe1f6ccb5e57eb9940_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0bbb931a074cedbe1f6ccb5e57eb9940_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
njrat
im523
nvidia
kids-notified.at.ply.gg:3845
565c7299a2f18977caf93e5da2f7e3c1
-
reg_key
565c7299a2f18977caf93e5da2f7e3c1
-
splitter
|'|'|
Targets
-
-
Target
0bbb931a074cedbe1f6ccb5e57eb9940_NeikiAnalytics.exe
-
Size
5.7MB
-
MD5
0bbb931a074cedbe1f6ccb5e57eb9940
-
SHA1
7572e21383c936466554f23ab820d0f971b7b459
-
SHA256
f5d0b4c0ae4b1410fad3cdd51927d4597a8ce8fc4711ce221e2f6f4861d90eb9
-
SHA512
92eee60e6aed78e25a237ef48a5667b3c0a954ea0d75299d0f1bccc62d236187b4fc31a8aa4e15d2a9d9b26ab80a4fcf064a93d576fca32d73bc7058e1258646
-
SSDEEP
98304:k887H6P2uW5MI079g+DgeFahftplflf6dUwOEH6d8e6b0+hLVy9SkAMS:k8aH6eL2V76+DgTNfwZHYY1/YSh1
Score10/10-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1