8bf44aa4f37172e2d739eb8996e89c9cfd1d62fd9cd76546641b532ec9136b99 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fc2b4c786e5ca6460f0a0954bd139c00_NEIKI
Size

73KB
Sample

240508-tfcr5seg79
MD5

fc2b4c786e5ca6460f0a0954bd139c00
SHA1

9aef78dd0c8a9f5ce60091190cb382312836d2ab
SHA256

8bf44aa4f37172e2d739eb8996e89c9cfd1d62fd9cd76546641b532ec9136b99
SHA512

267def5464b2a8ccf55d4b5433230f7239fe81a5c27b4aff08e444a79884ccda3141491b2d4766fed23941c4b9d029bf87a476d7f209833448cd06f1e8707ec1
SSDEEP

1536:x0MoWELkdEwt74R6QJro0857l+bMxNs2QWCFu6sDv:aMoWKkdEi74RLo0uaumjuD

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  fc2b4c786e5ca6460f0a0954bd139c00_NEIKI
- Size
  
  73KB
- MD5
  
  fc2b4c786e5ca6460f0a0954bd139c00
- SHA1
  
  9aef78dd0c8a9f5ce60091190cb382312836d2ab
- SHA256
  
  8bf44aa4f37172e2d739eb8996e89c9cfd1d62fd9cd76546641b532ec9136b99
- SHA512
  
  267def5464b2a8ccf55d4b5433230f7239fe81a5c27b4aff08e444a79884ccda3141491b2d4766fed23941c4b9d029bf87a476d7f209833448cd06f1e8707ec1
- SSDEEP
  
  1536:x0MoWELkdEwt74R6QJro0857l+bMxNs2QWCFu6sDv:aMoWKkdEi74RLo0uaumjuD
Score

10^/10

evasion persistence trojan
- Windows security bypass
  evasion trojan
- Modifies Installed Components in the registry
  persistence
- Sets file execution options in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencetrojan