Overview

overview

9

Static

static

7

b2fb1c0a2a...cs.exe

windows7-x64

9

b2fb1c0a2a...cs.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b2fb1c0a2a784c8d19cb6e9319254661f370e6e5bbb34f9e77cc6901f97d01c1_NeikiAnalytics.exe

  • Size

    2.6MB

  • Sample

    240629-tt6bls1cpc

  • MD5

    ed038e7fe58849684adc0d2dc13241d0

  • SHA1

    14ab133f45c62415047324359daa6b92408976ad

  • SHA256

    b2fb1c0a2a784c8d19cb6e9319254661f370e6e5bbb34f9e77cc6901f97d01c1

  • SHA512

    37c021bb1d18d7590cda945f73d9dc71ed6f6029c6f9cdbeddc3a93d65fdad9833d7ad03a5e88bfc3aa4db8c13b544443997371d33ec5a3309ba5ed4f9641640

  • SSDEEP

    49152:+XzhpDtKSK1cb8PGK+Tfuqmpc3elWo8GnQAsYZEVF:+XzhW148Pd+Tf1mpcOldJQ3/VF

Score
9/10
evasionthemidatrojan

Malware Config

Targets

    • Target

      b2fb1c0a2a784c8d19cb6e9319254661f370e6e5bbb34f9e77cc6901f97d01c1_NeikiAnalytics.exe

    • Size

      2.6MB

    • MD5

      ed038e7fe58849684adc0d2dc13241d0

    • SHA1

      14ab133f45c62415047324359daa6b92408976ad

    • SHA256

      b2fb1c0a2a784c8d19cb6e9319254661f370e6e5bbb34f9e77cc6901f97d01c1

    • SHA512

      37c021bb1d18d7590cda945f73d9dc71ed6f6029c6f9cdbeddc3a93d65fdad9833d7ad03a5e88bfc3aa4db8c13b544443997371d33ec5a3309ba5ed4f9641640

    • SSDEEP

      49152:+XzhpDtKSK1cb8PGK+Tfuqmpc3elWo8GnQAsYZEVF:+XzhW148Pd+Tf1mpcOldJQ3/VF

    Score
    9/10
    evasionthemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks