Malware Analysis Report

2025-08-05 19:17

Sample ID 240513-mlfyesad9t
Target b2c1b7deb8895437ea28a79ae38fa2b0_NeikiAnalytics
SHA256 0c120bba8d75c0b1994f6273766316a5f537a7ab5a8c4649aa52c38f7fc8e346
Tags
evasion
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

0c120bba8d75c0b1994f6273766316a5f537a7ab5a8c4649aa52c38f7fc8e346

Threat Level: Known bad

The file b2c1b7deb8895437ea28a79ae38fa2b0_NeikiAnalytics was found to be: Known bad.

Malicious Activity Summary

evasion

Modifies visibility of file extensions in Explorer

Executes dropped EXE

Enumerates connected drives

AutoIT Executable

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of SendNotifyMessage

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-13 10:32

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-13 10:32

Reported

2024-05-13 10:35

Platform

win7-20240508-en

Max time kernel

150s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b2c1b7deb8895437ea28a79ae38fa2b0_NeikiAnalytics.exe"

Signatures

Modifies visibility of file extensions in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Windows\svhost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\svhost.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\x: C:\Windows\svhost.exe N/A
File opened (read-only) \??\z: C:\Windows\svhost.exe N/A
File opened (read-only) \??\b: C:\Windows\svhost.exe N/A
File opened (read-only) \??\q: C:\Windows\svhost.exe N/A
File opened (read-only) \??\s: C:\Windows\svhost.exe N/A
File opened (read-only) \??\t: C:\Windows\svhost.exe N/A
File opened (read-only) \??\v: C:\Windows\svhost.exe N/A
File opened (read-only) \??\w: C:\Windows\svhost.exe N/A
File opened (read-only) \??\e: C:\Windows\svhost.exe N/A
File opened (read-only) \??\o: C:\Windows\svhost.exe N/A
File opened (read-only) \??\p: C:\Windows\svhost.exe N/A
File opened (read-only) \??\r: C:\Windows\svhost.exe N/A
File opened (read-only) \??\h: C:\Windows\svhost.exe N/A
File opened (read-only) \??\j: C:\Windows\svhost.exe N/A
File opened (read-only) \??\k: C:\Windows\svhost.exe N/A
File opened (read-only) \??\n: C:\Windows\svhost.exe N/A
File opened (read-only) \??\m: C:\Windows\svhost.exe N/A
File opened (read-only) \??\u: C:\Windows\svhost.exe N/A
File opened (read-only) \??\y: C:\Windows\svhost.exe N/A
File opened (read-only) \??\a: C:\Windows\svhost.exe N/A
File opened (read-only) \??\g: C:\Windows\svhost.exe N/A
File opened (read-only) \??\i: C:\Windows\svhost.exe N/A
File opened (read-only) \??\l: C:\Windows\svhost.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\svhost.exe C:\Users\Admin\AppData\Local\Temp\b2c1b7deb8895437ea28a79ae38fa2b0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Driver.db C:\Windows\svhost.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\b2c1b7deb8895437ea28a79ae38fa2b0_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\svhost.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\b2c1b7deb8895437ea28a79ae38fa2b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b2c1b7deb8895437ea28a79ae38fa2b0_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b2c1b7deb8895437ea28a79ae38fa2b0_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b2c1b7deb8895437ea28a79ae38fa2b0_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b2c1b7deb8895437ea28a79ae38fa2b0_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b2c1b7deb8895437ea28a79ae38fa2b0_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b2c1b7deb8895437ea28a79ae38fa2b0_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b2c1b7deb8895437ea28a79ae38fa2b0_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b2c1b7deb8895437ea28a79ae38fa2b0_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b2c1b7deb8895437ea28a79ae38fa2b0_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b2c1b7deb8895437ea28a79ae38fa2b0_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b2c1b7deb8895437ea28a79ae38fa2b0_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\b2c1b7deb8895437ea28a79ae38fa2b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b2c1b7deb8895437ea28a79ae38fa2b0_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b2c1b7deb8895437ea28a79ae38fa2b0_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b2c1b7deb8895437ea28a79ae38fa2b0_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b2c1b7deb8895437ea28a79ae38fa2b0_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b2c1b7deb8895437ea28a79ae38fa2b0_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b2c1b7deb8895437ea28a79ae38fa2b0_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b2c1b7deb8895437ea28a79ae38fa2b0_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b2c1b7deb8895437ea28a79ae38fa2b0_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b2c1b7deb8895437ea28a79ae38fa2b0_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b2c1b7deb8895437ea28a79ae38fa2b0_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b2c1b7deb8895437ea28a79ae38fa2b0_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\b2c1b7deb8895437ea28a79ae38fa2b0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\b2c1b7deb8895437ea28a79ae38fa2b0_NeikiAnalytics.exe"

C:\Windows\svhost.exe

C:\Windows\svhost.exe

Network

N/A

Files

memory/1716-0-0x0000000000400000-0x00000000004C0000-memory.dmp

C:\Windows\svhost.exe

MD5 5c6ae73a4bc604c3f0428e3bda220f9f
SHA1 42b191cabd8936454c616e7e1721a147368bffef
SHA256 f396e3b3221258eaf16a0fe0dee88f16216329c77836723818db51938ae2e1f0
SHA512 268575fcf0dfafa8b492b1b6d4d98db82134170ea8060198f3cf302a77e126e79bc1e9b208e7e21fd01495ca5afb0533b902a86538370dd8896b8922372194c0

memory/1688-6-0x0000000000400000-0x00000000004C0000-memory.dmp

C:\Windows\Driver.db

MD5 c2d2dc50dca8a2bfdc8e2d59dfa5796d
SHA1 7a6150fc53244e28d1bcea437c0c9d276c41ccad
SHA256 b2d38b3f122cfcf3cecabf0dfe2ab9c4182416d6961ae43f1eebee489cf3c960
SHA512 6cfdd08729de9ee9d1f5d8fcd859144d32ddc0a9e7074202a7d03d3795bdf0027a074a6aa54f451d4166024c134b27c55c7142170e64d979d86c13801f937ce4

C:\Documents and Settings.exe

MD5 c9d8208a53429eec993d20032a67a432
SHA1 51cc2db997c87a7eb2cb8a682957968ce040d2b0
SHA256 c9e565c38cd754a55f25e4dfad6e7e8336e7f2972ae3e01fdeabaaf74d545aec
SHA512 d7d0dbbbf5a9e3c19741caa605d0d7682672132d58e2830167079fe6c4b52ae9b74b3f351cca256f787e226828ff54fc3fb3b43138b60c088cfa02f75dc998d8

memory/1716-794-0x0000000000400000-0x00000000004C0000-memory.dmp

memory/1688-1324-0x0000000000400000-0x00000000004C0000-memory.dmp

memory/1688-2386-0x0000000000400000-0x00000000004C0000-memory.dmp

memory/1688-2655-0x0000000000400000-0x00000000004C0000-memory.dmp

memory/1688-3448-0x0000000000400000-0x00000000004C0000-memory.dmp

memory/1688-4766-0x0000000000400000-0x00000000004C0000-memory.dmp

memory/1688-5830-0x0000000000400000-0x00000000004C0000-memory.dmp

memory/1688-6889-0x0000000000400000-0x00000000004C0000-memory.dmp

memory/1688-7946-0x0000000000400000-0x00000000004C0000-memory.dmp

memory/1688-9271-0x0000000000400000-0x00000000004C0000-memory.dmp

memory/1688-10330-0x0000000000400000-0x00000000004C0000-memory.dmp

memory/1688-11387-0x0000000000400000-0x00000000004C0000-memory.dmp

memory/1688-12441-0x0000000000400000-0x00000000004C0000-memory.dmp

memory/1688-13771-0x0000000000400000-0x00000000004C0000-memory.dmp

memory/1688-14828-0x0000000000400000-0x00000000004C0000-memory.dmp

memory/1688-15884-0x0000000000400000-0x00000000004C0000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-13 10:32

Reported

2024-05-13 10:35

Platform

win10v2004-20240508-en

Max time kernel

150s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b2c1b7deb8895437ea28a79ae38fa2b0_NeikiAnalytics.exe"

Signatures

Modifies visibility of file extensions in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Windows\svhost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\svhost.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\n: C:\Windows\svhost.exe N/A
File opened (read-only) \??\p: C:\Windows\svhost.exe N/A
File opened (read-only) \??\s: C:\Windows\svhost.exe N/A
File opened (read-only) \??\t: C:\Windows\svhost.exe N/A
File opened (read-only) \??\b: C:\Windows\svhost.exe N/A
File opened (read-only) \??\h: C:\Windows\svhost.exe N/A
File opened (read-only) \??\k: C:\Windows\svhost.exe N/A
File opened (read-only) \??\q: C:\Windows\svhost.exe N/A
File opened (read-only) \??\u: C:\Windows\svhost.exe N/A
File opened (read-only) \??\v: C:\Windows\svhost.exe N/A
File opened (read-only) \??\w: C:\Windows\svhost.exe N/A
File opened (read-only) \??\x: C:\Windows\svhost.exe N/A
File opened (read-only) \??\i: C:\Windows\svhost.exe N/A
File opened (read-only) \??\j: C:\Windows\svhost.exe N/A
File opened (read-only) \??\o: C:\Windows\svhost.exe N/A
File opened (read-only) \??\a: C:\Windows\svhost.exe N/A
File opened (read-only) \??\y: C:\Windows\svhost.exe N/A
File opened (read-only) \??\m: C:\Windows\svhost.exe N/A
File opened (read-only) \??\r: C:\Windows\svhost.exe N/A
File opened (read-only) \??\z: C:\Windows\svhost.exe N/A
File opened (read-only) \??\e: C:\Windows\svhost.exe N/A
File opened (read-only) \??\g: C:\Windows\svhost.exe N/A
File opened (read-only) \??\l: C:\Windows\svhost.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\svhost.exe C:\Users\Admin\AppData\Local\Temp\b2c1b7deb8895437ea28a79ae38fa2b0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Driver.db C:\Windows\svhost.exe N/A

Enumerates physical storage devices

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\svhost.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\b2c1b7deb8895437ea28a79ae38fa2b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b2c1b7deb8895437ea28a79ae38fa2b0_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b2c1b7deb8895437ea28a79ae38fa2b0_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b2c1b7deb8895437ea28a79ae38fa2b0_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b2c1b7deb8895437ea28a79ae38fa2b0_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b2c1b7deb8895437ea28a79ae38fa2b0_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b2c1b7deb8895437ea28a79ae38fa2b0_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b2c1b7deb8895437ea28a79ae38fa2b0_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b2c1b7deb8895437ea28a79ae38fa2b0_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b2c1b7deb8895437ea28a79ae38fa2b0_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b2c1b7deb8895437ea28a79ae38fa2b0_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b2c1b7deb8895437ea28a79ae38fa2b0_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\b2c1b7deb8895437ea28a79ae38fa2b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b2c1b7deb8895437ea28a79ae38fa2b0_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b2c1b7deb8895437ea28a79ae38fa2b0_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b2c1b7deb8895437ea28a79ae38fa2b0_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b2c1b7deb8895437ea28a79ae38fa2b0_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b2c1b7deb8895437ea28a79ae38fa2b0_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b2c1b7deb8895437ea28a79ae38fa2b0_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b2c1b7deb8895437ea28a79ae38fa2b0_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b2c1b7deb8895437ea28a79ae38fa2b0_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b2c1b7deb8895437ea28a79ae38fa2b0_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b2c1b7deb8895437ea28a79ae38fa2b0_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b2c1b7deb8895437ea28a79ae38fa2b0_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A
N/A N/A C:\Windows\svhost.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\b2c1b7deb8895437ea28a79ae38fa2b0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\b2c1b7deb8895437ea28a79ae38fa2b0_NeikiAnalytics.exe"

C:\Windows\svhost.exe

C:\Windows\svhost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
NL 23.62.61.75:443 www.bing.com tcp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 75.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 4.173.189.20.in-addr.arpa udp

Files

memory/2840-0-0x0000000000400000-0x00000000004C0000-memory.dmp

C:\Windows\svhost.exe

MD5 a5d3e0cb224c423c620ab45971816e81
SHA1 6edd788f20338632fdbf4fbab6f70e4a09e67c15
SHA256 b9bc665344bc9d421cad844dd969dfb93e03a6ad17a177b4f0dc2014e426bc37
SHA512 f3a861e1f05ddee21f28c28f51dac30800eb4e226066cb05edb9dfd881259da563151643d2ef5d697e7b0c09a447d3005bc2cfcc5846e6f8b6ac654f422fb893

C:\Windows\Driver.db

MD5 c2d2dc50dca8a2bfdc8e2d59dfa5796d
SHA1 7a6150fc53244e28d1bcea437c0c9d276c41ccad
SHA256 b2d38b3f122cfcf3cecabf0dfe2ab9c4182416d6961ae43f1eebee489cf3c960
SHA512 6cfdd08729de9ee9d1f5d8fcd859144d32ddc0a9e7074202a7d03d3795bdf0027a074a6aa54f451d4166024c134b27c55c7142170e64d979d86c13801f937ce4

C:\PerfLogs.exe

MD5 e980d9fbcd6f7bf04f2094850a5895b2
SHA1 7e79d67864b6e75a84e82f30796daebc0a9d3711
SHA256 3272e160e8191ba50944b6ff118a98630984d36150261b48db85c437e9afbb3b
SHA512 2d71b5edc753be8a2944abbccb9cefd24dee7da2e8f2af1d9a11e901e5fe6500881ffbee439298fc2cfc5fa0f637be813e3af3006a2b514255a3f3ef78791962

memory/2840-776-0x0000000000400000-0x00000000004C0000-memory.dmp

memory/904-1313-0x0000000000400000-0x00000000004C0000-memory.dmp

memory/904-2372-0x0000000000400000-0x00000000004C0000-memory.dmp

memory/904-2639-0x0000000000400000-0x00000000004C0000-memory.dmp

memory/904-3431-0x0000000000400000-0x00000000004C0000-memory.dmp

memory/904-4752-0x0000000000400000-0x00000000004C0000-memory.dmp

memory/904-5809-0x0000000000400000-0x00000000004C0000-memory.dmp

memory/904-6871-0x0000000000400000-0x00000000004C0000-memory.dmp

memory/904-7927-0x0000000000400000-0x00000000004C0000-memory.dmp

memory/904-9247-0x0000000000400000-0x00000000004C0000-memory.dmp

memory/904-10304-0x0000000000400000-0x00000000004C0000-memory.dmp

memory/904-11361-0x0000000000400000-0x00000000004C0000-memory.dmp

memory/904-12418-0x0000000000400000-0x00000000004C0000-memory.dmp

memory/904-13740-0x0000000000400000-0x00000000004C0000-memory.dmp

memory/904-14799-0x0000000000400000-0x00000000004C0000-memory.dmp

memory/904-15857-0x0000000000400000-0x00000000004C0000-memory.dmp