Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
126s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
16/05/2024, 16:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e4fb63eb565865feed9d651317a7a360_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
7 signatures
150 seconds
General
-
Target
e4fb63eb565865feed9d651317a7a360_NeikiAnalytics.exe
-
Size
407KB
-
MD5
e4fb63eb565865feed9d651317a7a360
-
SHA1
3efc8e6e02508f402760ef1451ba8c35c6d6a383
-
SHA256
d912e7bb383e2548966fb0d2bd92df343616a0ed6cd049c1fe15bcb7d9f7d1f4
-
SHA512
44e2e82488f4fb866b6086ce3d8cc6c619950c0b0b5d7c95bd7bd59e2c6c56bc13fd2fb37efcfaeb6f5b4250a199eaa547f96d1b6a7f2c6605b4fef5b22636a0
-
SSDEEP
6144:KjEOrM9BMHmD1tYFLqY/W5R02qO7VKCX7F0Ko/HlEmWSMIqGNoYcpOLy:kI9+aYFLq3nX73QFEmzMoNVcELy
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1336 6E4.tmp -
Loads dropped DLL 2 IoCs
pid Process 1044 e4fb63eb565865feed9d651317a7a360_NeikiAnalytics.exe 1044 e4fb63eb565865feed9d651317a7a360_NeikiAnalytics.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\msrepl40.dll 6E4.tmp File created C:\Windows\System32\DriverStore\FileRepository\nv_lh.inf_amd64_neutral_bc69f20e3115af59\nvwgf2um.dll 6E4.tmp File created C:\Windows\SysWOW64\InstallShield\setup.exe 6E4.tmp File created C:\Windows\SysWOW64\d3d8.dll 6E4.tmp File opened for modification C:\Windows\SysWOW64\mfc120.dll 6E4.tmp File created C:\Windows\SysWOW64\msjet40.dll 6E4.tmp File created C:\Windows\SysWOW64\dplayx.dll 6E4.tmp File created C:\Windows\SysWOW64\FXSXP32.dll 6E4.tmp File created C:\Windows\SysWOW64\mfc40u.dll 6E4.tmp File opened for modification C:\Windows\SysWOW64\mfc140.dll 6E4.tmp File created C:\Windows\SysWOW64\mswstr10.dll 6E4.tmp File opened for modification C:\Windows\SysWOW64\vccorlib120.dll 6E4.tmp File opened for modification C:\Windows\SysWOW64\vcomp140.dll 6E4.tmp File created C:\Windows\System32\DriverStore\FileRepository\igdlh.inf_amd64_neutral_54a12b57f547d08e\igd10umd32.dll 6E4.tmp File created C:\Windows\SysWOW64\dpwsockx.dll 6E4.tmp File created C:\Windows\SysWOW64\iac25_32.ax 6E4.tmp File opened for modification C:\Windows\SysWOW64\mfc100.dll 6E4.tmp File created C:\Windows\SysWOW64\msorcl32.dll 6E4.tmp File created C:\Windows\SysWOW64\msrd2x40.dll 6E4.tmp File created C:\Windows\SysWOW64\odbcjt32.dll 6E4.tmp File created C:\Windows\System32\DriverStore\FileRepository\atiilhag.inf_amd64_neutral_0a660e899f5038a2\atiumdag.dll 6E4.tmp File created C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-MediaPlayer\MediaPlayer-DLMigPlugin.dll 6E4.tmp File created C:\Windows\SysWOW64\explorer.exe 6E4.tmp File created C:\Windows\SysWOW64\ir41_32.ax 6E4.tmp File created C:\Windows\SysWOW64\ivfsrc.ax 6E4.tmp File created C:\Windows\SysWOW64\msltus40.dll 6E4.tmp File created C:\Windows\SysWOW64\msrd3x40.dll 6E4.tmp File opened for modification C:\Windows\SysWOW64\atl110.dll 6E4.tmp File created C:\Windows\SysWOW64\d3dim.dll 6E4.tmp File opened for modification C:\Windows\SysWOW64\mfc110u.dll 6E4.tmp File created C:\Windows\SysWOW64\InstallShield\_isdel.exe 6E4.tmp File created C:\Windows\SysWOW64\audiodev.dll 6E4.tmp File created C:\Windows\SysWOW64\expsrv.dll 6E4.tmp File created C:\Windows\SysWOW64\sqlunirl.dll 6E4.tmp File created C:\Windows\SysWOW64\msxbde40.dll 6E4.tmp File created C:\Windows\SysWOW64\d3dim700.dll 6E4.tmp File created C:\Windows\SysWOW64\ir50_32.dll 6E4.tmp File created C:\Windows\SysWOW64\mswdat10.dll 6E4.tmp File created C:\Windows\SysWOW64\mfc40.dll 6E4.tmp File created C:\Windows\SysWOW64\mstext40.dll 6E4.tmp File opened for modification C:\Windows\SysWOW64\mfc140u.dll 6E4.tmp File created C:\Windows\SysWOW64\msjter40.dll 6E4.tmp File created C:\Windows\SysWOW64\msjtes40.dll 6E4.tmp File opened for modification C:\Windows\SysWOW64\msvcr120.dll 6E4.tmp File created C:\Windows\SysWOW64\olecli32.dll 6E4.tmp File created C:\Windows\System32\DriverStore\FileRepository\nv_lh.inf_amd64_neutral_bc69f20e3115af59\nvd3dum.dll 6E4.tmp File created C:\Windows\SysWOW64\crtdll.dll 6E4.tmp File opened for modification C:\Windows\SysWOW64\mfc100u.dll 6E4.tmp File created C:\Windows\SysWOW64\msexcl40.dll 6E4.tmp File created C:\Windows\SysWOW64\dplaysvr.exe 6E4.tmp File created C:\Windows\SysWOW64\setupSNK.exe 6E4.tmp File created C:\Windows\SysWOW64\msexch40.dll 6E4.tmp File created C:\Windows\SysWOW64\mspbde40.dll 6E4.tmp File created C:\Windows\SysWOW64\rdvgumd32.dll 6E4.tmp File opened for modification C:\Windows\SysWOW64\VBAME.DLL 6E4.tmp File created C:\Windows\System32\DriverStore\FileRepository\atiilhag.inf_amd64_neutral_0a660e899f5038a2\atidxx32.dll 6E4.tmp File opened for modification C:\Windows\SysWOW64\concrt140.dll 6E4.tmp File created C:\Windows\SysWOW64\dmscript.dll 6E4.tmp File opened for modification C:\Windows\SysWOW64\mfc110.dll 6E4.tmp File created C:\Windows\System32\DriverStore\FileRepository\igdlh.inf_amd64_neutral_54a12b57f547d08e\igdumd32.dll 6E4.tmp File opened for modification C:\Windows\SysWOW64\atl100.dll 6E4.tmp File opened for modification C:\Windows\SysWOW64\msvcr110.dll 6E4.tmp File created C:\Windows\SysWOW64\sqlwoa.dll 6E4.tmp File created C:\Windows\System32\DriverStore\FileRepository\atiilhag.inf_amd64_neutral_0a660e899f5038a2\atiumdva.dll 6E4.tmp -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\DBGHELP.DLL 6E4.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TextConv\MSCONV97.DLL 6E4.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\MSB1STAR.DLL 6E4.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSStr32.dll 6E4.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\drvSOFT.x3d 6E4.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACERCLR.DLL 6E4.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEXBE.DLL 6E4.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL 6E4.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\MOFL.DLL 6E4.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CLVIEW.EXE 6E4.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OLMAPI32.DLL 6E4.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Wordcnv.dll 6E4.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEOLEDB.DLL 6E4.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\FBIBLIO.DLL 6E4.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GKExcel.dll 6E4.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE 6E4.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Library\Analysis\ANALYS32.XLL 6E4.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE 6E4.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\EXSEC32.DLL 6E4.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\RTFHTML.DLL 6E4.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SELFCERT.EXE 6E4.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\OLTASK.FAE 6E4.tmp File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 6E4.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Csi.dll 6E4.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe 6E4.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOCFUIUTILITIESDLL.DLL 6E4.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\STSCOPY.DLL 6E4.tmp File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\xmlrw.dll 6E4.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSTORE.EXE 6E4.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PTXT9.DLL 6E4.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\DELIMWIN.FAE 6E4.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\IA32.api 6E4.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DW\DWTRIG20.EXE 6E4.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACCDDS.DLL 6E4.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\IPEDITOR.DLL 6E4.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PROOF\1033\MSGR3EN.DLL 6E4.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OUTLACCT.DLL 6E4.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\MSVCR71.DLL 6E4.tmp File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\ahclient.dll 6E4.tmp File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\logsession.dll 6E4.tmp File created C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.dll 6E4.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXEV.DLL 6E4.tmp File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\msolui100.dll 6E4.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\EMSMDB32.DLL 6E4.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\excelcnvpxy.dll 6E4.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SCNPST32.DLL 6E4.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\ReadOutLoud.api 6E4.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\ODeploy.exe 6E4.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\IETAG.DLL 6E4.tmp File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\msmdlocal.dll 6E4.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\DLGSETP.DLL 6E4.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Search.api 6E4.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\ADMPlugin.apl 6E4.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEODBC.DLL 6E4.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\ColleagueImport.dll 6E4.tmp File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe 6E4.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\sqlite.dll 6E4.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\QuickTime.mpp 6E4.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\mset7.dll 6E4.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE 6E4.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SCANPST.EXE 6E4.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\OUTLVBA.DLL 6E4.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\DESKSAM.SAM 6E4.tmp File opened for modification C:\Program Files (x86)\Common Files\DESIGNER\MSADDNDR.DLL 6E4.tmp -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\winsxs\x86_microsoft-windows-mfc40_31bf3856ad364e35_6.1.7601.17514_none_5c06580240091047\mfc40.dll 6E4.tmp File created C:\Windows\winsxs\x86_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7600.16385_none_0935b76c289e0fd5\locdrv.dll 6E4.tmp File created C:\Windows\winsxs\x86_microsoft-windows-w..ion-twaincomponents_31bf3856ad364e35_6.1.7601.17514_none_8b399e33ba72bed9\twunk_32.exe 6E4.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-ie-offlinefavorites_31bf3856ad364e35_8.0.7601.17514_none_e460d9f113bbd54e\webcheck.dll 6E4.tmp File created C:\Windows\winsxs\x86_microsoft-windows-directx-directdraw_31bf3856ad364e35_6.1.7600.16385_none_04dbf9102154d42e\ddrawex.dll 6E4.tmp File created C:\Windows\winsxs\x86_microsoft-windows-international-core_31bf3856ad364e35_6.1.7601.17514_none_ebb1ce7438031941\MuiUnattend.exe 6E4.tmp File created C:\Windows\winsxs\x86_microsoft-windows-m..s-components-jetvba_31bf3856ad364e35_6.1.7600.16385_none_7568a7acf374dfed\expsrv.dll 6E4.tmp File created C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-wmpsrcwp_31bf3856ad364e35_6.1.7601.17514_none_128e8361a0855574\wmpsrcwp.dll 6E4.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll 6E4.tmp File created C:\Windows\winsxs\x86_microsoft-windows-m..drivermanager-trace_31bf3856ad364e35_6.1.7601.17514_none_817af6649fbc1ed4\odbctrac.dll 6E4.tmp File created C:\Windows\winsxs\x86_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.4148_none_51ca66a2bbe76806\ATL90.dll 6E4.tmp File created C:\Windows\winsxs\x86_netfx-_vc_assembly_linker_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_0d584c7aa833ba19\alink.dll 6E4.tmp File created C:\Windows\winsxs\x86_microsoft-windows-displayswitch_31bf3856ad364e35_6.1.7600.16385_none_ec98071c85cf09eb\DisplaySwitch.exe 6E4.tmp File created C:\Windows\winsxs\x86_microsoft-windows-eventlog-commandline_31bf3856ad364e35_6.1.7600.16385_none_c0aa8bc2de239cf9\wevtutil.exe 6E4.tmp File created C:\Windows\winsxs\x86_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7601.17514_none_0b66cb34258c936f\wcp.dll 6E4.tmp File created C:\Windows\winsxs\x86_netfx35cdf-csd_cdf_installer_31bf3856ad364e35_6.1.7600.16385_none_58326e688d4907c6\WFServicesReg.exe 6E4.tmp File created C:\Windows\winsxs\Backup\x86_microsoft-windows-x..rtificateenrollment_31bf3856ad364e35_6.1.7601.17514_none_f59e20ddece8f922_certenrollctrl.exe_9495aa75 6E4.tmp File created C:\Windows\winsxs\x86_microsoft-windows-e..estorageengine-isam_31bf3856ad364e35_6.1.7601.17514_none_f3ebb0cc8a4dd814\esent.dll 6E4.tmp File created C:\Windows\winsxs\x86_microsoft-windows-video-for-windows_31bf3856ad364e35_6.1.7601.17514_none_94395a96e7042cf4\msvfw32.dll 6E4.tmp File created C:\Windows\winsxs\x86_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_6.1.7601.17514_none_ef38a8d0d05cc2c7\IMJPDADM.EXE 6E4.tmp File created C:\Windows\winsxs\x86_microsoft-windows-errorreportingfaults_31bf3856ad364e35_6.1.7601.17514_none_720e868d9b0b6a44\WerFaultSecure.exe 6E4.tmp File created C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-upgrade_31bf3856ad364e35_6.1.7600.16385_none_54780cc7e444c076\WsUpgrade.dll 6E4.tmp File created C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll 6E4.tmp File created C:\Windows\winsxs\x86_microsoft-windows-sxs_31bf3856ad364e35_6.1.7601.17514_none_b0540607b5e5d445\SxsMigPlugin.dll 6E4.tmp File created C:\Windows\winsxs\x86_microsoft-windows-wmadmoe_31bf3856ad364e35_6.1.7600.16385_none_8696c88e7f02ab7b\WMADMOE.DLL 6E4.tmp File created C:\Windows\winsxs\x86_wpf-presentationhostproxy_31bf3856ad364e35_6.2.7601.17514_none_f4c14ddc76dc8f97\PresentationHostProxy.dll 6E4.tmp File created C:\Windows\winsxs\x86_netfx-perfcounter_dll_b03f5f7f11d50a3a_6.1.7600.16385_none_fe5e474bbbf4bf39\PerfCounter.dll 6E4.tmp File created C:\Windows\Installer\$PatchCache$\Managed\E8EBCC90469BFE03EA485673BA14799F\4.7.3062\system_data_dll_gac_x86 6E4.tmp File created C:\Windows\winsxs\x86_microsoft-windows-t..framework-migration_31bf3856ad364e35_6.1.7600.16385_none_f0c791fc196de3b5\msctfmig.dll 6E4.tmp File created C:\Windows\winsxs\x86_microsoft-windows-wmvdecod_31bf3856ad364e35_6.1.7601.17514_none_c491ee3d3e923b78\WMVDECOD.DLL 6E4.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscordbi.dll 6E4.tmp File created C:\Windows\winsxs\Backup\x86_microsoft-windows-shlwapi_31bf3856ad364e35_6.1.7601.17514_none_fbe11bf002f10455_shlwapi.dll_1eec0a2e 6E4.tmp File created C:\Windows\winsxs\x86_microsoft-windows-font-embedding_31bf3856ad364e35_6.1.7601.17514_none_b7c78d327d35e10e\t2embed.dll 6E4.tmp File created C:\Windows\winsxs\x86_microsoft-windows-ie-iexpress_31bf3856ad364e35_11.2.9600.16428_none_eab4546b9b62b250\wextract.exe 6E4.tmp File created C:\Windows\winsxs\x86_microsoft-windows-m..-downlevelmanifests_31bf3856ad364e35_6.1.7601.17514_none_04801f69e1dbd8e6\MediaPlayer-DLMigPlugin.dll 6E4.tmp File created C:\Windows\winsxs\x86_microsoft-windows-cmi_31bf3856ad364e35_6.1.7601.17514_none_abd5b433b8ccf7a4\cmiv2.dll 6E4.tmp File created C:\Windows\winsxs\x86_microsoft-windows-wpd-shellextension_31bf3856ad364e35_6.1.7601.17514_none_13305696250bcb70\wpdshext.dll 6E4.tmp File created C:\Windows\winsxs\Temp\PendingDeletes\$$DeleteMe.wininet.dll.01da925a30521a90.000a 6E4.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-scripting-jscript9_31bf3856ad364e35_11.2.9600.16428_none_30d54a1007206a57\jscript9.dll 6E4.tmp File created C:\Windows\winsxs\Backup\wow64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_6.1.7601.17514_none_3eceef6140ec9728_puiobj.dll_343adf45 6E4.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_6.1.7601.17514_none_c79aef32ab85d92b\cmmon32.exe 6E4.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-wmi-management-snapins_31bf3856ad364e35_6.1.7600.16385_none_022f79b2090484a2\wbemcntl.dll 6E4.tmp File created C:\Windows\winsxs\x86_microsoft-windows-indeo4-codecs_31bf3856ad364e35_6.1.7600.16385_none_3ba474acb8a82ef6\ir41_32.ax 6E4.tmp File created C:\Windows\winsxs\Backup\x86_microsoft-windows-crypt32-dll_31bf3856ad364e35_6.1.7601.17514_none_5d772bc73c15dfe5_crypt32.dll_9c3ccf73 6E4.tmp File created C:\Windows\winsxs\x86_microsoft-windows-directx-direct3d10_31bf3856ad364e35_7.1.7601.16492_none_e2d7e0bdb71755ad\d3d10.dll 6E4.tmp File created C:\Windows\winsxs\x86_microsoft-windows-wimgapi_31bf3856ad364e35_6.1.7601.17514_none_8b030c557320a2c1\wimserv.exe 6E4.tmp File created C:\Windows\winsxs\x86_microsoft-windows-wmvencod_31bf3856ad364e35_6.1.7600.16385_none_efd4b2035f8b7c3c\WMVENCOD.DLL 6E4.tmp File created C:\Windows\Installer\$PatchCache$\Managed\E8EBCC90469BFE03EA485673BA14799F\4.7.3062\PresentationHostDLL_X86.dll 6E4.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Data.dll 6E4.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-r..sistance-dcomserver_31bf3856ad364e35_6.1.7600.16385_none_963d3becc3a475f1\raserver.exe 6E4.tmp File created C:\Windows\winsxs\x86_microsoft-windows-mobsyncexe_31bf3856ad364e35_6.1.7601.17514_none_f1584379b2973708\mobsync.exe 6E4.tmp File created C:\Windows\winsxs\Backup\wow64_microsoft-windows-security-schannel_31bf3856ad364e35_6.1.7601.17514_none_8a90facfa04322fd_schannel.dll_7364eaa8 6E4.tmp File created C:\Windows\winsxs\x86_microsoft-windows-display_31bf3856ad364e35_6.1.7601.17514_none_5a4fc71440f6b083\Display.dll 6E4.tmp File created C:\Windows\winsxs\x86_microsoft-windows-healthcenter_31bf3856ad364e35_6.1.7601.17514_none_ad648c1ec21694b8\ActionCenter.dll 6E4.tmp File created C:\Windows\winsxs\x86_microsoft-windows-secinit_31bf3856ad364e35_6.1.7600.16385_none_878e469b2e51ce80\secinit.exe 6E4.tmp File created C:\Windows\winsxs\Backup\wow64_microsoft-windows-rasbase_31bf3856ad364e35_6.1.7601.17514_none_765b17a2c56f9155_rasmxs.dll_0c54a828 6E4.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-directshow-core_31bf3856ad364e35_6.1.7601.17514_none_0eeae7a238e677c8\quartz.dll 6E4.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-mlang_31bf3856ad364e35_6.1.7600.16385_none_bd28e772321016e1\mlang.dll 6E4.tmp File created C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_8.0.7601.17514_none_1eaaa4a07717236e\jsproxy.dll 6E4.tmp File created C:\Windows\winsxs\x86_microsoft-windows-mpg4decd_31bf3856ad364e35_6.1.7600.16385_none_607be46cc35d6611\MPG4DECD.DLL 6E4.tmp File created C:\Windows\winsxs\x86_microsoft-windows-rastls_31bf3856ad364e35_6.1.7601.17514_none_6e6c95d9ae65f958\rastls.dll 6E4.tmp File created C:\Windows\winsxs\Backup\x86_microsoft-windows-htmlhelp-infotech_31bf3856ad364e35_6.1.7601.17514_none_f8ab56ff71fc562a_itircl.dll_dafa7917 6E4.tmp File created C:\Windows\winsxs\Backup\x86_microsoft-windows-riched32_31bf3856ad364e35_6.1.7601.17514_none_9f081dc1e0ddbddb_riched20.dll_fb578f95 6E4.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-v..e-filters-tvdigital_31bf3856ad364e35_6.1.7601.17514_none_4477e7eba20ff0b9\psisdecd.dll 6E4.tmp -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1044 wrote to memory of 1336 1044 e4fb63eb565865feed9d651317a7a360_NeikiAnalytics.exe 28 PID 1044 wrote to memory of 1336 1044 e4fb63eb565865feed9d651317a7a360_NeikiAnalytics.exe 28 PID 1044 wrote to memory of 1336 1044 e4fb63eb565865feed9d651317a7a360_NeikiAnalytics.exe 28 PID 1044 wrote to memory of 1336 1044 e4fb63eb565865feed9d651317a7a360_NeikiAnalytics.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\e4fb63eb565865feed9d651317a7a360_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\e4fb63eb565865feed9d651317a7a360_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\6E4.tmpC:\Users\Admin\AppData\Local\Temp\6E4.tmp2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:1336
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
145KB
MD5c610e7ccd6859872c585b2a85d7dc992
SHA1362b3d4b72e3add687c209c79b500b7c6a246d46
SHA25614063fc61dc71b9881d75e93a587c27a6daf8779ff5255a24a042beace541041
SHA5128570aad2ae8b5dcba00fc5ebf3dc0ea117e96cc88a83febd820c5811bf617a6431c1367b3eb88332f43f80b30ebe2c298c22dcc44860a075f7b41bf350236666