55a6680943aae16c189001f3566dccf20f7a80ca829e12a211432c9d3c2d20db

General

Target

0de3f1ee1da6ffcb52540daa79453010_NeikiAnalytics.exe
Size

569KB
MD5

0de3f1ee1da6ffcb52540daa79453010
SHA1

77ad40eeb4e5dc0da0de7820f0dd72ee758c6425
SHA256

55a6680943aae16c189001f3566dccf20f7a80ca829e12a211432c9d3c2d20db
SHA512

01d11be57398424964b0c33d24f01daec6daaef9bb9f7d5dfe427e6fa8af5965d05c37bac1edbc8253ca42fe53758b1e1bb512b0d30f0078b4a79f9e37e79b35
SSDEEP

12288:NpJcShRZhRUQ4hK137WTh0tFhfa+WHjpcf2E1eR4IrxwV:NpySZjQE13STh0tFda+CtcfR1eR

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

40A3.tmp

pid process

1684 40A3.tmp
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
1684	40A3.tmp

Drops file in System32 directory 58 IoCs

Processes:

40A3.tmp

description	ioc	process
File created	C:\Windows\SysWOW64\d3dxof.dll	40A3.tmp
File opened for modification	C:\Windows\SysWOW64\vccorlib120.dll	40A3.tmp
File created	C:\Windows\SysWOW64\d3d8.dll	40A3.tmp
File opened for modification	C:\Windows\SysWOW64\mfc120.dll	40A3.tmp
File created	C:\Windows\System32\DriverStore\FileRepository\prnms003.inf_x86_360f6f3a7c4b3433\I386\PrintConfig.dll	40A3.tmp
File created	C:\Windows\SysWOW64\crtdll.dll	40A3.tmp
File created	C:\Windows\SysWOW64\FXSXP32.dll	40A3.tmp
File created	C:\Windows\SysWOW64\hh.exe	40A3.tmp
File created	C:\Windows\SysWOW64\msrd3x40.dll	40A3.tmp
File opened for modification	C:\Windows\SysWOW64\msvcr120.dll	40A3.tmp
File created	C:\Windows\SysWOW64\mfc40.dll	40A3.tmp
File created	C:\Windows\SysWOW64\msjet40.dll	40A3.tmp
File created	C:\Windows\SysWOW64\msvbvm60.dll	40A3.tmp
File opened for modification	C:\Windows\SysWOW64\msvcr100.dll	40A3.tmp
File created	C:\Windows\SysWOW64\d3dim.dll	40A3.tmp
File created	C:\Windows\SysWOW64\gnsdk_fp.dll	40A3.tmp
File opened for modification	C:\Windows\SysWOW64\mfc140.dll	40A3.tmp
File opened for modification	C:\Windows\SysWOW64\mfc120u.dll	40A3.tmp
File created	C:\Windows\SysWOW64\msvcrt20.dll	40A3.tmp
File created	C:\Windows\SysWOW64\olesvr32.dll	40A3.tmp
File created	C:\Windows\SysWOW64\rdvgogl32.dll	40A3.tmp
File created	C:\Windows\SysWOW64\msorcl32.dll	40A3.tmp
File created	C:\Windows\SysWOW64\msrepl40.dll	40A3.tmp
File created	C:\Windows\SysWOW64\acwow64.dll	40A3.tmp
File opened for modification	C:\Windows\SysWOW64\concrt140.dll	40A3.tmp
File opened for modification	C:\Windows\SysWOW64\mfc140u.dll	40A3.tmp
File created	C:\Windows\SysWOW64\msjtes40.dll	40A3.tmp
File created	C:\Windows\SysWOW64\OneDriveSetup.exe	40A3.tmp
File opened for modification	C:\Windows\SysWOW64\atl110.dll	40A3.tmp
File created	C:\Windows\System32\DriverStore\FileRepository\ntprint.inf_x86_c62e9f8067f98247\I386\PS5UI.DLL	40A3.tmp
File created	C:\Windows\SysWOW64\iac25_32.ax	40A3.tmp
File created	C:\Windows\SysWOW64\mspbde40.dll	40A3.tmp
File created	C:\Windows\SysWOW64\msxbde40.dll	40A3.tmp
File opened for modification	C:\Windows\SysWOW64\vcomp140.dll	40A3.tmp
File opened for modification	C:\Windows\SysWOW64\msvcr110.dll	40A3.tmp
File opened for modification	C:\Windows\SysWOW64\opencl.dll	40A3.tmp
File opened for modification	C:\Windows\SysWOW64\PrintConfig.dll	40A3.tmp
File created	C:\Windows\SysWOW64\sqlunirl.dll	40A3.tmp
File created	C:\Windows\SysWOW64\mswstr10.dll	40A3.tmp
File created	C:\Windows\SysWOW64\odbcjt32.dll	40A3.tmp
File created	C:\Windows\SysWOW64\olecli32.dll	40A3.tmp
File created	C:\Windows\SysWOW64\AppVEntSubsystems32.dll	40A3.tmp
File opened for modification	C:\Windows\SysWOW64\mfc100.dll	40A3.tmp
File opened for modification	C:\Windows\SysWOW64\mfc110.dll	40A3.tmp
File opened for modification	C:\Windows\SysWOW64\mfc110u.dll	40A3.tmp
File created	C:\Windows\SysWOW64\ir41_32original.dll	40A3.tmp
File created	C:\Windows\SysWOW64\ivfsrc.ax	40A3.tmp
File created	C:\Windows\SysWOW64\InstallShield\setup.exe	40A3.tmp
File opened for modification	C:\Windows\SysWOW64\mfc100u.dll	40A3.tmp
File created	C:\Windows\SysWOW64\sqlwoa.dll	40A3.tmp
File created	C:\Windows\SysWOW64\InstallShield\_isdel.exe	40A3.tmp
File created	C:\Windows\SysWOW64\ir32_32original.dll	40A3.tmp
File created	C:\Windows\SysWOW64\ir50_32original.dll	40A3.tmp
File created	C:\Windows\SysWOW64\msexch40.dll	40A3.tmp
File created	C:\Windows\System32\DriverStore\FileRepository\ntprint.inf_x86_c62e9f8067f98247\I386\PSCRIPT5.DLL	40A3.tmp
File opened for modification	C:\Windows\SysWOW64\atl100.dll	40A3.tmp
File created	C:\Windows\SysWOW64\expsrv.dll	40A3.tmp
File created	C:\Windows\SysWOW64\mfc40u.dll	40A3.tmp

Drops file in Program Files directory 64 IoCs

Processes:

40A3.tmp

description	ioc	process
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\msvcr120.dll	40A3.tmp
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\ONBttnIELinkedNotes.dll	40A3.tmp
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\MSVCR110.DLL	40A3.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\d3dcompiler_47.dll	40A3.tmp
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\msoshext.dll	40A3.tmp
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\MSOXMLMF.DLL	40A3.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\ReadOutLoud.api	40A3.tmp
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll	40A3.tmp
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\x86\EmbeddedBrowserWebView.dll	40A3.tmp
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHEV.DLL	40A3.tmp
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	40A3.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	40A3.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\sqlite.dll	40A3.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\SendMail.api	40A3.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	40A3.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\drvDX9.x3d	40A3.tmp
File created	C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDFImpl.dll	40A3.tmp
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll	40A3.tmp
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	40A3.tmp
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	40A3.tmp
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\SystemX86\mfc140.dll	40A3.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annots.api	40A3.tmp
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\NAMEEXT.DLL	40A3.tmp
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\STSCOPY.DLL	40A3.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	40A3.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\drvSOFT.x3d	40A3.tmp
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	40A3.tmp
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll	40A3.tmp
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\IEAWSDC.DLL	40A3.tmp
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\SystemX86\concrt140.dll	40A3.tmp
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\msvcr120.dll	40A3.tmp
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\SystemX86\mfc140u.dll	40A3.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ACE.dll	40A3.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\d3dcompiler_43.dll	40A3.tmp
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	40A3.tmp
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\msmgdsrv.dll	40A3.tmp
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\xmsrv.dll	40A3.tmp
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia100.dll	40A3.tmp
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MeetingJoinAxOC.dll	40A3.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	40A3.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	40A3.tmp
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\goopdate.dll	40A3.tmp
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\concrt140.dll	40A3.tmp
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\msmdlocal.dll	40A3.tmp
File created	C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.dll	40A3.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\rt3d.dll	40A3.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Accessibility.api	40A3.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia.api	40A3.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\Flash.mpp	40A3.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\WindowsMedia.mpp	40A3.tmp
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\Mso40UIwin32client.dll	40A3.tmp
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\ONBttnIE.dll	40A3.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\nppdf32.dll	40A3.tmp
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\NPSPWRAP.DLL	40A3.tmp
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\VVIEWDWG.DLL	40A3.tmp
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\OWSCLT.DLL	40A3.tmp
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\PPSLAX.DLL	40A3.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\adoberfp.dll	40A3.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\PPKLite.api	40A3.tmp
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia90.dll	40A3.tmp
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\mfc140u.dll	40A3.tmp
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\MSO.DLL	40A3.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\EScript.api	40A3.tmp
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\NAME.DLL	40A3.tmp

Drops file in Windows directory 64 IoCs

Processes:

40A3.tmp

description	ioc	process
File created	C:\Windows\WinSxS\Backup\wow64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1288_none_6115038ba57fcb33_kerbclientshared.dll_1fa7b356	40A3.tmp
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll	40A3.tmp
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data.OracleClient\v4.0_4.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll	40A3.tmp
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	40A3.tmp
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adobearmhelper.exe.BDCA7721_F290_4124_BBED_7A15FE7694EB	40A3.tmp
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\nppdf32.dll	40A3.tmp
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\sqlite.dll	40A3.tmp
File created	C:\Windows\WinSxS\Backup\wow64_microsoft-windows-rasautodial_31bf3856ad364e35_10.0.19041.546_none_f827f008f8832bd5_rasautou.exe_477abe34	40A3.tmp
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	40A3.tmp
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logsession.dll	40A3.tmp
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\SendMail.api	40A3.tmp
File created	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\SecStoreFile.ico	40A3.tmp
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\F_CENTRAL_vccorlib120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA	40A3.tmp
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\ReadOutLoud.api	40A3.tmp
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32.exe	40A3.tmp
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\WindowsMedia.mpp	40A3.tmp
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\Search.api	40A3.tmp
File created	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\XFDFFile_8.ico	40A3.tmp
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.VisualBasic.Activities.Compiler\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Activities.Compiler.dll	40A3.tmp
File created	C:\Windows\WinSxS\Backup\wow64_microsoft-windows-atl_31bf3856ad364e35_10.0.19041.746_none_936e34e4ece273a7_atl.dll_0c7220db	40A3.tmp
File created	C:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_mfc100_x86	40A3.tmp
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\Multimedia.api_NON_OPT	40A3.tmp
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\EScript.api	40A3.tmp
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\F_CENTRAL_msvcr120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA	40A3.tmp
File created	C:\Windows\WinSxS\Backup\wow64_microsoft-windows-com-base-qfe-ole32_31bf3856ad364e35_10.0.19041.1202_none_2b327e97dbe87a1a_ole32.dll_e9dcc2e3	40A3.tmp
File created	C:\Windows\Installer\$PatchCache$\Managed\00006109E70000000100000000F01FEC\16.0.12527\concrt140.dll_x86	40A3.tmp
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32.dll	40A3.tmp
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\Accessibility.api_NON_OPT	40A3.tmp
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	40A3.tmp
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AGM.dll	40A3.tmp
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\Flash.mpp	40A3.tmp
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\nppdf32.dll_Apollo	40A3.tmp
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\PPKLite.api	40A3.tmp
File created	C:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_atl100_x86	40A3.tmp
File created	C:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_mfc100u_x86	40A3.tmp
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\Bib.dll_NON_OPT	40A3.tmp
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\drvDX9.x3d	40A3.tmp
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\drvSOFT.x3d	40A3.tmp
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	40A3.tmp
File created	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\PDFFile_8.ico	40A3.tmp
File created	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\SC_Reader.ico	40A3.tmp
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroPDFImpl.dll	40A3.tmp
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\Annots.api	40A3.tmp
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\napcrypt\v4.0_10.0.0.0__31bf3856ad364e35\NAPCRYPT.DLL	40A3.tmp
File created	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\FDFFile_8.ico	40A3.tmp
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll	40A3.tmp
File created	C:\Windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\wpfgfx_v0300.dll	40A3.tmp
File created	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\APIFile_8.ico	40A3.tmp
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adoberfp.dll	40A3.tmp
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	40A3.tmp
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\rt3d.dll	40A3.tmp
File created	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\XDPFile_8.ico	40A3.tmp
File created	C:\Windows\WinSxS\Backup\x86_microsoft.windows.isolationautomation_6595b64144ccf1df_1.0.19041.746_none_c33b9b0d5e48a5d2_sxsoa.dll_cb87188c	40A3.tmp
File created	C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll	40A3.tmp
File created	C:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_msvcr100_x86	40A3.tmp
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\SaveAsRTF.api_NON_OPT	40A3.tmp
File created	C:\Windows\WinSxS\Backup\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.19041.1110_none_c0da534e38c01f4d_comctl32.dll_9c499789	40A3.tmp
File created	C:\Windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll	40A3.tmp
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\MCIMPP.mpp	40A3.tmp
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrocef.exe.15EE1C08_ED51_465D_B6F3_FB152B1CC435	40A3.tmp
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\QuickTime.mpp	40A3.tmp
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	40A3.tmp
File created	C:\Windows\WinSxS\Backup\wow64_microsoft-windows-advapi32_31bf3856ad364e35_10.0.19041.1052_none_6277ca3070041917_advapi32.dll_9512793c	40A3.tmp
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\Ace.dll_NON_OPT	40A3.tmp

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

0de3f1ee1da6ffcb52540daa79453010_NeikiAnalytics.exe

description	pid	process	target process
PID 3844 wrote to memory of 1684	3844	0de3f1ee1da6ffcb52540daa79453010_NeikiAnalytics.exe	40A3.tmp
PID 3844 wrote to memory of 1684	3844	0de3f1ee1da6ffcb52540daa79453010_NeikiAnalytics.exe	40A3.tmp
PID 3844 wrote to memory of 1684	3844	0de3f1ee1da6ffcb52540daa79453010_NeikiAnalytics.exe	40A3.tmp

C:\Users\Admin\AppData\Local\Temp\0de3f1ee1da6ffcb52540daa79453010_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0de3f1ee1da6ffcb52540daa79453010_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3844
- C:\Users\Admin\AppData\Local\Temp\40A3.tmp
  C:\Users\Admin\AppData\Local\Temp\40A3.tmp
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  PID:1684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\59D76868C250B3240414CE3EFBB12518_809DE37BF6F91747203FF7559791C460

Filesize
471B

MD5
6a2addc78ace6881803ceb2af8e5434d

SHA1
2a6eb1ddaf31c834ca82a14067a5ca50b57f9da2

SHA256
da2439d8b6584ca641cb5233141c6e2bff0b306323021e403bbf682c08adf182

SHA512
277a9d069e2a08ee594fa77ed7e7e5c3e23c22d828d1254038344aa11c8e770e13e77a86edceaee64118b757b63a57f432c832c034cd66166755668228a7f94c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419

Filesize
471B

MD5
e5e3b9a44e7c44eb10937abff1471b6b

SHA1
de4c3e789179fbe019b4cb5da76aa076820a0f96

SHA256
b8daf1b1a084c58499b53a768fa833b9de752269a28177568841173c26589055

SHA512
72bd25a6de0bb1e90d514d4fed18ce6e259a729220416e2bf56b83dd6e57126673ee5d478a1f3dfe67971f51a92cdf819600f8feaf42a9d481193adeb43ce092

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\59D76868C250B3240414CE3EFBB12518_809DE37BF6F91747203FF7559791C460

Filesize
404B

MD5
629174bce6e9a015dfeb5bacfaf84c47

SHA1
dc68f35fd94912ff4bbbc619cc5e1b8880d87f7d

SHA256
a0fafc11271fa270e21106ff8f03040514d25bc144536f4184d6d40abd3f32b3

SHA512
ed12fcf055896aefe552a051c9bdaf46c3469440e09fe56d0ef1f35c82d45915c78cef0bb86a2c8b6520ff6fd1506c9e2b4127ea16aeb42739b767e4c2787243

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419

Filesize
412B

MD5
19355932ead7d6a4ee2b065aa172508a

SHA1
b9e0409f66d99ed78f7bcc71a21e4e0f283ea79c

SHA256
0a28367a94af62123aed2dbd237e2ae986ca5925af46472fbb076cc83998e119

SHA512
e1f34b616e22acbf575ca88d5e9c8a2bf829ba4e05c2835d17df34121123a484b3d4ccb79a6bad5b91501cc8f12c725854e8c5ff01b37b28d4fabe1622425332

Download Submit
C:\Users\Admin\AppData\Local\Temp\40A3.tmp

Filesize
145KB

MD5
c610e7ccd6859872c585b2a85d7dc992

SHA1
362b3d4b72e3add687c209c79b500b7c6a246d46

SHA256
14063fc61dc71b9881d75e93a587c27a6daf8779ff5255a24a042beace541041

SHA512
8570aad2ae8b5dcba00fc5ebf3dc0ea117e96cc88a83febd820c5811bf617a6431c1367b3eb88332f43f80b30ebe2c298c22dcc44860a075f7b41bf350236666

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe\LogTransport2\LogTransport2.cfg

Filesize
3KB

MD5
a1383a04720d80aac9f8ceeca06ddb5d

SHA1
3d0b26d44046384de7d57365eff5fcf8822f66af

SHA256
77e3eab7aa9884ab6efa94d046acc679cd718035609e585b539640f55f292ebb

SHA512
80af9f5400f1bf49476a292137ea6de6fe05976ed1968691b416b1b5b8a504b49e0f01fb2461b304ac9cc5c864456b5eb42c266054331bfcc7b80f5cea460dd7

Download Submit
memory/3844-0-0x0000000002220000-0x000000000225F000-memory.dmp

Filesize
252KB

Download
memory/3844-1-0x0000000002220000-0x000000000225F000-memory.dmp

Filesize
252KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads