09fa618d2c7def493f674607ebfbaff742cf16c1474a88e013f3a214b05ed645 | Triage

Sharing

General

Target

b4d3a934d557b2e80a14b0ef67198420_NeikiAnalytics
Size

70KB
Sample

240513-ngqgqsda73
MD5

b4d3a934d557b2e80a14b0ef67198420
SHA1

daf9e44b77d4fcb56cd5728d86f66db361fdcb92
SHA256

09fa618d2c7def493f674607ebfbaff742cf16c1474a88e013f3a214b05ed645
SHA512

86102104e00ef3e0f4dd5c8d969a5958a56dd434422c17b1ef14787380a1a160d0f3e4029ffbe4bd762a3248522748fdf8905ab859dfb6692ba411674d2038f3
SSDEEP

1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8tu:Olg35GTslA5t3/w8A

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  b4d3a934d557b2e80a14b0ef67198420_NeikiAnalytics
- Size
  
  70KB
- MD5
  
  b4d3a934d557b2e80a14b0ef67198420
- SHA1
  
  daf9e44b77d4fcb56cd5728d86f66db361fdcb92
- SHA256
  
  09fa618d2c7def493f674607ebfbaff742cf16c1474a88e013f3a214b05ed645
- SHA512
  
  86102104e00ef3e0f4dd5c8d969a5958a56dd434422c17b1ef14787380a1a160d0f3e4029ffbe4bd762a3248522748fdf8905ab859dfb6692ba411674d2038f3
- SSDEEP
  
  1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8tu:Olg35GTslA5t3/w8A
Score

10^/10

evasion persistence trojan
- Windows security bypass
  evasion trojan
- Modifies Installed Components in the registry
  persistence
- Sets file execution options in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencetrojan