34658c0b75433411a2913fdef09439955f99b89510c305360c2ff12fdb68a69a | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c98258e4b0b8112f42dbe0d70d177020_NEIKI
Size

70KB
Sample

240508-erwxtshh8x
MD5

c98258e4b0b8112f42dbe0d70d177020
SHA1

3187f35f812d9bdbe25fa68874adb471594721d8
SHA256

34658c0b75433411a2913fdef09439955f99b89510c305360c2ff12fdb68a69a
SHA512

35f9e5fbfa3436260b75e5810769222abd16291567c251b11f2f0a236bd5dac8ab85277096a53b89e8c7f046064baf46432a8407e0f8646a71898f3556e5dc13
SSDEEP

768:x/ngseFPR3dwG0XD0kfLkctfkx1/pbFuWnJWFwnpmkFzCfxUOxrlpZ+pZk7/NQ5k:xfE3dF0XD0CLX2pbP0ue66aC/NQa

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  c98258e4b0b8112f42dbe0d70d177020_NEIKI
- Size
  
  70KB
- MD5
  
  c98258e4b0b8112f42dbe0d70d177020
- SHA1
  
  3187f35f812d9bdbe25fa68874adb471594721d8
- SHA256
  
  34658c0b75433411a2913fdef09439955f99b89510c305360c2ff12fdb68a69a
- SHA512
  
  35f9e5fbfa3436260b75e5810769222abd16291567c251b11f2f0a236bd5dac8ab85277096a53b89e8c7f046064baf46432a8407e0f8646a71898f3556e5dc13
- SSDEEP
  
  768:x/ngseFPR3dwG0XD0kfLkctfkx1/pbFuWnJWFwnpmkFzCfxUOxrlpZ+pZk7/NQ5k:xfE3dF0XD0CLX2pbP0ue66aC/NQa
Score

10^/10

evasion persistence trojan
- Windows security bypass
  evasion trojan
- Modifies Installed Components in the registry
  persistence
- Sets file execution options in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencetrojan