fe8de48f1c8f70d3e327a87b62c5e5b22af63ffb08471ac677770eb495baf84c

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 01:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

40ce26d8a6d787b4486568471fd2e8b0_NeikiAnalytics.exe
Size

231KB
MD5

40ce26d8a6d787b4486568471fd2e8b0
SHA1

4e7fe15d4f3c60afec5dadddc6357fcd93680c56
SHA256

fe8de48f1c8f70d3e327a87b62c5e5b22af63ffb08471ac677770eb495baf84c
SHA512

951474171be6bfea52f026ce0939d706cd2174d44eaf837826f2467aaf7196e0b886f4cc34e2e3b864770133587d2c9d68162b4427047c4f4531789c93f45755
SSDEEP

6144:vhbZ5hMTNFf8LAurlEzAX7oAwfSZ4sXBzQIU:ZtXMzqrllX7XwGEIU

Score

7^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 26 IoCs

pid	Process
2476	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202.exe
2628	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202a.exe
2796	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202b.exe
2312	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202c.exe
2688	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202d.exe
2588	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202e.exe
1880	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202f.exe
2708	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202g.exe
1468	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202h.exe
2500	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202i.exe
2592	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202j.exe
1552	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202k.exe
1708	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202l.exe
1508	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202m.exe
2244	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202n.exe
1056	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202o.exe
2368	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202p.exe
980	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202q.exe
1040	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202r.exe
1792	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202s.exe
608	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202t.exe
2504	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202u.exe
2428	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202v.exe
1720	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202w.exe
1748	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202x.exe
2944	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202y.exe

Loads dropped DLL 52 IoCs

pid	Process
1712	40ce26d8a6d787b4486568471fd2e8b0_NeikiAnalytics.exe
1712	40ce26d8a6d787b4486568471fd2e8b0_NeikiAnalytics.exe
2476	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202.exe
2476	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202.exe
2628	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202a.exe
2628	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202a.exe
2796	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202b.exe
2796	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202b.exe
2312	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202c.exe
2312	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202c.exe
2688	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202d.exe
2688	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202d.exe
2588	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202e.exe
2588	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202e.exe
1880	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202f.exe
1880	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202f.exe
2708	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202g.exe
2708	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202g.exe
1468	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202h.exe
1468	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202h.exe
2500	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202i.exe
2500	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202i.exe
2592	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202j.exe
2592	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202j.exe
1552	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202k.exe
1552	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202k.exe
1708	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202l.exe
1708	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202l.exe
1508	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202m.exe
1508	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202m.exe
2244	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202n.exe
2244	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202n.exe
1056	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202o.exe
1056	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202o.exe
2368	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202p.exe
2368	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202p.exe
980	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202q.exe
980	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202q.exe
1040	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202r.exe
1040	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202r.exe
1792	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202s.exe
1792	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202s.exe
608	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202t.exe
608	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202t.exe
2504	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202u.exe
2504	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202u.exe
2428	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202v.exe
2428	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202v.exe
1720	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202w.exe
1720	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202w.exe
1748	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202x.exe
1748	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202x.exe

UPX packed file 49 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1712-0-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/files/0x000b0000000122ec-5.dat	upx
behavioral1/memory/1712-8-0x0000000000380000-0x00000000003BA000-memory.dmp	upx
behavioral1/memory/1712-13-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/memory/2476-15-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/memory/2476-28-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/memory/2628-43-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/memory/2796-44-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/memory/2796-58-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/memory/2312-72-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/memory/2688-73-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/memory/2688-87-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/files/0x0009000000015ccf-95.dat	upx
behavioral1/memory/2588-103-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/memory/2588-97-0x00000000005D0000-0x000000000060A000-memory.dmp	upx
behavioral1/memory/1880-104-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/memory/1880-117-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/memory/2708-119-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/memory/2708-133-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/memory/1468-134-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/memory/1468-147-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/memory/2500-161-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/memory/2592-163-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/memory/2592-176-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/memory/1552-191-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/memory/1708-192-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/memory/1708-205-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/memory/1508-219-0x0000000000850000-0x000000000088A000-memory.dmp	upx
behavioral1/memory/1508-221-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/memory/2244-234-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/memory/2368-248-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/memory/1056-247-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/memory/2368-258-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/memory/980-259-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/memory/980-269-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/memory/1040-270-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/memory/1040-280-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/memory/1792-290-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/memory/608-291-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/memory/608-302-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/memory/2428-318-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/memory/2504-312-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/memory/2428-323-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/memory/1720-334-0x0000000000280000-0x00000000002BA000-memory.dmp	upx
behavioral1/memory/1720-336-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/memory/1748-337-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/memory/1748-347-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/memory/2944-348-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/memory/2428-349-0x00000000002E0000-0x000000000031A000-memory.dmp	upx

Adds Run key to start application 2 TTPs 26 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Modifies registry class 54 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202q.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 0bc8b79e6f997dae	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202t.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202v.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 0bc8b79e6f997dae	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202k.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202l.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 0bc8b79e6f997dae	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202w.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202b.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202u.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 0bc8b79e6f997dae	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202i.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 0bc8b79e6f997dae	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202q.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202f.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 0bc8b79e6f997dae	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202p.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 0bc8b79e6f997dae	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202c.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 0bc8b79e6f997dae	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202f.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202s.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 0bc8b79e6f997dae	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202v.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202y.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	40ce26d8a6d787b4486568471fd2e8b0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202a.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 0bc8b79e6f997dae	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202j.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202c.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202j.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 0bc8b79e6f997dae	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202u.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202k.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 0bc8b79e6f997dae	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202n.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 0bc8b79e6f997dae	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202h.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 0bc8b79e6f997dae	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202y.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202d.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202g.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202i.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202x.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 0bc8b79e6f997dae	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202b.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202w.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 0bc8b79e6f997dae	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202a.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202o.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202p.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202t.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 0bc8b79e6f997dae	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 0bc8b79e6f997dae	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202l.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202n.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202r.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202h.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 0bc8b79e6f997dae	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202m.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 0bc8b79e6f997dae	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202e.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 0bc8b79e6f997dae	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202g.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 0bc8b79e6f997dae	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202o.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 0bc8b79e6f997dae	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202s.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 0bc8b79e6f997dae	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202d.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202m.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 0bc8b79e6f997dae	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202r.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 0bc8b79e6f997dae	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202x.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 0bc8b79e6f997dae	40ce26d8a6d787b4486568471fd2e8b0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202e.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 2476	1712	40ce26d8a6d787b4486568471fd2e8b0_NeikiAnalytics.exe	28
PID 1712 wrote to memory of 2476	1712	40ce26d8a6d787b4486568471fd2e8b0_NeikiAnalytics.exe	28
PID 1712 wrote to memory of 2476	1712	40ce26d8a6d787b4486568471fd2e8b0_NeikiAnalytics.exe	28
PID 1712 wrote to memory of 2476	1712	40ce26d8a6d787b4486568471fd2e8b0_NeikiAnalytics.exe	28
PID 2476 wrote to memory of 2628	2476	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202.exe	29
PID 2476 wrote to memory of 2628	2476	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202.exe	29
PID 2476 wrote to memory of 2628	2476	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202.exe	29
PID 2476 wrote to memory of 2628	2476	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202.exe	29
PID 2628 wrote to memory of 2796	2628	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202a.exe	30
PID 2628 wrote to memory of 2796	2628	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202a.exe	30
PID 2628 wrote to memory of 2796	2628	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202a.exe	30
PID 2628 wrote to memory of 2796	2628	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202a.exe	30
PID 2796 wrote to memory of 2312	2796	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202b.exe	31
PID 2796 wrote to memory of 2312	2796	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202b.exe	31
PID 2796 wrote to memory of 2312	2796	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202b.exe	31
PID 2796 wrote to memory of 2312	2796	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202b.exe	31
PID 2312 wrote to memory of 2688	2312	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202c.exe	32
PID 2312 wrote to memory of 2688	2312	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202c.exe	32
PID 2312 wrote to memory of 2688	2312	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202c.exe	32
PID 2312 wrote to memory of 2688	2312	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202c.exe	32
PID 2688 wrote to memory of 2588	2688	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202d.exe	33
PID 2688 wrote to memory of 2588	2688	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202d.exe	33
PID 2688 wrote to memory of 2588	2688	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202d.exe	33
PID 2688 wrote to memory of 2588	2688	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202d.exe	33
PID 2588 wrote to memory of 1880	2588	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202e.exe	34
PID 2588 wrote to memory of 1880	2588	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202e.exe	34
PID 2588 wrote to memory of 1880	2588	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202e.exe	34
PID 2588 wrote to memory of 1880	2588	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202e.exe	34
PID 1880 wrote to memory of 2708	1880	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202f.exe	35
PID 1880 wrote to memory of 2708	1880	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202f.exe	35
PID 1880 wrote to memory of 2708	1880	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202f.exe	35
PID 1880 wrote to memory of 2708	1880	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202f.exe	35
PID 2708 wrote to memory of 1468	2708	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202g.exe	36
PID 2708 wrote to memory of 1468	2708	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202g.exe	36
PID 2708 wrote to memory of 1468	2708	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202g.exe	36
PID 2708 wrote to memory of 1468	2708	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202g.exe	36
PID 1468 wrote to memory of 2500	1468	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202h.exe	37
PID 1468 wrote to memory of 2500	1468	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202h.exe	37
PID 1468 wrote to memory of 2500	1468	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202h.exe	37
PID 1468 wrote to memory of 2500	1468	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202h.exe	37
PID 2500 wrote to memory of 2592	2500	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202i.exe	38
PID 2500 wrote to memory of 2592	2500	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202i.exe	38
PID 2500 wrote to memory of 2592	2500	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202i.exe	38
PID 2500 wrote to memory of 2592	2500	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202i.exe	38
PID 2592 wrote to memory of 1552	2592	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202j.exe	39
PID 2592 wrote to memory of 1552	2592	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202j.exe	39
PID 2592 wrote to memory of 1552	2592	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202j.exe	39
PID 2592 wrote to memory of 1552	2592	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202j.exe	39
PID 1552 wrote to memory of 1708	1552	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202k.exe	40
PID 1552 wrote to memory of 1708	1552	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202k.exe	40
PID 1552 wrote to memory of 1708	1552	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202k.exe	40
PID 1552 wrote to memory of 1708	1552	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202k.exe	40
PID 1708 wrote to memory of 1508	1708	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202l.exe	41
PID 1708 wrote to memory of 1508	1708	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202l.exe	41
PID 1708 wrote to memory of 1508	1708	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202l.exe	41
PID 1708 wrote to memory of 1508	1708	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202l.exe	41
PID 1508 wrote to memory of 2244	1508	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202m.exe	42
PID 1508 wrote to memory of 2244	1508	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202m.exe	42
PID 1508 wrote to memory of 2244	1508	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202m.exe	42
PID 1508 wrote to memory of 2244	1508	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202m.exe	42
PID 2244 wrote to memory of 1056	2244	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202n.exe	43
PID 2244 wrote to memory of 1056	2244	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202n.exe	43
PID 2244 wrote to memory of 1056	2244	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202n.exe	43
PID 2244 wrote to memory of 1056	2244	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202n.exe	43

C:\Users\Admin\AppData\Local\Temp\40ce26d8a6d787b4486568471fd2e8b0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\40ce26d8a6d787b4486568471fd2e8b0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1712
- \??\c:\users\admin\appdata\local\temp\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202.exe
  c:\users\admin\appdata\local\temp\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2476
- - \??\c:\users\admin\appdata\local\temp\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202a.exe
    c:\users\admin\appdata\local\temp\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202a.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2628
  - - \??\c:\users\admin\appdata\local\temp\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202b.exe
      c:\users\admin\appdata\local\temp\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202b.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2796
    - - \??\c:\users\admin\appdata\local\temp\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202c.exe
        
        c:\users\admin\appdata\local\temp\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202c.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2312
      - \??\c:\users\admin\appdata\local\temp\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202d.exe
        
        c:\users\admin\appdata\local\temp\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202d.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2688
        
        \??\c:\users\admin\appdata\local\temp\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202e.exe
        
        c:\users\admin\appdata\local\temp\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202e.exe
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2588
        
        \??\c:\users\admin\appdata\local\temp\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202f.exe
        
        c:\users\admin\appdata\local\temp\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202f.exe
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1880
        
        \??\c:\users\admin\appdata\local\temp\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202g.exe
        
        c:\users\admin\appdata\local\temp\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202g.exe
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2708
        
        \??\c:\users\admin\appdata\local\temp\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202h.exe
        
        c:\users\admin\appdata\local\temp\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202h.exe
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1468
        
        \??\c:\users\admin\appdata\local\temp\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202i.exe
        
        c:\users\admin\appdata\local\temp\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202i.exe
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2500
        
        \??\c:\users\admin\appdata\local\temp\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202j.exe
        
        c:\users\admin\appdata\local\temp\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202j.exe
        12⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2592
        
        \??\c:\users\admin\appdata\local\temp\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202k.exe
        
        c:\users\admin\appdata\local\temp\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202k.exe
        13⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1552
        
        \??\c:\users\admin\appdata\local\temp\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202l.exe
        
        c:\users\admin\appdata\local\temp\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202l.exe
        14⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1708
        
        \??\c:\users\admin\appdata\local\temp\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202m.exe
        
        c:\users\admin\appdata\local\temp\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202m.exe
        15⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1508
        
        \??\c:\users\admin\appdata\local\temp\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202n.exe
        
        c:\users\admin\appdata\local\temp\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202n.exe
        16⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2244
        
        \??\c:\users\admin\appdata\local\temp\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202o.exe
        
        c:\users\admin\appdata\local\temp\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202o.exe
        17⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Modifies registry class
        
        PID:1056
        
        \??\c:\users\admin\appdata\local\temp\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202p.exe
        
        c:\users\admin\appdata\local\temp\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202p.exe
        18⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Modifies registry class
        
        PID:2368
        
        \??\c:\users\admin\appdata\local\temp\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202q.exe
        
        c:\users\admin\appdata\local\temp\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202q.exe
        19⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Modifies registry class
        
        PID:980
        
        \??\c:\users\admin\appdata\local\temp\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202r.exe
        
        c:\users\admin\appdata\local\temp\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202r.exe
        20⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Modifies registry class
        
        PID:1040
        
        \??\c:\users\admin\appdata\local\temp\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202s.exe
        
        c:\users\admin\appdata\local\temp\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202s.exe
        21⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Modifies registry class
        
        PID:1792
        
        \??\c:\users\admin\appdata\local\temp\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202t.exe
        
        c:\users\admin\appdata\local\temp\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202t.exe
        22⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Modifies registry class
        
        PID:608
        
        \??\c:\users\admin\appdata\local\temp\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202u.exe
        
        c:\users\admin\appdata\local\temp\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202u.exe
        23⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Modifies registry class
        
        PID:2504
        
        \??\c:\users\admin\appdata\local\temp\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202v.exe
        
        c:\users\admin\appdata\local\temp\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202v.exe
        24⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Modifies registry class
        
        PID:2428
        
        \??\c:\users\admin\appdata\local\temp\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202w.exe
        
        c:\users\admin\appdata\local\temp\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202w.exe
        25⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Modifies registry class
        
        PID:1720
        
        \??\c:\users\admin\appdata\local\temp\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202x.exe
        
        c:\users\admin\appdata\local\temp\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202x.exe
        26⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Modifies registry class
        
        PID:1748
        
        \??\c:\users\admin\appdata\local\temp\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202y.exe
        
        c:\users\admin\appdata\local\temp\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202y.exe
        27⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202.exe

Filesize
231KB

MD5
dc9665ad511afc83390dfaaaab86cf0e

SHA1
855bdc2de5b6326a1e522d8b09a4298b5c1af636

SHA256
1daff13db88877575d079cef96350f4de03160bd40a8bf4d2d88640c1a8b56ec

SHA512
03b98b439e8689752ab90e5cb1e686c676866c2844f79e5f50f37f1bb2b5ec6ad523bd911ec31b93e0c21fb72bce18fdc7a2125bc2f6a6f464be91031981b9a4

Download Submit
\Users\Admin\AppData\Local\Temp\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202f.exe

Filesize
231KB

MD5
5013c459516ba5b06fef4964ab9310c6

SHA1
c8bb91bb9b29f5476304c3f94daf9185ba4de134

SHA256
83d923ca5088cc950f83a9ecc6528b6e3b058a63784cd239dd4c9e820a2da829

SHA512
21f9400b903635758d36df76163041b6f2b058d5c3546e93c8e6b6688f7c4bd42408c725a0fa36703f60b0ca6d33f5df3b535ba6ab22301539d8278fcfdaf471

Download Submit
memory/608-298-0x0000000000390000-0x00000000003CA000-memory.dmp

Filesize
232KB

Download
memory/608-302-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/608-291-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/980-259-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/980-269-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1040-270-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1040-280-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1056-246-0x0000000002620000-0x000000000265A000-memory.dmp

Filesize
232KB

Download
memory/1056-247-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1468-134-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1468-147-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1508-221-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1508-219-0x0000000000850000-0x000000000088A000-memory.dmp

Filesize
232KB

Download
memory/1552-191-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1708-192-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1708-205-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1712-13-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1712-8-0x0000000000380000-0x00000000003BA000-memory.dmp

Filesize
232KB

Download
memory/1712-0-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1720-336-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1720-335-0x0000000000280000-0x00000000002BA000-memory.dmp

Filesize
232KB

Download
memory/1720-334-0x0000000000280000-0x00000000002BA000-memory.dmp

Filesize
232KB

Download
memory/1748-347-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1748-337-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1792-290-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1880-117-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1880-104-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2244-234-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2312-72-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2368-248-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2368-258-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2428-323-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2428-324-0x00000000002E0000-0x000000000031A000-memory.dmp

Filesize
232KB

Download
memory/2428-318-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2428-349-0x00000000002E0000-0x000000000031A000-memory.dmp

Filesize
232KB

Download
memory/2476-15-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2476-28-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2500-161-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2504-312-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2588-97-0x00000000005D0000-0x000000000060A000-memory.dmp

Filesize
232KB

Download
memory/2588-103-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2592-176-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2592-163-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2628-43-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2688-73-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2688-82-0x0000000000260000-0x000000000029A000-memory.dmp

Filesize
232KB

Download
memory/2688-87-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2708-133-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2708-119-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2796-44-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2796-58-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2944-348-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202l.exe\""	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202k.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202q.exe\""	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202p.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202y.exe\""	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202x.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202e.exe\""	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202x.exe\""	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202w.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202m.exe\""	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202l.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202o.exe\""	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202n.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202p.exe\""	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202o.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202w.exe\""	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202v.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202a.exe\""	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202h.exe\""	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202g.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202j.exe\""	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202i.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202t.exe\""	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202s.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202u.exe\""	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202t.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202v.exe\""	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202u.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202c.exe\""	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202i.exe\""	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202h.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202r.exe\""	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202q.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202s.exe\""	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202r.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202d.exe\""	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202f.exe\""	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202k.exe\""	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202j.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202.exe\""	40ce26d8a6d787b4486568471fd2e8b0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202g.exe\""	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202b.exe\""	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202n.exe\""	40ce26d8a6d787b4486568471fd2e8b0_neikianalytics_3202m.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads