Malware Analysis Report

2025-03-15 05:43

Sample ID 240509-s4x8bacd84
Target 78164206dfed61385dd3b2b533cbc900_NeikiAnalytics
SHA256 6539a35628fcb34c1bcf9d05bc73938a36dbab72deb7672cf7bc0fc9fae1bc03
Tags
aspackv2 persistence spyware stealer
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

6539a35628fcb34c1bcf9d05bc73938a36dbab72deb7672cf7bc0fc9fae1bc03

Threat Level: Shows suspicious behavior

The file 78164206dfed61385dd3b2b533cbc900_NeikiAnalytics was found to be: Shows suspicious behavior.

Malicious Activity Summary

aspackv2 persistence spyware stealer

ASPack v2.12-2.42

Reads user/profile data of web browsers

Adds Run key to start application

Drops autorun.inf file

Drops file in System32 directory

Drops file in Program Files directory

Drops file in Windows directory

Unsigned PE

Suspicious use of SetWindowsHookEx

NTFS ADS

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-09 15:41

Signatures

ASPack v2.12-2.42

aspackv2
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-09 15:41

Reported

2024-05-09 15:43

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe"

Signatures

ASPack v2.12-2.42

aspackv2
Description Indicator Process Target
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A

Drops autorun.inf file

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\CertEnrollCtrl.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\ThumbnailExtractionHost.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\WSManHTTPConfig.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\msra.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\srdelayed.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\autoconv.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\EaseOfAccessDialog.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\mcbuilder.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\wbem\WinMgmt.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\regini.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\finger.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\icacls.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\PickerHost.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\TpmInit.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\colorcpl.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\cttunesvr.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\Dism.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\dvdplay.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\edpnotify.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\dialer.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\dllhst3g.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\expand.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\psr.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\shutdown.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\certreq.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\odbcad32.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\SearchIndexer.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\SyncHost.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\unlodctr.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\makecab.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\ndadmin.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\rekeywiz.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\SndVol.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\tracerpt.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\upnpcont.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\cmstp.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\find.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\rasautou.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\regsvr32.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\sc.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\tttracer.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\CheckNetIsolation.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\ComputerDefaults.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\OposHost.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\clip.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\dplaysvr.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\wbem\mofcomp.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\msiexec.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\whoami.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\netsh.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\hh.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\quickassist.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\setupugc.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\Magnify.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\RdpSaUacHelper.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\Taskmgr.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\credwiz.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\ctfmon.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe$ C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe$ C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.187.37\MicrosoftEdgeUpdateSetup.exe$ C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$ C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe$ C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe$ C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedgewebview2.exe$ C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\pwahelper.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe$ C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$ C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe$ C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe$ C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe$ C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe$ C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe$ C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe$ C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe$ C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe$ C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.187.37\MicrosoftEdgeUpdateCore.exe$ C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.187.37\MicrosoftEdgeComRegisterShellARM64.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe$ C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE$ C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe$ C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\dotnet\dotnet.exe$ C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\updater.exe$ C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe$ C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$ C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe$ C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe$ C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File created C:\Program Files\7-Zip\7zFM.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe$ C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ComSvcConfig.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v3.5\AddInUtil.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\AppLaunch.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Speech\Common\sapisvr.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SystemApps\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\UndockedDevKit.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SystemApps\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\XGpuEjectDialog.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMConfigInstaller.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\WsatConfig.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMConfigInstaller.exe$ C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.5\MSBuild.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallUtil.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_state.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\WsatConfig.exe$ C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\WsatConfig.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\MSBuild.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SystemApps\Microsoft.Windows.AddSuggestedFoldersToLibraryDialog_cw5n1h2txyewy\AddSuggestedFoldersToLibraryDialog.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SystemApps\Windows.CBSPreview_cw5n1h2txyewy\CameraBarcodeScannerPreview.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\EdmGen.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegSvcs.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_compiler.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ComSvcConfig.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SystemApps\Microsoft.Win32WebViewHost_cw5n1h2txyewy\Win32WebViewHost.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A

NTFS ADS

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
BE 2.17.107.105:443 www.bing.com tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 105.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 31.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 130.211.222.173.in-addr.arpa udp
US 8.8.8.8:53 12.173.189.20.in-addr.arpa udp

Files

memory/2900-0-0x0000000000400000-0x000000000040D000-memory.dmp

C:\905c0769f9a06c95a24ddf945\patcher.exe$

MD5 78164206dfed61385dd3b2b533cbc900
SHA1 8d1172e8c2f607cbc4b787c16a978ac422696142
SHA256 6539a35628fcb34c1bcf9d05bc73938a36dbab72deb7672cf7bc0fc9fae1bc03
SHA512 ad40963add0e1cb8c30c0eb9906ce5eeda5d24ccac37d42d5dd6dd070038b93e45a4864eaba7cc668c7df256c6c14a546dd59af34878ba99e35d62f271c38a12

memory/2900-48-0x0000000000400000-0x000000000040D000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-09 15:41

Reported

2024-05-09 15:44

Platform

win7-20240221-en

Max time kernel

148s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe"

Signatures

ASPack v2.12-2.42

aspackv2
Description Indicator Process Target
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A

Drops autorun.inf file

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\com\comrepl.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\com\MigRegDB.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\Dism\DismHost.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Microsoft Office\Office14\OIS.EXE C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe$ C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File created C:\Program Files\Mozilla Firefox\crashreporter.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSQRY32.EXE C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe$ C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroTextExtractor.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\MSACCESS.EXE C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PPTICO.EXE$ C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe$ C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\rmid.exe$ C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\DW\DW20.EXE C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\vsta_ep32.exe$ C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\ONELEV.EXE$ C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File created C:\Program Files\Microsoft Games\Mahjong\Mahjong.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File created C:\Program Files\Mozilla Firefox\pingsender.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\1033\ONELEV.EXE C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\SmartTagInstall.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\NAMECONTROLSERVER.EXE$ C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\SETLANG.EXE C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe$ C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\pipanel.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Wordconv.exe$ C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe$ C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe$ C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe$ C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLED.EXE C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\orbd.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE$ C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.exe$ C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\ODeploy.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Setup.exe$ C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\ComSvcConfig\d632b7434f821829827657e23ac98589\ComSvcConfig.ni.exe$ C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File created C:\Windows\assembly\NativeImages_v4.0.30319_32\ComSvcConfig\2bd538d545e15452202ef3b41080e2ce\ComSvcConfig.ni.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regsql.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Speech\Common\sapisvr.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\EdmGen.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.5\DataSvcUtil.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\joticon.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File created C:\Windows\assembly\NativeImages_v4.0.30319_32\WsatConfig\537950d9c71af966e1d8c9deb550f842\WsatConfig.ni.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe$ C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe$ C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\ehome\MediaCenterWebLauncher.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe$ C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_64\mcupdate\f30beba36940b5a2b55a32ea7f42d694\mcupdate.ni.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W71daf281#\df459c0a2762c33e0699703f186b1751\Microsoft.Workflow.Compiler.ni.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ComSvcConfig.exe$ C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe$ C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\SMSvcHost\1bc1ee3c3aa45d28dcf4657bceb2fcb4\SMSvcHost.ni.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\LoadMxf\d09b54cd68bc772b3be3832926e940d4\LoadMxf.ni.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe$ C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe$ C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe$ C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_32\WsatConfig\96a8bdafba9f9d3e33cd974bfaa67e58\WsatConfig.ni.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_64\dfsvc\9bc0d921859b039d6e9f642148333949\dfsvc.ni.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_64\ehExtHost\ad37b6e3a1cb1081592f1c5797ae9dad\ehExtHost.ni.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\servicing\GC64\tzupd.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\MSBuild\f4a88265ac4ad47978daef8c5482fd30\MSBuild.ni.exe$ C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess32.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\MSBuild\b93c627ec2e15c2675bcc81edafb10be\MSBuild.ni.exe$ C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ComSvcConfig.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\AppLaunch.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe$ C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$ C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\assembly\GAC_32\ehexthost32\6.1.0.0__31bf3856ad364e35\ehexthost32.exe$ C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\ehexthost\6.1.0.0__31bf3856ad364e35\ehexthost.exe$ C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe$ C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A

NTFS ADS

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\78164206dfed61385dd3b2b533cbc900_NeikiAnalytics.exe"

Network

N/A

Files

memory/1936-0-0x0000000000400000-0x000000000040D000-memory.dmp

C:\905c0769f9a06c95a24ddf945\patcher.exe$

MD5 78164206dfed61385dd3b2b533cbc900
SHA1 8d1172e8c2f607cbc4b787c16a978ac422696142
SHA256 6539a35628fcb34c1bcf9d05bc73938a36dbab72deb7672cf7bc0fc9fae1bc03
SHA512 ad40963add0e1cb8c30c0eb9906ce5eeda5d24ccac37d42d5dd6dd070038b93e45a4864eaba7cc668c7df256c6c14a546dd59af34878ba99e35d62f271c38a12

memory/1936-55-0x0000000000400000-0x000000000040D000-memory.dmp