453a5b876e51b859e400589c0066e0c51c0cf726e9936b312c83cde11a5f6169 | Triage

Sharing

General

Target

7cec818abbd6fa06cf360222e3d9d340_NeikiAnalytics.exe
Size

3.6MB
Sample

240531-jc1ppaca58
MD5

7cec818abbd6fa06cf360222e3d9d340
SHA1

e1f874853eb57d4bcc31e68ee29ba8e0d2220c05
SHA256

453a5b876e51b859e400589c0066e0c51c0cf726e9936b312c83cde11a5f6169
SHA512

b3af8bbf9496ac61ca405099180ea125fe42c70a38298c0222c36d9932e0b469c616ab95fc148e2195ab7a6e1b517bdc31f4b170bf25b35c8e1180046904ee73
SSDEEP

49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB9B/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUpmbVz8eLFcz

Score

7^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  7cec818abbd6fa06cf360222e3d9d340_NeikiAnalytics.exe
- Size
  
  3.6MB
- MD5
  
  7cec818abbd6fa06cf360222e3d9d340
- SHA1
  
  e1f874853eb57d4bcc31e68ee29ba8e0d2220c05
- SHA256
  
  453a5b876e51b859e400589c0066e0c51c0cf726e9936b312c83cde11a5f6169
- SHA512
  
  b3af8bbf9496ac61ca405099180ea125fe42c70a38298c0222c36d9932e0b469c616ab95fc148e2195ab7a6e1b517bdc31f4b170bf25b35c8e1180046904ee73
- SSDEEP
  
  49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB9B/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUpmbVz8eLFcz
Score

7^/10

persistence spyware stealer
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer