6fe9f576b25ae243da838681572233ab76af20f5638e40bab041286b7e4378de | Triage

Sharing

General

Target

18f985b29775b3a46a81a0a7e4f7be80_NEIKI
Size

72KB
Sample

240508-jq7edsac5s
MD5

18f985b29775b3a46a81a0a7e4f7be80
SHA1

042234e569bdd2a0b3dbce2022ee999cf8150902
SHA256

6fe9f576b25ae243da838681572233ab76af20f5638e40bab041286b7e4378de
SHA512

265552e2c8eab5de14c407e147c0e8c75502c1eeab5eea11a088ffc30198bc05f39c68293c677a9703b28bbfd71a64d1d44fb0a9ecf6011dfa2dba22bc59d2a7
SSDEEP

1536:xPaRJeLZTu684iEU7tNpJzLB0QHql/z4pvVjygFDTqoFCjZS:RaRJeRu68GenzV0LpMpvVjy2DTq7FS

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  18f985b29775b3a46a81a0a7e4f7be80_NEIKI
- Size
  
  72KB
- MD5
  
  18f985b29775b3a46a81a0a7e4f7be80
- SHA1
  
  042234e569bdd2a0b3dbce2022ee999cf8150902
- SHA256
  
  6fe9f576b25ae243da838681572233ab76af20f5638e40bab041286b7e4378de
- SHA512
  
  265552e2c8eab5de14c407e147c0e8c75502c1eeab5eea11a088ffc30198bc05f39c68293c677a9703b28bbfd71a64d1d44fb0a9ecf6011dfa2dba22bc59d2a7
- SSDEEP
  
  1536:xPaRJeLZTu684iEU7tNpJzLB0QHql/z4pvVjygFDTqoFCjZS:RaRJeRu68GenzV0LpMpvVjy2DTq7FS
Score

10^/10

evasion persistence trojan
- Windows security bypass
  evasion trojan
- Modifies Installed Components in the registry
  persistence
- Sets file execution options in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencetrojan