Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09-05-2024 15:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6e4f08a9ad3277c5c57f2de49f1cbef0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
6e4f08a9ad3277c5c57f2de49f1cbef0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
6e4f08a9ad3277c5c57f2de49f1cbef0_NeikiAnalytics.exe
-
Size
88KB
-
MD5
6e4f08a9ad3277c5c57f2de49f1cbef0
-
SHA1
6b6601759d29e1d40b899716fddcb847f489ac0c
-
SHA256
5c510cf0d5afeebbac2cc1648702593334a23275d85dc29701f99e43e6b6e1de
-
SHA512
63ccea9ad7ba1c9c117bac3471863245b2df1cd0faf53ec35531d0a4a6b6683c01d2fbcf7e201347a121bfe11d1f99e395cbd1a193737d3510345898aa1da1be
-
SSDEEP
1536:ahUDofByDJWbMGcEFLPEPKOJUsy1+VMA:aIofBHbKMP0PvMA
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 1196 explorer.exe 696 explorer.exe 2528 explorer.exe 2740 explorer.exe -
Loads dropped DLL 5 IoCs
pid Process 1584 6e4f08a9ad3277c5c57f2de49f1cbef0_NeikiAnalytics.exe 1584 6e4f08a9ad3277c5c57f2de49f1cbef0_NeikiAnalytics.exe 1584 6e4f08a9ad3277c5c57f2de49f1cbef0_NeikiAnalytics.exe 1584 6e4f08a9ad3277c5c57f2de49f1cbef0_NeikiAnalytics.exe 1584 6e4f08a9ad3277c5c57f2de49f1cbef0_NeikiAnalytics.exe -
resource yara_rule behavioral1/memory/1584-136-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1584-137-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1584-139-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1584-133-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1584-131-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1584-313-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/696-309-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/696-479-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\Video Driver = "C:\\Users\\Admin\\AppData\\Roaming\\config\\explorer.exe" reg.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 1664 set thread context of 1584 1664 6e4f08a9ad3277c5c57f2de49f1cbef0_NeikiAnalytics.exe 28 PID 1196 set thread context of 696 1196 explorer.exe 33 PID 1196 set thread context of 2528 1196 explorer.exe 34 PID 2528 set thread context of 2740 2528 explorer.exe 35 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 040000000100000010000000a923759bba49366e31c2dbf2e766ba870f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca619000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A explorer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 explorer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e709000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6502000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6 explorer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 0f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd explorer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 19000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca61d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e4090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f006700690065007300000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a92000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd explorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 696 explorer.exe Token: SeDebugPrivilege 696 explorer.exe Token: SeDebugPrivilege 696 explorer.exe Token: SeDebugPrivilege 696 explorer.exe Token: SeDebugPrivilege 696 explorer.exe Token: SeDebugPrivilege 696 explorer.exe Token: SeDebugPrivilege 696 explorer.exe Token: SeDebugPrivilege 696 explorer.exe Token: SeDebugPrivilege 696 explorer.exe Token: SeDebugPrivilege 696 explorer.exe Token: SeDebugPrivilege 696 explorer.exe Token: SeDebugPrivilege 696 explorer.exe Token: SeDebugPrivilege 696 explorer.exe Token: SeDebugPrivilege 696 explorer.exe Token: SeDebugPrivilege 696 explorer.exe Token: SeDebugPrivilege 696 explorer.exe Token: SeDebugPrivilege 696 explorer.exe Token: SeDebugPrivilege 696 explorer.exe Token: SeDebugPrivilege 696 explorer.exe Token: SeDebugPrivilege 696 explorer.exe Token: SeDebugPrivilege 696 explorer.exe Token: SeDebugPrivilege 696 explorer.exe Token: SeDebugPrivilege 696 explorer.exe Token: SeDebugPrivilege 696 explorer.exe Token: SeDebugPrivilege 696 explorer.exe Token: SeDebugPrivilege 696 explorer.exe Token: SeDebugPrivilege 696 explorer.exe Token: SeDebugPrivilege 696 explorer.exe Token: SeDebugPrivilege 696 explorer.exe Token: SeDebugPrivilege 696 explorer.exe Token: SeDebugPrivilege 696 explorer.exe Token: SeDebugPrivilege 696 explorer.exe Token: SeDebugPrivilege 696 explorer.exe Token: SeDebugPrivilege 696 explorer.exe Token: SeDebugPrivilege 696 explorer.exe Token: SeDebugPrivilege 696 explorer.exe Token: SeDebugPrivilege 696 explorer.exe Token: SeDebugPrivilege 696 explorer.exe Token: SeDebugPrivilege 696 explorer.exe Token: SeDebugPrivilege 696 explorer.exe Token: SeDebugPrivilege 696 explorer.exe Token: SeDebugPrivilege 696 explorer.exe Token: SeDebugPrivilege 696 explorer.exe Token: SeDebugPrivilege 696 explorer.exe Token: SeDebugPrivilege 696 explorer.exe Token: SeDebugPrivilege 696 explorer.exe Token: SeDebugPrivilege 696 explorer.exe Token: SeDebugPrivilege 696 explorer.exe Token: SeDebugPrivilege 696 explorer.exe Token: SeDebugPrivilege 696 explorer.exe Token: SeDebugPrivilege 696 explorer.exe Token: SeDebugPrivilege 696 explorer.exe Token: SeDebugPrivilege 696 explorer.exe Token: SeDebugPrivilege 696 explorer.exe Token: SeDebugPrivilege 696 explorer.exe Token: SeDebugPrivilege 696 explorer.exe Token: SeDebugPrivilege 696 explorer.exe Token: SeDebugPrivilege 696 explorer.exe Token: SeDebugPrivilege 696 explorer.exe Token: SeDebugPrivilege 696 explorer.exe Token: SeDebugPrivilege 696 explorer.exe Token: SeDebugPrivilege 696 explorer.exe Token: SeDebugPrivilege 696 explorer.exe Token: SeDebugPrivilege 696 explorer.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1664 6e4f08a9ad3277c5c57f2de49f1cbef0_NeikiAnalytics.exe 1584 6e4f08a9ad3277c5c57f2de49f1cbef0_NeikiAnalytics.exe 1196 explorer.exe 696 explorer.exe -
Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 1664 wrote to memory of 1584 1664 6e4f08a9ad3277c5c57f2de49f1cbef0_NeikiAnalytics.exe 28 PID 1664 wrote to memory of 1584 1664 6e4f08a9ad3277c5c57f2de49f1cbef0_NeikiAnalytics.exe 28 PID 1664 wrote to memory of 1584 1664 6e4f08a9ad3277c5c57f2de49f1cbef0_NeikiAnalytics.exe 28 PID 1664 wrote to memory of 1584 1664 6e4f08a9ad3277c5c57f2de49f1cbef0_NeikiAnalytics.exe 28 PID 1664 wrote to memory of 1584 1664 6e4f08a9ad3277c5c57f2de49f1cbef0_NeikiAnalytics.exe 28 PID 1664 wrote to memory of 1584 1664 6e4f08a9ad3277c5c57f2de49f1cbef0_NeikiAnalytics.exe 28 PID 1664 wrote to memory of 1584 1664 6e4f08a9ad3277c5c57f2de49f1cbef0_NeikiAnalytics.exe 28 PID 1664 wrote to memory of 1584 1664 6e4f08a9ad3277c5c57f2de49f1cbef0_NeikiAnalytics.exe 28 PID 1584 wrote to memory of 752 1584 6e4f08a9ad3277c5c57f2de49f1cbef0_NeikiAnalytics.exe 29 PID 1584 wrote to memory of 752 1584 6e4f08a9ad3277c5c57f2de49f1cbef0_NeikiAnalytics.exe 29 PID 1584 wrote to memory of 752 1584 6e4f08a9ad3277c5c57f2de49f1cbef0_NeikiAnalytics.exe 29 PID 1584 wrote to memory of 752 1584 6e4f08a9ad3277c5c57f2de49f1cbef0_NeikiAnalytics.exe 29 PID 752 wrote to memory of 1460 752 cmd.exe 31 PID 752 wrote to memory of 1460 752 cmd.exe 31 PID 752 wrote to memory of 1460 752 cmd.exe 31 PID 752 wrote to memory of 1460 752 cmd.exe 31 PID 1584 wrote to memory of 1196 1584 6e4f08a9ad3277c5c57f2de49f1cbef0_NeikiAnalytics.exe 32 PID 1584 wrote to memory of 1196 1584 6e4f08a9ad3277c5c57f2de49f1cbef0_NeikiAnalytics.exe 32 PID 1584 wrote to memory of 1196 1584 6e4f08a9ad3277c5c57f2de49f1cbef0_NeikiAnalytics.exe 32 PID 1584 wrote to memory of 1196 1584 6e4f08a9ad3277c5c57f2de49f1cbef0_NeikiAnalytics.exe 32 PID 1196 wrote to memory of 696 1196 explorer.exe 33 PID 1196 wrote to memory of 696 1196 explorer.exe 33 PID 1196 wrote to memory of 696 1196 explorer.exe 33 PID 1196 wrote to memory of 696 1196 explorer.exe 33 PID 1196 wrote to memory of 696 1196 explorer.exe 33 PID 1196 wrote to memory of 696 1196 explorer.exe 33 PID 1196 wrote to memory of 696 1196 explorer.exe 33 PID 1196 wrote to memory of 696 1196 explorer.exe 33 PID 1196 wrote to memory of 2528 1196 explorer.exe 34 PID 1196 wrote to memory of 2528 1196 explorer.exe 34 PID 1196 wrote to memory of 2528 1196 explorer.exe 34 PID 1196 wrote to memory of 2528 1196 explorer.exe 34 PID 1196 wrote to memory of 2528 1196 explorer.exe 34 PID 1196 wrote to memory of 2528 1196 explorer.exe 34 PID 1196 wrote to memory of 2528 1196 explorer.exe 34 PID 1196 wrote to memory of 2528 1196 explorer.exe 34 PID 2528 wrote to memory of 2740 2528 explorer.exe 35 PID 2528 wrote to memory of 2740 2528 explorer.exe 35 PID 2528 wrote to memory of 2740 2528 explorer.exe 35 PID 2528 wrote to memory of 2740 2528 explorer.exe 35 PID 2528 wrote to memory of 2740 2528 explorer.exe 35 PID 2528 wrote to memory of 2740 2528 explorer.exe 35 PID 2528 wrote to memory of 2740 2528 explorer.exe 35 PID 2528 wrote to memory of 2740 2528 explorer.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\6e4f08a9ad3277c5c57f2de49f1cbef0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\6e4f08a9ad3277c5c57f2de49f1cbef0_NeikiAnalytics.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\6e4f08a9ad3277c5c57f2de49f1cbef0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\6e4f08a9ad3277c5c57f2de49f1cbef0_NeikiAnalytics.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JDIXY.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Video Driver" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\config\explorer.exe" /f4⤵
- Adds Run key to start application
PID:1460
-
-
-
C:\Users\Admin\AppData\Roaming\config\explorer.exe"C:\Users\Admin\AppData\Roaming\config\explorer.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Users\Admin\AppData\Roaming\config\explorer.exe"C:\Users\Admin\AppData\Roaming\config\explorer.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:696
-
-
C:\Users\Admin\AppData\Roaming\config\explorer.exe"C:\Users\Admin\AppData\Roaming\config\explorer.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Roaming\config\explorer.exe"C:\Users\Admin\AppData\Roaming\config\explorer.exe"5⤵
- Executes dropped EXE
- Modifies system certificate store
PID:2740
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51724b86cf8d81c54b3db2b593684f913
SHA1501fbbd3adbc49aa7316904079cafca4180e7b85
SHA256a6586336849cd9b13895a3567feda0d0d3be041358edade55ab5b31eafe38410
SHA51252c46a07dadfb76f04d7de933743aeb3639fe503ad7bd0e503833496c75d90fdadc149e65a6fe4250c518e61daaee8c052f02d36f15b543dcfce7c3a40dd6325
-
Filesize
149B
MD5fc1798b7c7938454220fda837a76f354
SHA1b232912930b2bc24ff18bf7ecd58f872bbe01ea0
SHA2567f0a5917b5aca9c5beb153aad0ef95bf0aeafb83768da5b086c3f029ba42d7c8
SHA512d1abdd45a8e5d33893b9d19424174a07feed145d2e6b4be318ab5fde503f850579a4a101a010f30e16ecde2c7123f45357a8341214655321ee0f0097ca911331
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
Filesize
88KB
MD52c503e712c0fb5ca78a0ea81c583fadf
SHA125d7ac2aa450a3ec84e80c4990ae0af22ff814c4
SHA256446795f95607a424ed79b872d4d07142d428b463aa15bb1f13a0627f7df4f3a1
SHA512a0e1ae8f841449fd8d33ec1c4bb0c512f8d2ac6b7f2f8dc786ee75f4301812dd4445ef0b05f75960a9567bdfdd9734f76df8048787660e3a0bbd5d6791cdcf5e