1b9f69ab37f3604930b846442d02eb9cf6c9831df7f91bd956034918e20fa761 | Triage

Sharing

General

Target

f4fb46b1ce696b7da63a051413cbdcf0_NeikiAnalytics.exe
Size

71KB
Sample

240522-y736mafe26
MD5

f4fb46b1ce696b7da63a051413cbdcf0
SHA1

80fb63ef7835d74fbaaecc778e41490966cc3ddd
SHA256

1b9f69ab37f3604930b846442d02eb9cf6c9831df7f91bd956034918e20fa761
SHA512

f1f637d74040322a881897af2879d22e6073159702cd2dd828d440e069daa6b408a0e9f7d1fdcfc5a5dd660f081a11d97a0e3688f68b885eb7437d654bce4bb0
SSDEEP

1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8slFx:Olg35GTslA5t3/w8qx

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  f4fb46b1ce696b7da63a051413cbdcf0_NeikiAnalytics.exe
- Size
  
  71KB
- MD5
  
  f4fb46b1ce696b7da63a051413cbdcf0
- SHA1
  
  80fb63ef7835d74fbaaecc778e41490966cc3ddd
- SHA256
  
  1b9f69ab37f3604930b846442d02eb9cf6c9831df7f91bd956034918e20fa761
- SHA512
  
  f1f637d74040322a881897af2879d22e6073159702cd2dd828d440e069daa6b408a0e9f7d1fdcfc5a5dd660f081a11d97a0e3688f68b885eb7437d654bce4bb0
- SSDEEP
  
  1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8slFx:Olg35GTslA5t3/w8qx
Score

10^/10

evasion persistence trojan
- Windows security bypass
  evasion trojan
- Modifies Installed Components in the registry
  persistence
- Sets file execution options in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencetrojan