Malware Analysis Report

2025-08-05 19:16

Sample ID 240526-d5jc8aeb54
Target 5c8240c58187f307d35c51c079639ff0_NeikiAnalytics.exe
SHA256 a232079f2c9dd01e7105ac504d50a4ad8ceb75ae9a9285e003f14381251830be
Tags
evasion persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a232079f2c9dd01e7105ac504d50a4ad8ceb75ae9a9285e003f14381251830be

Threat Level: Known bad

The file 5c8240c58187f307d35c51c079639ff0_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

evasion persistence trojan

Detects BazaLoader malware

Modifies visiblity of hidden/system files in Explorer

Modifies WinLogon for persistence

Modifies Installed Components in the registry

Loads dropped DLL

Executes dropped EXE

Adds Run key to start application

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-26 03:35

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-26 03:35

Reported

2024-05-26 03:37

Platform

win7-20240221-en

Max time kernel

150s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5c8240c58187f307d35c51c079639ff0_NeikiAnalytics.exe"

Signatures

Detects BazaLoader malware

trojan
Description Indicator Process Target
N/A N/A N/A N/A

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" \??\c:\windows\system\svchost.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\system\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\system\svchost.exe N/A

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\svchost.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} \??\c:\windows\system\svchost.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\explorer.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\svchost.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\spoolsv.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\spoolsv.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" \??\c:\windows\system\svchost.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification \??\c:\windows\system\explorer.exe C:\Users\Admin\AppData\Local\Temp\5c8240c58187f307d35c51c079639ff0_NeikiAnalytics.exe N/A
File opened for modification \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\explorer.exe N/A
File opened for modification \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe N/A
File opened for modification \??\c:\windows\system\explorer.exe \??\c:\windows\system\explorer.exe N/A
File opened for modification \??\c:\windows\system\svchost.exe \??\c:\windows\system\svchost.exe N/A
File opened for modification C:\Windows\system\udsys.exe \??\c:\windows\system\explorer.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\5c8240c58187f307d35c51c079639ff0_NeikiAnalytics.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1948 wrote to memory of 2336 N/A C:\Users\Admin\AppData\Local\Temp\5c8240c58187f307d35c51c079639ff0_NeikiAnalytics.exe \??\c:\windows\system\explorer.exe
PID 1948 wrote to memory of 2336 N/A C:\Users\Admin\AppData\Local\Temp\5c8240c58187f307d35c51c079639ff0_NeikiAnalytics.exe \??\c:\windows\system\explorer.exe
PID 1948 wrote to memory of 2336 N/A C:\Users\Admin\AppData\Local\Temp\5c8240c58187f307d35c51c079639ff0_NeikiAnalytics.exe \??\c:\windows\system\explorer.exe
PID 1948 wrote to memory of 2336 N/A C:\Users\Admin\AppData\Local\Temp\5c8240c58187f307d35c51c079639ff0_NeikiAnalytics.exe \??\c:\windows\system\explorer.exe
PID 2336 wrote to memory of 2572 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 2336 wrote to memory of 2572 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 2336 wrote to memory of 2572 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 2336 wrote to memory of 2572 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 2572 wrote to memory of 1736 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 2572 wrote to memory of 1736 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 2572 wrote to memory of 1736 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 2572 wrote to memory of 1736 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 1736 wrote to memory of 2660 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 1736 wrote to memory of 2660 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 1736 wrote to memory of 2660 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 1736 wrote to memory of 2660 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 1736 wrote to memory of 2884 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 1736 wrote to memory of 2884 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 1736 wrote to memory of 2884 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 1736 wrote to memory of 2884 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 1736 wrote to memory of 592 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 1736 wrote to memory of 592 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 1736 wrote to memory of 592 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 1736 wrote to memory of 592 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 1736 wrote to memory of 560 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 1736 wrote to memory of 560 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 1736 wrote to memory of 560 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 1736 wrote to memory of 560 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe

Processes

C:\Users\Admin\AppData\Local\Temp\5c8240c58187f307d35c51c079639ff0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\5c8240c58187f307d35c51c079639ff0_NeikiAnalytics.exe"

\??\c:\windows\system\explorer.exe

c:\windows\system\explorer.exe

\??\c:\windows\system\spoolsv.exe

c:\windows\system\spoolsv.exe SE

\??\c:\windows\system\svchost.exe

c:\windows\system\svchost.exe

\??\c:\windows\system\spoolsv.exe

c:\windows\system\spoolsv.exe PR

C:\Windows\SysWOW64\at.exe

at 03:37 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

C:\Windows\SysWOW64\at.exe

at 03:38 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

C:\Windows\SysWOW64\at.exe

at 03:39 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

Network

N/A

Files

memory/1948-0-0x0000000000400000-0x0000000000431000-memory.dmp

memory/1948-1-0x0000000000020000-0x0000000000024000-memory.dmp

memory/1948-3-0x0000000000400000-0x0000000000431000-memory.dmp

memory/1948-4-0x0000000000401000-0x000000000042E000-memory.dmp

memory/1948-2-0x0000000072940000-0x0000000072A93000-memory.dmp

\Windows\system\explorer.exe

MD5 8ab8b61ff4a32028f27c2dae64e45792
SHA1 c7cf4fb4711e57b050daa320d336db10580eb7a7
SHA256 8a2b1abbc005ac6244168d90d04786279de103e96646325b2ef83f2cd055ec39
SHA512 f7c55786724e573a1c616cb0358b76d1a1b3d0fff1b0eeae92a0c9c64eb61dd0537238dcefa20716228cf1928578e407464141c9514140ae0a8ee7253be1c4ff

memory/1948-12-0x0000000002720000-0x0000000002751000-memory.dmp

memory/2336-18-0x0000000072940000-0x0000000072A93000-memory.dmp

memory/2336-21-0x0000000000400000-0x0000000000431000-memory.dmp

memory/1948-20-0x0000000002720000-0x0000000002751000-memory.dmp

\Windows\system\spoolsv.exe

MD5 98b7a63e3f909aed7801eecf4b4aa41d
SHA1 712caec4bb8ed7790856d9ecdb8bf98aa1d63ad4
SHA256 ed14a3ee572a6605f998cab1b8d1b3357012a2006d287c65b9ec33f4809966b2
SHA512 5cf6e669a79b3eaac016c4e3bff234cd376339c3347516cd8aa14296062f097ec8096c2f01e17de0160693eb97cf430a3ecf189f99dbee04cc0c146257625741

memory/2336-35-0x0000000003130000-0x0000000003161000-memory.dmp

memory/2572-36-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2572-37-0x0000000072940000-0x0000000072A93000-memory.dmp

memory/2572-41-0x0000000000400000-0x0000000000431000-memory.dmp

\Windows\system\svchost.exe

MD5 b547ea416b127007f0e0ed3c4e7ba55b
SHA1 63f0898ffe66122a9624a28acd147bd71921a1d4
SHA256 701cd59ccbccb02443e8c8b8fa429d859b2a0797fb5fe159667e0276c5bfdb8f
SHA512 0ffa482d20b43a4ab8f80d3d39848b4c73b1034fffbde57f79f894f0b39b14cc718162a6a9a618117569e1c9580e1756f841c5bdb814c6b9b92d5882021a4a03

memory/2572-53-0x0000000001E80000-0x0000000001EB1000-memory.dmp

memory/2572-54-0x0000000001E80000-0x0000000001EB1000-memory.dmp

memory/1948-59-0x0000000000020000-0x0000000000024000-memory.dmp

memory/1736-61-0x0000000000400000-0x0000000000431000-memory.dmp

memory/1736-55-0x0000000072940000-0x0000000072A93000-memory.dmp

memory/1736-68-0x0000000002590000-0x00000000025C1000-memory.dmp

memory/1736-67-0x0000000002590000-0x00000000025C1000-memory.dmp

memory/1948-66-0x0000000000401000-0x000000000042E000-memory.dmp

memory/2660-69-0x0000000072940000-0x0000000072A93000-memory.dmp

memory/2660-75-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2572-79-0x0000000000400000-0x0000000000431000-memory.dmp

memory/1948-81-0x0000000000401000-0x000000000042E000-memory.dmp

memory/1948-82-0x0000000000400000-0x0000000000431000-memory.dmp

C:\Users\Admin\AppData\Roaming\mrsys.exe

MD5 6f02be24e1135f5a998673fba3d54cf7
SHA1 be633c1227c6f365ab13d262f313d64376eef233
SHA256 517ecc499d897417c7280639c267dc8a9c8701d4d409e3f7b1cbe17ed462d01d
SHA512 ae7a16f43cc5c999976e40acfe18bc28f05b0a8daf68cab9552c5cfe26676ba3e05fe4e973b162804827030bee7e4f87283a6c1f8cf377655b65d5c8415067aa

memory/2336-84-0x0000000000400000-0x0000000000431000-memory.dmp

memory/1736-86-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2336-95-0x0000000000400000-0x0000000000431000-memory.dmp

\??\PIPE\atsvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-26 03:35

Reported

2024-05-26 03:37

Platform

win10v2004-20240426-en

Max time kernel

150s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5c8240c58187f307d35c51c079639ff0_NeikiAnalytics.exe"

Signatures

Detects BazaLoader malware

trojan
Description Indicator Process Target
N/A N/A N/A N/A

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" \??\c:\windows\system\svchost.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\system\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\system\svchost.exe N/A

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} \??\c:\windows\system\svchost.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\explorer.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\svchost.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\svchost.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\spoolsv.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\spoolsv.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" \??\c:\windows\system\svchost.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification \??\c:\windows\system\explorer.exe C:\Users\Admin\AppData\Local\Temp\5c8240c58187f307d35c51c079639ff0_NeikiAnalytics.exe N/A
File opened for modification \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\explorer.exe N/A
File opened for modification \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe N/A
File opened for modification \??\c:\windows\system\explorer.exe \??\c:\windows\system\explorer.exe N/A
File opened for modification \??\c:\windows\system\svchost.exe \??\c:\windows\system\svchost.exe N/A
File opened for modification C:\Windows\system\udsys.exe \??\c:\windows\system\explorer.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\5c8240c58187f307d35c51c079639ff0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5c8240c58187f307d35c51c079639ff0_NeikiAnalytics.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3764 wrote to memory of 3192 N/A C:\Users\Admin\AppData\Local\Temp\5c8240c58187f307d35c51c079639ff0_NeikiAnalytics.exe \??\c:\windows\system\explorer.exe
PID 3764 wrote to memory of 3192 N/A C:\Users\Admin\AppData\Local\Temp\5c8240c58187f307d35c51c079639ff0_NeikiAnalytics.exe \??\c:\windows\system\explorer.exe
PID 3764 wrote to memory of 3192 N/A C:\Users\Admin\AppData\Local\Temp\5c8240c58187f307d35c51c079639ff0_NeikiAnalytics.exe \??\c:\windows\system\explorer.exe
PID 3192 wrote to memory of 2788 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 3192 wrote to memory of 2788 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 3192 wrote to memory of 2788 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 2788 wrote to memory of 4412 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 2788 wrote to memory of 4412 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 2788 wrote to memory of 4412 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 4412 wrote to memory of 3680 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 4412 wrote to memory of 3680 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 4412 wrote to memory of 3680 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 4412 wrote to memory of 1356 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 4412 wrote to memory of 1356 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 4412 wrote to memory of 1356 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 4412 wrote to memory of 1440 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 4412 wrote to memory of 1440 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 4412 wrote to memory of 1440 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 4412 wrote to memory of 2292 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 4412 wrote to memory of 2292 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 4412 wrote to memory of 2292 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe

Processes

C:\Users\Admin\AppData\Local\Temp\5c8240c58187f307d35c51c079639ff0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\5c8240c58187f307d35c51c079639ff0_NeikiAnalytics.exe"

\??\c:\windows\system\explorer.exe

c:\windows\system\explorer.exe

\??\c:\windows\system\spoolsv.exe

c:\windows\system\spoolsv.exe SE

\??\c:\windows\system\svchost.exe

c:\windows\system\svchost.exe

\??\c:\windows\system\spoolsv.exe

c:\windows\system\spoolsv.exe PR

C:\Windows\SysWOW64\at.exe

at 03:37 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

C:\Windows\SysWOW64\at.exe

at 03:38 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

C:\Windows\SysWOW64\at.exe

at 03:39 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.79.70.13.in-addr.arpa udp

Files

memory/3764-0-0x0000000000400000-0x0000000000431000-memory.dmp

memory/3764-1-0x00000000001C0000-0x00000000001C4000-memory.dmp

memory/3764-3-0x0000000000400000-0x0000000000431000-memory.dmp

memory/3764-4-0x0000000000401000-0x000000000042E000-memory.dmp

memory/3764-2-0x00000000754B0000-0x000000007560D000-memory.dmp

C:\Windows\System\explorer.exe

MD5 69c98a1512d4ddbca4dd75ece612bc39
SHA1 feed0f854caa46446c17fe566f7f22b8fe0e733e
SHA256 79091a059087cd0b668f7745a72e7904c90f231aed8605752215702a7652dc5f
SHA512 2d6007c78dbf4b9f9d131a045f4beb4a1b9ee98d3879b8a76c5753a6067d128d869bd90c3dc66e9d093c0e6400d1f137188e5ef1fb2d5eb02bb464c5f2fa0051

memory/3192-14-0x0000000000400000-0x0000000000431000-memory.dmp

memory/3192-13-0x0000000000400000-0x0000000000431000-memory.dmp

memory/3192-15-0x00000000754B0000-0x000000007560D000-memory.dmp

memory/3192-18-0x0000000000400000-0x0000000000431000-memory.dmp

C:\Windows\System\spoolsv.exe

MD5 bb6b27eec0ab459285af071fc0b49664
SHA1 0eb369557d711436c340aedc751b0f793e430ba5
SHA256 92696ce6b182559235780a21fead09ba5072e0bb0519d8a77bccf9d85d1c8d7f
SHA512 7b83d9f47833045408cc4dafa3db624b759822bd5453df861da2e60ffd4eeb2aa39c119e35cfb659da81e1d5de6afe022bd612a058c5deb59533ed9c260d7ec7

memory/2788-26-0x00000000754B0000-0x000000007560D000-memory.dmp

memory/2788-30-0x0000000000400000-0x0000000000431000-memory.dmp

C:\Windows\System\svchost.exe

MD5 b7eb82cce98c259f83df6848280d3f9e
SHA1 697c7c34ef977729dab50dc682c32a44466ede6a
SHA256 75f060ced9ef21a8da05d52a773ad8421b2c700910ddf2a00751335f783b235b
SHA512 47bd61db07f9cdc00a53ffc6f6a856c2cedda144279d45df3b0a33ad87c59abb928419db6a5ccef70b0b62ca4f62b9cd4e9c20364a3a7290c2dbc749a9e9c444

memory/4412-41-0x0000000000400000-0x0000000000431000-memory.dmp

memory/4412-42-0x0000000000400000-0x0000000000431000-memory.dmp

memory/4412-37-0x00000000754B0000-0x000000007560D000-memory.dmp

memory/3680-45-0x00000000754B0000-0x000000007560D000-memory.dmp

memory/3680-51-0x0000000000400000-0x0000000000431000-memory.dmp

memory/3764-58-0x0000000000401000-0x000000000042E000-memory.dmp

memory/3764-57-0x0000000000400000-0x0000000000431000-memory.dmp

C:\Users\Admin\AppData\Roaming\mrsys.exe

MD5 9bb2a21fd9ea8497338ad064f3a79e6c
SHA1 b03f54c3f02b0f7ce116edc4080909832ee37543
SHA256 8a206c442e38f68356a02d0e4bc57eb9fe76bfa11578695d3ee698b06744a753
SHA512 e818034a939f632afe231c7f454c6d82f7ca77f6e1e75afa8d6ce6dfc23f11c48338d2f1bdbe1a09a0982597dc21803c8c5eecb23654b7550f15de16813b65b6

memory/2788-56-0x0000000000400000-0x0000000000431000-memory.dmp

memory/3192-60-0x0000000000400000-0x0000000000431000-memory.dmp

memory/4412-62-0x0000000000400000-0x0000000000431000-memory.dmp

memory/3192-71-0x0000000000400000-0x0000000000431000-memory.dmp