Malware Analysis Report

2025-08-05 19:16

Sample ID 240526-d8x1sade8y
Target 5d990147db1016b8a08a535f962af420_NeikiAnalytics.exe
SHA256 85c5390c3ef6dba5814f298d4f35ca965c42da3962a6b33ef7ed9081a30bd38e
Tags
evasion persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

85c5390c3ef6dba5814f298d4f35ca965c42da3962a6b33ef7ed9081a30bd38e

Threat Level: Known bad

The file 5d990147db1016b8a08a535f962af420_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

evasion persistence

Modifies visiblity of hidden/system files in Explorer

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Unsigned PE

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-26 03:41

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-26 03:41

Reported

2024-05-26 03:43

Platform

win7-20240221-en

Max time kernel

150s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5d990147db1016b8a08a535f962af420_NeikiAnalytics.exe"

Signatures

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Users\Admin\AppData\Local\Temp\5d990147db1016b8a08a535f962af420_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Users\Admin\Admin.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\Admin.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\Admin = "C:\\Users\\Admin\\Admin.exe" C:\Users\Admin\AppData\Local\Temp\5d990147db1016b8a08a535f962af420_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\Admin = "C:\\Users\\Admin\\Admin.exe" C:\Users\Admin\Admin.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\5d990147db1016b8a08a535f962af420_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5d990147db1016b8a08a535f962af420_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5d990147db1016b8a08a535f962af420_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5d990147db1016b8a08a535f962af420_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5d990147db1016b8a08a535f962af420_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5d990147db1016b8a08a535f962af420_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5d990147db1016b8a08a535f962af420_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5d990147db1016b8a08a535f962af420_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5d990147db1016b8a08a535f962af420_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5d990147db1016b8a08a535f962af420_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5d990147db1016b8a08a535f962af420_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5d990147db1016b8a08a535f962af420_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5d990147db1016b8a08a535f962af420_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5d990147db1016b8a08a535f962af420_NeikiAnalytics.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\5d990147db1016b8a08a535f962af420_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\5d990147db1016b8a08a535f962af420_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\5d990147db1016b8a08a535f962af420_NeikiAnalytics.exe"

C:\Users\Admin\Admin.exe

"C:\Users\Admin\Admin.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 ns1.theimageparlour.net udp
US 206.189.185.75:8000 ns1.theimageparlour.net tcp

Files

memory/2024-0-0x0000000000400000-0x000000000040C000-memory.dmp

\Users\Admin\Admin.exe

MD5 61c55da4cd6574487977257e8b160d35
SHA1 80b76f2c49df5695cde501125dc16e32534d4b00
SHA256 7f7fba60865ae87525161b6f975f2b517703fe43fe4652b12767b80e4a3c1b90
SHA512 6fdca15021f3c1a004f3d789c0e678019610cd76fb568f9a5478abe50f8ee76e8156b505133e2f9ace59084f1beb062797f4ac2ac9742362292511c23688fe77

memory/2228-13-0x0000000000400000-0x000000000040C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-26 03:41

Reported

2024-05-26 03:43

Platform

win10v2004-20240508-en

Max time kernel

150s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5d990147db1016b8a08a535f962af420_NeikiAnalytics.exe"

Signatures

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Users\Admin\AppData\Local\Temp\5d990147db1016b8a08a535f962af420_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Users\Admin\Admin.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\5d990147db1016b8a08a535f962af420_NeikiAnalytics.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\Admin.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Admin = "C:\\Users\\Admin\\Admin.exe" C:\Users\Admin\AppData\Local\Temp\5d990147db1016b8a08a535f962af420_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Admin = "C:\\Users\\Admin\\Admin.exe" C:\Users\Admin\Admin.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\5d990147db1016b8a08a535f962af420_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5d990147db1016b8a08a535f962af420_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5d990147db1016b8a08a535f962af420_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5d990147db1016b8a08a535f962af420_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5d990147db1016b8a08a535f962af420_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5d990147db1016b8a08a535f962af420_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5d990147db1016b8a08a535f962af420_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5d990147db1016b8a08a535f962af420_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5d990147db1016b8a08a535f962af420_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5d990147db1016b8a08a535f962af420_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5d990147db1016b8a08a535f962af420_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5d990147db1016b8a08a535f962af420_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5d990147db1016b8a08a535f962af420_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5d990147db1016b8a08a535f962af420_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5d990147db1016b8a08a535f962af420_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5d990147db1016b8a08a535f962af420_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5d990147db1016b8a08a535f962af420_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5d990147db1016b8a08a535f962af420_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5d990147db1016b8a08a535f962af420_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5d990147db1016b8a08a535f962af420_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5d990147db1016b8a08a535f962af420_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5d990147db1016b8a08a535f962af420_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5d990147db1016b8a08a535f962af420_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5d990147db1016b8a08a535f962af420_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5d990147db1016b8a08a535f962af420_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5d990147db1016b8a08a535f962af420_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5d990147db1016b8a08a535f962af420_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5d990147db1016b8a08a535f962af420_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5d990147db1016b8a08a535f962af420_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5d990147db1016b8a08a535f962af420_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5d990147db1016b8a08a535f962af420_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5d990147db1016b8a08a535f962af420_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5d990147db1016b8a08a535f962af420_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5d990147db1016b8a08a535f962af420_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5d990147db1016b8a08a535f962af420_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5d990147db1016b8a08a535f962af420_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\5d990147db1016b8a08a535f962af420_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\Admin.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\5d990147db1016b8a08a535f962af420_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\5d990147db1016b8a08a535f962af420_NeikiAnalytics.exe"

C:\Users\Admin\Admin.exe

"C:\Users\Admin\Admin.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 ns1.theimageparlour.net udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 4.73.50.20.in-addr.arpa udp

Files

memory/224-0-0x0000000000400000-0x000000000040C000-memory.dmp

C:\Users\Admin\Admin.exe

MD5 03f68d02006708c1ef603dc43524438e
SHA1 f979a68fac19794ff40a022130ebe6b17156a30a
SHA256 6ed950fcbcaf6d95f13e0c6fad515da1a8393a69aaba82520d9433f63a0795a5
SHA512 3a11707c5045a774a03da43c17081b8d44e79c180e34fbbe9ed568a14bdf052af8ed8babf96049f67c69430da5cdaa5da98aa760880879a124fa6aba0fa879ed

memory/1468-33-0x0000000000400000-0x000000000040C000-memory.dmp