7ec40d3c21efda8040a35a95a71ea518216f8b19a95ab81312d9b1b2156c4274 | Triage

Sharing

General

Target

17cdb4c1976dc5c7f7fc4e47f1d3ce60_NeikiAnalytics.exe
Size

73KB
Sample

240526-vxhv6aef87
MD5

17cdb4c1976dc5c7f7fc4e47f1d3ce60
SHA1

652e8354a567a055fa885ca58c6438e942f73a37
SHA256

7ec40d3c21efda8040a35a95a71ea518216f8b19a95ab81312d9b1b2156c4274
SHA512

4ca7d23483df3fef5382e204662fd775abaa2a8f2e2341e4254414f7f86913fcd674a83b890b74829fe385d414e3dfcdbe607c1cbcf68ce32f4f731346ff1334
SSDEEP

1536:xUzOORyuTKxBpkcoIOgm5qyrY4xhzO2dsM:a/Kx8DIOvqeY4PzOXM

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  17cdb4c1976dc5c7f7fc4e47f1d3ce60_NeikiAnalytics.exe
- Size
  
  73KB
- MD5
  
  17cdb4c1976dc5c7f7fc4e47f1d3ce60
- SHA1
  
  652e8354a567a055fa885ca58c6438e942f73a37
- SHA256
  
  7ec40d3c21efda8040a35a95a71ea518216f8b19a95ab81312d9b1b2156c4274
- SHA512
  
  4ca7d23483df3fef5382e204662fd775abaa2a8f2e2341e4254414f7f86913fcd674a83b890b74829fe385d414e3dfcdbe607c1cbcf68ce32f4f731346ff1334
- SSDEEP
  
  1536:xUzOORyuTKxBpkcoIOgm5qyrY4xhzO2dsM:a/Kx8DIOvqeY4PzOXM
Score

10^/10

evasion persistence trojan
- Windows security bypass
  evasion trojan
- Modifies Installed Components in the registry
  persistence
- Sets file execution options in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencetrojan