edd478c024b1b8f18cab22696b75e537c67eb64a32d11fc32c39c43a0b4801f2 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

932e204d659453c617a72171e41b6740_NeikiAnalytics
Size

70KB
Sample

240516-ekzp5sbd93
MD5

932e204d659453c617a72171e41b6740
SHA1

8e53c7330e1fe19bcdd7c5f4516bf33e9d5d90a3
SHA256

edd478c024b1b8f18cab22696b75e537c67eb64a32d11fc32c39c43a0b4801f2
SHA512

7ce84cdbd911a505d893ca24d0a5f2c0c9fc034f8881cfb63165e6d9b523130e6d6dc4c45138bd58534125bb46417b01b3056e7e5c9879e43cd5aa6c6a680a5d
SSDEEP

1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8sl6m:Olg35GTslA5t3/w8A

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  932e204d659453c617a72171e41b6740_NeikiAnalytics
- Size
  
  70KB
- MD5
  
  932e204d659453c617a72171e41b6740
- SHA1
  
  8e53c7330e1fe19bcdd7c5f4516bf33e9d5d90a3
- SHA256
  
  edd478c024b1b8f18cab22696b75e537c67eb64a32d11fc32c39c43a0b4801f2
- SHA512
  
  7ce84cdbd911a505d893ca24d0a5f2c0c9fc034f8881cfb63165e6d9b523130e6d6dc4c45138bd58534125bb46417b01b3056e7e5c9879e43cd5aa6c6a680a5d
- SSDEEP
  
  1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8sl6m:Olg35GTslA5t3/w8A
Score

10^/10

evasion persistence trojan
- Windows security bypass
  evasion trojan
- Modifies Installed Components in the registry
  persistence
- Sets file execution options in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencetrojan