21516c41344193827a1bb447a887d5f1b438c675e3c06adf8e8f1354420f41d2 | Triage

Sharing

General

Target

21516c41344193827a1bb447a887d5f1b438c675e3c06adf8e8f1354420f41d2_NeikiAnalytics.exe
Size

277KB
Sample

240625-28xxsasclk
MD5

32611d9830fd069336e9c9b4e8735c90
SHA1

43ead5ac2d007e3750c3eeb29c5b6b450e323b99
SHA256

21516c41344193827a1bb447a887d5f1b438c675e3c06adf8e8f1354420f41d2
SHA512

0365793a50b794e1cf86814496548dbcbf3cb8945235e71d04a4461d89e7da33245334ab9393b51e87c6d8047d018f4cbe54327270e87e250d5e625ef069bd3a
SSDEEP

6144:A//ICMmDRxs3NBRwESuGPMKOcv75zDYx97pMDsmd45wnMstCAfEq7F:A//vi9B6EdZKOGqx9NMIH5WSeF

Score

7^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  21516c41344193827a1bb447a887d5f1b438c675e3c06adf8e8f1354420f41d2_NeikiAnalytics.exe
- Size
  
  277KB
- MD5
  
  32611d9830fd069336e9c9b4e8735c90
- SHA1
  
  43ead5ac2d007e3750c3eeb29c5b6b450e323b99
- SHA256
  
  21516c41344193827a1bb447a887d5f1b438c675e3c06adf8e8f1354420f41d2
- SHA512
  
  0365793a50b794e1cf86814496548dbcbf3cb8945235e71d04a4461d89e7da33245334ab9393b51e87c6d8047d018f4cbe54327270e87e250d5e625ef069bd3a
- SSDEEP
  
  6144:A//ICMmDRxs3NBRwESuGPMKOcv75zDYx97pMDsmd45wnMstCAfEq7F:A//vi9B6EdZKOGqx9NMIH5WSeF
Score

7^/10

persistence spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer