b7ab8a24eb98e5a8cf1a6ba94b5ebc361fc2266f56f2b2586c5a79991e24bbb0

Analysis

max time kernel
141s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 01:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5e4e424fc1a95de6113c4c7c588d6360_NeikiAnalytics.exe
Size 461KB
Sample240530-bngf7aaa97
SHA256 b7ab8a24eb98e5a8cf1a6ba94b5ebc361fc2266f56f2b2586c5a79991e24bbb0
MD5 5e4e424fc1a95de6113c4c7c588d6360
SHA1 ee522082a50d06af803b83516d7ec1e0c27e30b9
SHA512 a86f404721a6a38073ab36b353c3f9653d4d50b7173ed3e6b28461146c44c4690b625e163d1b38738312401fef68ebf8ae97b459af31fbb5154df15f09e40c11
SSDEEP 6144:it03a62hzpSNxV2qcJVLNyTiY6wDyIJ2r/bl5hydz3Sd:Os52hzpHq8eTi30yIQrDl5hydO
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 26 IoCs

pid	Process
2212	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202.exe
1420	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202a.exe
4612	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202b.exe
3816	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202c.exe
1764	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202d.exe
2116	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202e.exe
1044	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202f.exe
1936	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202g.exe
1624	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202h.exe
4852	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202i.exe
3232	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202j.exe
3328	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202k.exe
2192	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202l.exe
4172	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202m.exe
4092	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202n.exe
4292	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202o.exe
3792	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202p.exe
4956	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202q.exe
4756	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202r.exe
1824	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202s.exe
2356	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202t.exe
2212	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202u.exe
2908	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202v.exe
3036	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202w.exe
1428	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202x.exe
2964	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202y.exe

Adds Run key to start application 2 TTPs 26 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Modifies registry class 54 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202f.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 75c3645d165e0891	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202o.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202s.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 75c3645d165e0891	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202s.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	5e4e424fc1a95de6113c4c7c588d6360_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202l.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202o.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202k.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 75c3645d165e0891	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202m.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202n.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 75c3645d165e0891	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202y.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 75c3645d165e0891	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202b.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 75c3645d165e0891	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202f.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202j.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202e.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 75c3645d165e0891	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202v.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 75c3645d165e0891	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202x.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 75c3645d165e0891	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202c.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202d.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202b.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 75c3645d165e0891	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202l.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 75c3645d165e0891	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202j.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202x.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202t.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 75c3645d165e0891	5e4e424fc1a95de6113c4c7c588d6360_NeikiAnalytics.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 75c3645d165e0891	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202n.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 75c3645d165e0891	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202r.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 75c3645d165e0891	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202h.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202i.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 75c3645d165e0891	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202i.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202r.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 75c3645d165e0891	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202u.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 75c3645d165e0891	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202g.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202h.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202p.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 75c3645d165e0891	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202k.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 75c3645d165e0891	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202w.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 75c3645d165e0891	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202t.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202w.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202y.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 75c3645d165e0891	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202c.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 75c3645d165e0891	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202p.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 75c3645d165e0891	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202q.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 75c3645d165e0891	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202d.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202v.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202u.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202a.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202q.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202m.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 75c3645d165e0891	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202a.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 75c3645d165e0891	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202e.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202g.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3700 wrote to memory of 2212	3700	5e4e424fc1a95de6113c4c7c588d6360_NeikiAnalytics.exe	92
PID 3700 wrote to memory of 2212	3700	5e4e424fc1a95de6113c4c7c588d6360_NeikiAnalytics.exe	92
PID 3700 wrote to memory of 2212	3700	5e4e424fc1a95de6113c4c7c588d6360_NeikiAnalytics.exe	92
PID 2212 wrote to memory of 1420	2212	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202.exe	93
PID 2212 wrote to memory of 1420	2212	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202.exe	93
PID 2212 wrote to memory of 1420	2212	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202.exe	93
PID 1420 wrote to memory of 4612	1420	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202a.exe	94
PID 1420 wrote to memory of 4612	1420	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202a.exe	94
PID 1420 wrote to memory of 4612	1420	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202a.exe	94
PID 4612 wrote to memory of 3816	4612	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202b.exe	95
PID 4612 wrote to memory of 3816	4612	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202b.exe	95
PID 4612 wrote to memory of 3816	4612	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202b.exe	95
PID 3816 wrote to memory of 1764	3816	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202c.exe	96
PID 3816 wrote to memory of 1764	3816	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202c.exe	96
PID 3816 wrote to memory of 1764	3816	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202c.exe	96
PID 1764 wrote to memory of 2116	1764	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202d.exe	97
PID 1764 wrote to memory of 2116	1764	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202d.exe	97
PID 1764 wrote to memory of 2116	1764	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202d.exe	97
PID 2116 wrote to memory of 1044	2116	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202e.exe	98
PID 2116 wrote to memory of 1044	2116	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202e.exe	98
PID 2116 wrote to memory of 1044	2116	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202e.exe	98
PID 1044 wrote to memory of 1936	1044	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202f.exe	99
PID 1044 wrote to memory of 1936	1044	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202f.exe	99
PID 1044 wrote to memory of 1936	1044	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202f.exe	99
PID 1936 wrote to memory of 1624	1936	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202g.exe	100
PID 1936 wrote to memory of 1624	1936	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202g.exe	100
PID 1936 wrote to memory of 1624	1936	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202g.exe	100
PID 1624 wrote to memory of 4852	1624	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202h.exe	101
PID 1624 wrote to memory of 4852	1624	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202h.exe	101
PID 1624 wrote to memory of 4852	1624	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202h.exe	101
PID 4852 wrote to memory of 3232	4852	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202i.exe	102
PID 4852 wrote to memory of 3232	4852	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202i.exe	102
PID 4852 wrote to memory of 3232	4852	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202i.exe	102
PID 3232 wrote to memory of 3328	3232	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202j.exe	103
PID 3232 wrote to memory of 3328	3232	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202j.exe	103
PID 3232 wrote to memory of 3328	3232	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202j.exe	103
PID 3328 wrote to memory of 2192	3328	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202k.exe	104
PID 3328 wrote to memory of 2192	3328	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202k.exe	104
PID 3328 wrote to memory of 2192	3328	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202k.exe	104
PID 2192 wrote to memory of 4172	2192	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202l.exe	105
PID 2192 wrote to memory of 4172	2192	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202l.exe	105
PID 2192 wrote to memory of 4172	2192	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202l.exe	105
PID 4172 wrote to memory of 4092	4172	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202m.exe	106
PID 4172 wrote to memory of 4092	4172	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202m.exe	106
PID 4172 wrote to memory of 4092	4172	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202m.exe	106
PID 4092 wrote to memory of 4292	4092	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202n.exe	107
PID 4092 wrote to memory of 4292	4092	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202n.exe	107
PID 4092 wrote to memory of 4292	4092	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202n.exe	107
PID 4292 wrote to memory of 3792	4292	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202o.exe	108
PID 4292 wrote to memory of 3792	4292	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202o.exe	108
PID 4292 wrote to memory of 3792	4292	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202o.exe	108
PID 3792 wrote to memory of 4956	3792	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202p.exe	109
PID 3792 wrote to memory of 4956	3792	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202p.exe	109
PID 3792 wrote to memory of 4956	3792	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202p.exe	109
PID 4956 wrote to memory of 4756	4956	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202q.exe	110
PID 4956 wrote to memory of 4756	4956	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202q.exe	110
PID 4956 wrote to memory of 4756	4956	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202q.exe	110
PID 4756 wrote to memory of 1824	4756	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202r.exe	111
PID 4756 wrote to memory of 1824	4756	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202r.exe	111
PID 4756 wrote to memory of 1824	4756	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202r.exe	111
PID 1824 wrote to memory of 2356	1824	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202s.exe	112
PID 1824 wrote to memory of 2356	1824	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202s.exe	112
PID 1824 wrote to memory of 2356	1824	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202s.exe	112
PID 2356 wrote to memory of 2212	2356	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202t.exe	113

C:\Users\Admin\AppData\Local\Temp\5e4e424fc1a95de6113c4c7c588d6360_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5e4e424fc1a95de6113c4c7c588d6360_NeikiAnalytics.exe"
1⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3700
- \??\c:\users\admin\appdata\local\temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202.exe
  c:\users\admin\appdata\local\temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2212
- - \??\c:\users\admin\appdata\local\temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202a.exe
    c:\users\admin\appdata\local\temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202a.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1420
  - - \??\c:\users\admin\appdata\local\temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202b.exe
      c:\users\admin\appdata\local\temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202b.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4612
    - - \??\c:\users\admin\appdata\local\temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202c.exe
        
        c:\users\admin\appdata\local\temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202c.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3816
      - \??\c:\users\admin\appdata\local\temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202d.exe
        
        c:\users\admin\appdata\local\temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202d.exe
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1764
        
        \??\c:\users\admin\appdata\local\temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202e.exe
        
        c:\users\admin\appdata\local\temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202e.exe
        7⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2116
        
        \??\c:\users\admin\appdata\local\temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202f.exe
        
        c:\users\admin\appdata\local\temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202f.exe
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1044
        
        \??\c:\users\admin\appdata\local\temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202g.exe
        
        c:\users\admin\appdata\local\temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202g.exe
        9⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1936
        
        \??\c:\users\admin\appdata\local\temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202h.exe
        
        c:\users\admin\appdata\local\temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202h.exe
        10⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1624
        
        \??\c:\users\admin\appdata\local\temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202i.exe
        
        c:\users\admin\appdata\local\temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202i.exe
        11⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4852
        
        \??\c:\users\admin\appdata\local\temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202j.exe
        
        c:\users\admin\appdata\local\temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202j.exe
        12⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3232
        
        \??\c:\users\admin\appdata\local\temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202k.exe
        
        c:\users\admin\appdata\local\temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202k.exe
        13⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3328
        
        \??\c:\users\admin\appdata\local\temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202l.exe
        
        c:\users\admin\appdata\local\temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202l.exe
        14⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2192
        
        \??\c:\users\admin\appdata\local\temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202m.exe
        
        c:\users\admin\appdata\local\temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202m.exe
        15⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4172
        
        \??\c:\users\admin\appdata\local\temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202n.exe
        
        c:\users\admin\appdata\local\temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202n.exe
        16⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4092
        
        \??\c:\users\admin\appdata\local\temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202o.exe
        
        c:\users\admin\appdata\local\temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202o.exe
        17⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4292
        
        \??\c:\users\admin\appdata\local\temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202p.exe
        
        c:\users\admin\appdata\local\temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202p.exe
        18⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3792
        
        \??\c:\users\admin\appdata\local\temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202q.exe
        
        c:\users\admin\appdata\local\temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202q.exe
        19⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4956
        
        \??\c:\users\admin\appdata\local\temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202r.exe
        
        c:\users\admin\appdata\local\temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202r.exe
        20⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4756
        
        \??\c:\users\admin\appdata\local\temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202s.exe
        
        c:\users\admin\appdata\local\temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202s.exe
        21⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1824
        
        \??\c:\users\admin\appdata\local\temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202t.exe
        
        c:\users\admin\appdata\local\temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202t.exe
        22⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2356
        
        \??\c:\users\admin\appdata\local\temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202u.exe
        
        c:\users\admin\appdata\local\temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202u.exe
        23⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        
        PID:2212
        
        \??\c:\users\admin\appdata\local\temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202v.exe
        
        c:\users\admin\appdata\local\temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202v.exe
        24⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        
        PID:2908
        
        \??\c:\users\admin\appdata\local\temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202w.exe
        
        c:\users\admin\appdata\local\temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202w.exe
        25⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        
        PID:3036
        
        \??\c:\users\admin\appdata\local\temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202x.exe
        
        c:\users\admin\appdata\local\temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202x.exe
        26⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        
        PID:1428
        
        \??\c:\users\admin\appdata\local\temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202y.exe
        
        c:\users\admin\appdata\local\temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202y.exe
        27⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2964

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4172 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
1⤵
PID:1100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202.exe

Path C:\Users\Admin\AppData\Local\Temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202.exe
Size 462KB
SHA256 7bd6e3c75b31a01c6c628fb1f441f5900fc7bcefbb05314c46b094a6892b54a3
MD5 338ab84a620b3fd572602239dc19c47b
SHA1 c898691f3aaa20169975233d97526b5440dac123
SHA512 af13ac18cc9407aab65f3b8c7b7b9c1d64bedcb488e765034d7a4ab23d2150dcf1525b62e154f14c334fc80e944e2755b65c4d3fb0587fe4be586a47399644c6
SSDEEP 6144:it03a62hzpSNxV2qcJVLNyTiY6wDyIJ2r/bl5hydz3Su:Os52hzpHq8eTi30yIQrDl5hydF
MD5 SHA1 SHA512 SSDEEP

Submit Download

5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202c.exe

Path C:\Users\Admin\AppData\Local\Temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202c.exe
Size 462KB
SHA256 d29d04732171a6134d3f0317ebd32278fe5cb6f599ad445deeea2972e7368295
MD5 280b614136e1111db2fbd8c9d449c5e7
SHA1 6d60c24b1c1c3d7760dae52c89cf1d067268effc
SHA512 5b7272526c636b3aa0a922b4b0dc1cdd2faa95e239107320a0225be44c81a151b507c5757b556f9b0153629052ea1173a78a92c663142484c27f7e4cfd0e14a3
SSDEEP 6144:it03a62hzpSNxV2qcJVLNyTiY6wDyIJ2r/bl5hydz3Sb:Os52hzpHq8eTi30yIQrDl5hydc
MD5 SHA1 SHA512 SSDEEP

Submit Download

5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202d.exe

Path C:\Users\Admin\AppData\Local\Temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202d.exe
Size 463KB
SHA256 23e5bc053e366a4f71ec28b8d3ad37d8604b015d436e10752b862731ce200ccc
MD5 88d39847a8a33f9a079d2f64d2770d2d
SHA1 dec15d73f5e1b52fbd10bb3775d3d822c3ea60c6
SHA512 d7f80811edde6d271f6d30e099501039553dc65ddfdd8b96d99ffdb0eb82faa4044d0b8bc8abcd77de7129f504ca03e414ba26bd4d0a704d7995e3f3464370c8
SSDEEP 6144:it03a62hzpSNxV2qcJVLNyTiY6wDyIJ2r/bl5hydz3Sh:Os52hzpHq8eTi30yIQrDl5hydO
MD5 SHA1 SHA512 SSDEEP

Submit Download

5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202g.exe

Path C:\Users\Admin\AppData\Local\Temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202g.exe
Size 463KB
SHA256 8ebdbbcaedb2fb65a115f85b33b37edd3276538124a64396c8f247fe4a4b3119
MD5 30f87a1133cf608dada33fd46d387b14
SHA1 893e3a9c1c006f6a0b35b1a88061e092493d3c81
SHA512 c99c332feb434c3385d688b680094ccd8ab682d73eed3807ce2d8d5ec99b0b920ce799b71a2d6206c4ef4ed082de541e048a8e4afd94f68ecd9037e38889a18a
SSDEEP 6144:it03a62hzpSNxV2qcJVLNyTiY6wDyIJ2r/bl5hydz3Si:Os52hzpHq8eTi30yIQrDl5hydJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202h.exe

Path C:\Users\Admin\AppData\Local\Temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202h.exe
Size 463KB
SHA256 1f70f14a80181fcede715fb7bf48e620bb3d46cd80f42d872d2be4b2c5bd103c
MD5 29ae5640b528c70b973486150740764c
SHA1 3b33437e4ff7e679e9cf9fc79d62777aad8320f5
SHA512 92fb1dfe799d3e59403d3e32732a45ad10a02f8ab44dde6789966abf58858f172c24eacd91a85910318aa8a3eb8a28c2b64070b76ba0e48ad9a0e1445eefeff7
SSDEEP 6144:it03a62hzpSNxV2qcJVLNyTiY6wDyIJ2r/bl5hydz3SZ:Os52hzpHq8eTi30yIQrDl5hydW
MD5 SHA1 SHA512 SSDEEP

Submit Download

5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202i.exe

Path C:\Users\Admin\AppData\Local\Temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202i.exe
Size 464KB
SHA256 c44f548e2efb578546efb75036dc2d3afbfcdd487cd8cef591c76b980e0fe3e4
MD5 30fbbcb95d9b82797f8443cd05f1be58
SHA1 4b5d051b5a8dac9e7dd0f6b32e8c032ea9a4ec76
SHA512 f22c9b975fc697f557a492a1e56789915185e8ff7f5ebdb1eeee249441fa7e903c702cbb9732cbfa382047eb8437b8237d54ed2c5cdd2219398f4c8573e9d2e3
SSDEEP 6144:it03a62hzpSNxV2qcJVLNyTiY6wDyIJ2r/bl5hydz3Sd:Os52hzpHq8eTi30yIQrDl5hydG
MD5 SHA1 SHA512 SSDEEP

Submit Download

5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202j.exe

Path C:\Users\Admin\AppData\Local\Temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202j.exe
Size 464KB
SHA256 f89d72943b92f8200e287e644d04aaf09dde9deb7391cf2fd51cec2d41009952
MD5 3233665aeb75fc3d627787f994672beb
SHA1 07a3e81dda19d431d86e297d626e67fcca17375b
SHA512 785948c458f8694412caad45b8ec5047d42f3528836b455542af1609ebdb648e0ed02c0bb427f63e69e05d116f73372687bfce9f3592da9cfba8f7e3762ad6c4
SSDEEP 6144:it03a62hzpSNxV2qcJVLNyTiY6wDyIJ2r/bl5hydz3Se:Os52hzpHq8eTi30yIQrDl5hydl
MD5 SHA1 SHA512 SSDEEP

Submit Download

5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202n.exe

Path C:\Users\Admin\AppData\Local\Temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202n.exe
Size 465KB
SHA256 fb0ab683fc862181a912327d5a2d604521f0a20c3d97cb8387e7d5f82aedfeab
MD5 d5a4ca6e42167846079933ff9f4766a3
SHA1 67ee2a00eaef9f602ab9e2e22e148b1da8a84d32
SHA512 be1426435bd73c8bc39b265822a847e8067dc70fc5b17123ea1b048d965828e516b980babf7dd11ef17dda1e4a3d4fcae7c6957048916f3323bd4c2f773ef412
SSDEEP 6144:it03a62hzpSNxV2qcJVLNyTiY6wDyIJ2r/bl5hydz3Sh:Os52hzpHq8eTi30yIQrDl5hydC
MD5 SHA1 SHA512 SSDEEP

Submit Download

5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202o.exe

Path C:\Users\Admin\AppData\Local\Temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202o.exe
Size 465KB
SHA256 ebdbfb849635848e2ec97968fb755928a29b71906e9a8f306e73b74fe12ea0a2
MD5 6ce5fea959c9666e837ec91f90ed878d
SHA1 1dff2728e8d3bc91d470bddf05de73c2423825c2
SHA512 b2ea8d0266ef9cb4c08716b4637355d2d133b082b55439843fc284209ba1f5d82c460daea7006348dff4e7a297c7131a025e0b4b672b8d8d6d7cfb8a6e0cc786
SSDEEP 6144:it03a62hzpSNxV2qcJVLNyTiY6wDyIJ2r/bl5hydz3SC:Os52hzpHq8eTi30yIQrDl5hydZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202r.exe

Path C:\Users\Admin\AppData\Local\Temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202r.exe
Size 466KB
SHA256 9e22acac09163ab108ca31260a16f67c3cd64d07e819328b247e71df8fcd2fa6
MD5 0c1a931b7a84dcf9e6b99e863de03bdc
SHA1 89f9ea3da5fa05e07ccd4fdd0387acce1a571061
SHA512 a7c7876c4943bb669de670baa89368cfa562a1aa47219c42cb43fb96a6b8836a2a9a7b2d9b5d817212b5ae92e993bf73e48b659daf95271d12e36705f535ef97
SSDEEP 6144:it03a62hzpSNxV2qcJVLNyTiY6wDyIJ2r/bl5hydz3S2:Os52hzpHq8eTi30yIQrDl5hydh
MD5 SHA1 SHA512 SSDEEP

Submit Download

5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202s.exe

Path C:\Users\Admin\AppData\Local\Temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202s.exe
Size 466KB
SHA256 9754a445e44d55ca8cdda061bf2e2e91724e2f29712d094b7093883108a8fee9
MD5 ba9b2cf748b80e9bf8ff3b9ff9e6865d
SHA1 f0af8918d37fb974bc553d1812007210279ccd51
SHA512 54b55f432b5ea3b55af2ec39057691e57f183b3ae4842c52b796e50061359b42a123e8e9436457df40ab42f34b9424a11ffdb4da4fac3fd03062e4df98f97c88
SSDEEP 6144:it03a62hzpSNxV2qcJVLNyTiY6wDyIJ2r/bl5hydz3S3:Os52hzpHq8eTi30yIQrDl5hyd4
MD5 SHA1 SHA512 SSDEEP

Submit Download

5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202t.exe

Path C:\Users\Admin\AppData\Local\Temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202t.exe
Size 466KB
SHA256 03cfe777b8ae74a76ec6bc0a4d5394aeccc058aad288ac09f2e94e34dcbfb9d7
MD5 fb5e7bdcf861b579a0f354e4a09e8ed7
SHA1 f697cc228198c844a8abc14749e41b9e777829e5
SHA512 9a9803b0caa1aba64936372f689f246a67e37fc723a15a6964dce881d1a8cc12e3745919edfab1027466b5d8a785fa952de2726da34542123b85b7ceb2f11ca0
SSDEEP 6144:it03a62hzpSNxV2qcJVLNyTiY6wDyIJ2r/bl5hydz3Se:Os52hzpHq8eTi30yIQrDl5hydx
MD5 SHA1 SHA512 SSDEEP

Submit Download

5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202u.exe

Path C:\Users\Admin\AppData\Local\Temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202u.exe
Size 466KB
SHA256 647cae4da1a7529772cbc0ef62b73944ecc1d58501380fec3ded5e64ddc6fe01
MD5 42aee88529fc03d5a054d095ae7a0a2b
SHA1 464148c16352de6a312e8ab699191040b68c5974
SHA512 ba5acad95afea817c4f210b88b8aa64ed2171bea2940678af1bf606c5bbe1989a2ea0a8cb5e391bb583f4ba92b9e0b58bf41482a1aa83a5fc01b7fffec75288b
SSDEEP 6144:it03a62hzpSNxV2qcJVLNyTiY6wDyIJ2r/bl5hydz3Sz:Os52hzpHq8eTi30yIQrDl5hydM
MD5 SHA1 SHA512 SSDEEP

Submit Download

5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202w.exe

Path C:\Users\Admin\AppData\Local\Temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202w.exe
Size 467KB
SHA256 44b8410a9c24d8ad222560b34798274f1f9ea6dac8deb58778ab9360f9a95340
MD5 7c203a7480f86179310e79f5f92e9017
SHA1 5d9d60f53933c090e9129d7c6874015c9f383fd0
SHA512 9228cd1e050cf8b9e9f99f3cf98d57418224a937ecbcedc274bea8eb9829fc68e9af24afc6db08e76562c4110f04cbf4ba94e8c7b6489fcd84dd8e4029ee8792
SSDEEP 6144:it03a62hzpSNxV2qcJVLNyTiY6wDyIJ2r/bl5hydz3Sz:Os52hzpHq8eTi30yIQrDl5hydU
MD5 SHA1 SHA512 SSDEEP

Submit Download

5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202y.exe

Path C:\Users\Admin\AppData\Local\Temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202y.exe
Size 467KB
SHA256 31123ea47e8bfc3f2916d907960b36420a76ddea832b164554f71502ace0495b
MD5 1a97d6c03c395122a9b332592868bad6
SHA1 5933557126c565a3b63fd28e7fa7f46e27b20244
SHA512 f679b5c97498ff2591b71131a9950054982b8f1cf4466f85f7b9cbbbe588fcb8fab52218ad1d7306d39861a2a386021f6c7b1f93b858eeccf34508a2139c2893
SSDEEP 6144:it03a62hzpSNxV2qcJVLNyTiY6wDyIJ2r/bl5hydz3SX:Os52hzpHq8eTi30yIQrDl5hyd0
MD5 SHA1 SHA512 SSDEEP

Submit Download

5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202a.exe

Path \??\c:\users\admin\appdata\local\temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202a.exe
Size 462KB
SHA256 d6eea8aa2428fb1d64879e2443b056191427916a1d08c212a5dab09df9793ab9
MD5 9b9cd26afa5bed5936918189e0939fd3
SHA1 179848376fd07aa3a7f08367c16fed5454051e5a
SHA512 22bca2a55a57969b2c86f6318b0f73b0a763a817d07d9e732e9b2ec2fa29847405055e98d0fc23befd84fb68b4e700987d861e1a4156e1dc2cf083f44ce9ba68
SSDEEP 6144:it03a62hzpSNxV2qcJVLNyTiY6wDyIJ2r/bl5hydz3Sz:Os52hzpHq8eTi30yIQrDl5hydA
MD5 SHA1 SHA512 SSDEEP

Submit Download

5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202b.exe

Path \??\c:\users\admin\appdata\local\temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202b.exe
Size 462KB
SHA256 c91e018438d1775942247dfa36e4a18a5f2349ac6f4f9f24449447ed9f7d0cbc
MD5 0ec9f00b0e04cb25e16cf10835142612
SHA1 87f99c2263cbba9838f282e57d7dbeebd2444e95
SHA512 0b4a2c0655a01789d9b20ae098384b817905320be79eef9bf704d41975b0ae73b36de61bd720df4a3c5117152f4816bc7f454f0ab1c72fe584c2261cce1a571c
SSDEEP 6144:it03a62hzpSNxV2qcJVLNyTiY6wDyIJ2r/bl5hydz3Sm:Os52hzpHq8eTi30yIQrDl5hyd5
MD5 SHA1 SHA512 SSDEEP

Submit Download

5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202e.exe

Path \??\c:\users\admin\appdata\local\temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202e.exe
Size 463KB
SHA256 442b429421e0b463770609d8ba6628a7e1067462f146bb749ba9a07b51e2a345
MD5 2b43ca7072ca61dd03278553bb1a3cc1
SHA1 23316dfd2e77c0c8a265acfe3bd8a5702cd70741
SHA512 3eb981943b88f00d78fb762e1b67633ba1667153bd8c7af88c9bb93fc96397d6af166aa6001b6c61d04784739a50d0ef702ea89a1412d600792c0b387a8e709b
SSDEEP 6144:it03a62hzpSNxV2qcJVLNyTiY6wDyIJ2r/bl5hydz3SM:Os52hzpHq8eTi30yIQrDl5hydb
MD5 SHA1 SHA512 SSDEEP

Submit Download

5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202f.exe

Path \??\c:\users\admin\appdata\local\temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202f.exe
Size 463KB
SHA256 3da1103d4e2de45a76d54747fa029d5d0daf9b3f49a07906690a683dcb482b38
MD5 0d7b8ac05ade6bf0fbf3cc817dcb37ce
SHA1 f19036baa95baa98240939786368d0d099d1a911
SHA512 bc74e92dbba4f5a6378b8c11b2a04735f32ee6ed117842281ea5944f5283b59b5f392d658b14414c36fbd61afb246d1b6cd201ee8d666329b081740699c16383
SSDEEP 6144:it03a62hzpSNxV2qcJVLNyTiY6wDyIJ2r/bl5hydz3Sx:Os52hzpHq8eTi30yIQrDl5hydm
MD5 SHA1 SHA512 SSDEEP

Submit Download

5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202k.exe

Path \??\c:\users\admin\appdata\local\temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202k.exe
Size 464KB
SHA256 23f962cab24ec97bff183c70f929dbb7cdd5ac313bfbf3d3f7a05ca60cccf82d
MD5 6b3d2b74d29c4345e9e6155a7a9eec16
SHA1 13417442dc48703d46fa8c09b004bbd5f4e24aa2
SHA512 5e896659408b24f713a57e7f7e46441047e166a11674e791c27a0b1b0bf88553f4b7f7810874b4fd19ab4d22dcc6e09e8e7db53f0f127f22d9bac6e72bbab028
SSDEEP 6144:it03a62hzpSNxV2qcJVLNyTiY6wDyIJ2r/bl5hydz3S5:Os52hzpHq8eTi30yIQrDl5hyd2
MD5 SHA1 SHA512 SSDEEP

Submit Download

5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202l.exe

Path \??\c:\users\admin\appdata\local\temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202l.exe
Size 464KB
SHA256 6381b9f5db907168d2d2a43d48243d17e097778b2fcca4c52af53a5078000f4c
MD5 6f4cb3743712359bb81acb9f455ff9dc
SHA1 f9f3b9100408a521ef6b0bc0e49c1681720f5dc9
SHA512 b21ad9013ebfc7c9d27d2a09c0b4d28aa7bf97937a78b8d116af93abb1947097539dea33ecbc6b7edecd7234f3ad8be3acf46616d6aa215a50dcb50c002c355a
SSDEEP 6144:it03a62hzpSNxV2qcJVLNyTiY6wDyIJ2r/bl5hydz3Sy:Os52hzpHq8eTi30yIQrDl5hydl
MD5 SHA1 SHA512 SSDEEP

Submit Download

5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202m.exe

Path \??\c:\users\admin\appdata\local\temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202m.exe
Size 465KB
SHA256 1348026dde9bca503927ef0caa6c174ce40d554a8151a1247dfacf793f1e868b
MD5 93350a99041c70f608d5527d27431499
SHA1 c00e1823e68eb71a2cb14cd3544495e54a699b28
SHA512 c8e9d4c94f85e3daf3b36851fc7ee68da41919a1d61260e879204f015943bf71ebb0778658bdd693460697a6a71e3f487fa2afa3539a86610d5f35807621b369
SSDEEP 6144:it03a62hzpSNxV2qcJVLNyTiY6wDyIJ2r/bl5hydz3SJ:Os52hzpHq8eTi30yIQrDl5hydK
MD5 SHA1 SHA512 SSDEEP

Submit Download

5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202p.exe

Path \??\c:\users\admin\appdata\local\temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202p.exe
Size 465KB
SHA256 f694a68787b8fb040c1766f72a5a3f75159cad8bd4a78dc7d75f67f16f7d6b17
MD5 74e1141b9601092f2c7a1807980a09db
SHA1 b65d5d4abfc547d6978a3f04cfce931f3adeb551
SHA512 d64388249a817e831720e41f06e55c0b7264acebe1692879c9bc788527bb5fbc0d3e6ff51f0c0db95c994ee40d725cd04e2f82a2a2cb4ed5b0d5a49f563604ff
SSDEEP 6144:it03a62hzpSNxV2qcJVLNyTiY6wDyIJ2r/bl5hydz3St:Os52hzpHq8eTi30yIQrDl5hydi
MD5 SHA1 SHA512 SSDEEP

Submit Download

5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202q.exe

Path \??\c:\users\admin\appdata\local\temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202q.exe
Size 466KB
SHA256 9831bd25a76f09148861e67699fb4b928a61a8d14d8aea7eec11e1dab79c1bef
MD5 b542ce31614a0746c5fd2f9f1b658255
SHA1 3abafe96cbc8decd1f2a561ee663ed1505be9972
SHA512 3a941557fedc1430604a186dec27aacfc2dbdf9609bdf6b63798eb85ad582d2502dbe48e6e7272332b0af5566f285cfaf00b36ac4e9f7809da5a977d7892267c
SSDEEP 6144:it03a62hzpSNxV2qcJVLNyTiY6wDyIJ2r/bl5hydz3S6:Os52hzpHq8eTi30yIQrDl5hyd1
MD5 SHA1 SHA512 SSDEEP

Submit Download

5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202v.exe

Path \??\c:\users\admin\appdata\local\temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202v.exe
Size 467KB
SHA256 ed6bf977b2153940991c0a54cce06e7e8530269ffca1e57a5815360a222356d5
MD5 3a44db320d5e52dab94a76e57b8f0e06
SHA1 05b97ef5029d9885b8d5de6f75f30fa3f4ba97f5
SHA512 c5996ead37c00e1dcb2ac6d1673e6d7eeb0a1e08b6bf71db1558868b0e9c2e6cbff54643c86f4d99e15c51039450195f667f60e0e38386684d705b49a8fea46f
SSDEEP 6144:it03a62hzpSNxV2qcJVLNyTiY6wDyIJ2r/bl5hydz3Si:Os52hzpHq8eTi30yIQrDl5hydZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202x.exe

Path \??\c:\users\admin\appdata\local\temp\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202x.exe
Size 467KB
SHA256 2a6e1367a9f06a78541fda2a7b74bffe23a39bce6eda335aec085b54be963c43
MD5 48a642fbfe5c807e9309abca0fe77815
SHA1 e2af6a7e3ebe696cf283fe5ebc2628e0ac6dd650
SHA512 70fd157b8e9812444c52c810c584118691636cd7878baffd2b352e1e7ca2e7715460d46b1b2dd086b0bb583c28c1e6cd2974de649a0c972698f0ec9de239b775
SSDEEP 6144:it03a62hzpSNxV2qcJVLNyTiY6wDyIJ2r/bl5hydz3SI:Os52hzpHq8eTi30yIQrDl5hydn
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1044-83-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/1044-71-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/1420-29-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/1428-259-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/1428-269-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/1624-102-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/1764-60-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/1824-216-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/1936-92-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/1936-82-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/2116-72-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/2192-136-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/2192-146-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/2212-18-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/2212-236-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/2356-224-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/2908-247-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/2908-237-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/2964-271-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/2964-270-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/3036-258-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/3036-248-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/3232-124-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/3232-114-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/3328-134-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/3328-125-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/3700-0-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/3700-10-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/3792-185-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/3816-41-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/3816-49-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/4092-164-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/4172-156-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/4292-174-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/4612-40-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/4612-30-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/4756-206-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/4756-197-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/4852-113-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/4956-186-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/4956-195-0x0000000000400000-0x0000000000479000-memory.dmp

Download

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202s.exe\""	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202r.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202w.exe\""	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202v.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202c.exe\""	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202j.exe\""	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202i.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202k.exe\""	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202j.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202h.exe\""	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202g.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202u.exe\""	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202t.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202a.exe\""	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202i.exe\""	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202h.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202l.exe\""	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202k.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202q.exe\""	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202p.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202v.exe\""	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202u.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202.exe\""	5e4e424fc1a95de6113c4c7c588d6360_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202m.exe\""	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202l.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202p.exe\""	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202o.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202r.exe\""	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202q.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202d.exe\""	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202o.exe\""	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202n.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202t.exe\""	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202s.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202b.exe\""	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202f.exe\""	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202g.exe\""	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202y.exe\""	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202x.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202e.exe\""	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202n.exe\""	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202m.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202x.exe\""	5e4e424fc1a95de6113c4c7c588d6360_neikianalytics_3202w.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads