8f319a94ca172c493096b1f5089dfe0344dca3835dbb79e197d372e81a77931d

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 03:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5808f7b38e6e535e4937e44f9d383d90_NeikiAnalytics.exe
Size

2.4MB
MD5

5808f7b38e6e535e4937e44f9d383d90
SHA1

0ba5a950d2d8dd879e0e1dacf6fda9abe7730caa
SHA256

8f319a94ca172c493096b1f5089dfe0344dca3835dbb79e197d372e81a77931d
SHA512

91dc2de80a8b42f75401ebf3a8762bec881e95207ca2a93c1fffb3f6ce4accb9c609518ad58e6e4503ccfab6f9db9bce96656c87f1a94623c7c1c646c603c80e
SSDEEP

49152:b1x9Nx97QmVL7hSt4/pyoXelyosbmleddMb+89eyDW716iJpj:bj9Nx9pL7hg4/pkR4mleb8oyDSdJpj

Score

4^/10

Malware Config

Signatures

Drops file in Program Files directory 32 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\webrec\WEB30\WebPlugin\fisheye.dll	5808f7b38e6e535e4937e44f9d383d90_NeikiAnalytics.exe
File created	C:\Program Files (x86)\webrec\WEB30\WebPlugin\SurveillanceDll.dll	5808f7b38e6e535e4937e44f9d383d90_NeikiAnalytics.exe
File created	C:\Program Files (x86)\webrec\WEB30\WebPlugin\h264dec.dll	5808f7b38e6e535e4937e44f9d383d90_NeikiAnalytics.exe
File created	C:\Program Files (x86)\webrec\WEB30\WebPlugin\VideoWindow.dll	5808f7b38e6e535e4937e44f9d383d90_NeikiAnalytics.exe
File created	C:\Program Files (x86)\webrec\WEB30\WebPlugin\Version.ini	5808f7b38e6e535e4937e44f9d383d90_NeikiAnalytics.exe
File created	C:\Program Files (x86)\webrec\WEB30\WebPlugin\IVSJsonSdk.dll	5808f7b38e6e535e4937e44f9d383d90_NeikiAnalytics.exe
File created	C:\Program Files (x86)\webrec\WEB30\WebPlugin\MCL_FPTZ.dll	5808f7b38e6e535e4937e44f9d383d90_NeikiAnalytics.exe
File created	C:\Program Files (x86)\webrec\WEB30\WebPlugin\mpeg4dec.dll	5808f7b38e6e535e4937e44f9d383d90_NeikiAnalytics.exe
File created	C:\Program Files (x86)\webrec\WEB30\WebPlugin\aacdec.dll	5808f7b38e6e535e4937e44f9d383d90_NeikiAnalytics.exe
File created	C:\Program Files (x86)\webrec\WEB30\WebPlugin\netsdk.dll	5808f7b38e6e535e4937e44f9d383d90_NeikiAnalytics.exe
File created	C:\Program Files (x86)\webrec\WEB30\WebPlugin\timeAxesDll.dll	5808f7b38e6e535e4937e44f9d383d90_NeikiAnalytics.exe
File created	C:\Program Files (x86)\webrec\WEB30\WebPlugin\IvsDrawer.dll	5808f7b38e6e535e4937e44f9d383d90_NeikiAnalytics.exe
File created	C:\Program Files (x86)\webrec\WEB30\WebPlugin\hevcdec.dll	5808f7b38e6e535e4937e44f9d383d90_NeikiAnalytics.exe
File created	C:\Program Files (x86)\webrec\WEB30\WebPlugin\swscale.dll	5808f7b38e6e535e4937e44f9d383d90_NeikiAnalytics.exe
File created	C:\Program Files (x86)\webrec\WEB30\WebPlugin\aacEnc.dll	5808f7b38e6e535e4937e44f9d383d90_NeikiAnalytics.exe
File created	C:\Program Files (x86)\webrec\WEB30\WebPlugin\mjpegdec.dll	5808f7b38e6e535e4937e44f9d383d90_NeikiAnalytics.exe
File created	C:\Program Files (x86)\webrec\WEB30\WebPlugin\npmedia.dll	5808f7b38e6e535e4937e44f9d383d90_NeikiAnalytics.exe
File created	C:\Program Files (x86)\webrec\WEB30\WebPlugin\postproc.dll	5808f7b38e6e535e4937e44f9d383d90_NeikiAnalytics.exe
File created	C:\Program Files (x86)\webrec\WEB30\WebPlugin\TimeGridEXE.exe	5808f7b38e6e535e4937e44f9d383d90_NeikiAnalytics.exe
File created	C:\Program Files (x86)\webrec\WEB30\WebPlugin\WebActiveEXE.exe	5808f7b38e6e535e4937e44f9d383d90_NeikiAnalytics.exe
File created	C:\Program Files (x86)\webrec\WEB30\WebPlugin\svac_dec.dll	5808f7b38e6e535e4937e44f9d383d90_NeikiAnalytics.exe
File created	C:\Program Files (x86)\webrec\WEB30\WebPlugin\g729dec.dll	5808f7b38e6e535e4937e44f9d383d90_NeikiAnalytics.exe
File created	C:\Program Files (x86)\webrec\WEB30\WebPlugin\FisheyeCtrl.dll	5808f7b38e6e535e4937e44f9d383d90_NeikiAnalytics.exe
File created	C:\Program Files (x86)\webrec\WEB30\WebPlugin\CsvOperation.dll	5808f7b38e6e535e4937e44f9d383d90_NeikiAnalytics.exe
File created	C:\Program Files (x86)\webrec\WEB30\WebPlugin\mp2dec.dll	5808f7b38e6e535e4937e44f9d383d90_NeikiAnalytics.exe
File created	C:\Program Files (x86)\webrec\WEB30\WebPlugin\uninst.exe	5808f7b38e6e535e4937e44f9d383d90_NeikiAnalytics.exe
File created	C:\Program Files (x86)\webrec\WEB30\WebPlugin\IvsLogic.dll	5808f7b38e6e535e4937e44f9d383d90_NeikiAnalytics.exe
File created	C:\Program Files (x86)\webrec\WEB30\WebPlugin\FileOperator.dll	5808f7b38e6e535e4937e44f9d383d90_NeikiAnalytics.exe
File created	C:\Program Files (x86)\webrec\WEB30\WebPlugin\VideoAnalyse.dll	5808f7b38e6e535e4937e44f9d383d90_NeikiAnalytics.exe
File created	C:\Program Files (x86)\webrec\WEB30\WebPlugin\play.dll	5808f7b38e6e535e4937e44f9d383d90_NeikiAnalytics.exe
File created	C:\Program Files (x86)\webrec\WEB30\WebPlugin\npTimeGrid.dll	5808f7b38e6e535e4937e44f9d383d90_NeikiAnalytics.exe
File created	C:\Program Files (x86)\webrec\WEB30\WebPlugin\g7221dec.dll	5808f7b38e6e535e4937e44f9d383d90_NeikiAnalytics.exe

Executes dropped EXE 2 IoCs

pid	Process
2352	WebActiveEXE.exe
2428	TimeGridEXE.exe

Loads dropped DLL 7 IoCs

pid	Process
1656	5808f7b38e6e535e4937e44f9d383d90_NeikiAnalytics.exe
1656	5808f7b38e6e535e4937e44f9d383d90_NeikiAnalytics.exe
1656	5808f7b38e6e535e4937e44f9d383d90_NeikiAnalytics.exe
1656	5808f7b38e6e535e4937e44f9d383d90_NeikiAnalytics.exe
1656	5808f7b38e6e535e4937e44f9d383d90_NeikiAnalytics.exe
1656	5808f7b38e6e535e4937e44f9d383d90_NeikiAnalytics.exe
2428	TimeGridEXE.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 2 IoCs

evasion

pid	Process
1988	TASKKILL.exe
2716	TASKKILL.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7F9063B6-E081-49DB-9FEC-D72422F2727F}\ = "Plugin Class"	WebActiveEXE.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7F9063B6-E081-49DB-9FEC-D72422F2727F}\ToolboxBitmap32	WebActiveEXE.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BEDCA323-84CC-4294-8C8A-866137D44A02}\ProxyStubClsid32	WebActiveEXE.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BEDCA323-84CC-4294-8C8A-866137D44A02}\ = "_IPluginEvents"	WebActiveEXE.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TimeGridEXE.Plugin\ = "Plugin Class"	TimeGridEXE.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WebActiveEXE.Plugin\CurVer	WebActiveEXE.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EC76FFFE-A40A-4DAA-BC51-CAEBD5B5434C}\TypeLib\ = "{4825A5A4-6D6F-4852-86AC-296295CB3A01}"	TimeGridEXE.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{42D32C3C-E614-422E-A061-6BDB18A7165D}\ = "IPlugin"	TimeGridEXE.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{42D32C3C-E614-422E-A061-6BDB18A7165D}\TypeLib\ = "{4825A5A4-6D6F-4852-86AC-296295CB3A01}"	TimeGridEXE.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7F9063B6-E081-49DB-9FEC-D72422F2727F}\Insertable	WebActiveEXE.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DD09A797-F29F-453D-BA05-43E3A7BCC433}\1.0\FLAGS\ = "0"	WebActiveEXE.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WebActiveEXE.Plugin.1	WebActiveEXE.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WebActiveEXE.Plugin.1\CLSID\ = "{7F9063B6-E081-49DB-9FEC-D72422F2727F}"	WebActiveEXE.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DD09A797-F29F-453D-BA05-43E3A7BCC433}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\webrec\\WEB30\\WebPlugin"	WebActiveEXE.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\TimeGridEXE.EXE	TimeGridEXE.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TimeGridEXE.Plugin.1	TimeGridEXE.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7F9063B6-E081-49DB-9FEC-D72422F2727F}\ProgID\ = "WebActiveEXE.Plugin.1"	WebActiveEXE.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DD09A797-F29F-453D-BA05-43E3A7BCC433}\1.0\HELPDIR	WebActiveEXE.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TimeGridEXE.Plugin	TimeGridEXE.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{15EF48B3-D5CA-4321-A186-EBE7B15392F1}\VersionIndependentProgID	TimeGridEXE.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{15EF48B3-D5CA-4321-A186-EBE7B15392F1}\MiscStatus	TimeGridEXE.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EC76FFFE-A40A-4DAA-BC51-CAEBD5B5434C}\TypeLib\Version = "1.0"	TimeGridEXE.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7F9063B6-E081-49DB-9FEC-D72422F2727F}\VersionIndependentProgID	WebActiveEXE.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EE2DC66D-C162-496D-953C-C378F8B9B43F}\TypeLib\ = "{DD09A797-F29F-453D-BA05-43E3A7BCC433}"	WebActiveEXE.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{15EF48B3-D5CA-4321-A186-EBE7B15392F1}\ToolboxBitmap32	TimeGridEXE.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{15EF48B3-D5CA-4321-A186-EBE7B15392F1}\MiscStatus\ = "0"	TimeGridEXE.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7F9063B6-E081-49DB-9FEC-D72422F2727F}\ProgID	WebActiveEXE.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DD09A797-F29F-453D-BA05-43E3A7BCC433}\1.0\0	WebActiveEXE.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EE2DC66D-C162-496D-953C-C378F8B9B43F}\TypeLib	WebActiveEXE.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{15EF48B3-D5CA-4321-A186-EBE7B15392F1}\ = "Plugin Class"	TimeGridEXE.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7F9063B6-E081-49DB-9FEC-D72422F2727F}\TypeLib\ = "{DD09A797-F29F-453D-BA05-43E3A7BCC433}"	WebActiveEXE.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BEDCA323-84CC-4294-8C8A-866137D44A02}\TypeLib\ = "{DD09A797-F29F-453D-BA05-43E3A7BCC433}"	WebActiveEXE.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EC76FFFE-A40A-4DAA-BC51-CAEBD5B5434C}\ProxyStubClsid32	TimeGridEXE.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WebActiveEXE.Plugin.1\CLSID	WebActiveEXE.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7F9063B6-E081-49DB-9FEC-D72422F2727F}\VersionIndependentProgID\ = "WebActiveEXE.Plugin"	WebActiveEXE.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EE2DC66D-C162-496D-953C-C378F8B9B43F}\TypeLib\ = "{DD09A797-F29F-453D-BA05-43E3A7BCC433}"	WebActiveEXE.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EE2DC66D-C162-496D-953C-C378F8B9B43F}\TypeLib\Version = "1.0"	WebActiveEXE.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EC76FFFE-A40A-4DAA-BC51-CAEBD5B5434C}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	TimeGridEXE.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EC76FFFE-A40A-4DAA-BC51-CAEBD5B5434C}\TypeLib	TimeGridEXE.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TimeGridEXE.Plugin.1\ = "Plugin Class"	TimeGridEXE.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{15EF48B3-D5CA-4321-A186-EBE7B15392F1}\Version\ = "1.0"	TimeGridEXE.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EC76FFFE-A40A-4DAA-BC51-CAEBD5B5434C}\TypeLib	TimeGridEXE.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WebActiveEXE.Plugin\CLSID\ = "{7F9063B6-E081-49DB-9FEC-D72422F2727F}"	WebActiveEXE.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BEDCA323-84CC-4294-8C8A-866137D44A02}	WebActiveEXE.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7F9063B6-E081-49DB-9FEC-D72422F2727F}\Programmable	WebActiveEXE.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7F9063B6-E081-49DB-9FEC-D72422F2727F}\MiscStatus\1	WebActiveEXE.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{15EF48B3-D5CA-4321-A186-EBE7B15392F1}\Control	TimeGridEXE.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{15EF48B3-D5CA-4321-A186-EBE7B15392F1}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	TimeGridEXE.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{42D32C3C-E614-422E-A061-6BDB18A7165D}\TypeLib\Version = "1.0"	TimeGridEXE.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7F9063B6-E081-49DB-9FEC-D72422F2727F}\TypeLib	WebActiveEXE.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DD09A797-F29F-453D-BA05-43E3A7BCC433}	WebActiveEXE.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BEDCA323-84CC-4294-8C8A-866137D44A02}\TypeLib	WebActiveEXE.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{15EF48B3-D5CA-4321-A186-EBE7B15392F1}\LocalServer32	TimeGridEXE.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EC76FFFE-A40A-4DAA-BC51-CAEBD5B5434C}	TimeGridEXE.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EC76FFFE-A40A-4DAA-BC51-CAEBD5B5434C}\ProxyStubClsid32	TimeGridEXE.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7F9063B6-E081-49DB-9FEC-D72422F2727F}\ToolboxBitmap32\ = "C:\\Program Files (x86)\\webrec\\WEB30\\WebPlugin\\WebActiveEXE.exe, 101"	WebActiveEXE.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EE2DC66D-C162-496D-953C-C378F8B9B43F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	WebActiveEXE.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{56422B45-FCAD-4B20-9C5A-A72686EE43F6}\ = "TimeGridEXE"	TimeGridEXE.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TimeGridEXE.Plugin\CLSID\ = "{15EF48B3-D5CA-4321-A186-EBE7B15392F1}"	TimeGridEXE.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{42D32C3C-E614-422E-A061-6BDB18A7165D}\TypeLib	TimeGridEXE.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{42D32C3C-E614-422E-A061-6BDB18A7165D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	TimeGridEXE.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7F9063B6-E081-49DB-9FEC-D72422F2727F}	WebActiveEXE.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EE2DC66D-C162-496D-953C-C378F8B9B43F}\ProxyStubClsid32	WebActiveEXE.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EE2DC66D-C162-496D-953C-C378F8B9B43F}\ = "IPlugin"	WebActiveEXE.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1988	TASKKILL.exe
Token: SeDebugPrivilege	2716	TASKKILL.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 1988	1656	5808f7b38e6e535e4937e44f9d383d90_NeikiAnalytics.exe	28
PID 1656 wrote to memory of 1988	1656	5808f7b38e6e535e4937e44f9d383d90_NeikiAnalytics.exe	28
PID 1656 wrote to memory of 1988	1656	5808f7b38e6e535e4937e44f9d383d90_NeikiAnalytics.exe	28
PID 1656 wrote to memory of 1988	1656	5808f7b38e6e535e4937e44f9d383d90_NeikiAnalytics.exe	28
PID 1656 wrote to memory of 2716	1656	5808f7b38e6e535e4937e44f9d383d90_NeikiAnalytics.exe	31
PID 1656 wrote to memory of 2716	1656	5808f7b38e6e535e4937e44f9d383d90_NeikiAnalytics.exe	31
PID 1656 wrote to memory of 2716	1656	5808f7b38e6e535e4937e44f9d383d90_NeikiAnalytics.exe	31
PID 1656 wrote to memory of 2716	1656	5808f7b38e6e535e4937e44f9d383d90_NeikiAnalytics.exe	31
PID 1656 wrote to memory of 2352	1656	5808f7b38e6e535e4937e44f9d383d90_NeikiAnalytics.exe	33
PID 1656 wrote to memory of 2352	1656	5808f7b38e6e535e4937e44f9d383d90_NeikiAnalytics.exe	33
PID 1656 wrote to memory of 2352	1656	5808f7b38e6e535e4937e44f9d383d90_NeikiAnalytics.exe	33
PID 1656 wrote to memory of 2352	1656	5808f7b38e6e535e4937e44f9d383d90_NeikiAnalytics.exe	33
PID 1656 wrote to memory of 2428	1656	5808f7b38e6e535e4937e44f9d383d90_NeikiAnalytics.exe	34
PID 1656 wrote to memory of 2428	1656	5808f7b38e6e535e4937e44f9d383d90_NeikiAnalytics.exe	34
PID 1656 wrote to memory of 2428	1656	5808f7b38e6e535e4937e44f9d383d90_NeikiAnalytics.exe	34
PID 1656 wrote to memory of 2428	1656	5808f7b38e6e535e4937e44f9d383d90_NeikiAnalytics.exe	34
PID 1656 wrote to memory of 2888	1656	5808f7b38e6e535e4937e44f9d383d90_NeikiAnalytics.exe	35
PID 1656 wrote to memory of 2888	1656	5808f7b38e6e535e4937e44f9d383d90_NeikiAnalytics.exe	35
PID 1656 wrote to memory of 2888	1656	5808f7b38e6e535e4937e44f9d383d90_NeikiAnalytics.exe	35
PID 1656 wrote to memory of 2888	1656	5808f7b38e6e535e4937e44f9d383d90_NeikiAnalytics.exe	35
PID 1656 wrote to memory of 2888	1656	5808f7b38e6e535e4937e44f9d383d90_NeikiAnalytics.exe	35
PID 1656 wrote to memory of 2888	1656	5808f7b38e6e535e4937e44f9d383d90_NeikiAnalytics.exe	35
PID 1656 wrote to memory of 2888	1656	5808f7b38e6e535e4937e44f9d383d90_NeikiAnalytics.exe	35

C:\Users\Admin\AppData\Local\Temp\5808f7b38e6e535e4937e44f9d383d90_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5808f7b38e6e535e4937e44f9d383d90_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM WebActiveEXE.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1988
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM TimeGridEXE.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2716
- C:\Program Files (x86)\webrec\WEB30\WebPlugin\WebActiveEXE.exe
  "C:\Program Files (x86)\webrec\WEB30\WebPlugin\WebActiveEXE.exe" /regserver
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  PID:2352
- C:\Program Files (x86)\webrec\WEB30\WebPlugin\TimeGridEXE.exe
  "C:\Program Files (x86)\webrec\WEB30\WebPlugin\TimeGridEXE.exe" /regserver
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies registry class
  PID:2428
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32 /s "atl.dll"
  2⤵
  PID:2888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Program Files (x86)\webrec\WEB30\WebPlugin\TimeGridEXE.exe

Filesize
64KB

MD5
653fceba84fb1e06c1b100dc346da4ba

SHA1
0fd4901daa5ca9e13dcf7ef036e78469d0be0934

SHA256
678fd44b43f7707dcef415763f53641d72015643020288ccfc28adf649846b19

SHA512
ab0ade93a53f66a4ecc6238635321ce3c38bf3400df52c9afe4d6dbd857ab5c31a65cf5fc5f5b0b576b2746c8ab97d27bfad0378595aa2d7b92ea315ecab3946

Download Submit
\Program Files (x86)\webrec\WEB30\WebPlugin\WebActiveEXE.exe

Filesize
160KB

MD5
074db80f527178fa4fc903c887f10c78

SHA1
3844390c925d6301e0ed761fe2806a3e727916b1

SHA256
92186bef8f533fc33e1b103a4d2a2b63e7a0a640f75a8e1a983a35438a424871

SHA512
afd5cdebb8c7b4b7cfecc255c4040aeab1a434357b043a22a27b89708f6a9a31656e07c72c5a89f8dda75382b0848dd1e9335707324393e4811380feaa1de817

Download Submit
\Program Files (x86)\webrec\WEB30\WebPlugin\timeAxesDll.dll

Filesize
108KB

MD5
3571110f68f58e9612cee71724ef2f9a

SHA1
749897253d07ffba7d4664a5d0cc7a87ede765d3

SHA256
b2801090e36fd51e2536d1a82edf48acf02db6a44033a210f72814a60815160f

SHA512
4ac5b33d2d9a65c909862db961d1a2eb03e8391fc2b870a215c71e514f6a7e513ac461a97e4b2615083985f619862c4ed1cad71cab04d73175951efe262e90a6

Download Submit
\Users\Admin\AppData\Local\Temp\nsd1D33.tmp\nsExec.dll

Filesize
6KB

MD5
50ba20cad29399e2db9fa75a1324bd1d

SHA1
3850634bb15a112623222972ef554c8d1eca16f4

SHA256
e7b145abc7c519e6bd91dc06b7b83d1e73735ac1ac37d30a7889840a6eed38fc

SHA512
893e053fcb0a2d3742e2b13b869941a3a485b2bda3a92567f84190cb1be170b67d20cc71c6a2cb92f4202140c8afd9c40a358496947d709e0c4b68d43a368754

Download Submit