561b9c9dd868a2f96a82317135940eff88e4c99b9024d8610956208f9fdc284c | Triage

Sharing

General

Target

561b9c9dd868a2f96a82317135940eff88e4c99b9024d8610956208f9fdc284c_NeikiAnalytics.exe
Size

496KB
Sample

240624-j8vhjswcpl
MD5

a7088b1746cee86ba2c809a2afd47c70
SHA1

7a2cb0496f61bfc134a533e6e29ff5c1775902ee
SHA256

561b9c9dd868a2f96a82317135940eff88e4c99b9024d8610956208f9fdc284c
SHA512

3b79aadd965cdcacd9904acc0f65c1b5cb30628f28a75778597ddaa15267f852918882524f33ab43c151b24b73c7d003f05e2ec1d281827b2417fa57755e42ff
SSDEEP

12288:dXCNi9B6M0AOApludKHzTaj50pzdmSC58VKTl+8h4:oW+7muMTTgIYnTl+8O

Score

7^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  561b9c9dd868a2f96a82317135940eff88e4c99b9024d8610956208f9fdc284c_NeikiAnalytics.exe
- Size
  
  496KB
- MD5
  
  a7088b1746cee86ba2c809a2afd47c70
- SHA1
  
  7a2cb0496f61bfc134a533e6e29ff5c1775902ee
- SHA256
  
  561b9c9dd868a2f96a82317135940eff88e4c99b9024d8610956208f9fdc284c
- SHA512
  
  3b79aadd965cdcacd9904acc0f65c1b5cb30628f28a75778597ddaa15267f852918882524f33ab43c151b24b73c7d003f05e2ec1d281827b2417fa57755e42ff
- SSDEEP
  
  12288:dXCNi9B6M0AOApludKHzTaj50pzdmSC58VKTl+8h4:oW+7muMTTgIYnTl+8O
Score

7^/10

persistence spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer