2383fa7159e156478c5127bb126458ad8427a836909b78c575c24d4210ef6988 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

7427a10df0715ee7eed376d4b6567110_NeikiAnalytics
Size

70KB
Sample

240515-ebch9agb48
MD5

7427a10df0715ee7eed376d4b6567110
SHA1

06a081081a88282eede3b177ca8bf881fad45acd
SHA256

2383fa7159e156478c5127bb126458ad8427a836909b78c575c24d4210ef6988
SHA512

7672b7851e77775e7a46120e6c3910c91c134dc642c2c895a60067829992c59570820a52596ad52abe39240d192a171486707fd59477c4c709cbc9d2bab252a3
SSDEEP

1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8slaX:Olg35GTslA5t3/w89

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  7427a10df0715ee7eed376d4b6567110_NeikiAnalytics
- Size
  
  70KB
- MD5
  
  7427a10df0715ee7eed376d4b6567110
- SHA1
  
  06a081081a88282eede3b177ca8bf881fad45acd
- SHA256
  
  2383fa7159e156478c5127bb126458ad8427a836909b78c575c24d4210ef6988
- SHA512
  
  7672b7851e77775e7a46120e6c3910c91c134dc642c2c895a60067829992c59570820a52596ad52abe39240d192a171486707fd59477c4c709cbc9d2bab252a3
- SSDEEP
  
  1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8slaX:Olg35GTslA5t3/w89
Score

10^/10

evasion persistence trojan
- Windows security bypass
  evasion trojan
- Modifies Installed Components in the registry
  persistence
- Sets file execution options in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencetrojan