Overview

overview

8

Static

static

1

6415252a1c...cs.dll

windows7-x64

8

6415252a1c...cs.dll

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6415252a1c0437d77c73800239907d6b9930529f5f7763e661c705adf14fa080_NeikiAnalytics.exe

  • Size

    1.7MB

  • Sample

    240629-e9a33s1crf

  • MD5

    fe71375c57879a1cc4e764213b3bd3b0

  • SHA1

    38cbd4ab9f31899f5c2c01336025b5752d112751

  • SHA256

    6415252a1c0437d77c73800239907d6b9930529f5f7763e661c705adf14fa080

  • SHA512

    c56e963bb596b9281f2296483d7df786c85f4c68edd223412534c82c883e92b64c2ea562a5feec1dc72e921b5dca983e224a0012dee33c050fbbd6073c9ad90a

  • SSDEEP

    49152:80Vf3Q6IQ2ByAzvdYPxus6cF47Vkj7URLHkJigQU/CIabjKoh9WIN0s:VQ6IQ2ByAzvdYPAxeQDbrFIabjKoh9WE

Score
8/10
adwarepersistenceprivilege_escalationstealerupx

Malware Config

Targets

    • Target

      6415252a1c0437d77c73800239907d6b9930529f5f7763e661c705adf14fa080_NeikiAnalytics.exe

    • Size

      1.7MB

    • MD5

      fe71375c57879a1cc4e764213b3bd3b0

    • SHA1

      38cbd4ab9f31899f5c2c01336025b5752d112751

    • SHA256

      6415252a1c0437d77c73800239907d6b9930529f5f7763e661c705adf14fa080

    • SHA512

      c56e963bb596b9281f2296483d7df786c85f4c68edd223412534c82c883e92b64c2ea562a5feec1dc72e921b5dca983e224a0012dee33c050fbbd6073c9ad90a

    • SSDEEP

      49152:80Vf3Q6IQ2ByAzvdYPxus6cF47Vkj7URLHkJigQU/CIabjKoh9WIN0s:VQ6IQ2ByAzvdYPAxeQDbrFIabjKoh9WE

    Score
    8/10
    adwarepersistenceprivilege_escalationstealerupx

    • Event Triggered Execution: AppInit DLLs

      Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

      persistenceprivilege_escalation

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Event Triggered Execution

1
T1546

AppInit DLLs

1
T1546.010

Browser Extensions

1
T1176

Privilege Escalation

Event Triggered Execution

1
T1546

AppInit DLLs

1
T1546.010

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks