96eb89fde28bc952b958b732035be34ac02ef25fd758f5cb73bdbaeadf5fffb3

Analysis

max time kernel
139s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 01:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

57710ebdcafe4e89fe8762078c1fb120_NeikiAnalytics.exe
Size

245KB
MD5

57710ebdcafe4e89fe8762078c1fb120
SHA1

4bbfd85d7bd4ea6c6626f8dcafb788793bfd261c
SHA256

96eb89fde28bc952b958b732035be34ac02ef25fd758f5cb73bdbaeadf5fffb3
SHA512

5c85045c2c05d3f2a6bd3aa3240c51efe495df5cb3f8e8da64dd8f74b196c7e251cb263dfc15e391a6ad1a1c951958aac4d0b30c6c71efda2cd1113e7a8aafcf
SSDEEP

6144:9hbZ5hMTNFf8LAurlEzAX7o5hn8wVSZ2sX6AX:vtXMzqrllX7618wGX

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 26 IoCs

pid	Process
2936	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202.exe
2668	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202a.exe
2592	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202b.exe
2796	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202c.exe
2472	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202d.exe
1204	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202e.exe
2712	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202f.exe
1824	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202g.exe
2016	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202h.exe
1832	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202i.exe
816	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202j.exe
1604	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202k.exe
2052	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202l.exe
2844	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202m.exe
1032	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202n.exe
2152	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202o.exe
1400	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202p.exe
2264	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202q.exe
1600	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202r.exe
940	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202s.exe
1232	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202t.exe
2184	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202u.exe
604	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202v.exe
840	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202w.exe
824	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202x.exe
2968	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202y.exe

Loads dropped DLL 52 IoCs

pid	Process
2876	57710ebdcafe4e89fe8762078c1fb120_NeikiAnalytics.exe
2876	57710ebdcafe4e89fe8762078c1fb120_NeikiAnalytics.exe
2936	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202.exe
2936	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202.exe
2668	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202a.exe
2668	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202a.exe
2592	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202b.exe
2592	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202b.exe
2796	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202c.exe
2796	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202c.exe
2472	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202d.exe
2472	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202d.exe
1204	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202e.exe
1204	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202e.exe
2712	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202f.exe
2712	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202f.exe
1824	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202g.exe
1824	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202g.exe
2016	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202h.exe
2016	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202h.exe
1832	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202i.exe
1832	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202i.exe
816	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202j.exe
816	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202j.exe
1604	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202k.exe
1604	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202k.exe
2052	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202l.exe
2052	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202l.exe
2844	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202m.exe
2844	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202m.exe
1032	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202n.exe
1032	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202n.exe
2152	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202o.exe
2152	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202o.exe
1400	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202p.exe
1400	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202p.exe
2264	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202q.exe
2264	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202q.exe
1600	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202r.exe
1600	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202r.exe
940	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202s.exe
940	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202s.exe
1232	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202t.exe
1232	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202t.exe
2184	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202u.exe
2184	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202u.exe
604	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202v.exe
604	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202v.exe
840	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202w.exe
840	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202w.exe
824	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202x.exe
824	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202x.exe

Adds Run key to start application 2 TTPs 26 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Modifies registry class 54 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202m.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202r.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 8681731f3c8fba95	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202d.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202g.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 8681731f3c8fba95	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202l.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 8681731f3c8fba95	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202r.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202y.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202a.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202i.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 8681731f3c8fba95	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202o.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 8681731f3c8fba95	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202s.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202n.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202q.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 8681731f3c8fba95	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202w.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202k.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 8681731f3c8fba95	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202a.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202d.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202h.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 8681731f3c8fba95	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202j.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 8681731f3c8fba95	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202y.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202b.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 8681731f3c8fba95	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202b.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202p.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202w.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 8681731f3c8fba95	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202c.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 8681731f3c8fba95	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202v.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 8681731f3c8fba95	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202k.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202l.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202t.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 8681731f3c8fba95	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202e.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202j.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202u.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 8681731f3c8fba95	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202u.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 8681731f3c8fba95	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202x.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 8681731f3c8fba95	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202h.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	57710ebdcafe4e89fe8762078c1fb120_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202f.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 8681731f3c8fba95	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202g.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 8681731f3c8fba95	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202m.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202s.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202v.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 8681731f3c8fba95	57710ebdcafe4e89fe8762078c1fb120_NeikiAnalytics.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 8681731f3c8fba95	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202t.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202x.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 8681731f3c8fba95	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202f.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 8681731f3c8fba95	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202e.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 8681731f3c8fba95	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202i.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 8681731f3c8fba95	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202n.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202o.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 8681731f3c8fba95	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202p.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 8681731f3c8fba95	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202q.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202c.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 2936	2876	57710ebdcafe4e89fe8762078c1fb120_NeikiAnalytics.exe	28
PID 2876 wrote to memory of 2936	2876	57710ebdcafe4e89fe8762078c1fb120_NeikiAnalytics.exe	28
PID 2876 wrote to memory of 2936	2876	57710ebdcafe4e89fe8762078c1fb120_NeikiAnalytics.exe	28
PID 2876 wrote to memory of 2936	2876	57710ebdcafe4e89fe8762078c1fb120_NeikiAnalytics.exe	28
PID 2936 wrote to memory of 2668	2936	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202.exe	29
PID 2936 wrote to memory of 2668	2936	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202.exe	29
PID 2936 wrote to memory of 2668	2936	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202.exe	29
PID 2936 wrote to memory of 2668	2936	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202.exe	29
PID 2668 wrote to memory of 2592	2668	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202a.exe	30
PID 2668 wrote to memory of 2592	2668	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202a.exe	30
PID 2668 wrote to memory of 2592	2668	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202a.exe	30
PID 2668 wrote to memory of 2592	2668	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202a.exe	30
PID 2592 wrote to memory of 2796	2592	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202b.exe	31
PID 2592 wrote to memory of 2796	2592	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202b.exe	31
PID 2592 wrote to memory of 2796	2592	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202b.exe	31
PID 2592 wrote to memory of 2796	2592	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202b.exe	31
PID 2796 wrote to memory of 2472	2796	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202c.exe	32
PID 2796 wrote to memory of 2472	2796	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202c.exe	32
PID 2796 wrote to memory of 2472	2796	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202c.exe	32
PID 2796 wrote to memory of 2472	2796	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202c.exe	32
PID 2472 wrote to memory of 1204	2472	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202d.exe	33
PID 2472 wrote to memory of 1204	2472	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202d.exe	33
PID 2472 wrote to memory of 1204	2472	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202d.exe	33
PID 2472 wrote to memory of 1204	2472	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202d.exe	33
PID 1204 wrote to memory of 2712	1204	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202e.exe	34
PID 1204 wrote to memory of 2712	1204	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202e.exe	34
PID 1204 wrote to memory of 2712	1204	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202e.exe	34
PID 1204 wrote to memory of 2712	1204	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202e.exe	34
PID 2712 wrote to memory of 1824	2712	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202f.exe	35
PID 2712 wrote to memory of 1824	2712	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202f.exe	35
PID 2712 wrote to memory of 1824	2712	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202f.exe	35
PID 2712 wrote to memory of 1824	2712	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202f.exe	35
PID 1824 wrote to memory of 2016	1824	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202g.exe	36
PID 1824 wrote to memory of 2016	1824	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202g.exe	36
PID 1824 wrote to memory of 2016	1824	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202g.exe	36
PID 1824 wrote to memory of 2016	1824	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202g.exe	36
PID 2016 wrote to memory of 1832	2016	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202h.exe	37
PID 2016 wrote to memory of 1832	2016	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202h.exe	37
PID 2016 wrote to memory of 1832	2016	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202h.exe	37
PID 2016 wrote to memory of 1832	2016	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202h.exe	37
PID 1832 wrote to memory of 816	1832	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202i.exe	38
PID 1832 wrote to memory of 816	1832	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202i.exe	38
PID 1832 wrote to memory of 816	1832	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202i.exe	38
PID 1832 wrote to memory of 816	1832	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202i.exe	38
PID 816 wrote to memory of 1604	816	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202j.exe	39
PID 816 wrote to memory of 1604	816	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202j.exe	39
PID 816 wrote to memory of 1604	816	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202j.exe	39
PID 816 wrote to memory of 1604	816	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202j.exe	39
PID 1604 wrote to memory of 2052	1604	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202k.exe	40
PID 1604 wrote to memory of 2052	1604	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202k.exe	40
PID 1604 wrote to memory of 2052	1604	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202k.exe	40
PID 1604 wrote to memory of 2052	1604	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202k.exe	40
PID 2052 wrote to memory of 2844	2052	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202l.exe	41
PID 2052 wrote to memory of 2844	2052	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202l.exe	41
PID 2052 wrote to memory of 2844	2052	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202l.exe	41
PID 2052 wrote to memory of 2844	2052	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202l.exe	41
PID 2844 wrote to memory of 1032	2844	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202m.exe	42
PID 2844 wrote to memory of 1032	2844	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202m.exe	42
PID 2844 wrote to memory of 1032	2844	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202m.exe	42
PID 2844 wrote to memory of 1032	2844	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202m.exe	42
PID 1032 wrote to memory of 2152	1032	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202n.exe	43
PID 1032 wrote to memory of 2152	1032	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202n.exe	43
PID 1032 wrote to memory of 2152	1032	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202n.exe	43
PID 1032 wrote to memory of 2152	1032	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202n.exe	43

C:\Users\Admin\AppData\Local\Temp\57710ebdcafe4e89fe8762078c1fb120_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\57710ebdcafe4e89fe8762078c1fb120_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2876
- \??\c:\users\admin\appdata\local\temp\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202.exe
  c:\users\admin\appdata\local\temp\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2936
- - \??\c:\users\admin\appdata\local\temp\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202a.exe
    c:\users\admin\appdata\local\temp\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202a.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2668
  - - \??\c:\users\admin\appdata\local\temp\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202b.exe
      c:\users\admin\appdata\local\temp\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202b.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2592
    - - \??\c:\users\admin\appdata\local\temp\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202c.exe
        
        c:\users\admin\appdata\local\temp\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202c.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2796
      - \??\c:\users\admin\appdata\local\temp\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202d.exe
        
        c:\users\admin\appdata\local\temp\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202d.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2472
        
        \??\c:\users\admin\appdata\local\temp\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202e.exe
        
        c:\users\admin\appdata\local\temp\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202e.exe
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1204
        
        \??\c:\users\admin\appdata\local\temp\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202f.exe
        
        c:\users\admin\appdata\local\temp\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202f.exe
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2712
        
        \??\c:\users\admin\appdata\local\temp\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202g.exe
        
        c:\users\admin\appdata\local\temp\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202g.exe
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1824
        
        \??\c:\users\admin\appdata\local\temp\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202h.exe
        
        c:\users\admin\appdata\local\temp\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202h.exe
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2016
        
        \??\c:\users\admin\appdata\local\temp\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202i.exe
        
        c:\users\admin\appdata\local\temp\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202i.exe
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1832
        
        \??\c:\users\admin\appdata\local\temp\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202j.exe
        
        c:\users\admin\appdata\local\temp\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202j.exe
        12⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:816
        
        \??\c:\users\admin\appdata\local\temp\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202k.exe
        
        c:\users\admin\appdata\local\temp\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202k.exe
        13⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1604
        
        \??\c:\users\admin\appdata\local\temp\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202l.exe
        
        c:\users\admin\appdata\local\temp\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202l.exe
        14⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2052
        
        \??\c:\users\admin\appdata\local\temp\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202m.exe
        
        c:\users\admin\appdata\local\temp\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202m.exe
        15⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2844
        
        \??\c:\users\admin\appdata\local\temp\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202n.exe
        
        c:\users\admin\appdata\local\temp\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202n.exe
        16⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1032
        
        \??\c:\users\admin\appdata\local\temp\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202o.exe
        
        c:\users\admin\appdata\local\temp\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202o.exe
        17⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Modifies registry class
        
        PID:2152
        
        \??\c:\users\admin\appdata\local\temp\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202p.exe
        
        c:\users\admin\appdata\local\temp\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202p.exe
        18⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Modifies registry class
        
        PID:1400
        
        \??\c:\users\admin\appdata\local\temp\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202q.exe
        
        c:\users\admin\appdata\local\temp\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202q.exe
        19⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Modifies registry class
        
        PID:2264
        
        \??\c:\users\admin\appdata\local\temp\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202r.exe
        
        c:\users\admin\appdata\local\temp\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202r.exe
        20⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Modifies registry class
        
        PID:1600
        
        \??\c:\users\admin\appdata\local\temp\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202s.exe
        
        c:\users\admin\appdata\local\temp\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202s.exe
        21⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Modifies registry class
        
        PID:940
        
        \??\c:\users\admin\appdata\local\temp\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202t.exe
        
        c:\users\admin\appdata\local\temp\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202t.exe
        22⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Modifies registry class
        
        PID:1232
        
        \??\c:\users\admin\appdata\local\temp\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202u.exe
        
        c:\users\admin\appdata\local\temp\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202u.exe
        23⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Modifies registry class
        
        PID:2184
        
        \??\c:\users\admin\appdata\local\temp\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202v.exe
        
        c:\users\admin\appdata\local\temp\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202v.exe
        24⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Modifies registry class
        
        PID:604
        
        \??\c:\users\admin\appdata\local\temp\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202w.exe
        
        c:\users\admin\appdata\local\temp\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202w.exe
        25⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Modifies registry class
        
        PID:840
        
        \??\c:\users\admin\appdata\local\temp\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202x.exe
        
        c:\users\admin\appdata\local\temp\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202x.exe
        26⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Modifies registry class
        
        PID:824
        
        \??\c:\users\admin\appdata\local\temp\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202y.exe
        
        c:\users\admin\appdata\local\temp\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202y.exe
        27⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202.exe

Filesize
245KB

MD5
943017ed75d4d48cc5bf695067ccecfa

SHA1
bde18da1159afcb1e03ff75526625cd36eb16adb

SHA256
f2aeb27766a84237b19a5539be56e651b2894b3fd8fb758d5d4f60201dd99b5b

SHA512
29a685d0ecf677fab9844bfc248fa5624b2a0101d977d5a77821681e9484b6850c1a36fc157ab7f834035eb1176f71d7a8f0a8e449c250daab580d461ccaa1ea

Download Submit
\Users\Admin\AppData\Local\Temp\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202m.exe

Filesize
245KB

MD5
7ed752d3d38fbef2657d5c695bfdf427

SHA1
2d14c3df7ad54608609a031435e3ed6509ae6527

SHA256
8c12ad8e47ab3953f3fbba21bc818887d7ae867fbceaa7996362729f0ce87008

SHA512
d64c25e53550aff75dd354eb30fd1a18eea9f3fdbf6cb7c4b6806098829c2ddbd7fb8f3d0f96c99a30e14bdce667c7556b75da5b54282de537801bc65b4fad8b

Download Submit
memory/604-320-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/604-326-0x0000000000260000-0x000000000029B000-memory.dmp

Filesize
236KB

Download
memory/604-330-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/816-182-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/824-342-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/824-352-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/840-341-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/840-331-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/940-295-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/1032-229-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/1032-243-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/1204-106-0x0000000000360000-0x000000000039B000-memory.dmp

Filesize
236KB

Download
memory/1204-93-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/1204-107-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/1232-308-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/1232-306-0x0000000000310000-0x000000000034B000-memory.dmp

Filesize
236KB

Download
memory/1232-307-0x0000000000310000-0x000000000034B000-memory.dmp

Filesize
236KB

Download
memory/1232-296-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/1400-264-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/1600-285-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/1604-197-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/1824-137-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/1832-166-0x0000000000370000-0x00000000003AB000-memory.dmp

Filesize
236KB

Download
memory/1832-153-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/1832-167-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/1832-168-0x0000000000370000-0x00000000003AB000-memory.dmp

Filesize
236KB

Download
memory/1832-354-0x0000000000370000-0x00000000003AB000-memory.dmp

Filesize
236KB

Download
memory/2016-152-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/2016-138-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/2052-199-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/2052-212-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/2052-207-0x0000000000260000-0x000000000029B000-memory.dmp

Filesize
236KB

Download
memory/2152-254-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/2184-318-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/2264-275-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/2264-274-0x0000000000270000-0x00000000002AB000-memory.dmp

Filesize
236KB

Download
memory/2472-78-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/2472-91-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/2592-45-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/2592-54-0x00000000002F0000-0x000000000032B000-memory.dmp

Filesize
236KB

Download
memory/2592-59-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/2668-44-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/2668-30-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/2712-109-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/2712-123-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/2796-75-0x00000000003A0000-0x00000000003DB000-memory.dmp

Filesize
236KB

Download
memory/2796-61-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/2796-74-0x00000000003A0000-0x00000000003DB000-memory.dmp

Filesize
236KB

Download
memory/2796-77-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/2844-214-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/2844-228-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/2876-0-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/2876-13-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/2876-8-0x0000000000290000-0x00000000002CB000-memory.dmp

Filesize
236KB

Download
memory/2936-29-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/2936-15-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/2968-353-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202c.exe\""	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202g.exe\""	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202x.exe\""	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202w.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202y.exe\""	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202x.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202h.exe\""	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202g.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202m.exe\""	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202l.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202n.exe\""	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202m.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202l.exe\""	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202k.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202.exe\""	57710ebdcafe4e89fe8762078c1fb120_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202d.exe\""	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202i.exe\""	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202h.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202j.exe\""	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202i.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202q.exe\""	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202p.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202r.exe\""	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202q.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202s.exe\""	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202r.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202v.exe\""	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202u.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202a.exe\""	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202b.exe\""	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202e.exe\""	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202o.exe\""	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202n.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202p.exe\""	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202o.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202f.exe\""	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202k.exe\""	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202j.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202t.exe\""	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202s.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202u.exe\""	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202t.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202w.exe\""	57710ebdcafe4e89fe8762078c1fb120_neikianalytics_3202v.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads