General
-
Target
b2e984c83450c58f862d1d606febe03850954e758b33b9125d2822c1791d02b0_NeikiAnalytics.exe
-
Size
80KB
-
Sample
240629-tsn1ya1cmb
-
MD5
24e8d2e987904e15845cfed585b57e60
-
SHA1
6530808d32d9b44d1ff808c2f845520e4c14e320
-
SHA256
b2e984c83450c58f862d1d606febe03850954e758b33b9125d2822c1791d02b0
-
SHA512
d29f5253fe2e427260c637f585f2025110740ad9e3f32dbb4cf0b3570b7639244075303fbce64b741b5b876cbedcd2f9c16ccc0c3a93fd8f8d23fbcdc0129b5c
-
SSDEEP
1536:3l35hnx4z7Ziy+AbvsPVbbGhN6BCoCYTk6I9mO3hMOTSdXY:35nyvZSVbbGhsLOmO3hMO0Y
Behavioral task
behavioral1
Sample
b2e984c83450c58f862d1d606febe03850954e758b33b9125d2822c1791d02b0_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b2e984c83450c58f862d1d606febe03850954e758b33b9125d2822c1791d02b0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
xworm
127.0.0.1:36622
many-created.gl.at.ply.gg:36622
-
Install_directory
%Temp%
-
install_file
Power.exe
Targets
-
-
Target
b2e984c83450c58f862d1d606febe03850954e758b33b9125d2822c1791d02b0_NeikiAnalytics.exe
-
Size
80KB
-
MD5
24e8d2e987904e15845cfed585b57e60
-
SHA1
6530808d32d9b44d1ff808c2f845520e4c14e320
-
SHA256
b2e984c83450c58f862d1d606febe03850954e758b33b9125d2822c1791d02b0
-
SHA512
d29f5253fe2e427260c637f585f2025110740ad9e3f32dbb4cf0b3570b7639244075303fbce64b741b5b876cbedcd2f9c16ccc0c3a93fd8f8d23fbcdc0129b5c
-
SSDEEP
1536:3l35hnx4z7Ziy+AbvsPVbbGhN6BCoCYTk6I9mO3hMOTSdXY:35nyvZSVbbGhsLOmO3hMO0Y
Score10/10-
Detect Xworm Payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
MITRE ATT&CK Matrix ATT&CK v13
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1