3847320ac4b2881fb1ab7d38f130782cc418799fd66694487ccac84e4b6b1a02 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4577cde747bbf708fefe842cde1ed0b0_NeikiAnalytics
Size

72KB
Sample

240510-xcfamsbe9z
MD5

4577cde747bbf708fefe842cde1ed0b0
SHA1

92b1fde7d4ec9d5bcb820a94d8bbe75210db3d52
SHA256

3847320ac4b2881fb1ab7d38f130782cc418799fd66694487ccac84e4b6b1a02
SHA512

9ba7633170b15c63b0d9e8850f945c9d041661ae743e9fdafd120342635fed4c25bde50eb64e09d311ce1d966fc9d88ec43104c45f917ac8fd94c5a8af7af5be
SSDEEP

1536:x9ouU985sNstFt5n59tXwvDz7w2Hqn7+e:XiG3tx59EfdHi6e

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  4577cde747bbf708fefe842cde1ed0b0_NeikiAnalytics
- Size
  
  72KB
- MD5
  
  4577cde747bbf708fefe842cde1ed0b0
- SHA1
  
  92b1fde7d4ec9d5bcb820a94d8bbe75210db3d52
- SHA256
  
  3847320ac4b2881fb1ab7d38f130782cc418799fd66694487ccac84e4b6b1a02
- SHA512
  
  9ba7633170b15c63b0d9e8850f945c9d041661ae743e9fdafd120342635fed4c25bde50eb64e09d311ce1d966fc9d88ec43104c45f917ac8fd94c5a8af7af5be
- SSDEEP
  
  1536:x9ouU985sNstFt5n59tXwvDz7w2Hqn7+e:XiG3tx59EfdHi6e
Score

10^/10

evasion persistence trojan
- Windows security bypass
  evasion trojan
- Modifies Installed Components in the registry
  persistence
- Sets file execution options in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencetrojan