General

  • Target

    681d4d17d4097647a48ef286d051b7e01f42a8c2fae10065e3be065d490621ce_NeikiAnalytics.exe

  • Size

    2.9MB

  • Sample

    240621-ngvrfsxepd

  • MD5

    5b025cc9d67d12d8699766e418ea0250

  • SHA1

    195c6d43ed319762efede0e73fb9ea3580115bba

  • SHA256

    681d4d17d4097647a48ef286d051b7e01f42a8c2fae10065e3be065d490621ce

  • SHA512

    2fdceac8cc5a9f17ce1828426d846dbcebaeff59ca9180f0ee96d1d8ab8044d0bc50c47ecd69defdb65124519a5b83ec2c0f5efd284e1cc3ee6031adf4d1810e

  • SSDEEP

    49152:kI2WyD1T122NQ/FZ/0HLJ7DL8mY7YQDM9huDZls8n0WV9:CmDGK

Malware Config

Targets

    • Target

      681d4d17d4097647a48ef286d051b7e01f42a8c2fae10065e3be065d490621ce_NeikiAnalytics.exe

    • Size

      2.9MB

    • MD5

      5b025cc9d67d12d8699766e418ea0250

    • SHA1

      195c6d43ed319762efede0e73fb9ea3580115bba

    • SHA256

      681d4d17d4097647a48ef286d051b7e01f42a8c2fae10065e3be065d490621ce

    • SHA512

      2fdceac8cc5a9f17ce1828426d846dbcebaeff59ca9180f0ee96d1d8ab8044d0bc50c47ecd69defdb65124519a5b83ec2c0f5efd284e1cc3ee6031adf4d1810e

    • SSDEEP

      49152:kI2WyD1T122NQ/FZ/0HLJ7DL8mY7YQDM9huDZls8n0WV9:CmDGK

    • Detect Neshta payload

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Privilege Escalation

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

1
T1005

Tasks