c91344b852bd26fe067fefa1adc94c07159a1641875a39623fe0c41f4d519eb5 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

e31765dc7bde50a0109e5f2f4d9291c0_NeikiAnalytics
Size

72KB
Sample

240516-ss9f7sah3t
MD5

e31765dc7bde50a0109e5f2f4d9291c0
SHA1

f1798ceb3cff3084ec38495ab9188d13417466f5
SHA256

c91344b852bd26fe067fefa1adc94c07159a1641875a39623fe0c41f4d519eb5
SHA512

7e9b8f704fa7343e93d937244ec40b8445de47922778537cd4f407cae1b92f3b9a554746ff0a5b900a0163c95db5d9cff018d06d1588c841e2c9e916288d6c80
SSDEEP

1536:xWLw62p7KTxU0IIBhVu2d7mN9msbqt36etdJ:lgTJBq2d7e9ahH

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  e31765dc7bde50a0109e5f2f4d9291c0_NeikiAnalytics
- Size
  
  72KB
- MD5
  
  e31765dc7bde50a0109e5f2f4d9291c0
- SHA1
  
  f1798ceb3cff3084ec38495ab9188d13417466f5
- SHA256
  
  c91344b852bd26fe067fefa1adc94c07159a1641875a39623fe0c41f4d519eb5
- SHA512
  
  7e9b8f704fa7343e93d937244ec40b8445de47922778537cd4f407cae1b92f3b9a554746ff0a5b900a0163c95db5d9cff018d06d1588c841e2c9e916288d6c80
- SSDEEP
  
  1536:xWLw62p7KTxU0IIBhVu2d7mN9msbqt36etdJ:lgTJBq2d7e9ahH
Score

10^/10

evasion persistence trojan
- Windows security bypass
  evasion trojan
- Modifies Installed Components in the registry
  persistence
- Sets file execution options in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencetrojan