11a5a128472f6b1b8fcefc7bfcb17cb143bafb5bbd5288e46dd4bccfaab4843b | Triage

Sharing

Copy URL Twitter E-mail

General

Target

82a739557540394e649cb572c5ec9680_NeikiAnalytics
Size

72KB
Sample

240512-lz275sae2z
MD5

82a739557540394e649cb572c5ec9680
SHA1

f9a3226c45dc5bdadf4f882722c8ec398bbd16cf
SHA256

11a5a128472f6b1b8fcefc7bfcb17cb143bafb5bbd5288e46dd4bccfaab4843b
SHA512

c056d113030a34930ef4e8710b1884b3515faaa42d2f79a45a18e097b61270973f3228d83d490a3318a4663cf8780b305ddbe40655bfb53d08efdc492be181e7
SSDEEP

1536:xWLw62p7KTxU0IIBhVu2d7mN9msbqt36etdh:lgTJBq2d7e9ahb

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  82a739557540394e649cb572c5ec9680_NeikiAnalytics
- Size
  
  72KB
- MD5
  
  82a739557540394e649cb572c5ec9680
- SHA1
  
  f9a3226c45dc5bdadf4f882722c8ec398bbd16cf
- SHA256
  
  11a5a128472f6b1b8fcefc7bfcb17cb143bafb5bbd5288e46dd4bccfaab4843b
- SHA512
  
  c056d113030a34930ef4e8710b1884b3515faaa42d2f79a45a18e097b61270973f3228d83d490a3318a4663cf8780b305ddbe40655bfb53d08efdc492be181e7
- SSDEEP
  
  1536:xWLw62p7KTxU0IIBhVu2d7mN9msbqt36etdh:lgTJBq2d7e9ahb
Score

10^/10

evasion persistence trojan
- Windows security bypass
  evasion trojan
- Modifies Installed Components in the registry
  persistence
- Sets file execution options in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencetrojan