Overview

overview

10

Static

static

10

4d0d8e63d7...cs.exe

windows7-x64

10

4d0d8e63d7...cs.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    4d0d8e63d70313a6d84836f018f98b50_NeikiAnalytics.exe

  • Size

    490KB

  • Sample

    240607-l672zaef6s

  • MD5

    4d0d8e63d70313a6d84836f018f98b50

  • SHA1

    d30c46ae7aee03ab20fd63f3c1ebefb3c5115cf4

  • SHA256

    efda70d55c27ae119914b42fb2672d65e6a2c2f4452b305811483beb47552233

  • SHA512

    dd109b88ef2e3835b6d85ae2968db5788c85e4010fb4ae3a2e3afdaa3e154ce2e75670fca1b17cadd560e5c855ed0d9c9300ba03e746a19513ddb5c42b9a2d8a

  • SSDEEP

    12288:D1VNc0zxG5+tpcKlx0gXFnbHbOYgZZZSsDJ:D1XcSxGwXWgXFr6YgZ

Score
10/10
xwormexecutionpersistencerattrojan

Malware Config

Targets

    • Target

      4d0d8e63d70313a6d84836f018f98b50_NeikiAnalytics.exe

    • Size

      490KB

    • MD5

      4d0d8e63d70313a6d84836f018f98b50

    • SHA1

      d30c46ae7aee03ab20fd63f3c1ebefb3c5115cf4

    • SHA256

      efda70d55c27ae119914b42fb2672d65e6a2c2f4452b305811483beb47552233

    • SHA512

      dd109b88ef2e3835b6d85ae2968db5788c85e4010fb4ae3a2e3afdaa3e154ce2e75670fca1b17cadd560e5c855ed0d9c9300ba03e746a19513ddb5c42b9a2d8a

    • SSDEEP

      12288:D1VNc0zxG5+tpcKlx0gXFnbHbOYgZZZSsDJ:D1XcSxGwXWgXFr6YgZ

    Score
    10/10
    xwormexecutionpersistencerattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks