03590c1aa298be61d20c0658e8571691e7180614834a220a1c65310bd263ffd4 | Triage

Sharing

General

Target

ed2318bec81a939e30e41f4a59223bf0_NeikiAnalytics.exe
Size

73KB
Sample

240517-scyd1ach8w
MD5

ed2318bec81a939e30e41f4a59223bf0
SHA1

592ba933f88f9b4cb1029a4d41769271e1df2964
SHA256

03590c1aa298be61d20c0658e8571691e7180614834a220a1c65310bd263ffd4
SHA512

2c775952038ad0415e7236336901ea858cdd22153cf6468efd0bde9a1d52d0dc15501912c3b5a8784bfff3a81403e251bdc9889f5f626d9804bb232b691c38c1
SSDEEP

1536:xJHpt8q03mUqaoPB8TvSrtXr1CNs9utog:PH0j3x1oPB8TvS5ANsm

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  ed2318bec81a939e30e41f4a59223bf0_NeikiAnalytics.exe
- Size
  
  73KB
- MD5
  
  ed2318bec81a939e30e41f4a59223bf0
- SHA1
  
  592ba933f88f9b4cb1029a4d41769271e1df2964
- SHA256
  
  03590c1aa298be61d20c0658e8571691e7180614834a220a1c65310bd263ffd4
- SHA512
  
  2c775952038ad0415e7236336901ea858cdd22153cf6468efd0bde9a1d52d0dc15501912c3b5a8784bfff3a81403e251bdc9889f5f626d9804bb232b691c38c1
- SSDEEP
  
  1536:xJHpt8q03mUqaoPB8TvSrtXr1CNs9utog:PH0j3x1oPB8TvS5ANsm
Score

10^/10

evasion persistence trojan
- Windows security bypass
  evasion trojan
- Modifies Installed Components in the registry
  persistence
- Sets file execution options in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencetrojan