8a205eb2de82354fba17ef8793ba5f99cfcb3a8b830f485d0fe0f7b2833065d9

Sharing

Copy URL Twitter E-mail

General

Target
a45e2482beb82d36042e23a506a1ffd0_NeikiAnalytics.exe
Size 9.5MB
Sample240603-qa99nsfc91
SHA256 8a205eb2de82354fba17ef8793ba5f99cfcb3a8b830f485d0fe0f7b2833065d9
MD5 a45e2482beb82d36042e23a506a1ffd0
SHA1 3d07fcb1ccd7a96e65a4942ae31ea4b59aa3a362
SHA512 0c98d9c8ace3f0c9d4dc26895935e1ca32739051ca6fcf3bcea392b2a66e5156931a7ab1f5c6580ba4638345c228a7d37c7e396ed079f5c709f9d9581a7ebd62
SSDEEP 196608:jSeE2E7TdIyHRhCrtAriSzyRKKYFBlags9qltnoFbaxc4GBGiadQSs0nqVCrxsp:jSJN57eKiJCUSnaax4QlQShkCr
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Targets

- Target
  a45e2482beb82d36042e23a506a1ffd0_NeikiAnalytics.exe
- Size 9.5MB
- SHA256 8a205eb2de82354fba17ef8793ba5f99cfcb3a8b830f485d0fe0f7b2833065d9
- MD5 a45e2482beb82d36042e23a506a1ffd0
- SHA1 3d07fcb1ccd7a96e65a4942ae31ea4b59aa3a362
- SHA512 0c98d9c8ace3f0c9d4dc26895935e1ca32739051ca6fcf3bcea392b2a66e5156931a7ab1f5c6580ba4638345c228a7d37c7e396ed079f5c709f9d9581a7ebd62
- SSDEEP 196608:jSeE2E7TdIyHRhCrtAriSzyRKKYFBlags9qltnoFbaxc4GBGiadQSs0nqVCrxsp:jSJN57eKiJCUSnaax4QlQShkCr
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2
- Target
  $LOCALAPPDATA/arphaCrashReport/arphaCrashReport64.exe
- Size 233KB
- SHA256 2b9a7960a5d7cc77318af937cadd47270fe5ada6e42067c241a2b9b0830c5f2c
- MD5 da5f97cab6279eed78b6f1d47aa267ed
- SHA1 6ae39162d0e1e32c0a8a51baaf3fab491a37c3f3
- SHA512 a1fbc66ffbb99f09a91487b5d2bf9285e76184fe23d3045b5b1eee185943541a9bbcdfbf33acf5edc754d8d25cec2e5ad823d477f57f3bcf00ac11792a510552
- SSDEEP 3072:TN9rZ5vuFomptSepjTxUPjfOgwXCtRLDya09M9EvoHmkQ/2Y8L0puG:PZ5qomPSeCx7tRNQjSo
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral3 behavioral4
- Target
  $LOCALAPPDATA/arphaCrashReport/arphadump64.dll
- Size 3.4MB
- SHA256 a5736a1535c81b3a15a5589cc0717a20e05fce0201bed7be96dbacca1fc47da2
- MD5 daacd794a6cbf927804a158cfaf14b09
- SHA1 a8247e9ee7c40423d0a8e14a41dc2713699c7860
- SHA512 edc0abfcc92ab51cc2578d2b0288b4df3af6aad02f983303073a137e0b8fbcb25e0c151e386fbe0b2dca279645cfc50fd53192c655af5884e8d8d2846d5f6686
- SSDEEP 98304:fCJTfEYHRjVHPCIq6UC98RRMjQNJX/sipEC2:GTsIpqkUCe4QvX/5p4
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706
- MD5 4add245d4ba34b04f213409bfe504c07
- SHA1 ef756d6581d70e87d58cc4982e3f4d18e0ea5b09
- SHA512 1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d
- SSDEEP 192:VjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZv0QPi:B/Qlt7wiij/lMRv/9V4bvr
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral7 behavioral8
- Target
  $PLUGINSDIR/nsProcess.dll
- Size 4KB
- SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
- MD5 f0438a894f3a7e01a4aae8d1b5dd0289
- SHA1 b058e3fcfb7b550041da16bf10d8837024c38bf6
- SHA512 f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
- SSDEEP 48:Sz4joMeH+Iwdf8Rom/L+rOnnk5/OCnXeAdbdOAa4GPI+CJ87eILzlq7gthwIsEQW:64c/eFdfS/SSnkxNa4G+ueqPuCtGsj
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral10 behavioral9

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10