b5781db26c21fee869638183e7559dae993b306c845ff6be1ccb18fb726c6ae7 | Triage

Sharing

General

Target

1ec3f95fead26d4b55f2c85b9df28c00_NeikiAnalytics.exe
Size

71KB
Sample

240517-x21b4seg72
MD5

1ec3f95fead26d4b55f2c85b9df28c00
SHA1

0c924c26eba6aef31d093f1939446ff451d7d63b
SHA256

b5781db26c21fee869638183e7559dae993b306c845ff6be1ccb18fb726c6ae7
SHA512

d8bb70b2275bde476551b72393202b2df4aeab30dbffc748aee2ae802e21ec96ced4facf2698d41da13e29d56c748f612cc465c840deffcfbd9fa7997a012dbe
SSDEEP

1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8sl/:Olg35GTslA5t3/w8y

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  1ec3f95fead26d4b55f2c85b9df28c00_NeikiAnalytics.exe
- Size
  
  71KB
- MD5
  
  1ec3f95fead26d4b55f2c85b9df28c00
- SHA1
  
  0c924c26eba6aef31d093f1939446ff451d7d63b
- SHA256
  
  b5781db26c21fee869638183e7559dae993b306c845ff6be1ccb18fb726c6ae7
- SHA512
  
  d8bb70b2275bde476551b72393202b2df4aeab30dbffc748aee2ae802e21ec96ced4facf2698d41da13e29d56c748f612cc465c840deffcfbd9fa7997a012dbe
- SSDEEP
  
  1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8sl/:Olg35GTslA5t3/w8y
Score

10^/10

evasion persistence trojan
- Windows security bypass
  evasion trojan
- Modifies Installed Components in the registry
  persistence
- Sets file execution options in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencetrojan