Malware Analysis Report

2024-11-16 13:16

Sample ID 240519-zwnggahg82
Target 392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe
SHA256 18246d971fc456ad9f5c719ecf23058ec9621641ac931876b18101bd512220d8
Tags
sality backdoor evasion trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

18246d971fc456ad9f5c719ecf23058ec9621641ac931876b18101bd512220d8

Threat Level: Known bad

The file 392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

sality backdoor evasion trojan upx

Modifies firewall policy service

UAC bypass

Sality

Windows security bypass

Disables Task Manager via registry modification

Disables RegEdit via registry modification

Windows security modification

UPX packed file

Checks whether UAC is enabled

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

System policy modification

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-19 21:04

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-19 21:04

Reported

2024-05-19 21:06

Platform

win7-20240221-en

Max time kernel

121s

Max time network

122s

Command Line

"taskhost.exe"

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A

Sality

backdoor sality

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1" C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A

Disables Task Manager via registry modification

evasion

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\SYSTEM.INI C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A

Processes

C:\Windows\system32\taskhost.exe

"taskhost.exe"

C:\Windows\system32\Dwm.exe

"C:\Windows\system32\Dwm.exe"

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe"

Network

N/A

Files

memory/3000-0-0x0000000000400000-0x00000000004DA000-memory.dmp

memory/3000-2-0x0000000001E20000-0x0000000002EAE000-memory.dmp

memory/3000-4-0x0000000001E20000-0x0000000002EAE000-memory.dmp

memory/3000-13-0x0000000001E20000-0x0000000002EAE000-memory.dmp

memory/3000-16-0x0000000001E20000-0x0000000002EAE000-memory.dmp

memory/3000-17-0x0000000001E20000-0x0000000002EAE000-memory.dmp

memory/3000-15-0x0000000001E20000-0x0000000002EAE000-memory.dmp

memory/3000-32-0x00000000002C0000-0x00000000002C2000-memory.dmp

memory/3000-31-0x00000000003E0000-0x00000000003E1000-memory.dmp

memory/3000-35-0x00000000002C0000-0x00000000002C2000-memory.dmp

memory/3000-29-0x00000000003E0000-0x00000000003E1000-memory.dmp

memory/3000-28-0x00000000002C0000-0x00000000002C2000-memory.dmp

memory/1116-18-0x0000000000250000-0x0000000000252000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\0F76227E_Rar\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe

MD5 3054ee5d73fcd42690216a69abda7856
SHA1 172aca1075c7e71b6751309bc925d14b743b05a0
SHA256 bfc2b55ee1c53c97da7cec93f48c3c3f84dc66ea613a7af0ef4a2c8a8a14563a
SHA512 f2f3e17630f105d19814f465f7489cf41f3b15781d19bcce6f8aa7e7518664f579c837117f14fd4d33d65ce6496925d27654a3435d42278efb0c60ddc3526335

memory/3000-14-0x0000000001E20000-0x0000000002EAE000-memory.dmp

memory/3000-12-0x0000000001E20000-0x0000000002EAE000-memory.dmp

memory/3000-11-0x0000000001E20000-0x0000000002EAE000-memory.dmp

memory/3000-36-0x0000000001E20000-0x0000000002EAE000-memory.dmp

memory/3000-37-0x0000000001E20000-0x0000000002EAE000-memory.dmp

memory/3000-40-0x0000000001E20000-0x0000000002EAE000-memory.dmp

memory/3000-41-0x0000000001E20000-0x0000000002EAE000-memory.dmp

memory/3000-42-0x0000000001E20000-0x0000000002EAE000-memory.dmp

memory/3000-44-0x0000000001E20000-0x0000000002EAE000-memory.dmp

memory/3000-45-0x0000000001E20000-0x0000000002EAE000-memory.dmp

memory/3000-47-0x0000000001E20000-0x0000000002EAE000-memory.dmp

memory/3000-63-0x0000000000400000-0x00000000004DA000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-19 21:04

Reported

2024-05-19 21:06

Platform

win10v2004-20240426-en

Max time kernel

150s

Max time network

154s

Command Line

"fontdrvhost.exe"

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A

Sality

backdoor sality

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1" C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A

Disables Task Manager via registry modification

evasion

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\SYSTEM.INI C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1056 wrote to memory of 792 N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe C:\Windows\system32\fontdrvhost.exe
PID 1056 wrote to memory of 800 N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe C:\Windows\system32\fontdrvhost.exe
PID 1056 wrote to memory of 64 N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe C:\Windows\system32\dwm.exe
PID 1056 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe C:\Windows\system32\svchost.exe
PID 1056 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe C:\Windows\system32\sihost.exe
PID 1056 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe C:\Windows\system32\taskhostw.exe
PID 1056 wrote to memory of 3576 N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe C:\Windows\Explorer.EXE
PID 1056 wrote to memory of 3736 N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe C:\Windows\system32\svchost.exe
PID 1056 wrote to memory of 3900 N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe C:\Windows\system32\DllHost.exe
PID 1056 wrote to memory of 3992 N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 1056 wrote to memory of 4052 N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe C:\Windows\System32\RuntimeBroker.exe
PID 1056 wrote to memory of 672 N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 1056 wrote to memory of 4132 N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe C:\Windows\System32\RuntimeBroker.exe
PID 1056 wrote to memory of 3324 N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 1056 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe C:\Windows\System32\RuntimeBroker.exe
PID 1056 wrote to memory of 4772 N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe C:\Windows\system32\backgroundTaskHost.exe
PID 1056 wrote to memory of 1528 N/A C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe C:\Windows\system32\backgroundTaskHost.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe N/A

Processes

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\dwm.exe

"dwm.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

C:\Windows\system32\sihost.exe

sihost.exe

C:\Windows\system32\taskhostw.exe

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe

"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe

"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe

"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca

C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
NL 23.62.61.72:443 www.bing.com tcp
US 8.8.8.8:53 72.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 219.183.117.104.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 17.173.189.20.in-addr.arpa udp

Files

memory/1056-0-0x0000000000400000-0x00000000004DA000-memory.dmp

memory/1056-5-0x0000000002350000-0x00000000033DE000-memory.dmp

memory/1056-3-0x0000000002350000-0x00000000033DE000-memory.dmp

memory/1056-1-0x0000000002350000-0x00000000033DE000-memory.dmp

memory/1056-6-0x0000000002350000-0x00000000033DE000-memory.dmp

memory/1056-8-0x0000000002350000-0x00000000033DE000-memory.dmp

memory/1056-11-0x0000000000A30000-0x0000000000A31000-memory.dmp

memory/1056-10-0x00000000006A0000-0x00000000006A2000-memory.dmp

memory/1056-23-0x00000000006A0000-0x00000000006A2000-memory.dmp

memory/1056-9-0x0000000002350000-0x00000000033DE000-memory.dmp

memory/1056-12-0x0000000002350000-0x00000000033DE000-memory.dmp

memory/1056-22-0x00000000006A0000-0x00000000006A2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\0E5733B2_Rar\392b219101ac9b39ff7252405d196120_NeikiAnalytics.exe

MD5 3054ee5d73fcd42690216a69abda7856
SHA1 172aca1075c7e71b6751309bc925d14b743b05a0
SHA256 bfc2b55ee1c53c97da7cec93f48c3c3f84dc66ea613a7af0ef4a2c8a8a14563a
SHA512 f2f3e17630f105d19814f465f7489cf41f3b15781d19bcce6f8aa7e7518664f579c837117f14fd4d33d65ce6496925d27654a3435d42278efb0c60ddc3526335

memory/1056-7-0x0000000002350000-0x00000000033DE000-memory.dmp

memory/1056-19-0x0000000002350000-0x00000000033DE000-memory.dmp

memory/1056-24-0x0000000002350000-0x00000000033DE000-memory.dmp

memory/1056-25-0x0000000002350000-0x00000000033DE000-memory.dmp

memory/1056-27-0x0000000002350000-0x00000000033DE000-memory.dmp

memory/1056-28-0x0000000002350000-0x00000000033DE000-memory.dmp

memory/1056-30-0x0000000002350000-0x00000000033DE000-memory.dmp

memory/1056-31-0x0000000002350000-0x00000000033DE000-memory.dmp

memory/1056-33-0x0000000002350000-0x00000000033DE000-memory.dmp

memory/1056-50-0x0000000000400000-0x00000000004DA000-memory.dmp

memory/1056-47-0x0000000002350000-0x00000000033DE000-memory.dmp

memory/1056-39-0x00000000006A0000-0x00000000006A2000-memory.dmp