350660b19dab35528641fbbbee526a2951c04e87d0804ad8d1291f9e17f42c44 | Triage

Sharing

General

Target

a33fc0896a2b063bcfbc2292572cd760_NeikiAnalytics.exe
Size

71KB
Sample

240524-3a3aaaef5z
MD5

a33fc0896a2b063bcfbc2292572cd760
SHA1

80ae76602fb0be1671f54624e9ca75c2b29006a3
SHA256

350660b19dab35528641fbbbee526a2951c04e87d0804ad8d1291f9e17f42c44
SHA512

46bacdff79499336ca95960c1e0579627f1cf32a3400f7a58a04a455d783ddf7c869079eb859c12172a460b3d69827f4642611a9c224dc4c922e42fa3c492bcc
SSDEEP

1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8slD:Olg35GTslA5t3/w8w

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  a33fc0896a2b063bcfbc2292572cd760_NeikiAnalytics.exe
- Size
  
  71KB
- MD5
  
  a33fc0896a2b063bcfbc2292572cd760
- SHA1
  
  80ae76602fb0be1671f54624e9ca75c2b29006a3
- SHA256
  
  350660b19dab35528641fbbbee526a2951c04e87d0804ad8d1291f9e17f42c44
- SHA512
  
  46bacdff79499336ca95960c1e0579627f1cf32a3400f7a58a04a455d783ddf7c869079eb859c12172a460b3d69827f4642611a9c224dc4c922e42fa3c492bcc
- SSDEEP
  
  1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8slD:Olg35GTslA5t3/w8w
Score

10^/10

evasion persistence trojan
- Windows security bypass
  evasion trojan
- Modifies Installed Components in the registry
  persistence
- Sets file execution options in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencetrojan