87a29a3edc3277bc3bd14889fcdec1dbc06f53864170c12f012323c0d3f6372b | Triage

Sharing

General

Target

3254ed4610c71c24aa9b3f1b0ac66220_NeikiAnalytics
Size

70KB
Sample

240513-25qdjaaa73
MD5

3254ed4610c71c24aa9b3f1b0ac66220
SHA1

9b8ce91838c4cad79947ff4efca53c151561ff98
SHA256

87a29a3edc3277bc3bd14889fcdec1dbc06f53864170c12f012323c0d3f6372b
SHA512

be5441e4521483eca6086c4b3454b3019220f34c1f675720e54356ecaa3f4ab116c99d39779c5b7acf7f358c75b0d5ae8a3763f5c37d9a3fceb41a5ab2b2cb37
SSDEEP

1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8slN:Olg35GTslA5t3/w8Y

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  3254ed4610c71c24aa9b3f1b0ac66220_NeikiAnalytics
- Size
  
  70KB
- MD5
  
  3254ed4610c71c24aa9b3f1b0ac66220
- SHA1
  
  9b8ce91838c4cad79947ff4efca53c151561ff98
- SHA256
  
  87a29a3edc3277bc3bd14889fcdec1dbc06f53864170c12f012323c0d3f6372b
- SHA512
  
  be5441e4521483eca6086c4b3454b3019220f34c1f675720e54356ecaa3f4ab116c99d39779c5b7acf7f358c75b0d5ae8a3763f5c37d9a3fceb41a5ab2b2cb37
- SSDEEP
  
  1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8slN:Olg35GTslA5t3/w8Y
Score

10^/10

evasion persistence trojan
- Windows security bypass
  evasion trojan
- Modifies Installed Components in the registry
  persistence
- Sets file execution options in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencetrojan