c7bd9627443e5e03f044a3a506f8c78b5eebe9b7f79b74ad57bd087454675735 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d40d923f62a4f64f81d1382e0a612b70_NeikiAnalytics
Size

70KB
Sample

240515-qnz1vsbe84
MD5

d40d923f62a4f64f81d1382e0a612b70
SHA1

04a6617d7b4cc25103faae15550adbbfd8803bdf
SHA256

c7bd9627443e5e03f044a3a506f8c78b5eebe9b7f79b74ad57bd087454675735
SHA512

012fd3c7336b9b140e4397740a8e4556a1bb9381d6b2862d5803fe605c4f58fc82aaaf04daefec3feb8f79ad3e421f3d7f261d63fcef80dc824a8d4b0337c47b
SSDEEP

1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8sl12:Olg35GTslA5t3/w87

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  d40d923f62a4f64f81d1382e0a612b70_NeikiAnalytics
- Size
  
  70KB
- MD5
  
  d40d923f62a4f64f81d1382e0a612b70
- SHA1
  
  04a6617d7b4cc25103faae15550adbbfd8803bdf
- SHA256
  
  c7bd9627443e5e03f044a3a506f8c78b5eebe9b7f79b74ad57bd087454675735
- SHA512
  
  012fd3c7336b9b140e4397740a8e4556a1bb9381d6b2862d5803fe605c4f58fc82aaaf04daefec3feb8f79ad3e421f3d7f261d63fcef80dc824a8d4b0337c47b
- SSDEEP
  
  1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8sl12:Olg35GTslA5t3/w87
Score

10^/10

evasion persistence trojan
- Windows security bypass
  evasion trojan
- Modifies Installed Components in the registry
  persistence
- Sets file execution options in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencetrojan