Overview

overview

10

Static

static

1

1b38015db0...cs.exe

windows7-x64

6

1b38015db0...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1b38015db059780ef6a59307deb2deb8a75dc06d4e14b91ae511f0b72327abcd_NeikiAnalytics.exe

  • Size

    110KB

  • Sample

    240625-2f53pazenr

  • MD5

    bc98184553877c8c61f96cdc8c2de820

  • SHA1

    8db5150ef1c912ec846de52b3b2c957d85114c81

  • SHA256

    1b38015db059780ef6a59307deb2deb8a75dc06d4e14b91ae511f0b72327abcd

  • SHA512

    9fbeab6968be99513c10921cd1d0f7b423aeb4badc3c665e9da068a1c86aed8b148f0682190e6aa3363eb9672506cb0d435dff385928d903802ed3b0e7d623b5

  • SSDEEP

    1536:bLXB65939tY6HBg4sXJ1UviBhkohVKJjFhaLeT99+eLnVtUviBhkohVKJjFhvOc4:bLk395hYXJ1UvUWXsP2nvUvUWX8CE

Score
10/10
banloaddiscoverydownloaderdropperevasionspywarestealertrojan

Malware Config

Targets

    • Target

      1b38015db059780ef6a59307deb2deb8a75dc06d4e14b91ae511f0b72327abcd_NeikiAnalytics.exe

    • Size

      110KB

    • MD5

      bc98184553877c8c61f96cdc8c2de820

    • SHA1

      8db5150ef1c912ec846de52b3b2c957d85114c81

    • SHA256

      1b38015db059780ef6a59307deb2deb8a75dc06d4e14b91ae511f0b72327abcd

    • SHA512

      9fbeab6968be99513c10921cd1d0f7b423aeb4badc3c665e9da068a1c86aed8b148f0682190e6aa3363eb9672506cb0d435dff385928d903802ed3b0e7d623b5

    • SSDEEP

      1536:bLXB65939tY6HBg4sXJ1UviBhkohVKJjFhaLeT99+eLnVtUviBhkohVKJjFhvOc4:bLk395hYXJ1UvUWXsP2nvUvUWX8CE

    Score
    10/10
    discoverybanloaddownloaderdropperevasionspywarestealertrojan

    • Banload

      Banload variants download malicious files, then install and execute the files.

      trojandropperdownloaderbanload

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Downloads MZ/PE file

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

3
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks