9849eb076dea208708947b425dea9d0fd0e9bb49285ac73aa1f98e3465e1ad94 | Triage

Sharing

General

Target

590d8f7a38ff6a27505cca0a9e090530_NeikiAnalytics.exe
Size

72KB
Sample

240522-3lbxgadd2y
MD5

590d8f7a38ff6a27505cca0a9e090530
SHA1

fd7ab786d5af02fa507fcf36a240f430da2afdd1
SHA256

9849eb076dea208708947b425dea9d0fd0e9bb49285ac73aa1f98e3465e1ad94
SHA512

6c3e806f2bbce836ab08f577e260d59ed4789a1dd8880065b242d65ef3c58c91f4b6bc5d1e994051a09c43f5890e824ee4b0a719d4657bcdcae42d54d990dd05
SSDEEP

1536:x2zDjFBlS8G13YgsQSGE4zCvrbiCFkaG8pyb2y+/km:QPBBFGtzcJkaxpFAm

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  590d8f7a38ff6a27505cca0a9e090530_NeikiAnalytics.exe
- Size
  
  72KB
- MD5
  
  590d8f7a38ff6a27505cca0a9e090530
- SHA1
  
  fd7ab786d5af02fa507fcf36a240f430da2afdd1
- SHA256
  
  9849eb076dea208708947b425dea9d0fd0e9bb49285ac73aa1f98e3465e1ad94
- SHA512
  
  6c3e806f2bbce836ab08f577e260d59ed4789a1dd8880065b242d65ef3c58c91f4b6bc5d1e994051a09c43f5890e824ee4b0a719d4657bcdcae42d54d990dd05
- SSDEEP
  
  1536:x2zDjFBlS8G13YgsQSGE4zCvrbiCFkaG8pyb2y+/km:QPBBFGtzcJkaxpFAm
Score

10^/10

evasion persistence trojan
- Windows security bypass
  evasion trojan
- Modifies Installed Components in the registry
  persistence
- Sets file execution options in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencetrojan