393356813078f635939213feab46d7fc454e5830d2b240d01ea7abc28347e54d | Triage

Sharing

General

Target

393356813078f635939213feab46d7fc454e5830d2b240d01ea7abc28347e54d_NeikiAnalytics.exe
Size

686KB
Sample

240701-gasj7a1bqr
MD5

57ef1ce375a5ca03a2351e887ff55ab0
SHA1

bb9b68af7fd202c6581f631156a20d989256f906
SHA256

393356813078f635939213feab46d7fc454e5830d2b240d01ea7abc28347e54d
SHA512

3dca05507009e7fd4a15919309a406d260f68a314f680810cad993f2be5f9b347c23732b2bd91784040c9d6f35496b5f2a8439fcfcd3d9081ac71d6db2b85b63
SSDEEP

12288:dXCNi9BgqNAtiA1w6Qhfr44ejQShbj59zfMyR2460P8h+/iMLy3hFZGRlaWXc3v0:oWgqKO6i44mQSh1Cc1OE/fEERM9A

Score

7^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  393356813078f635939213feab46d7fc454e5830d2b240d01ea7abc28347e54d_NeikiAnalytics.exe
- Size
  
  686KB
- MD5
  
  57ef1ce375a5ca03a2351e887ff55ab0
- SHA1
  
  bb9b68af7fd202c6581f631156a20d989256f906
- SHA256
  
  393356813078f635939213feab46d7fc454e5830d2b240d01ea7abc28347e54d
- SHA512
  
  3dca05507009e7fd4a15919309a406d260f68a314f680810cad993f2be5f9b347c23732b2bd91784040c9d6f35496b5f2a8439fcfcd3d9081ac71d6db2b85b63
- SSDEEP
  
  12288:dXCNi9BgqNAtiA1w6Qhfr44ejQShbj59zfMyR2460P8h+/iMLy3hFZGRlaWXc3v0:oWgqKO6i44mQSh1Cc1OE/fEERM9A
Score

7^/10

persistence spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer