Malware Analysis Report

2025-08-11 00:07

Sample ID 240513-hvq3jaee49
Target a40cef77c32e47d2afed6f2ad797e6a0_NeikiAnalytics
SHA256 5e1338efd0474116d2e8b44b979af06595fc0bf0f749a0bc2e7a099245dc82d5
Tags
evasion persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

5e1338efd0474116d2e8b44b979af06595fc0bf0f749a0bc2e7a099245dc82d5

Threat Level: Known bad

The file a40cef77c32e47d2afed6f2ad797e6a0_NeikiAnalytics was found to be: Known bad.

Malicious Activity Summary

evasion persistence

Modifies WinLogon for persistence

Modifies visiblity of hidden/system files in Explorer

Modifies Installed Components in the registry

Executes dropped EXE

Adds Run key to start application

Drops file in System32 directory

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Suspicious use of WriteProcessMemory

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-13 07:03

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-13 07:03

Reported

2024-05-13 07:06

Platform

win7-20231129-en

Max time kernel

150s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a40cef77c32e47d2afed6f2ad797e6a0_NeikiAnalytics.exe"

Signatures

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\userinit.exe" \??\c:\windows\userinit.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\userinit.exe" \??\c:\windows\swchost.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\userinit.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\swchost.exe N/A

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\swchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\mrsys.exe MR" \??\c:\windows\swchost.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} \??\c:\windows\swchost.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\userinit.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\mrsys.exe MR" \??\c:\windows\userinit.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} \??\c:\windows\swchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\mrsys.exe MR" \??\c:\windows\swchost.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\swchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A \??\c:\windows\userinit.exe N/A
N/A N/A \??\c:\windows\spoolsw.exe N/A
N/A N/A \??\c:\windows\swchost.exe N/A
N/A N/A \??\c:\windows\spoolsw.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\userinit = "c:\\windows\\userinit.exe RO" \??\c:\windows\userinit.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Swchost = "c:\\windows\\swchost.exe RO" \??\c:\windows\userinit.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\userinit = "c:\\windows\\userinit.exe RO" \??\c:\windows\swchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Swchost = "c:\\windows\\swchost.exe RO" \??\c:\windows\swchost.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\system\udsys.exe \??\c:\windows\userinit.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification \??\c:\windows\userinit.exe C:\Users\Admin\AppData\Local\Temp\a40cef77c32e47d2afed6f2ad797e6a0_NeikiAnalytics.exe N/A
File opened for modification \??\c:\windows\spoolsw.exe \??\c:\windows\userinit.exe N/A
File opened for modification \??\c:\windows\swchost.exe \??\c:\windows\spoolsw.exe N/A
File opened for modification \??\c:\windows\userinit.exe \??\c:\windows\userinit.exe N/A
File opened for modification \??\c:\windows\swchost.exe \??\c:\windows\swchost.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a40cef77c32e47d2afed6f2ad797e6a0_NeikiAnalytics.exe N/A
N/A N/A \??\c:\windows\userinit.exe N/A
N/A N/A \??\c:\windows\userinit.exe N/A
N/A N/A \??\c:\windows\swchost.exe N/A
N/A N/A \??\c:\windows\userinit.exe N/A
N/A N/A \??\c:\windows\swchost.exe N/A
N/A N/A \??\c:\windows\swchost.exe N/A
N/A N/A \??\c:\windows\userinit.exe N/A
N/A N/A \??\c:\windows\userinit.exe N/A
N/A N/A \??\c:\windows\swchost.exe N/A
N/A N/A \??\c:\windows\userinit.exe N/A
N/A N/A \??\c:\windows\swchost.exe N/A
N/A N/A \??\c:\windows\userinit.exe N/A
N/A N/A \??\c:\windows\swchost.exe N/A
N/A N/A \??\c:\windows\swchost.exe N/A
N/A N/A \??\c:\windows\userinit.exe N/A
N/A N/A \??\c:\windows\userinit.exe N/A
N/A N/A \??\c:\windows\swchost.exe N/A
N/A N/A \??\c:\windows\userinit.exe N/A
N/A N/A \??\c:\windows\swchost.exe N/A
N/A N/A \??\c:\windows\swchost.exe N/A
N/A N/A \??\c:\windows\userinit.exe N/A
N/A N/A \??\c:\windows\userinit.exe N/A
N/A N/A \??\c:\windows\swchost.exe N/A
N/A N/A \??\c:\windows\userinit.exe N/A
N/A N/A \??\c:\windows\swchost.exe N/A
N/A N/A \??\c:\windows\userinit.exe N/A
N/A N/A \??\c:\windows\swchost.exe N/A
N/A N/A \??\c:\windows\userinit.exe N/A
N/A N/A \??\c:\windows\swchost.exe N/A
N/A N/A \??\c:\windows\userinit.exe N/A
N/A N/A \??\c:\windows\swchost.exe N/A
N/A N/A \??\c:\windows\userinit.exe N/A
N/A N/A \??\c:\windows\swchost.exe N/A
N/A N/A \??\c:\windows\userinit.exe N/A
N/A N/A \??\c:\windows\swchost.exe N/A
N/A N/A \??\c:\windows\userinit.exe N/A
N/A N/A \??\c:\windows\swchost.exe N/A
N/A N/A \??\c:\windows\swchost.exe N/A
N/A N/A \??\c:\windows\userinit.exe N/A
N/A N/A \??\c:\windows\swchost.exe N/A
N/A N/A \??\c:\windows\userinit.exe N/A
N/A N/A \??\c:\windows\swchost.exe N/A
N/A N/A \??\c:\windows\userinit.exe N/A
N/A N/A \??\c:\windows\userinit.exe N/A
N/A N/A \??\c:\windows\swchost.exe N/A
N/A N/A \??\c:\windows\userinit.exe N/A
N/A N/A \??\c:\windows\swchost.exe N/A
N/A N/A \??\c:\windows\userinit.exe N/A
N/A N/A \??\c:\windows\swchost.exe N/A
N/A N/A \??\c:\windows\swchost.exe N/A
N/A N/A \??\c:\windows\userinit.exe N/A
N/A N/A \??\c:\windows\swchost.exe N/A
N/A N/A \??\c:\windows\userinit.exe N/A
N/A N/A \??\c:\windows\swchost.exe N/A
N/A N/A \??\c:\windows\userinit.exe N/A
N/A N/A \??\c:\windows\swchost.exe N/A
N/A N/A \??\c:\windows\userinit.exe N/A
N/A N/A \??\c:\windows\swchost.exe N/A
N/A N/A \??\c:\windows\userinit.exe N/A
N/A N/A \??\c:\windows\swchost.exe N/A
N/A N/A \??\c:\windows\userinit.exe N/A
N/A N/A \??\c:\windows\userinit.exe N/A
N/A N/A \??\c:\windows\swchost.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A \??\c:\windows\userinit.exe N/A
N/A N/A \??\c:\windows\swchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3048 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\a40cef77c32e47d2afed6f2ad797e6a0_NeikiAnalytics.exe \??\c:\windows\userinit.exe
PID 3048 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\a40cef77c32e47d2afed6f2ad797e6a0_NeikiAnalytics.exe \??\c:\windows\userinit.exe
PID 3048 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\a40cef77c32e47d2afed6f2ad797e6a0_NeikiAnalytics.exe \??\c:\windows\userinit.exe
PID 3048 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\a40cef77c32e47d2afed6f2ad797e6a0_NeikiAnalytics.exe \??\c:\windows\userinit.exe
PID 2920 wrote to memory of 2560 N/A \??\c:\windows\userinit.exe \??\c:\windows\spoolsw.exe
PID 2920 wrote to memory of 2560 N/A \??\c:\windows\userinit.exe \??\c:\windows\spoolsw.exe
PID 2920 wrote to memory of 2560 N/A \??\c:\windows\userinit.exe \??\c:\windows\spoolsw.exe
PID 2920 wrote to memory of 2560 N/A \??\c:\windows\userinit.exe \??\c:\windows\spoolsw.exe
PID 2560 wrote to memory of 2584 N/A \??\c:\windows\spoolsw.exe \??\c:\windows\swchost.exe
PID 2560 wrote to memory of 2584 N/A \??\c:\windows\spoolsw.exe \??\c:\windows\swchost.exe
PID 2560 wrote to memory of 2584 N/A \??\c:\windows\spoolsw.exe \??\c:\windows\swchost.exe
PID 2560 wrote to memory of 2584 N/A \??\c:\windows\spoolsw.exe \??\c:\windows\swchost.exe
PID 2584 wrote to memory of 2548 N/A \??\c:\windows\swchost.exe \??\c:\windows\spoolsw.exe
PID 2584 wrote to memory of 2548 N/A \??\c:\windows\swchost.exe \??\c:\windows\spoolsw.exe
PID 2584 wrote to memory of 2548 N/A \??\c:\windows\swchost.exe \??\c:\windows\spoolsw.exe
PID 2584 wrote to memory of 2548 N/A \??\c:\windows\swchost.exe \??\c:\windows\spoolsw.exe

Processes

C:\Users\Admin\AppData\Local\Temp\a40cef77c32e47d2afed6f2ad797e6a0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\a40cef77c32e47d2afed6f2ad797e6a0_NeikiAnalytics.exe"

\??\c:\windows\userinit.exe

c:\windows\userinit.exe

\??\c:\windows\spoolsw.exe

c:\windows\spoolsw.exe SE

\??\c:\windows\swchost.exe

c:\windows\swchost.exe

\??\c:\windows\spoolsw.exe

c:\windows\spoolsw.exe PR

Network

N/A

Files

C:\Windows\userinit.exe

MD5 4cd05fe54e673cc2060770e36f2c853d
SHA1 a8f1a3e4bcf62db6546c4a3a85edb162d1837006
SHA256 2711264e25131ef58b42f1ab852364d145699d851bb8f6af8d68cb21fe1b09a0
SHA512 667361a6c032fa2ef4aa821a87145c44f94b12dcf7a959ed0b356116419b6af2c4085cfe98e619c9824a3b759ff5c4c9f8271919174824962511102c4d87a98e

C:\Windows\spoolsw.exe

MD5 590e098355345b163e1b1df035a77424
SHA1 3292d737957a240afc4ceaa516fded4e3615a670
SHA256 ef2de95bcc6358f114039f614e6ae2166d4c1e9685a4fdd62a22d7de282f5dbf
SHA512 3183a8caef0e616656c7e54362658f4f244afd649b7219dbd30c8ccb0d9d6d2e64109360fccdf95a3ad2ce007ca282ca94be50df36b28fe6b929790c7d90b5a6

C:\Windows\swchost.exe

MD5 e909b88bf9a72a500b76c8578d7a40ec
SHA1 cbe18fbc77b7dcc4e5ef3c276f6168e50edf09f7
SHA256 d867938b4067d87bd42e75c080533694523bf9b465e117d4dff69511f260b7c6
SHA512 2724154b95eed76a0953b1d679ff48ec6e3e01e056d395d3f5936d0fbd927cfbb7ac4bb35adfcbb6ac6937d2540864dc425b3e24e4b336cfc469abd53bbefcef

C:\Users\Admin\AppData\Local\mrsys.exe

MD5 3e3ce31a32465ca83c0070197db1435a
SHA1 1fde904afbc48ac59f7cba5a5128858919bf5e08
SHA256 01b5eec87b995237e9ab23e06fc00e4ce00cbed85469483d417f7d924c08bda5
SHA512 1b4efe8a9c419855223c1f8bf47c895dccbcea7a4ebeb756ffa82ee9e8a459dfe12c34d0ba4512b71768a177d2ad1e8d29c74a63d57830caf78a67f5e8893013

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-13 07:03

Reported

2024-05-13 07:06

Platform

win10v2004-20240508-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a40cef77c32e47d2afed6f2ad797e6a0_NeikiAnalytics.exe"

Signatures

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\userinit.exe" \??\c:\windows\userinit.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\userinit.exe" \??\c:\windows\swchost.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\userinit.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\swchost.exe N/A

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} \??\c:\windows\swchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\mrsys.exe MR" \??\c:\windows\swchost.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\swchost.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\swchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\mrsys.exe MR" \??\c:\windows\swchost.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} \??\c:\windows\swchost.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\userinit.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\mrsys.exe MR" \??\c:\windows\userinit.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A \??\c:\windows\userinit.exe N/A
N/A N/A \??\c:\windows\spoolsw.exe N/A
N/A N/A \??\c:\windows\swchost.exe N/A
N/A N/A \??\c:\windows\spoolsw.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Swchost = "c:\\windows\\swchost.exe RO" \??\c:\windows\swchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\userinit = "c:\\windows\\userinit.exe RO" \??\c:\windows\userinit.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Swchost = "c:\\windows\\swchost.exe RO" \??\c:\windows\userinit.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\userinit = "c:\\windows\\userinit.exe RO" \??\c:\windows\swchost.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\system\udsys.exe \??\c:\windows\userinit.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification \??\c:\windows\swchost.exe \??\c:\windows\swchost.exe N/A
File opened for modification \??\c:\windows\userinit.exe C:\Users\Admin\AppData\Local\Temp\a40cef77c32e47d2afed6f2ad797e6a0_NeikiAnalytics.exe N/A
File opened for modification \??\c:\windows\spoolsw.exe \??\c:\windows\userinit.exe N/A
File opened for modification \??\c:\windows\swchost.exe \??\c:\windows\spoolsw.exe N/A
File opened for modification \??\c:\windows\userinit.exe \??\c:\windows\userinit.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a40cef77c32e47d2afed6f2ad797e6a0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a40cef77c32e47d2afed6f2ad797e6a0_NeikiAnalytics.exe N/A
N/A N/A \??\c:\windows\userinit.exe N/A
N/A N/A \??\c:\windows\userinit.exe N/A
N/A N/A \??\c:\windows\userinit.exe N/A
N/A N/A \??\c:\windows\userinit.exe N/A
N/A N/A \??\c:\windows\userinit.exe N/A
N/A N/A \??\c:\windows\userinit.exe N/A
N/A N/A \??\c:\windows\swchost.exe N/A
N/A N/A \??\c:\windows\swchost.exe N/A
N/A N/A \??\c:\windows\swchost.exe N/A
N/A N/A \??\c:\windows\swchost.exe N/A
N/A N/A \??\c:\windows\userinit.exe N/A
N/A N/A \??\c:\windows\userinit.exe N/A
N/A N/A \??\c:\windows\swchost.exe N/A
N/A N/A \??\c:\windows\swchost.exe N/A
N/A N/A \??\c:\windows\userinit.exe N/A
N/A N/A \??\c:\windows\userinit.exe N/A
N/A N/A \??\c:\windows\swchost.exe N/A
N/A N/A \??\c:\windows\swchost.exe N/A
N/A N/A \??\c:\windows\userinit.exe N/A
N/A N/A \??\c:\windows\userinit.exe N/A
N/A N/A \??\c:\windows\swchost.exe N/A
N/A N/A \??\c:\windows\swchost.exe N/A
N/A N/A \??\c:\windows\userinit.exe N/A
N/A N/A \??\c:\windows\userinit.exe N/A
N/A N/A \??\c:\windows\swchost.exe N/A
N/A N/A \??\c:\windows\swchost.exe N/A
N/A N/A \??\c:\windows\userinit.exe N/A
N/A N/A \??\c:\windows\userinit.exe N/A
N/A N/A \??\c:\windows\swchost.exe N/A
N/A N/A \??\c:\windows\swchost.exe N/A
N/A N/A \??\c:\windows\userinit.exe N/A
N/A N/A \??\c:\windows\userinit.exe N/A
N/A N/A \??\c:\windows\swchost.exe N/A
N/A N/A \??\c:\windows\swchost.exe N/A
N/A N/A \??\c:\windows\userinit.exe N/A
N/A N/A \??\c:\windows\userinit.exe N/A
N/A N/A \??\c:\windows\swchost.exe N/A
N/A N/A \??\c:\windows\swchost.exe N/A
N/A N/A \??\c:\windows\userinit.exe N/A
N/A N/A \??\c:\windows\userinit.exe N/A
N/A N/A \??\c:\windows\swchost.exe N/A
N/A N/A \??\c:\windows\swchost.exe N/A
N/A N/A \??\c:\windows\userinit.exe N/A
N/A N/A \??\c:\windows\userinit.exe N/A
N/A N/A \??\c:\windows\swchost.exe N/A
N/A N/A \??\c:\windows\swchost.exe N/A
N/A N/A \??\c:\windows\userinit.exe N/A
N/A N/A \??\c:\windows\userinit.exe N/A
N/A N/A \??\c:\windows\swchost.exe N/A
N/A N/A \??\c:\windows\swchost.exe N/A
N/A N/A \??\c:\windows\userinit.exe N/A
N/A N/A \??\c:\windows\userinit.exe N/A
N/A N/A \??\c:\windows\swchost.exe N/A
N/A N/A \??\c:\windows\swchost.exe N/A
N/A N/A \??\c:\windows\userinit.exe N/A
N/A N/A \??\c:\windows\userinit.exe N/A
N/A N/A \??\c:\windows\swchost.exe N/A
N/A N/A \??\c:\windows\swchost.exe N/A
N/A N/A \??\c:\windows\userinit.exe N/A
N/A N/A \??\c:\windows\userinit.exe N/A
N/A N/A \??\c:\windows\swchost.exe N/A
N/A N/A \??\c:\windows\swchost.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A \??\c:\windows\userinit.exe N/A
N/A N/A \??\c:\windows\swchost.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\a40cef77c32e47d2afed6f2ad797e6a0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\a40cef77c32e47d2afed6f2ad797e6a0_NeikiAnalytics.exe"

\??\c:\windows\userinit.exe

c:\windows\userinit.exe

\??\c:\windows\spoolsw.exe

c:\windows\spoolsw.exe SE

\??\c:\windows\swchost.exe

c:\windows\swchost.exe

\??\c:\windows\spoolsw.exe

c:\windows\spoolsw.exe PR

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 142.53.16.96.in-addr.arpa udp
US 8.8.8.8:53 169.117.168.52.in-addr.arpa udp

Files

C:\Windows\userinit.exe

MD5 73318a053b04276cfc2fd369b0a902b6
SHA1 9fdbe895d9798c780da87577b0ea53001bfacd35
SHA256 3a55bbdfb0949d7801151885f26228017c050de2ff2ac3e50c1dc2a73a2b3570
SHA512 b88635ad2f6df6be11d3f49f78f96d7811522893e1828bfa0ef9ba519cc6e80d2c1cc4aa697cec0179443c57135cf93a57f8ad0f949ef8632b11ace6395e5594

C:\Windows\spoolsw.exe

MD5 1f7faa7d124afba20a8ff5b9ab78323e
SHA1 6b2479a1071141f3a5fd13d836fca50d5222e071
SHA256 88232cec2ba91682543b2f058772d4a89d0ffc5dcb0b24f1528ced1f2bdf408f
SHA512 0717dface8c763a6b88efc51e3dfa26655c8bf0de0f6cf5efd60a08fddaf8b348b3247f5496341032d821e5a767be68a21ff5b8e7d87b9b7c01d8766823948a5

C:\Windows\swchost.exe

MD5 524e624accd2a24a1125705b67e8240e
SHA1 73ffcaf92dabdd9e61d8f9601d892c4f383429de
SHA256 bc631bcd6dd066ce136d9e22765ee4e240e9e97b8db2af41044b63c53edba3a1
SHA512 fe30ea9cb28c9be331ebdad2348d25a0644fda154641a61180407483b9a2f88687d0049fe51333e4bca34aa2d530eb26db583fe2d67618609e7030ba2c7f0651

C:\Users\Admin\AppData\Local\mrsys.exe

MD5 c6870633b46a05208b2845f9595a8fbf
SHA1 a0c945a917a86fc8ecc9aa582e95223978dd512a
SHA256 c198ef806df6c20e8446a470b10fdd4d554f57a68c7569fb730b3a707f7f76a9
SHA512 a5a4aab4a2bf514eac121e8ce92b376387bf666b554027a0d1d0188f861bdf3ebf230f000119da778b1d219e88bbc2de841d7d6209def87b9c90ed82c85b1bc0