07a1eb71ebbbdc0e8752a738c83ac5b9c4fa5a4ad060c8ebbe9ea0851e963811 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

cecb4324a7e7b2fa5f4cfc07f952b540_NEIKI
Size

70KB
Sample

240508-e24enaaf3w
MD5

cecb4324a7e7b2fa5f4cfc07f952b540
SHA1

692e4b175dbee4d47e88c0f58b9db93a6ab2cec6
SHA256

07a1eb71ebbbdc0e8752a738c83ac5b9c4fa5a4ad060c8ebbe9ea0851e963811
SHA512

4aa5816ec6fc0e290b4bfd6a9c6d10f518659a822b47715dc4b03030b942812cae99d8b04d32a34fa4d3a003deb3130bb8bae4465ba0e19efac5cec90cf266d1
SSDEEP

1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8O:Olg35GTslA5t3/w8O

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  cecb4324a7e7b2fa5f4cfc07f952b540_NEIKI
- Size
  
  70KB
- MD5
  
  cecb4324a7e7b2fa5f4cfc07f952b540
- SHA1
  
  692e4b175dbee4d47e88c0f58b9db93a6ab2cec6
- SHA256
  
  07a1eb71ebbbdc0e8752a738c83ac5b9c4fa5a4ad060c8ebbe9ea0851e963811
- SHA512
  
  4aa5816ec6fc0e290b4bfd6a9c6d10f518659a822b47715dc4b03030b942812cae99d8b04d32a34fa4d3a003deb3130bb8bae4465ba0e19efac5cec90cf266d1
- SSDEEP
  
  1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8O:Olg35GTslA5t3/w8O
Score

10^/10

evasion persistence trojan
- Windows security bypass
  evasion trojan
- Modifies Installed Components in the registry
  persistence
- Sets file execution options in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencetrojan