Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
12/05/2024, 04:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
673460cb019bf118be3aa48638bc9e80_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
673460cb019bf118be3aa48638bc9e80_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
673460cb019bf118be3aa48638bc9e80_NeikiAnalytics.exe
-
Size
84KB
-
MD5
673460cb019bf118be3aa48638bc9e80
-
SHA1
0fa38e4d9161d3bc7515c95ad36bb341b4b4008c
-
SHA256
43d44636eb3b4b9d6e6f5869c9fe95f427448200a7d491307618339ad9948711
-
SHA512
2c8d7837255e9d97a7e4ce26da73e96599da9f2e3f851aa99b7d01019ac3b8323c6c0a4236307e036a59101fd9bc1280e316032f4c1dac3e835b6b85005baca6
-
SSDEEP
1536:1clIGFNMi+hJUneHoGTvvv4V9hqdhbtgS:+RMi+fUnCTvvv4V9hEhbCS
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 1420 lsass.exe 2684 lsass.exe 2624 lsass.exe 2616 lsass.exe -
Loads dropped DLL 5 IoCs
pid Process 1608 673460cb019bf118be3aa48638bc9e80_NeikiAnalytics.exe 1608 673460cb019bf118be3aa48638bc9e80_NeikiAnalytics.exe 1608 673460cb019bf118be3aa48638bc9e80_NeikiAnalytics.exe 1608 673460cb019bf118be3aa48638bc9e80_NeikiAnalytics.exe 1608 673460cb019bf118be3aa48638bc9e80_NeikiAnalytics.exe -
resource yara_rule behavioral1/memory/1608-180-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1608-187-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1608-178-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1608-282-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/2684-391-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1608-395-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/2684-561-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\Audio Driver = "C:\\Users\\Admin\\AppData\\Roaming\\system\\lsass.exe" reg.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 1640 set thread context of 1608 1640 673460cb019bf118be3aa48638bc9e80_NeikiAnalytics.exe 28 PID 1420 set thread context of 2684 1420 lsass.exe 35 PID 1420 set thread context of 2624 1420 lsass.exe 36 PID 2624 set thread context of 2616 2624 lsass.exe 37 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6 lsass.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 0f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd lsass.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 19000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca61d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e4090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f006700690065007300000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a92000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd lsass.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 040000000100000010000000a923759bba49366e31c2dbf2e766ba870f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca619000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd lsass.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A lsass.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 lsass.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e709000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6502000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 lsass.exe -
Suspicious use of AdjustPrivilegeToken 63 IoCs
description pid Process Token: SeDebugPrivilege 2684 lsass.exe Token: SeDebugPrivilege 2684 lsass.exe Token: SeDebugPrivilege 2684 lsass.exe Token: SeDebugPrivilege 2684 lsass.exe Token: SeDebugPrivilege 2684 lsass.exe Token: SeDebugPrivilege 2684 lsass.exe Token: SeDebugPrivilege 2684 lsass.exe Token: SeDebugPrivilege 2684 lsass.exe Token: SeDebugPrivilege 2684 lsass.exe Token: SeDebugPrivilege 2684 lsass.exe Token: SeDebugPrivilege 2684 lsass.exe Token: SeDebugPrivilege 2684 lsass.exe Token: SeDebugPrivilege 2684 lsass.exe Token: SeDebugPrivilege 2684 lsass.exe Token: SeDebugPrivilege 2684 lsass.exe Token: SeDebugPrivilege 2684 lsass.exe Token: SeDebugPrivilege 2684 lsass.exe Token: SeDebugPrivilege 2684 lsass.exe Token: SeDebugPrivilege 2684 lsass.exe Token: SeDebugPrivilege 2684 lsass.exe Token: SeDebugPrivilege 2684 lsass.exe Token: SeDebugPrivilege 2684 lsass.exe Token: SeDebugPrivilege 2684 lsass.exe Token: SeDebugPrivilege 2684 lsass.exe Token: SeDebugPrivilege 2684 lsass.exe Token: SeDebugPrivilege 2684 lsass.exe Token: SeDebugPrivilege 2684 lsass.exe Token: SeDebugPrivilege 2684 lsass.exe Token: SeDebugPrivilege 2684 lsass.exe Token: SeDebugPrivilege 2684 lsass.exe Token: SeDebugPrivilege 2684 lsass.exe Token: SeDebugPrivilege 2684 lsass.exe Token: SeDebugPrivilege 2684 lsass.exe Token: SeDebugPrivilege 2684 lsass.exe Token: SeDebugPrivilege 2684 lsass.exe Token: SeDebugPrivilege 2684 lsass.exe Token: SeDebugPrivilege 2684 lsass.exe Token: SeDebugPrivilege 2684 lsass.exe Token: SeDebugPrivilege 2684 lsass.exe Token: SeDebugPrivilege 2684 lsass.exe Token: SeDebugPrivilege 2684 lsass.exe Token: SeDebugPrivilege 2684 lsass.exe Token: SeDebugPrivilege 2684 lsass.exe Token: SeDebugPrivilege 2684 lsass.exe Token: SeDebugPrivilege 2684 lsass.exe Token: SeDebugPrivilege 2684 lsass.exe Token: SeDebugPrivilege 2684 lsass.exe Token: SeDebugPrivilege 2684 lsass.exe Token: SeDebugPrivilege 2684 lsass.exe Token: SeDebugPrivilege 2684 lsass.exe Token: SeDebugPrivilege 2684 lsass.exe Token: SeDebugPrivilege 2684 lsass.exe Token: SeDebugPrivilege 2684 lsass.exe Token: SeDebugPrivilege 2684 lsass.exe Token: SeDebugPrivilege 2684 lsass.exe Token: SeDebugPrivilege 2684 lsass.exe Token: SeDebugPrivilege 2684 lsass.exe Token: SeDebugPrivilege 2684 lsass.exe Token: SeDebugPrivilege 2684 lsass.exe Token: SeDebugPrivilege 2684 lsass.exe Token: SeDebugPrivilege 2684 lsass.exe Token: SeDebugPrivilege 2684 lsass.exe Token: SeDebugPrivilege 2684 lsass.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1640 673460cb019bf118be3aa48638bc9e80_NeikiAnalytics.exe 1608 673460cb019bf118be3aa48638bc9e80_NeikiAnalytics.exe 1420 lsass.exe 2684 lsass.exe -
Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 1640 wrote to memory of 1608 1640 673460cb019bf118be3aa48638bc9e80_NeikiAnalytics.exe 28 PID 1640 wrote to memory of 1608 1640 673460cb019bf118be3aa48638bc9e80_NeikiAnalytics.exe 28 PID 1640 wrote to memory of 1608 1640 673460cb019bf118be3aa48638bc9e80_NeikiAnalytics.exe 28 PID 1640 wrote to memory of 1608 1640 673460cb019bf118be3aa48638bc9e80_NeikiAnalytics.exe 28 PID 1640 wrote to memory of 1608 1640 673460cb019bf118be3aa48638bc9e80_NeikiAnalytics.exe 28 PID 1640 wrote to memory of 1608 1640 673460cb019bf118be3aa48638bc9e80_NeikiAnalytics.exe 28 PID 1640 wrote to memory of 1608 1640 673460cb019bf118be3aa48638bc9e80_NeikiAnalytics.exe 28 PID 1640 wrote to memory of 1608 1640 673460cb019bf118be3aa48638bc9e80_NeikiAnalytics.exe 28 PID 1608 wrote to memory of 1264 1608 673460cb019bf118be3aa48638bc9e80_NeikiAnalytics.exe 29 PID 1608 wrote to memory of 1264 1608 673460cb019bf118be3aa48638bc9e80_NeikiAnalytics.exe 29 PID 1608 wrote to memory of 1264 1608 673460cb019bf118be3aa48638bc9e80_NeikiAnalytics.exe 29 PID 1608 wrote to memory of 1264 1608 673460cb019bf118be3aa48638bc9e80_NeikiAnalytics.exe 29 PID 1264 wrote to memory of 772 1264 cmd.exe 31 PID 1264 wrote to memory of 772 1264 cmd.exe 31 PID 1264 wrote to memory of 772 1264 cmd.exe 31 PID 1264 wrote to memory of 772 1264 cmd.exe 31 PID 1608 wrote to memory of 1420 1608 673460cb019bf118be3aa48638bc9e80_NeikiAnalytics.exe 32 PID 1608 wrote to memory of 1420 1608 673460cb019bf118be3aa48638bc9e80_NeikiAnalytics.exe 32 PID 1608 wrote to memory of 1420 1608 673460cb019bf118be3aa48638bc9e80_NeikiAnalytics.exe 32 PID 1608 wrote to memory of 1420 1608 673460cb019bf118be3aa48638bc9e80_NeikiAnalytics.exe 32 PID 1420 wrote to memory of 2684 1420 lsass.exe 35 PID 1420 wrote to memory of 2684 1420 lsass.exe 35 PID 1420 wrote to memory of 2684 1420 lsass.exe 35 PID 1420 wrote to memory of 2684 1420 lsass.exe 35 PID 1420 wrote to memory of 2684 1420 lsass.exe 35 PID 1420 wrote to memory of 2684 1420 lsass.exe 35 PID 1420 wrote to memory of 2684 1420 lsass.exe 35 PID 1420 wrote to memory of 2684 1420 lsass.exe 35 PID 1420 wrote to memory of 2624 1420 lsass.exe 36 PID 1420 wrote to memory of 2624 1420 lsass.exe 36 PID 1420 wrote to memory of 2624 1420 lsass.exe 36 PID 1420 wrote to memory of 2624 1420 lsass.exe 36 PID 1420 wrote to memory of 2624 1420 lsass.exe 36 PID 1420 wrote to memory of 2624 1420 lsass.exe 36 PID 1420 wrote to memory of 2624 1420 lsass.exe 36 PID 1420 wrote to memory of 2624 1420 lsass.exe 36 PID 2624 wrote to memory of 2616 2624 lsass.exe 37 PID 2624 wrote to memory of 2616 2624 lsass.exe 37 PID 2624 wrote to memory of 2616 2624 lsass.exe 37 PID 2624 wrote to memory of 2616 2624 lsass.exe 37 PID 2624 wrote to memory of 2616 2624 lsass.exe 37 PID 2624 wrote to memory of 2616 2624 lsass.exe 37 PID 2624 wrote to memory of 2616 2624 lsass.exe 37 PID 2624 wrote to memory of 2616 2624 lsass.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\673460cb019bf118be3aa48638bc9e80_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\673460cb019bf118be3aa48638bc9e80_NeikiAnalytics.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\673460cb019bf118be3aa48638bc9e80_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\673460cb019bf118be3aa48638bc9e80_NeikiAnalytics.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\EIYWF.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Audio Driver" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\lsass.exe" /f4⤵
- Adds Run key to start application
PID:772
-
-
-
C:\Users\Admin\AppData\Roaming\system\lsass.exe"C:\Users\Admin\AppData\Roaming\system\lsass.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Users\Admin\AppData\Roaming\system\lsass.exe"C:\Users\Admin\AppData\Roaming\system\lsass.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2684
-
-
C:\Users\Admin\AppData\Roaming\system\lsass.exe"C:\Users\Admin\AppData\Roaming\system\lsass.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Roaming\system\lsass.exe"C:\Users\Admin\AppData\Roaming\system\lsass.exe"5⤵
- Executes dropped EXE
- Modifies system certificate store
PID:2616
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a51723b25824c762b51f2678be846b97
SHA1445a0c766ec13a48162123e62c7f945448382448
SHA256765bc9543a68a744bb211e79cf5f8a21359efaecef32dd1667c813452bf6147d
SHA5120313943e162023a52a19237113dea19a3370ff772b98f5fc14923059c2137845ad4064eb11c0e76070339d12c1fb55f84b96aa6ad790adbc3aa2df37cf158e09
-
Filesize
146B
MD5c8cba0a9d4d5600b5f53c4c0681d1115
SHA10e5348e210ca70b2b0ffdc3ff7e6f611716df80c
SHA256ca2b63f6d7bf17480415ae93e115bf9f9699335e84e62719eefdbcc5a78bd2e1
SHA512a2ad6eb5ae2f6d57ca15363ac2f0c57ca3580474e94b9c010750948814cf4d5ffa0c3e7ef44634a3593da23f56011703ff220a3d7780f6f01785bf3b6676ced0
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
Filesize
84KB
MD54b264b356fc1518c56909909d7b8c51a
SHA10f0c4cf4d2e7e1f7c08f9a3dfed84ca024339c83
SHA25601847490a916e479f4be1809b77243b5a6d12e024b80c7aca8cc850325bd5c1a
SHA5125c11168bd2c16cc58b7940a7dc7186851103685ff57ded3daee933ea8e57d21e0d22337206d9a045d7b69ce2871b0d01735586668a18dbe68d97e21838cc8176