General
-
Target
0a6ed8ade40d8fe4ed395843ab666737b12edc19d823b71d5de8bf1adddd4b2a_NeikiAnalytics.exe
-
Size
120KB
-
Sample
240630-nxh3lazhlk
-
MD5
4a7c1623d0bd5a69e4c2f5f905207050
-
SHA1
2cd3715ed8565274652fc705394818d4f7f2f86c
-
SHA256
0a6ed8ade40d8fe4ed395843ab666737b12edc19d823b71d5de8bf1adddd4b2a
-
SHA512
6a5deae3670f6bbab89641afdf2c45adf006dffac86b45aa6df755bd0b8d09bb18f8fc0815d591607e10b8f17b0c19258edce72e8b323a26578c0a8d51676f24
-
SSDEEP
3072:8U5XtaaL5H/N6PHj4LUQMF88U7ogqbb8CfHo6l39:VVgaLxmDqU+8YogW8CP/N
Static task
static1
Behavioral task
behavioral1
Sample
0a6ed8ade40d8fe4ed395843ab666737b12edc19d823b71d5de8bf1adddd4b2a_NeikiAnalytics.dll
Resource
win7-20240508-en
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Targets
-
-
Target
0a6ed8ade40d8fe4ed395843ab666737b12edc19d823b71d5de8bf1adddd4b2a_NeikiAnalytics.exe
-
Size
120KB
-
MD5
4a7c1623d0bd5a69e4c2f5f905207050
-
SHA1
2cd3715ed8565274652fc705394818d4f7f2f86c
-
SHA256
0a6ed8ade40d8fe4ed395843ab666737b12edc19d823b71d5de8bf1adddd4b2a
-
SHA512
6a5deae3670f6bbab89641afdf2c45adf006dffac86b45aa6df755bd0b8d09bb18f8fc0815d591607e10b8f17b0c19258edce72e8b323a26578c0a8d51676f24
-
SSDEEP
3072:8U5XtaaL5H/N6PHj4LUQMF88U7ogqbb8CfHo6l39:VVgaLxmDqU+8YogW8CP/N
-
Modifies firewall policy service
-
Executes dropped EXE
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Impair Defenses
4Disable or Modify Tools
3Disable or Modify System Firewall
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1