General
-
Target
336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe
-
Size
3.1MB
-
Sample
240701-ef1fwavhmf
-
MD5
e1d9cf8f0681c095c206be771c74bbe0
-
SHA1
9f145b4cab5880bf7543781746edd1eeddfb7f2f
-
SHA256
336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e
-
SHA512
7d8b7aef957600139f92197c7698462abe1b5b38a89303f53e049dac23eb5087a4c4b5af0f60f94720ebb1213614bc2ab1aabe8cc07f91e669208c413e358a16
-
SSDEEP
98304:tqNY3aiqSfLWppP9qfXme/LbwMlmdxcs/0K3nd2k:tZamTWphmWezbwMYR/0ungk
Static task
static1
Behavioral task
behavioral1
Sample
336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Targets
-
-
Target
336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe
-
Size
3.1MB
-
MD5
e1d9cf8f0681c095c206be771c74bbe0
-
SHA1
9f145b4cab5880bf7543781746edd1eeddfb7f2f
-
SHA256
336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e
-
SHA512
7d8b7aef957600139f92197c7698462abe1b5b38a89303f53e049dac23eb5087a4c4b5af0f60f94720ebb1213614bc2ab1aabe8cc07f91e669208c413e358a16
-
SSDEEP
98304:tqNY3aiqSfLWppP9qfXme/LbwMlmdxcs/0K3nd2k:tZamTWphmWezbwMYR/0ungk
-
Modifies firewall policy service
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Defense Evasion
Modify Registry
6Impair Defenses
4Disable or Modify Tools
3Disable or Modify System Firewall
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1