d5316ec5380d9d5c07d69bfdcfae1034871027c79854d49e51e72e9553dea133 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

04c9a24d6f59fbbf591d6e315d2f8310_NeikiAnalytics
Size

70KB
Sample

240514-wgqfqshc92
MD5

04c9a24d6f59fbbf591d6e315d2f8310
SHA1

58a03508d5df08cd2dd1f13dd15036531d7af69e
SHA256

d5316ec5380d9d5c07d69bfdcfae1034871027c79854d49e51e72e9553dea133
SHA512

cf4eafbb3ab3c6ee07c4d9aaa80808560b2bb965a3c951dffa2816856e7e1552a60a40a94d61a0f50f94ffa52180cdf83e29aa19be847f1b9014ceb4d16659e3
SSDEEP

1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8z:Olg35GTslA5t3/w8z

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  04c9a24d6f59fbbf591d6e315d2f8310_NeikiAnalytics
- Size
  
  70KB
- MD5
  
  04c9a24d6f59fbbf591d6e315d2f8310
- SHA1
  
  58a03508d5df08cd2dd1f13dd15036531d7af69e
- SHA256
  
  d5316ec5380d9d5c07d69bfdcfae1034871027c79854d49e51e72e9553dea133
- SHA512
  
  cf4eafbb3ab3c6ee07c4d9aaa80808560b2bb965a3c951dffa2816856e7e1552a60a40a94d61a0f50f94ffa52180cdf83e29aa19be847f1b9014ceb4d16659e3
- SSDEEP
  
  1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8z:Olg35GTslA5t3/w8z
Score

10^/10

evasion persistence trojan
- Windows security bypass
  evasion trojan
- Modifies Installed Components in the registry
  persistence
- Sets file execution options in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencetrojan