c94f0c108e2db6f2c30793d7d68b61a5ddd2ae56c3a01a80acfded334c98cfd5 | Triage

Sharing

General

Target

2e8a44c2f751a75b18fffee6814b2000_NeikiAnalytics
Size

71KB
Sample

240515-zcjn6saf5s
MD5

2e8a44c2f751a75b18fffee6814b2000
SHA1

5c8ba64eb3796057ed5805dca8b7607495631922
SHA256

c94f0c108e2db6f2c30793d7d68b61a5ddd2ae56c3a01a80acfded334c98cfd5
SHA512

657a6b9f249042f0954eeed348ae291294fcc3df19424363b5bdf123a7fddbe5b1963c86b9e6831ab3d53ea49906feaeba7b2486446f8865348654da09be6629
SSDEEP

1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8slNjV:Olg35GTslA5t3/w8GjV

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  2e8a44c2f751a75b18fffee6814b2000_NeikiAnalytics
- Size
  
  71KB
- MD5
  
  2e8a44c2f751a75b18fffee6814b2000
- SHA1
  
  5c8ba64eb3796057ed5805dca8b7607495631922
- SHA256
  
  c94f0c108e2db6f2c30793d7d68b61a5ddd2ae56c3a01a80acfded334c98cfd5
- SHA512
  
  657a6b9f249042f0954eeed348ae291294fcc3df19424363b5bdf123a7fddbe5b1963c86b9e6831ab3d53ea49906feaeba7b2486446f8865348654da09be6629
- SSDEEP
  
  1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8slNjV:Olg35GTslA5t3/w8GjV
Score

10^/10

evasion persistence trojan
- Windows security bypass
  evasion trojan
- Modifies Installed Components in the registry
  persistence
- Sets file execution options in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencetrojan