4b9fd9bdab15b18e36ce8e004c18db311b1ab3f2e23406913f6bb7676a66e6f3 | Triage

Sharing

General

Target

4b9fd9bdab15b18e36ce8e004c18db311b1ab3f2e23406913f6bb7676a66e6f3_NeikiAnalytics.exe
Size

528KB
Sample

240625-k1wajstdlq
MD5

64f6c8d2608186042e74adbac3be52a0
SHA1

6060abad6f9a88b2e7f0fc0e28d5463c1eaf949d
SHA256

4b9fd9bdab15b18e36ce8e004c18db311b1ab3f2e23406913f6bb7676a66e6f3
SHA512

df9097737013ccfcbbb5258afc892c9ca8349227de0c1b170837a982ed560d820cec6f9cf8357d971b88d2648d3882f137b263e405d6d5a66fcd66e87dd69abd
SSDEEP

12288:hmLoLgmqLjKDzsMLYvNMy2RFQny1nve0m3:hmLoLgJLjKDzs9NMy2RFQny1nve0y

Score

7^/10

Malware Config

Targets

- Target
  
  4b9fd9bdab15b18e36ce8e004c18db311b1ab3f2e23406913f6bb7676a66e6f3_NeikiAnalytics.exe
- Size
  
  528KB
- MD5
  
  64f6c8d2608186042e74adbac3be52a0
- SHA1
  
  6060abad6f9a88b2e7f0fc0e28d5463c1eaf949d
- SHA256
  
  4b9fd9bdab15b18e36ce8e004c18db311b1ab3f2e23406913f6bb7676a66e6f3
- SHA512
  
  df9097737013ccfcbbb5258afc892c9ca8349227de0c1b170837a982ed560d820cec6f9cf8357d971b88d2648d3882f137b263e405d6d5a66fcd66e87dd69abd
- SSDEEP
  
  12288:hmLoLgmqLjKDzsMLYvNMy2RFQny1nve0m3:hmLoLgJLjKDzs9NMy2RFQny1nve0y
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2