42ee04b2e939b9788c4527383489d423bd8f74a4a23df256f58335a784c0cfde | Triage

Sharing

Copy URL Twitter E-mail

General

Target

76db39734445909db1f053b6d49186e0_NEIKI
Size

73KB
Sample

240508-akzmxsba58
MD5

76db39734445909db1f053b6d49186e0
SHA1

25ac29a239cd59f1b514e6efd2fe92742b35b314
SHA256

42ee04b2e939b9788c4527383489d423bd8f74a4a23df256f58335a784c0cfde
SHA512

6e4649970fe4539dd125497bcdb3c8569ac0f76075f28006d5ee7b1af0098dabc94f32c5326974f50fff324c20b6c8987accf31e71736e4e02fbcbfa2cd783e9
SSDEEP

1536:x5VhzJSxCFPnYOo0ve0NRmeh5maKKpsc+I:nDtACFPYmNRmegI

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  76db39734445909db1f053b6d49186e0_NEIKI
- Size
  
  73KB
- MD5
  
  76db39734445909db1f053b6d49186e0
- SHA1
  
  25ac29a239cd59f1b514e6efd2fe92742b35b314
- SHA256
  
  42ee04b2e939b9788c4527383489d423bd8f74a4a23df256f58335a784c0cfde
- SHA512
  
  6e4649970fe4539dd125497bcdb3c8569ac0f76075f28006d5ee7b1af0098dabc94f32c5326974f50fff324c20b6c8987accf31e71736e4e02fbcbfa2cd783e9
- SSDEEP
  
  1536:x5VhzJSxCFPnYOo0ve0NRmeh5maKKpsc+I:nDtACFPYmNRmegI
Score

10^/10

evasion persistence trojan
- Windows security bypass
  evasion trojan
- Modifies Installed Components in the registry
  persistence
- Sets file execution options in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencetrojan