3916fc95ef916baac6e205705fce3dff4c869e1f73d50f0bfec61eb0fe88cbd0 | Triage

Sharing

General

Target

4f85c5535ea95aac2281122207644400_NeikiAnalytics
Size

70KB
Sample

240515-aw2lnagd3x
MD5

4f85c5535ea95aac2281122207644400
SHA1

9059d32a084724976e456cefdd0a6d4b1ac16853
SHA256

3916fc95ef916baac6e205705fce3dff4c869e1f73d50f0bfec61eb0fe88cbd0
SHA512

67e7498d04094d815556f5903336b3351384d3dcc2831c20b7c7279d3d8690e3c828bc6f04e665df46106acb20ab2b6b01fa071afa3ffa77248e12496267ec41
SSDEEP

1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8sltI:Olg35GTslA5t3/w84I

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  4f85c5535ea95aac2281122207644400_NeikiAnalytics
- Size
  
  70KB
- MD5
  
  4f85c5535ea95aac2281122207644400
- SHA1
  
  9059d32a084724976e456cefdd0a6d4b1ac16853
- SHA256
  
  3916fc95ef916baac6e205705fce3dff4c869e1f73d50f0bfec61eb0fe88cbd0
- SHA512
  
  67e7498d04094d815556f5903336b3351384d3dcc2831c20b7c7279d3d8690e3c828bc6f04e665df46106acb20ab2b6b01fa071afa3ffa77248e12496267ec41
- SSDEEP
  
  1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8sltI:Olg35GTslA5t3/w84I
Score

10^/10

evasion persistence trojan
- Windows security bypass
  evasion trojan
- Modifies Installed Components in the registry
  persistence
- Sets file execution options in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencetrojan