Malware Analysis Report

2025-08-11 00:07

Sample ID 240513-hg2xwadh69
Target a2554fb13a2ae16d5f511a373fac9810_NeikiAnalytics
SHA256 44b35895a3a56655d32a55706c52ce04d96c1829c465d750df4afe7421bbcb5f
Tags
evasion persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

44b35895a3a56655d32a55706c52ce04d96c1829c465d750df4afe7421bbcb5f

Threat Level: Known bad

The file a2554fb13a2ae16d5f511a373fac9810_NeikiAnalytics was found to be: Known bad.

Malicious Activity Summary

evasion persistence trojan

Windows security bypass

Sets file execution options in registry

Modifies Installed Components in the registry

Executes dropped EXE

Windows security modification

Loads dropped DLL

Modifies WinLogon

Drops file in System32 directory

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-13 06:43

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-13 06:43

Reported

2024-05-13 06:45

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

139s

Command Line

winlogon.exe

Signatures

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" C:\Windows\SysWOW64\ettasac.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" C:\Windows\SysWOW64\ettasac.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" C:\Windows\SysWOW64\ettasac.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" C:\Windows\SysWOW64\ettasac.exe N/A

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4256524B-4950-5453-4256-524B49505453} C:\Windows\SysWOW64\ettasac.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4256524B-4950-5453-4256-524B49505453}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" C:\Windows\SysWOW64\ettasac.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4256524B-4950-5453-4256-524B49505453}\IsInstalled = "1" C:\Windows\SysWOW64\ettasac.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4256524B-4950-5453-4256-524B49505453}\StubPath = "C:\\Windows\\system32\\imgatoor.exe" C:\Windows\SysWOW64\ettasac.exe N/A

Sets file execution options in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" C:\Windows\SysWOW64\ettasac.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\eanneras-otex.exe" C:\Windows\SysWOW64\ettasac.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe C:\Windows\SysWOW64\ettasac.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" C:\Windows\SysWOW64\ettasac.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" C:\Windows\SysWOW64\ettasac.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" C:\Windows\SysWOW64\ettasac.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" C:\Windows\SysWOW64\ettasac.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} C:\Windows\SysWOW64\ettasac.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify C:\Windows\SysWOW64\ettasac.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" C:\Windows\SysWOW64\ettasac.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\ettooboar.dll" C:\Windows\SysWOW64\ettasac.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" C:\Windows\SysWOW64\ettasac.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\ettooboar.dll C:\Windows\SysWOW64\ettasac.exe N/A
File opened for modification C:\Windows\SysWOW64\ettasac.exe C:\Windows\SysWOW64\ettasac.exe N/A
File opened for modification C:\Windows\SysWOW64\ettasac.exe C:\Users\Admin\AppData\Local\Temp\a2554fb13a2ae16d5f511a373fac9810_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\eanneras-otex.exe C:\Windows\SysWOW64\ettasac.exe N/A
File created C:\Windows\SysWOW64\eanneras-otex.exe C:\Windows\SysWOW64\ettasac.exe N/A
File opened for modification C:\Windows\SysWOW64\imgatoor.exe C:\Windows\SysWOW64\ettasac.exe N/A
File created C:\Windows\SysWOW64\ettasac.exe C:\Users\Admin\AppData\Local\Temp\a2554fb13a2ae16d5f511a373fac9810_NeikiAnalytics.exe N/A
File created C:\Windows\SysWOW64\imgatoor.exe C:\Windows\SysWOW64\ettasac.exe N/A
File opened for modification C:\Windows\SysWOW64\ettooboar.dll C:\Windows\SysWOW64\ettasac.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a2554fb13a2ae16d5f511a373fac9810_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ettasac.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3404 wrote to memory of 864 N/A C:\Users\Admin\AppData\Local\Temp\a2554fb13a2ae16d5f511a373fac9810_NeikiAnalytics.exe C:\Windows\SysWOW64\ettasac.exe
PID 3404 wrote to memory of 864 N/A C:\Users\Admin\AppData\Local\Temp\a2554fb13a2ae16d5f511a373fac9810_NeikiAnalytics.exe C:\Windows\SysWOW64\ettasac.exe
PID 3404 wrote to memory of 864 N/A C:\Users\Admin\AppData\Local\Temp\a2554fb13a2ae16d5f511a373fac9810_NeikiAnalytics.exe C:\Windows\SysWOW64\ettasac.exe
PID 864 wrote to memory of 616 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\system32\winlogon.exe
PID 864 wrote to memory of 3436 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 864 wrote to memory of 3436 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 864 wrote to memory of 1792 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\SysWOW64\ettasac.exe
PID 864 wrote to memory of 1792 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\SysWOW64\ettasac.exe
PID 864 wrote to memory of 1792 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\SysWOW64\ettasac.exe
PID 864 wrote to memory of 3436 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 864 wrote to memory of 3436 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 864 wrote to memory of 3436 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 864 wrote to memory of 3436 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 864 wrote to memory of 3436 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 864 wrote to memory of 3436 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 864 wrote to memory of 3436 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 864 wrote to memory of 3436 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 864 wrote to memory of 3436 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 864 wrote to memory of 3436 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 864 wrote to memory of 3436 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 864 wrote to memory of 3436 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 864 wrote to memory of 3436 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 864 wrote to memory of 3436 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 864 wrote to memory of 3436 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 864 wrote to memory of 3436 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 864 wrote to memory of 3436 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 864 wrote to memory of 3436 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 864 wrote to memory of 3436 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 864 wrote to memory of 3436 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 864 wrote to memory of 3436 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 864 wrote to memory of 3436 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 864 wrote to memory of 3436 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 864 wrote to memory of 3436 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 864 wrote to memory of 3436 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 864 wrote to memory of 3436 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 864 wrote to memory of 3436 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 864 wrote to memory of 3436 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 864 wrote to memory of 3436 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 864 wrote to memory of 3436 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 864 wrote to memory of 3436 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 864 wrote to memory of 3436 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 864 wrote to memory of 3436 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 864 wrote to memory of 3436 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 864 wrote to memory of 3436 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 864 wrote to memory of 3436 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 864 wrote to memory of 3436 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 864 wrote to memory of 3436 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 864 wrote to memory of 3436 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 864 wrote to memory of 3436 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 864 wrote to memory of 3436 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 864 wrote to memory of 3436 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 864 wrote to memory of 3436 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 864 wrote to memory of 3436 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 864 wrote to memory of 3436 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 864 wrote to memory of 3436 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 864 wrote to memory of 3436 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 864 wrote to memory of 3436 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 864 wrote to memory of 3436 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 864 wrote to memory of 3436 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 864 wrote to memory of 3436 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 864 wrote to memory of 3436 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 864 wrote to memory of 3436 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 864 wrote to memory of 3436 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 864 wrote to memory of 3436 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\system32\winlogon.exe

winlogon.exe

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\a2554fb13a2ae16d5f511a373fac9810_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\a2554fb13a2ae16d5f511a373fac9810_NeikiAnalytics.exe"

C:\Windows\SysWOW64\ettasac.exe

"C:\Windows\system32\ettasac.exe"

C:\Windows\SysWOW64\ettasac.exe

--k33p

Network

Country Destination Domain Proto
US 8.8.8.8:53 glompjpglgpok.vg udp
DE 88.198.29.97:80 glompjpglgpok.vg tcp
US 8.8.8.8:53 utbidet-ugeas.biz udp
US 54.157.24.8:80 utbidet-ugeas.biz tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 97.29.198.88.in-addr.arpa udp
US 8.8.8.8:53 8.24.157.54.in-addr.arpa udp
US 8.8.8.8:53 utbidet-ugeas.biz udp
US 54.157.24.8:80 utbidet-ugeas.biz tcp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
NL 23.62.61.163:443 www.bing.com tcp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 163.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 240.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 99.58.20.217.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp

Files

memory/3404-6-0x0000000000400000-0x0000000000414000-memory.dmp

C:\Windows\SysWOW64\ettasac.exe

MD5 a2554fb13a2ae16d5f511a373fac9810
SHA1 19e413e49e81776b44e9e30a1aedde574a862d66
SHA256 44b35895a3a56655d32a55706c52ce04d96c1829c465d750df4afe7421bbcb5f
SHA512 13bea34ea015addcbae9e820463fb56128d3e2e3d10244950ecb2a49a0dba838233d8146950155fbf42a1336ab2b931bd600c66bbadd8184298700f02fe542a9

C:\Windows\SysWOW64\imgatoor.exe

MD5 7ec96562f976840ecb30ae2d1600d033
SHA1 3df2dfaabd1c755ecf69ca9d197b03e9bf437176
SHA256 b5b314dac512e8c022b71c97c465953003f642fffc22e47441800a37236a5e89
SHA512 a52760b514b149cf10f41d91a2ac027f05c100e856833790404b4342c10b9e772daa765bb20b992e3a5184ab86717a42a0123307a5e929dc14b3e623fb7dbb9b

C:\Windows\SysWOW64\eanneras-otex.exe

MD5 ae244095bcbdb41be9f5ebc11058a764
SHA1 2a6ce4e4eefaaaaa4755300e3157b37688cf90c1
SHA256 bcb45c70e1d7727cf799e24a604e7d53a8b6973f2a74f3abf8e9f6bb50928227
SHA512 f5945b247d194c036efa72428853c3cfb2ed0f5d8f546343a94884ffcc3054a3ee55b1bd3f1f3c2644724fbae7c1d1e0a9e218b07f5dec24f78300e4303292d4

C:\Windows\SysWOW64\ettooboar.dll

MD5 f37b21c00fd81bd93c89ce741a88f183
SHA1 b2796500597c68e2f5638e1101b46eaf32676c1c
SHA256 76cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
SHA512 252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4

memory/864-49-0x0000000000400000-0x0000000000414000-memory.dmp

memory/1792-50-0x0000000000400000-0x0000000000414000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-13 06:43

Reported

2024-05-13 06:45

Platform

win7-20240221-en

Max time kernel

149s

Max time network

118s

Command Line

winlogon.exe

Signatures

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" C:\Windows\SysWOW64\ettasac.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" C:\Windows\SysWOW64\ettasac.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" C:\Windows\SysWOW64\ettasac.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" C:\Windows\SysWOW64\ettasac.exe N/A

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{495A4B43-4b4f-5450-495A-4B434B4F5450} C:\Windows\SysWOW64\ettasac.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{495A4B43-4b4f-5450-495A-4B434B4F5450}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" C:\Windows\SysWOW64\ettasac.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{495A4B43-4b4f-5450-495A-4B434B4F5450}\IsInstalled = "1" C:\Windows\SysWOW64\ettasac.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{495A4B43-4b4f-5450-495A-4B434B4F5450}\StubPath = "C:\\Windows\\system32\\imgatoor.exe" C:\Windows\SysWOW64\ettasac.exe N/A

Sets file execution options in registry

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe C:\Windows\SysWOW64\ettasac.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" C:\Windows\SysWOW64\ettasac.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\eanneras-otex.exe" C:\Windows\SysWOW64\ettasac.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" C:\Windows\SysWOW64\ettasac.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" C:\Windows\SysWOW64\ettasac.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" C:\Windows\SysWOW64\ettasac.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" C:\Windows\SysWOW64\ettasac.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} C:\Windows\SysWOW64\ettasac.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify C:\Windows\SysWOW64\ettasac.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" C:\Windows\SysWOW64\ettasac.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\ettooboar.dll" C:\Windows\SysWOW64\ettasac.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" C:\Windows\SysWOW64\ettasac.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\ettasac.exe C:\Users\Admin\AppData\Local\Temp\a2554fb13a2ae16d5f511a373fac9810_NeikiAnalytics.exe N/A
File created C:\Windows\SysWOW64\eanneras-otex.exe C:\Windows\SysWOW64\ettasac.exe N/A
File created C:\Windows\SysWOW64\imgatoor.exe C:\Windows\SysWOW64\ettasac.exe N/A
File opened for modification C:\Windows\SysWOW64\ettasac.exe C:\Windows\SysWOW64\ettasac.exe N/A
File created C:\Windows\SysWOW64\ettasac.exe C:\Users\Admin\AppData\Local\Temp\a2554fb13a2ae16d5f511a373fac9810_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\eanneras-otex.exe C:\Windows\SysWOW64\ettasac.exe N/A
File opened for modification C:\Windows\SysWOW64\imgatoor.exe C:\Windows\SysWOW64\ettasac.exe N/A
File opened for modification C:\Windows\SysWOW64\ettooboar.dll C:\Windows\SysWOW64\ettasac.exe N/A
File created C:\Windows\SysWOW64\ettooboar.dll C:\Windows\SysWOW64\ettasac.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A
N/A N/A C:\Windows\SysWOW64\ettasac.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a2554fb13a2ae16d5f511a373fac9810_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ettasac.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2340 wrote to memory of 320 N/A C:\Users\Admin\AppData\Local\Temp\a2554fb13a2ae16d5f511a373fac9810_NeikiAnalytics.exe C:\Windows\SysWOW64\ettasac.exe
PID 2340 wrote to memory of 320 N/A C:\Users\Admin\AppData\Local\Temp\a2554fb13a2ae16d5f511a373fac9810_NeikiAnalytics.exe C:\Windows\SysWOW64\ettasac.exe
PID 2340 wrote to memory of 320 N/A C:\Users\Admin\AppData\Local\Temp\a2554fb13a2ae16d5f511a373fac9810_NeikiAnalytics.exe C:\Windows\SysWOW64\ettasac.exe
PID 2340 wrote to memory of 320 N/A C:\Users\Admin\AppData\Local\Temp\a2554fb13a2ae16d5f511a373fac9810_NeikiAnalytics.exe C:\Windows\SysWOW64\ettasac.exe
PID 320 wrote to memory of 436 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\system32\winlogon.exe
PID 320 wrote to memory of 1196 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 320 wrote to memory of 1196 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 320 wrote to memory of 1284 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\SysWOW64\ettasac.exe
PID 320 wrote to memory of 1284 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\SysWOW64\ettasac.exe
PID 320 wrote to memory of 1284 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\SysWOW64\ettasac.exe
PID 320 wrote to memory of 1284 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\SysWOW64\ettasac.exe
PID 320 wrote to memory of 1196 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 320 wrote to memory of 1196 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 320 wrote to memory of 1196 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 320 wrote to memory of 1196 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 320 wrote to memory of 1196 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 320 wrote to memory of 1196 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 320 wrote to memory of 1196 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 320 wrote to memory of 1196 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 320 wrote to memory of 1196 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 320 wrote to memory of 1196 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 320 wrote to memory of 1196 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 320 wrote to memory of 1196 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 320 wrote to memory of 1196 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 320 wrote to memory of 1196 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 320 wrote to memory of 1196 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 320 wrote to memory of 1196 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 320 wrote to memory of 1196 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 320 wrote to memory of 1196 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 320 wrote to memory of 1196 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 320 wrote to memory of 1196 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 320 wrote to memory of 1196 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 320 wrote to memory of 1196 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 320 wrote to memory of 1196 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 320 wrote to memory of 1196 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 320 wrote to memory of 1196 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 320 wrote to memory of 1196 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 320 wrote to memory of 1196 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 320 wrote to memory of 1196 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 320 wrote to memory of 1196 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 320 wrote to memory of 1196 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 320 wrote to memory of 1196 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 320 wrote to memory of 1196 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 320 wrote to memory of 1196 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 320 wrote to memory of 1196 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 320 wrote to memory of 1196 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 320 wrote to memory of 1196 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 320 wrote to memory of 1196 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 320 wrote to memory of 1196 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 320 wrote to memory of 1196 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 320 wrote to memory of 1196 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 320 wrote to memory of 1196 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 320 wrote to memory of 1196 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 320 wrote to memory of 1196 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 320 wrote to memory of 1196 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 320 wrote to memory of 1196 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 320 wrote to memory of 1196 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 320 wrote to memory of 1196 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 320 wrote to memory of 1196 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 320 wrote to memory of 1196 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 320 wrote to memory of 1196 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 320 wrote to memory of 1196 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 320 wrote to memory of 1196 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE
PID 320 wrote to memory of 1196 N/A C:\Windows\SysWOW64\ettasac.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\system32\winlogon.exe

winlogon.exe

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\a2554fb13a2ae16d5f511a373fac9810_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\a2554fb13a2ae16d5f511a373fac9810_NeikiAnalytics.exe"

C:\Windows\SysWOW64\ettasac.exe

"C:\Windows\system32\ettasac.exe"

C:\Windows\SysWOW64\ettasac.exe

--k33p

Network

Country Destination Domain Proto
US 8.8.8.8:53 dmoas.cg udp
US 8.8.8.8:53 dmoas.cg udp

Files

\Windows\SysWOW64\ettasac.exe

MD5 a2554fb13a2ae16d5f511a373fac9810
SHA1 19e413e49e81776b44e9e30a1aedde574a862d66
SHA256 44b35895a3a56655d32a55706c52ce04d96c1829c465d750df4afe7421bbcb5f
SHA512 13bea34ea015addcbae9e820463fb56128d3e2e3d10244950ecb2a49a0dba838233d8146950155fbf42a1336ab2b931bd600c66bbadd8184298700f02fe542a9

memory/2340-9-0x0000000000400000-0x0000000000414000-memory.dmp

C:\Windows\SysWOW64\ettooboar.dll

MD5 f37b21c00fd81bd93c89ce741a88f183
SHA1 b2796500597c68e2f5638e1101b46eaf32676c1c
SHA256 76cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
SHA512 252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4

C:\Windows\SysWOW64\eanneras-otex.exe

MD5 23d25df477b371881af5d5f92e1d56c7
SHA1 43fbf2f7151f04d481e118509dc61a069850e5ca
SHA256 6deb43b5679fd3f1d2546e137efead94709e1c8fc07f7390017d2008caaa5e08
SHA512 0da93b07c72457334eb4bd3af5f8b11af74d62f1a155b4f4c7255969ee1327fc12ad74472723791185141f06aa017946197348f2099309ed8821b1a996d864bb

C:\Windows\SysWOW64\imgatoor.exe

MD5 f1bdf77ab055abefec81854a4a671a08
SHA1 2295d0faeaf8dd1ed0a10be7936ac086bb960c77
SHA256 a879edf5eaa1d4758352f5d34e47705c6283e82504dc85fb83046fa984c9a1b6
SHA512 3556303a00a0d5d7fa8dbedd9e08559e60779cd9c2b406e7eed98165584ccd80b827a4b0c1102359a1dfd39b53fa738fd81286ba98c7a52988059768b8355432

memory/320-55-0x0000000000400000-0x0000000000414000-memory.dmp

memory/1284-56-0x0000000000400000-0x0000000000414000-memory.dmp