20a624120053a764e2a20ed0e3c9a43e8a8cb81883a238fe4207955df726a989 | Triage

Sharing

General

Target

56eb146cc989a66e5cfde37136e71470_NeikiAnalytics
Size

73KB
Sample

240515-blcp8aac26
MD5

56eb146cc989a66e5cfde37136e71470
SHA1

b5fcb4f91fa2c2a718a5eb6917302553e94e7611
SHA256

20a624120053a764e2a20ed0e3c9a43e8a8cb81883a238fe4207955df726a989
SHA512

501dc8e8696fd737ddc743e5f8690ca0704d4cf51b935268627036dc458282489fa286160e5c649dce824710bd35a0c2a142c8395b495ec81b6f83ba2163f86d
SSDEEP

1536:xWLw62p7KTxU0IIBhVu2d7mN9msbqt36etdF:lgTJBq2d7e9ahH

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  56eb146cc989a66e5cfde37136e71470_NeikiAnalytics
- Size
  
  73KB
- MD5
  
  56eb146cc989a66e5cfde37136e71470
- SHA1
  
  b5fcb4f91fa2c2a718a5eb6917302553e94e7611
- SHA256
  
  20a624120053a764e2a20ed0e3c9a43e8a8cb81883a238fe4207955df726a989
- SHA512
  
  501dc8e8696fd737ddc743e5f8690ca0704d4cf51b935268627036dc458282489fa286160e5c649dce824710bd35a0c2a142c8395b495ec81b6f83ba2163f86d
- SSDEEP
  
  1536:xWLw62p7KTxU0IIBhVu2d7mN9msbqt36etdF:lgTJBq2d7e9ahH
Score

10^/10

evasion persistence trojan
- Windows security bypass
  evasion trojan
- Modifies Installed Components in the registry
  persistence
- Sets file execution options in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencetrojan