General

  • Target

    8caba5539f961fd189df9a68172a5220_NeikiAnalytics.exe

  • Size

    2.5MB

  • Sample

    240603-wzzr5aee7x

  • MD5

    8caba5539f961fd189df9a68172a5220

  • SHA1

    25210f5f0f40881a89fd069147e449625e0e4d7f

  • SHA256

    595ec88c1a487624e22df620033139ab1db30a43880dd0f65c5bf2a2483a64fc

  • SHA512

    10f79505416336109e3bc51d3c1910c5e4f62837ce0946d7ed5a1dad0629fe599291dc1cfb415174e479b43b54c3e158beec35d21730ecffafee62898c5fe792

  • SSDEEP

    49152:gxmvumkQ9lY9sgUXdTPSxdQ8KX75IyuWuCjcCqWOyx0:gxx9NUFkQx753uWuCyyx0

Malware Config

Targets

    • Target

      8caba5539f961fd189df9a68172a5220_NeikiAnalytics.exe

    • Size

      2.5MB

    • MD5

      8caba5539f961fd189df9a68172a5220

    • SHA1

      25210f5f0f40881a89fd069147e449625e0e4d7f

    • SHA256

      595ec88c1a487624e22df620033139ab1db30a43880dd0f65c5bf2a2483a64fc

    • SHA512

      10f79505416336109e3bc51d3c1910c5e4f62837ce0946d7ed5a1dad0629fe599291dc1cfb415174e479b43b54c3e158beec35d21730ecffafee62898c5fe792

    • SSDEEP

      49152:gxmvumkQ9lY9sgUXdTPSxdQ8KX75IyuWuCjcCqWOyx0:gxx9NUFkQx753uWuCyyx0

    • Modifies visiblity of hidden/system files in Explorer

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Executes dropped EXE

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

    • Adds Run key to start application

    • Checks whether UAC is enabled

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Matrix ATT&CK v13

Execution

Scheduled Task/Job

1
T1053

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Defense Evasion

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Modify Registry

2
T1112

Virtualization/Sandbox Evasion

1
T1497

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

2
T1082

Tasks