b6611ddd973c8da93f822f26ba8eb2eb23b7191a3af445e9a6ae5bd0621b4f2c | Triage

Sharing

General

Target

79a013822824fc3be193cf68599294f0_NeikiAnalytics.exe
Size

70KB
Sample

240517-bw6faabc72
MD5

79a013822824fc3be193cf68599294f0
SHA1

a28a3b04aeccc5356eb382aff656e3f3de05d0b3
SHA256

b6611ddd973c8da93f822f26ba8eb2eb23b7191a3af445e9a6ae5bd0621b4f2c
SHA512

7d8caa1ca9f1be2c644331ae8e67c8d9050bd45f559b973a82f78a4d04b21ecaa04e1ef73d111904d506ad2cba204a8a91adf0d595a61f955276f0bed453e513
SSDEEP

1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8Dv:Olg35GTslA5t3/w8z

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  79a013822824fc3be193cf68599294f0_NeikiAnalytics.exe
- Size
  
  70KB
- MD5
  
  79a013822824fc3be193cf68599294f0
- SHA1
  
  a28a3b04aeccc5356eb382aff656e3f3de05d0b3
- SHA256
  
  b6611ddd973c8da93f822f26ba8eb2eb23b7191a3af445e9a6ae5bd0621b4f2c
- SHA512
  
  7d8caa1ca9f1be2c644331ae8e67c8d9050bd45f559b973a82f78a4d04b21ecaa04e1ef73d111904d506ad2cba204a8a91adf0d595a61f955276f0bed453e513
- SSDEEP
  
  1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8Dv:Olg35GTslA5t3/w8z
Score

10^/10

evasion persistence trojan
- Windows security bypass
  evasion trojan
- Modifies Installed Components in the registry
  persistence
- Sets file execution options in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencetrojan