f0d222b74ebbd4582656bf243d64ca2f742a3edb4b3a1519f5dab7f3806af7b7 | Triage

Sharing

General

Target

06164abd1ee1ffc9bf3be344a68d1020_NeikiAnalytics
Size

72KB
Sample

240512-nr7trsdb91
MD5

06164abd1ee1ffc9bf3be344a68d1020
SHA1

8f4cfa9ef4ace61bb82a446b3c12bb8bdf322894
SHA256

f0d222b74ebbd4582656bf243d64ca2f742a3edb4b3a1519f5dab7f3806af7b7
SHA512

58e8d286528511de365c4e58c3792eda7d2643e59471342aba86979d48430a79b59d3fedc5b32b719928ab4b43c363623e79c3fb28ce8fef87c8da49f034f4f5
SSDEEP

1536:xuZG3rqYGOJXGF6RlbOUWc7dFKJbeKHzl+v8KHD5oeJmqabqBER:4ZGbqGIeKHzQ8KHVoqmqaSW

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  06164abd1ee1ffc9bf3be344a68d1020_NeikiAnalytics
- Size
  
  72KB
- MD5
  
  06164abd1ee1ffc9bf3be344a68d1020
- SHA1
  
  8f4cfa9ef4ace61bb82a446b3c12bb8bdf322894
- SHA256
  
  f0d222b74ebbd4582656bf243d64ca2f742a3edb4b3a1519f5dab7f3806af7b7
- SHA512
  
  58e8d286528511de365c4e58c3792eda7d2643e59471342aba86979d48430a79b59d3fedc5b32b719928ab4b43c363623e79c3fb28ce8fef87c8da49f034f4f5
- SSDEEP
  
  1536:xuZG3rqYGOJXGF6RlbOUWc7dFKJbeKHzl+v8KHD5oeJmqabqBER:4ZGbqGIeKHzQ8KHVoqmqaSW
Score

10^/10

evasion persistence trojan
- Windows security bypass
  evasion trojan
- Modifies Installed Components in the registry
  persistence
- Sets file execution options in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencetrojan