362f4b21468484d6b00d9c72b30db49ee43303ccc362e87a3a14ff4c1b662354 | Triage

Sharing

General

Target

362f4b21468484d6b00d9c72b30db49ee43303ccc362e87a3a14ff4c1b662354_NeikiAnalytics.exe
Size

1.1MB
Sample

240701-fcc2vazdrn
MD5

d6649a6778c42d3a73da84e7926bc8b0
SHA1

9c52d5828c9a93a8c2eccb2587a032f9772f4003
SHA256

362f4b21468484d6b00d9c72b30db49ee43303ccc362e87a3a14ff4c1b662354
SHA512

cc1a33661a7ca8997f8095c591779d9af1478d65c3e14e5490c3d0e19146ddb974a3883b51fbfee70efca03834397dd2ad0139098aa8b8968cb818cba630b675
SSDEEP

24576:COyOuKpA9temTKNaX5SH/l16Vf0OPI/CXpgZ0u:CbOu6AfLKsgd0D8CuZR

Score

7^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  362f4b21468484d6b00d9c72b30db49ee43303ccc362e87a3a14ff4c1b662354_NeikiAnalytics.exe
- Size
  
  1.1MB
- MD5
  
  d6649a6778c42d3a73da84e7926bc8b0
- SHA1
  
  9c52d5828c9a93a8c2eccb2587a032f9772f4003
- SHA256
  
  362f4b21468484d6b00d9c72b30db49ee43303ccc362e87a3a14ff4c1b662354
- SHA512
  
  cc1a33661a7ca8997f8095c591779d9af1478d65c3e14e5490c3d0e19146ddb974a3883b51fbfee70efca03834397dd2ad0139098aa8b8968cb818cba630b675
- SSDEEP
  
  24576:COyOuKpA9temTKNaX5SH/l16Vf0OPI/CXpgZ0u:CbOu6AfLKsgd0D8CuZR
Score

7^/10

persistence spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer