ff999f9bca7aa7fd1560a7155fa58c6e05a563c159819399980370327586929a

Analysis

max time kernel
142s
max time network
118s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 09:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe
Size

5.7MB
MD5

b32ab2de851bdaf8ea45c2b5e986cfa0
SHA1

f7d851e4970758e5b8ea3efaab77795425e6a059
SHA256

ff999f9bca7aa7fd1560a7155fa58c6e05a563c159819399980370327586929a
SHA512

3dc011884a3cd521569e398420982a02d5aadee16c82ffe65acdf6bc285af8946dffd197e3a77732322ea2f6d0a101989747801f035b7a172dd993cf526892b9
SSDEEP

98304:aJnPsinGJq1y7eYEP4o18frP3wbzWFimaI7dlZtWV:JinF4gbzWFimaI7dlzWV

Score

8^/10

adware persistence spyware stealer upx

Malware Config

Signatures

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000b000000015cbd-1.dat	acprotect

Loads dropped DLL 7 IoCs

pid	Process
1924	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe
1924	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe
1112	regsvr32.exe
2876	regsvr32.exe
2880	regsvr32.exe
804	regsvr32.exe
1548	regsvr32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 15 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000b000000015cbd-1.dat	upx
behavioral1/memory/1924-3-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/1112-15-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/1924-18-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/1924-26-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2880-28-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2876-27-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/1924-25-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2880-31-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/804-34-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/1548-37-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/1924-43-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/1924-47-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/1924-51-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/1924-54-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\IDMan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe /onboot"	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\e:	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\symsrv.dll	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe
File created	\??\c:\program files\common files\system\symsrv.dll.000	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 21 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\MenuExt\	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe"	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEExt.htm"	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe"	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3"	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\Policy = "3"	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe"	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\contexts = "243"	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Low Rights	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3"	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan.CIDMLinkTransmitter"	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\AppID = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\RunAs = "Interactive User"	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID\ = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe"	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan"	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ROTFlags = "1"	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1924	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe
1924	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe
1924	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1924	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1924	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe
Token: SeRestorePrivilege	1924	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1924	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1924	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
1924	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe
1924	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe
1924	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe
1924	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe
1924	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe
1924	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe
1924	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe
1924	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe
1924	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe
1924	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe
1924	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 1112	1924	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe	29
PID 1924 wrote to memory of 1112	1924	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe	29
PID 1924 wrote to memory of 1112	1924	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe	29
PID 1924 wrote to memory of 1112	1924	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe	29
PID 1924 wrote to memory of 1112	1924	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe	29
PID 1924 wrote to memory of 1112	1924	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe	29
PID 1924 wrote to memory of 1112	1924	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe	29
PID 1924 wrote to memory of 2876	1924	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe	31
PID 1924 wrote to memory of 2876	1924	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe	31
PID 1924 wrote to memory of 2876	1924	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe	31
PID 1924 wrote to memory of 2876	1924	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe	31
PID 1924 wrote to memory of 2876	1924	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe	31
PID 1924 wrote to memory of 2876	1924	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe	31
PID 1924 wrote to memory of 2876	1924	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe	31
PID 1924 wrote to memory of 2880	1924	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe	32
PID 1924 wrote to memory of 2880	1924	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe	32
PID 1924 wrote to memory of 2880	1924	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe	32
PID 1924 wrote to memory of 2880	1924	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe	32
PID 1924 wrote to memory of 2880	1924	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe	32
PID 1924 wrote to memory of 2880	1924	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe	32
PID 1924 wrote to memory of 2880	1924	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe	32
PID 1924 wrote to memory of 804	1924	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe	33
PID 1924 wrote to memory of 804	1924	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe	33
PID 1924 wrote to memory of 804	1924	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe	33
PID 1924 wrote to memory of 804	1924	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe	33
PID 1924 wrote to memory of 804	1924	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe	33
PID 1924 wrote to memory of 804	1924	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe	33
PID 1924 wrote to memory of 804	1924	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe	33
PID 1924 wrote to memory of 1548	1924	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe	34
PID 1924 wrote to memory of 1548	1924	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe	34
PID 1924 wrote to memory of 1548	1924	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe	34
PID 1924 wrote to memory of 1548	1924	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe	34
PID 1924 wrote to memory of 1548	1924	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe	34
PID 1924 wrote to memory of 1548	1924	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe	34
PID 1924 wrote to memory of 1548	1924	b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe	34

C:\Users\Admin\AppData\Local\Temp\b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\b32ab2de851bdaf8ea45c2b5e986cfa0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
  2⤵
  - Loads dropped DLL
  PID:1112
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
  2⤵
  - Loads dropped DLL
  PID:2876
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"
  2⤵
  - Loads dropped DLL
  PID:2880
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"
  2⤵
  - Loads dropped DLL
  PID:804
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"
  2⤵
  - Loads dropped DLL
  PID:1548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\System\symsrv.dll.000

Filesize
175B

MD5
1130c911bf5db4b8f7cf9b6f4b457623

SHA1
48e734c4bc1a8b5399bff4954e54b268bde9d54c

SHA256
eba08cc8182f379392a97f542b350ea0dbbe5e4009472f35af20e3d857eafdf1

SHA512
94e2511ef2c53494c2aff0960266491ffc0e54e75185427d1ccedae27c286992c754ca94cbb0c9ea36e3f04cd4eb7f032c551cf2d4b309f292906303f1a75fa0

Download Submit
\Program Files\Common Files\System\symsrv.dll

Filesize
67KB

MD5
7574cf2c64f35161ab1292e2f532aabf

SHA1
14ba3fa927a06224dfe587014299e834def4644f

SHA256
de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085

SHA512
4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab

Download Submit
\Users\Admin\AppData\Local\Temp\A1D26E2\2EEDB7C784.tmp

Filesize
5.6MB

MD5
1e0f25fc9bf58365e65422e1d338e346

SHA1
a69cef4b2dd0ac2cd438ef6c9ec2d45d6adbea71

SHA256
3317e3c053884436ca55287f8438df7c3ef04ecd5d4eddc625765198788c506b

SHA512
b59ef099eff69c1c2b179c8014b7eaf22c4c6d31d5a9804b58e37773f79b3dc6803d51a8f584b141f3d996489583f93def0a260ae60cea37a7422c863ff868fe

Download Submit
memory/804-34-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/1112-15-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/1548-37-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/1924-24-0x0000000001080000-0x000000000162B000-memory.dmp

Filesize
5.7MB

Download
memory/1924-18-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/1924-70-0x0000000001080000-0x000000000162B000-memory.dmp

Filesize
5.7MB

Download
memory/1924-25-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/1924-26-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/1924-54-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/1924-17-0x0000000001080000-0x000000000162B000-memory.dmp

Filesize
5.7MB

Download
memory/1924-51-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/1924-43-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/1924-42-0x0000000001080000-0x000000000162B000-memory.dmp

Filesize
5.7MB

Download
memory/1924-3-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/1924-47-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2876-27-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2880-28-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2880-31-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download