General
-
Target
8f77f8b13b914f358059e3f7b9ddab70_NeikiAnalytics.exe
-
Size
139KB
-
Sample
240601-gcwdvscd43
-
MD5
8f77f8b13b914f358059e3f7b9ddab70
-
SHA1
d406a28486b4dd881c454e526e149b98c0ec8462
-
SHA256
c22c863186e9e86a07cdb7f214c4acede216405a09d4032a603e64931f6966e6
-
SHA512
b00ba88d36203e389021672b39839a172b58e492bb71afb33c9f53b9ba406a0cf5d61cb5bfe6f11dc40529be8424690737ce178d7dd4981b120ec4694f51abad
-
SSDEEP
3072:bNmWFIDmBFlT1wnCMjIM8pec/dAnXQdnbeFa7cMjGvA/v2QmZ6OGmfx7jHJm:b06BwnRlcCXUhcdv2uN5
Static task
static1
Behavioral task
behavioral1
Sample
8f77f8b13b914f358059e3f7b9ddab70_NeikiAnalytics.exe
Resource
win7-20240221-en
Malware Config
Extracted
xworm
answer-riverside.gl.at.ply.gg:45691
-
Install_directory
%AppData%
-
install_file
svhost.exe
Extracted
umbral
https://discordapp.com/api/webhooks/1239665745831530598/iJT0OELt4O4igXW_VMu-CUIfcqaawXLhyC4Bruuv1t2x0XOvC0_p9dc-G_RxJMO7fn-V
Targets
-
-
Target
8f77f8b13b914f358059e3f7b9ddab70_NeikiAnalytics.exe
-
Size
139KB
-
MD5
8f77f8b13b914f358059e3f7b9ddab70
-
SHA1
d406a28486b4dd881c454e526e149b98c0ec8462
-
SHA256
c22c863186e9e86a07cdb7f214c4acede216405a09d4032a603e64931f6966e6
-
SHA512
b00ba88d36203e389021672b39839a172b58e492bb71afb33c9f53b9ba406a0cf5d61cb5bfe6f11dc40529be8424690737ce178d7dd4981b120ec4694f51abad
-
SSDEEP
3072:bNmWFIDmBFlT1wnCMjIM8pec/dAnXQdnbeFa7cMjGvA/v2QmZ6OGmfx7jHJm:b06BwnRlcCXUhcdv2uN5
-
Detect Umbral payload
-
Detect Xworm Payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Drops file in Drivers directory
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1