45dcafae58a2a7af6b48910326684df5b4363623a2225b2149ae2755afadf7a9 | Triage

Sharing

General

Target

6b71e456f254168cf5246a28ffb1a490_NeikiAnalytics.exe
Size

70KB
Sample

240607-tpxtnsbh52
MD5

6b71e456f254168cf5246a28ffb1a490
SHA1

0c7dd7f2b19d2a0621801d7b764c98bf89e84c9f
SHA256

45dcafae58a2a7af6b48910326684df5b4363623a2225b2149ae2755afadf7a9
SHA512

35d530ba729030fc075a48a519e55f334e4b4241259a863dfab443cc8c2b556a9a3b06beaf4e9963524c6938c900155634596c76986306726fa726ec349feaf8
SSDEEP

1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8E:Olg35GTslA5t3/w8E

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  6b71e456f254168cf5246a28ffb1a490_NeikiAnalytics.exe
- Size
  
  70KB
- MD5
  
  6b71e456f254168cf5246a28ffb1a490
- SHA1
  
  0c7dd7f2b19d2a0621801d7b764c98bf89e84c9f
- SHA256
  
  45dcafae58a2a7af6b48910326684df5b4363623a2225b2149ae2755afadf7a9
- SHA512
  
  35d530ba729030fc075a48a519e55f334e4b4241259a863dfab443cc8c2b556a9a3b06beaf4e9963524c6938c900155634596c76986306726fa726ec349feaf8
- SSDEEP
  
  1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8E:Olg35GTslA5t3/w8E
Score

10^/10

evasion persistence trojan
- Windows security bypass
  evasion trojan
- Modifies Installed Components in the registry
  persistence
- Sets file execution options in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencetrojan