General

  • Target

    93042f3f65ed73f67479b52d2bca77c0_NeikiAnalytics.exe

  • Size

    192KB

  • Sample

    240617-p9pata1hpa

  • MD5

    93042f3f65ed73f67479b52d2bca77c0

  • SHA1

    619097993e06f4bd8b8e5cbc72b646039e883568

  • SHA256

    a71e16da1442ec4dca9a520e986854379496e2145482e961a98cf62e46fe12da

  • SHA512

    4253cff58cce729fb58d2077db84ffe1212bb8194956abbb92d5ca715785ca8442128be58e395f22c6df46ec11f0100a2cc75cb36e9fa30f1effd00bfe6ec12b

  • SSDEEP

    6144:k9vBdVuYMJyfvMaVVq5HmUEQzXimwEQZQX:QrMJyfvMwO

Malware Config

Targets

    • Target

      93042f3f65ed73f67479b52d2bca77c0_NeikiAnalytics.exe

    • Size

      192KB

    • MD5

      93042f3f65ed73f67479b52d2bca77c0

    • SHA1

      619097993e06f4bd8b8e5cbc72b646039e883568

    • SHA256

      a71e16da1442ec4dca9a520e986854379496e2145482e961a98cf62e46fe12da

    • SHA512

      4253cff58cce729fb58d2077db84ffe1212bb8194956abbb92d5ca715785ca8442128be58e395f22c6df46ec11f0100a2cc75cb36e9fa30f1effd00bfe6ec12b

    • SSDEEP

      6144:k9vBdVuYMJyfvMaVVq5HmUEQzXimwEQZQX:QrMJyfvMwO

    • Detect Neshta payload

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Privilege Escalation

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

1
T1005

Tasks