24168336e6e17dee78a9e0215f188ab72414c28e9df45aaf8cb8ae4761941d4e | Triage

Sharing

General

Target

dc5fa8bb2d8501ca8f6f1ba41b0ac5b0_NEIKI
Size

72KB
Sample

240508-frvv7scc2x
MD5

dc5fa8bb2d8501ca8f6f1ba41b0ac5b0
SHA1

5b6aa2ceb2108dfb2d1cabafe0d9e96ace40bb6e
SHA256

24168336e6e17dee78a9e0215f188ab72414c28e9df45aaf8cb8ae4761941d4e
SHA512

6a8ac5cee242da101517871d4d2ed613a0231c9a892a13e3320e29b94c012e19b7441a66d258b91b91a29a236f1aa72ed589024fb77f499e03a1e4803359471a
SSDEEP

768:x/nJIh3SDyA0BIy/jIx+TZjUPx80sxCOopBoRxZzq3Yy+gMqMXmDLHr+cSDDcGIV:xSdDCxGZwPm0/p8xY3clZcsVAQEn

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  dc5fa8bb2d8501ca8f6f1ba41b0ac5b0_NEIKI
- Size
  
  72KB
- MD5
  
  dc5fa8bb2d8501ca8f6f1ba41b0ac5b0
- SHA1
  
  5b6aa2ceb2108dfb2d1cabafe0d9e96ace40bb6e
- SHA256
  
  24168336e6e17dee78a9e0215f188ab72414c28e9df45aaf8cb8ae4761941d4e
- SHA512
  
  6a8ac5cee242da101517871d4d2ed613a0231c9a892a13e3320e29b94c012e19b7441a66d258b91b91a29a236f1aa72ed589024fb77f499e03a1e4803359471a
- SSDEEP
  
  768:x/nJIh3SDyA0BIy/jIx+TZjUPx80sxCOopBoRxZzq3Yy+gMqMXmDLHr+cSDDcGIV:xSdDCxGZwPm0/p8xY3clZcsVAQEn
Score

10^/10

evasion persistence trojan
- Windows security bypass
  evasion trojan
- Modifies Installed Components in the registry
  persistence
- Sets file execution options in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencetrojan