58e2ddadfd73e1989a502103d92ab1469eb05cdeda063296b7462826c234fced | Triage

Sharing

General

Target

636c889e1c5efb3ec218599c62781160_NeikiAnalytics.exe
Size

71KB
Sample

240517-akeyhsgc51
MD5

636c889e1c5efb3ec218599c62781160
SHA1

9c55e0528cbc03b68d96979144cb89b9a168eece
SHA256

58e2ddadfd73e1989a502103d92ab1469eb05cdeda063296b7462826c234fced
SHA512

e96937e53421c674ba1a4fad3a0f309714b19166147f4b94f96a747766795b9b9ca87bf491e981f8f54f8433fde6bd1bfd91ab29657f2e61970c9592f166d2f1
SSDEEP

1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8sl5:Olg35GTslA5t3/w8Q

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  636c889e1c5efb3ec218599c62781160_NeikiAnalytics.exe
- Size
  
  71KB
- MD5
  
  636c889e1c5efb3ec218599c62781160
- SHA1
  
  9c55e0528cbc03b68d96979144cb89b9a168eece
- SHA256
  
  58e2ddadfd73e1989a502103d92ab1469eb05cdeda063296b7462826c234fced
- SHA512
  
  e96937e53421c674ba1a4fad3a0f309714b19166147f4b94f96a747766795b9b9ca87bf491e981f8f54f8433fde6bd1bfd91ab29657f2e61970c9592f166d2f1
- SSDEEP
  
  1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8sl5:Olg35GTslA5t3/w8Q
Score

10^/10

evasion persistence trojan
- Windows security bypass
  evasion trojan
- Modifies Installed Components in the registry
  persistence
- Sets file execution options in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencetrojan