9ebd3b168cc538fb0c1bae2c1388e375b66c5bd54b0b108018719c7b6994455e | Triage

Sharing

General

Target

5fbf35ea147a76a86dc68d1b3313c0b0_NeikiAnalytics
Size

72KB
Sample

240515-cey6bacd54
MD5

5fbf35ea147a76a86dc68d1b3313c0b0
SHA1

3f46c7c50640b08df868ee6f0929593374bba38b
SHA256

9ebd3b168cc538fb0c1bae2c1388e375b66c5bd54b0b108018719c7b6994455e
SHA512

c9a613e32099c81a6c158a481983aaf0a7b87e78d3c08e4edec612a3f6f9136fae6e7c5208bd838484e0d40696ec47d0f1a4f898a201d8d0cfd3341b9200209f
SSDEEP

1536:xJrcZa4V5fH01ZJdlUOIV3js6/XyMgjm6Ul0sYnLwDR:j6RRH0IVweitm7lXYnEDR

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  5fbf35ea147a76a86dc68d1b3313c0b0_NeikiAnalytics
- Size
  
  72KB
- MD5
  
  5fbf35ea147a76a86dc68d1b3313c0b0
- SHA1
  
  3f46c7c50640b08df868ee6f0929593374bba38b
- SHA256
  
  9ebd3b168cc538fb0c1bae2c1388e375b66c5bd54b0b108018719c7b6994455e
- SHA512
  
  c9a613e32099c81a6c158a481983aaf0a7b87e78d3c08e4edec612a3f6f9136fae6e7c5208bd838484e0d40696ec47d0f1a4f898a201d8d0cfd3341b9200209f
- SSDEEP
  
  1536:xJrcZa4V5fH01ZJdlUOIV3js6/XyMgjm6Ul0sYnLwDR:j6RRH0IVweitm7lXYnEDR
Score

10^/10

evasion persistence trojan
- Windows security bypass
  evasion trojan
- Modifies Installed Components in the registry
  persistence
- Sets file execution options in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencetrojan