Malware Analysis Report

2024-11-16 13:19

Sample ID 240519-gflntsda5y
Target 8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe
SHA256 00873bed46bc0978f4040dadfac94eb74a0dba708fa1db0e41a65b4eef0cf466
Tags
sality backdoor evasion trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

00873bed46bc0978f4040dadfac94eb74a0dba708fa1db0e41a65b4eef0cf466

Threat Level: Known bad

The file 8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

sality backdoor evasion trojan upx

Sality

Modifies firewall policy service

UAC bypass

Windows security bypass

Windows security modification

UPX packed file

Checks whether UAC is enabled

Enumerates connected drives

Drops autorun.inf file

Drops file in Windows directory

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

System policy modification

Modifies registry class

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-19 05:44

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-19 05:44

Reported

2024-05-19 05:47

Platform

win7-20240221-en

Max time kernel

124s

Max time network

128s

Command Line

"taskhost.exe"

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A

Sality

backdoor sality

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A

Drops autorun.inf file

Description Indicator Process Target
File opened for modification C:\autorun.inf C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
File opened for modification F:\autorun.inf C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\7-Zip\7zFM.exe C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\7-Zip\7zG.exe C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\7-Zip\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.exe C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\f76a257 C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SYSTEM.INI C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1300 wrote to memory of 1128 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\system32\taskhost.exe
PID 1300 wrote to memory of 1184 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\system32\Dwm.exe
PID 1300 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\Explorer.EXE
PID 1300 wrote to memory of 1864 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\system32\DllHost.exe
PID 1300 wrote to memory of 1128 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\system32\taskhost.exe
PID 1300 wrote to memory of 1184 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\system32\Dwm.exe
PID 1300 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\Explorer.EXE
PID 1300 wrote to memory of 1128 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\system32\taskhost.exe
PID 1300 wrote to memory of 1184 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\system32\Dwm.exe
PID 1300 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\Explorer.EXE
PID 1300 wrote to memory of 1128 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\system32\taskhost.exe
PID 1300 wrote to memory of 1184 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\system32\Dwm.exe
PID 1300 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\Explorer.EXE
PID 1300 wrote to memory of 1128 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\system32\taskhost.exe
PID 1300 wrote to memory of 1184 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\system32\Dwm.exe
PID 1300 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\Explorer.EXE
PID 1300 wrote to memory of 1128 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\system32\taskhost.exe
PID 1300 wrote to memory of 1184 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\system32\Dwm.exe
PID 1300 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\Explorer.EXE
PID 1300 wrote to memory of 1128 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\system32\taskhost.exe
PID 1300 wrote to memory of 1184 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\system32\Dwm.exe
PID 1300 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\Explorer.EXE
PID 1300 wrote to memory of 1128 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\system32\taskhost.exe
PID 1300 wrote to memory of 1184 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\system32\Dwm.exe
PID 1300 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\Explorer.EXE
PID 1300 wrote to memory of 1128 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\system32\taskhost.exe
PID 1300 wrote to memory of 1184 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\system32\Dwm.exe
PID 1300 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\Explorer.EXE
PID 1300 wrote to memory of 1128 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\system32\taskhost.exe
PID 1300 wrote to memory of 1184 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\system32\Dwm.exe
PID 1300 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\Explorer.EXE
PID 1300 wrote to memory of 1128 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\system32\taskhost.exe
PID 1300 wrote to memory of 1184 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\system32\Dwm.exe
PID 1300 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\Explorer.EXE
PID 1300 wrote to memory of 1128 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\system32\taskhost.exe
PID 1300 wrote to memory of 1184 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\system32\Dwm.exe
PID 1300 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\Explorer.EXE

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A

Processes

C:\Windows\system32\taskhost.exe

"taskhost.exe"

C:\Windows\system32\Dwm.exe

"C:\Windows\system32\Dwm.exe"

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe"

Network

N/A

Files

memory/1300-0-0x0000000000400000-0x0000000000412000-memory.dmp

memory/1300-2-0x0000000000560000-0x000000000161A000-memory.dmp

memory/1300-4-0x0000000000560000-0x000000000161A000-memory.dmp

memory/1300-8-0x0000000000560000-0x000000000161A000-memory.dmp

memory/1300-12-0x0000000000560000-0x000000000161A000-memory.dmp

memory/1300-5-0x0000000000560000-0x000000000161A000-memory.dmp

memory/1300-9-0x0000000000560000-0x000000000161A000-memory.dmp

memory/1300-6-0x0000000000560000-0x000000000161A000-memory.dmp

memory/1300-11-0x0000000000560000-0x000000000161A000-memory.dmp

memory/1300-7-0x0000000000560000-0x000000000161A000-memory.dmp

memory/1300-10-0x0000000000560000-0x000000000161A000-memory.dmp

memory/1300-28-0x00000000038B0000-0x00000000038B2000-memory.dmp

memory/1300-29-0x00000000038B0000-0x00000000038B2000-memory.dmp

memory/1300-25-0x00000000038C0000-0x00000000038C1000-memory.dmp

memory/1300-27-0x00000000038C0000-0x00000000038C1000-memory.dmp

memory/1300-24-0x00000000038B0000-0x00000000038B2000-memory.dmp

memory/1128-18-0x0000000000160000-0x0000000000162000-memory.dmp

memory/1300-30-0x0000000000560000-0x000000000161A000-memory.dmp

memory/1300-31-0x0000000000560000-0x000000000161A000-memory.dmp

memory/1300-32-0x0000000000560000-0x000000000161A000-memory.dmp

memory/1300-33-0x0000000000560000-0x000000000161A000-memory.dmp

memory/1300-34-0x0000000000560000-0x000000000161A000-memory.dmp

memory/1300-36-0x0000000000560000-0x000000000161A000-memory.dmp

memory/1300-37-0x0000000000560000-0x000000000161A000-memory.dmp

memory/1300-38-0x0000000000560000-0x000000000161A000-memory.dmp

memory/1300-41-0x0000000000560000-0x000000000161A000-memory.dmp

memory/1300-42-0x0000000000560000-0x000000000161A000-memory.dmp

memory/1300-48-0x0000000000560000-0x000000000161A000-memory.dmp

memory/1300-51-0x0000000000560000-0x000000000161A000-memory.dmp

memory/1300-50-0x0000000000560000-0x000000000161A000-memory.dmp

memory/1300-53-0x0000000000560000-0x000000000161A000-memory.dmp

memory/1300-57-0x0000000000560000-0x000000000161A000-memory.dmp

memory/1300-61-0x0000000000560000-0x000000000161A000-memory.dmp

memory/1300-63-0x0000000000560000-0x000000000161A000-memory.dmp

memory/1300-64-0x0000000000560000-0x000000000161A000-memory.dmp

memory/1300-67-0x0000000000560000-0x000000000161A000-memory.dmp

memory/1300-66-0x0000000000560000-0x000000000161A000-memory.dmp

memory/1300-74-0x0000000000560000-0x000000000161A000-memory.dmp

memory/1300-76-0x0000000000560000-0x000000000161A000-memory.dmp

memory/1300-80-0x0000000000560000-0x000000000161A000-memory.dmp

memory/1300-92-0x00000000038B0000-0x00000000038B2000-memory.dmp

C:\fvsle.pif

MD5 1073968c7ca5a875fc31766f53012fbd
SHA1 3af6e2a4687ccb39a34e6c6e849f3e2cf9959002
SHA256 0e105e11dca4b495be98cb3db2be02d667c7191e1c22cef2e2b39e7da6f0e1c3
SHA512 08939f7f54f917d32e68ec64844130649952c54087c60083ff8e5c510df75d38b81424946275cdd6cf4796dd0cd2823277569f0bf1b9f8c1cb9ed52394e526f9

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-19 05:44

Reported

2024-05-19 05:47

Platform

win10v2004-20240226-en

Max time kernel

138s

Max time network

152s

Command Line

"fontdrvhost.exe"

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A

Sality

backdoor sality

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A

Drops autorun.inf file

Description Indicator Process Target
File opened for modification C:\autorun.inf C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
File opened for modification F:\autorun.inf C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\7-Zip\7z.exe C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\7-Zip\7zFM.exe C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\7-Zip\7zG.exe C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\7-Zip\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\e58484f C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SYSTEM.INI C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1600 wrote to memory of 776 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\system32\fontdrvhost.exe
PID 1600 wrote to memory of 780 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\system32\fontdrvhost.exe
PID 1600 wrote to memory of 1020 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\system32\dwm.exe
PID 1600 wrote to memory of 2340 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\system32\sihost.exe
PID 1600 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\system32\svchost.exe
PID 1600 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\system32\taskhostw.exe
PID 1600 wrote to memory of 3348 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\Explorer.EXE
PID 1600 wrote to memory of 3496 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\system32\svchost.exe
PID 1600 wrote to memory of 3732 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\system32\DllHost.exe
PID 1600 wrote to memory of 3820 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 1600 wrote to memory of 3924 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\System32\RuntimeBroker.exe
PID 1600 wrote to memory of 4040 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 1600 wrote to memory of 4124 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\System32\RuntimeBroker.exe
PID 1600 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\System32\RuntimeBroker.exe
PID 1600 wrote to memory of 4900 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 1600 wrote to memory of 4692 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\System32\RuntimeBroker.exe
PID 1600 wrote to memory of 3576 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1600 wrote to memory of 4928 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1600 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1600 wrote to memory of 3908 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1600 wrote to memory of 3936 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1600 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1600 wrote to memory of 1552 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1600 wrote to memory of 776 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\system32\fontdrvhost.exe
PID 1600 wrote to memory of 780 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\system32\fontdrvhost.exe
PID 1600 wrote to memory of 1020 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\system32\dwm.exe
PID 1600 wrote to memory of 2340 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\system32\sihost.exe
PID 1600 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\system32\svchost.exe
PID 1600 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\system32\taskhostw.exe
PID 1600 wrote to memory of 3348 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\Explorer.EXE
PID 1600 wrote to memory of 3496 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\system32\svchost.exe
PID 1600 wrote to memory of 3732 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\system32\DllHost.exe
PID 1600 wrote to memory of 3820 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 1600 wrote to memory of 3924 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\System32\RuntimeBroker.exe
PID 1600 wrote to memory of 4040 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 1600 wrote to memory of 4124 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\System32\RuntimeBroker.exe
PID 1600 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\System32\RuntimeBroker.exe
PID 1600 wrote to memory of 4900 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 1600 wrote to memory of 4692 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\System32\RuntimeBroker.exe
PID 1600 wrote to memory of 3576 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1600 wrote to memory of 4928 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1600 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1600 wrote to memory of 3908 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1600 wrote to memory of 3936 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1600 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1600 wrote to memory of 1552 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1600 wrote to memory of 776 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\system32\fontdrvhost.exe
PID 1600 wrote to memory of 780 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\system32\fontdrvhost.exe
PID 1600 wrote to memory of 1020 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\system32\dwm.exe
PID 1600 wrote to memory of 2340 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\system32\sihost.exe
PID 1600 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\system32\svchost.exe
PID 1600 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\system32\taskhostw.exe
PID 1600 wrote to memory of 3348 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\Explorer.EXE
PID 1600 wrote to memory of 3496 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\system32\svchost.exe
PID 1600 wrote to memory of 3732 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\system32\DllHost.exe
PID 1600 wrote to memory of 3820 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 1600 wrote to memory of 3924 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\System32\RuntimeBroker.exe
PID 1600 wrote to memory of 4040 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 1600 wrote to memory of 4124 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\System32\RuntimeBroker.exe
PID 1600 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\System32\RuntimeBroker.exe
PID 1600 wrote to memory of 4900 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 1600 wrote to memory of 4692 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Windows\System32\RuntimeBroker.exe
PID 1600 wrote to memory of 3576 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1600 wrote to memory of 4928 N/A C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe N/A

Processes

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\dwm.exe

"dwm.exe"

C:\Windows\system32\sihost.exe

sihost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

C:\Windows\system32\taskhostw.exe

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe

"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe

"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe

"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.52 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ff980c42e98,0x7ff980c42ea4,0x7ff980c42eb0

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=3224 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=3208 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=3484 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --mojo-platform-channel-handle=5452 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --mojo-platform-channel-handle=5468 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:1

C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\8618d611ce83426bbacd5c22f17683e0_NeikiAnalytics.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4140 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 79.121.231.20.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
GB 142.250.187.234:443 tcp
US 8.8.8.8:53 135.85.32.23.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 13.107.246.64:443 tcp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 27.173.189.20.in-addr.arpa udp

Files

memory/1600-0-0x0000000000400000-0x0000000000412000-memory.dmp

memory/1600-1-0x0000000000750000-0x000000000180A000-memory.dmp

memory/1600-6-0x0000000000750000-0x000000000180A000-memory.dmp

memory/1600-9-0x0000000000750000-0x000000000180A000-memory.dmp

memory/1600-10-0x0000000000750000-0x000000000180A000-memory.dmp

memory/1600-11-0x0000000000750000-0x000000000180A000-memory.dmp

memory/1600-8-0x0000000000750000-0x000000000180A000-memory.dmp

memory/1600-7-0x0000000000750000-0x000000000180A000-memory.dmp

memory/1600-5-0x0000000000750000-0x000000000180A000-memory.dmp

memory/1600-3-0x0000000000750000-0x000000000180A000-memory.dmp

memory/1600-4-0x0000000000750000-0x000000000180A000-memory.dmp

memory/1600-19-0x0000000003260000-0x0000000003262000-memory.dmp

memory/1600-18-0x0000000004480000-0x0000000004481000-memory.dmp

memory/1600-17-0x0000000003260000-0x0000000003262000-memory.dmp

memory/1600-20-0x0000000003260000-0x0000000003262000-memory.dmp

memory/1600-21-0x0000000000750000-0x000000000180A000-memory.dmp

memory/1600-22-0x0000000000750000-0x000000000180A000-memory.dmp

memory/1600-23-0x0000000000750000-0x000000000180A000-memory.dmp

memory/1600-24-0x0000000000750000-0x000000000180A000-memory.dmp

memory/1600-25-0x0000000000750000-0x000000000180A000-memory.dmp

memory/1600-27-0x0000000000750000-0x000000000180A000-memory.dmp

memory/1600-28-0x0000000000750000-0x000000000180A000-memory.dmp

memory/1600-30-0x0000000000750000-0x000000000180A000-memory.dmp

memory/1600-31-0x0000000000750000-0x000000000180A000-memory.dmp

memory/1600-33-0x0000000000750000-0x000000000180A000-memory.dmp

memory/1600-32-0x0000000000750000-0x000000000180A000-memory.dmp

memory/1600-36-0x0000000000750000-0x000000000180A000-memory.dmp

memory/1600-37-0x0000000000750000-0x000000000180A000-memory.dmp

memory/1600-40-0x0000000000750000-0x000000000180A000-memory.dmp

memory/1600-43-0x0000000000750000-0x000000000180A000-memory.dmp

memory/1600-45-0x0000000000750000-0x000000000180A000-memory.dmp

memory/1600-48-0x0000000000750000-0x000000000180A000-memory.dmp

memory/1600-55-0x0000000000750000-0x000000000180A000-memory.dmp

memory/1600-57-0x0000000000750000-0x000000000180A000-memory.dmp

memory/1600-58-0x0000000000750000-0x000000000180A000-memory.dmp

memory/1600-59-0x0000000000750000-0x000000000180A000-memory.dmp

memory/1600-61-0x0000000000750000-0x000000000180A000-memory.dmp

memory/1600-62-0x0000000000750000-0x000000000180A000-memory.dmp

memory/1600-63-0x0000000000750000-0x000000000180A000-memory.dmp

memory/1600-65-0x0000000000750000-0x000000000180A000-memory.dmp

memory/1600-66-0x0000000000750000-0x000000000180A000-memory.dmp

memory/1600-68-0x0000000000750000-0x000000000180A000-memory.dmp

memory/1600-70-0x0000000000750000-0x000000000180A000-memory.dmp

memory/1600-72-0x0000000000750000-0x000000000180A000-memory.dmp

memory/1600-74-0x0000000000750000-0x000000000180A000-memory.dmp

memory/1600-79-0x0000000000750000-0x000000000180A000-memory.dmp

C:\bgoj.exe

MD5 44caa3f2119a2c44f5b6b2aaca2be7d8
SHA1 1b0e20ece9423d0eb07a5990663fed55770028e8
SHA256 6742ab160d8a7c4cdfa7d27310137ce52eae2302aa509c50c9e1922f80bd0e4a
SHA512 2fcc2cb4034bb9e9d81dfe207c0f0575ec11c009b7d9c2332958024d70d7349ad62e25a708845aa5ec71d6813a132eabdf2c42b1b9337aed0baba0ff59d160e4

memory/1600-88-0x0000000003260000-0x0000000003262000-memory.dmp