ceb67544c1ac260436d5610511175e81de48daa1684790b5da6aa8fef8f69695 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

cd8c3e8a16058e3a4c6e84763acc6fe0_NEIKI
Size

70KB
Sample

240508-ez8xcsdb54
MD5

cd8c3e8a16058e3a4c6e84763acc6fe0
SHA1

adf3e38d86de3d04bcf0d4280114e9052d19d922
SHA256

ceb67544c1ac260436d5610511175e81de48daa1684790b5da6aa8fef8f69695
SHA512

b95f4d66957061a21c3bc34ac06c39869ab72d5d3ab76c8516422ae16f0faf0f811e077fb32a73444dd55f2e2af47d3e10ef4433933ad3ad19c8abe666db1a7b
SSDEEP

1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8EfYD:Olg35GTslA5t3/w8Ea

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  cd8c3e8a16058e3a4c6e84763acc6fe0_NEIKI
- Size
  
  70KB
- MD5
  
  cd8c3e8a16058e3a4c6e84763acc6fe0
- SHA1
  
  adf3e38d86de3d04bcf0d4280114e9052d19d922
- SHA256
  
  ceb67544c1ac260436d5610511175e81de48daa1684790b5da6aa8fef8f69695
- SHA512
  
  b95f4d66957061a21c3bc34ac06c39869ab72d5d3ab76c8516422ae16f0faf0f811e077fb32a73444dd55f2e2af47d3e10ef4433933ad3ad19c8abe666db1a7b
- SSDEEP
  
  1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8EfYD:Olg35GTslA5t3/w8Ea
Score

10^/10

evasion persistence trojan
- Windows security bypass
  evasion trojan
- Modifies Installed Components in the registry
  persistence
- Sets file execution options in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencetrojan