77dddef8c3718b949256df71b1aba3cfeea898c39c8471a3e82123a52c0ef812 | Triage

Sharing

General

Target

af7d82f7979e59268d7671654c2661e0_NEIKI
Size

71KB
Sample

240508-psfmcafc93
MD5

af7d82f7979e59268d7671654c2661e0
SHA1

29ea3ad009dabb453355006f30b5f6c089f5235f
SHA256

77dddef8c3718b949256df71b1aba3cfeea898c39c8471a3e82123a52c0ef812
SHA512

ef1563848a95ce741ffba99a1a40776763e78d3ab935f369a959d42914c4be87cd3dc793e8caa3f5ca10dcdf6c8734ebf895094845be7368ff1421f3ca3997f5
SSDEEP

1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8sl+:Olg35GTslA5t3/w8n

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  af7d82f7979e59268d7671654c2661e0_NEIKI
- Size
  
  71KB
- MD5
  
  af7d82f7979e59268d7671654c2661e0
- SHA1
  
  29ea3ad009dabb453355006f30b5f6c089f5235f
- SHA256
  
  77dddef8c3718b949256df71b1aba3cfeea898c39c8471a3e82123a52c0ef812
- SHA512
  
  ef1563848a95ce741ffba99a1a40776763e78d3ab935f369a959d42914c4be87cd3dc793e8caa3f5ca10dcdf6c8734ebf895094845be7368ff1421f3ca3997f5
- SSDEEP
  
  1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8sl+:Olg35GTslA5t3/w8n
Score

10^/10

evasion persistence trojan
- Windows security bypass
  evasion trojan
- Modifies Installed Components in the registry
  persistence
- Sets file execution options in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencetrojan