Overview

overview

9

Static

static

7

43e15cc431...cs.exe

windows7-x64

9

43e15cc431...cs.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    43e15cc43184cdba5f3e2b986524d104f524bd17dd3e4e589953edeb993baff8_NeikiAnalytics.exe

  • Size

    2.4MB

  • Sample

    240701-kj78sa1hrd

  • MD5

    61dac54b7073bfdd947c235a2eddc210

  • SHA1

    69f06bc250c6676cbc400a86e151c39c25dfeec5

  • SHA256

    43e15cc43184cdba5f3e2b986524d104f524bd17dd3e4e589953edeb993baff8

  • SHA512

    7e2ac7a1497d2c948ba702f2c3206f53226eb699bc6079032804f2c22c0b1eb09a4c8e2c1694fdc33054f5ca2bd9b0ebda51953c8d20dc58bfb707ba6de543c8

  • SSDEEP

    49152:L3KoBQxG9i9w4QclMHG/m9FBiC1y/uUNxff0vhtAFE9P/qX/SBi:L3KkQMcNQlHG/oF8aUz0vnx94

Score
9/10
evasionpersistenceprivilege_escalationthemidatrojan

Malware Config

Targets

    • Target

      43e15cc43184cdba5f3e2b986524d104f524bd17dd3e4e589953edeb993baff8_NeikiAnalytics.exe

    • Size

      2.4MB

    • MD5

      61dac54b7073bfdd947c235a2eddc210

    • SHA1

      69f06bc250c6676cbc400a86e151c39c25dfeec5

    • SHA256

      43e15cc43184cdba5f3e2b986524d104f524bd17dd3e4e589953edeb993baff8

    • SHA512

      7e2ac7a1497d2c948ba702f2c3206f53226eb699bc6079032804f2c22c0b1eb09a4c8e2c1694fdc33054f5ca2bd9b0ebda51953c8d20dc58bfb707ba6de543c8

    • SSDEEP

      49152:L3KoBQxG9i9w4QclMHG/m9FBiC1y/uUNxff0vhtAFE9P/qX/SBi:L3KkQMcNQlHG/oF8aUz0vnx94

    Score
    9/10
    evasionpersistenceprivilege_escalationthemidatrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Event Triggered Execution: AppInit DLLs

      Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

      persistenceprivilege_escalation

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Executes dropped EXE

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Event Triggered Execution

1
T1546

AppInit DLLs

1
T1546.010

Privilege Escalation

Event Triggered Execution

1
T1546

AppInit DLLs

1
T1546.010

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks