General

  • Target

    2c6a37c8bd46a7e725610d29b3b919f0_NeikiAnalytics.exe

  • Size

    409KB

  • Sample

    240611-h69n1syeka

  • MD5

    2c6a37c8bd46a7e725610d29b3b919f0

  • SHA1

    ff9f9775fa1c010c40d45a25f9f7e05b366f0742

  • SHA256

    60d6746812a059690e6bb7e94830ee3747f74b3e20005ea8e15a030d8f86f731

  • SHA512

    8520b67fe783bb2a7b710f100413c4034f7b853c85403b0693298080913ddee382018fc36df7ebe3c9afb4169b46f54115171fa22cc1922ebd23f6625358ef40

  • SSDEEP

    12288:vdDU6g13sJd1fm/+yb3O2jg82ydU/DdKumy:vdE3sJd1fm/+yb3OYg84/JHJ

Malware Config

Targets

    • Target

      2c6a37c8bd46a7e725610d29b3b919f0_NeikiAnalytics.exe

    • Size

      409KB

    • MD5

      2c6a37c8bd46a7e725610d29b3b919f0

    • SHA1

      ff9f9775fa1c010c40d45a25f9f7e05b366f0742

    • SHA256

      60d6746812a059690e6bb7e94830ee3747f74b3e20005ea8e15a030d8f86f731

    • SHA512

      8520b67fe783bb2a7b710f100413c4034f7b853c85403b0693298080913ddee382018fc36df7ebe3c9afb4169b46f54115171fa22cc1922ebd23f6625358ef40

    • SSDEEP

      12288:vdDU6g13sJd1fm/+yb3O2jg82ydU/DdKumy:vdE3sJd1fm/+yb3OYg84/JHJ

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

MITRE ATT&CK Enterprise v15

Tasks