7a74a4a7ba0d2d72db2f969c16614b213796016b8ca21b3fe93cc92743772824 | Triage

Sharing

General

Target

1c36946cd1c14b92838cf909906e65a0_NeikiAnalytics.exe
Size

71KB
Sample

240610-1dzx8asakj
MD5

1c36946cd1c14b92838cf909906e65a0
SHA1

aaf328f60944b2c67f3522fe1e4d82d7ba40cec7
SHA256

7a74a4a7ba0d2d72db2f969c16614b213796016b8ca21b3fe93cc92743772824
SHA512

2f3fd2f77042b66e2011ad63bc002ae84b2fb7656b4a45c7741290290b33210eeab7027aab6e182424313fca892f489e32461caf5f2348a28ec0e598ef9087b9
SSDEEP

1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8slvB:Olg35GTslA5t3/w8wB

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  1c36946cd1c14b92838cf909906e65a0_NeikiAnalytics.exe
- Size
  
  71KB
- MD5
  
  1c36946cd1c14b92838cf909906e65a0
- SHA1
  
  aaf328f60944b2c67f3522fe1e4d82d7ba40cec7
- SHA256
  
  7a74a4a7ba0d2d72db2f969c16614b213796016b8ca21b3fe93cc92743772824
- SHA512
  
  2f3fd2f77042b66e2011ad63bc002ae84b2fb7656b4a45c7741290290b33210eeab7027aab6e182424313fca892f489e32461caf5f2348a28ec0e598ef9087b9
- SSDEEP
  
  1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8slvB:Olg35GTslA5t3/w8wB
Score

10^/10

evasion persistence trojan
- Windows security bypass
  evasion trojan
- Modifies Installed Components in the registry
  persistence
- Sets file execution options in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencetrojan