General

  • Target

    74b87b43fa96edf6c9e07069d490ad2945494a959feb4a65d3f1de9d24150bb6_NeikiAnalytics.exe

  • Size

    2.7MB

  • Sample

    240622-ba58dstbnr

  • MD5

    823bb59fde1a34ff44decd87379fd890

  • SHA1

    73177506d268c08ff8179f37937eadbaf4625300

  • SHA256

    74b87b43fa96edf6c9e07069d490ad2945494a959feb4a65d3f1de9d24150bb6

  • SHA512

    fce7a238320d330371c54b6fe2f973b38784ac465e5f8554e8a2aa58f3222426ede2cc47ed42988b98cd107aa8cee5926da06974e44277b10b8c49249ec58a13

  • SSDEEP

    49152:t6v2CAUryzQPcwG8neMPQVFtiQzD/O0Yzaee28XZ3mFC:t6v2CAUr+Q3IVFtdzTWaeZ8J

Malware Config

Targets

    • Target

      74b87b43fa96edf6c9e07069d490ad2945494a959feb4a65d3f1de9d24150bb6_NeikiAnalytics.exe

    • Size

      2.7MB

    • MD5

      823bb59fde1a34ff44decd87379fd890

    • SHA1

      73177506d268c08ff8179f37937eadbaf4625300

    • SHA256

      74b87b43fa96edf6c9e07069d490ad2945494a959feb4a65d3f1de9d24150bb6

    • SHA512

      fce7a238320d330371c54b6fe2f973b38784ac465e5f8554e8a2aa58f3222426ede2cc47ed42988b98cd107aa8cee5926da06974e44277b10b8c49249ec58a13

    • SSDEEP

      49152:t6v2CAUryzQPcwG8neMPQVFtiQzD/O0Yzaee28XZ3mFC:t6v2CAUr+Q3IVFtdzTWaeZ8J

    • Detect Neshta payload

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Modifies system executable filetype association

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Privilege Escalation

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

1
T1005

Tasks