Malware Analysis Report

2024-09-23 05:29

Sample ID 240531-hh1q7sac61
Target 7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe
SHA256 ee686ddd9126710f429211dfd9a068c7209587a00be516b22be1fa2fe75dd4ad
Tags
gandcrab backdoor persistence ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ee686ddd9126710f429211dfd9a068c7209587a00be516b22be1fa2fe75dd4ad

Threat Level: Known bad

The file 7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

gandcrab backdoor persistence ransomware

Gandcrab

GandCrab payload

Unexpected DNS network traffic destination

Enumerates connected drives

Adds Run key to start application

Drops file in Windows directory

Program crash

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Checks SCSI registry key(s)

Suspicious use of AdjustPrivilegeToken

Checks processor information in registry

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-05-31 06:44

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-31 06:44

Reported

2024-05-31 06:47

Platform

win7-20240221-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe"

Signatures

GandCrab payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gandcrab

ransomware backdoor gandcrab

Unexpected DNS network traffic destination

Description Indicator Process Target
Destination IP 107.178.223.183 N/A N/A
Destination IP 104.155.138.21 N/A N/A
Destination IP 104.155.138.21 N/A N/A
Destination IP 104.155.138.21 N/A N/A
Destination IP 107.178.223.183 N/A N/A
Destination IP 104.155.138.21 N/A N/A
Destination IP 107.178.223.183 N/A N/A
Destination IP 107.178.223.183 N/A N/A
Destination IP 107.178.223.183 N/A N/A
Destination IP 107.178.223.183 N/A N/A
Destination IP 107.178.223.183 N/A N/A
Destination IP 107.178.223.183 N/A N/A
Destination IP 104.155.138.21 N/A N/A
Destination IP 107.178.223.183 N/A N/A
Destination IP 107.178.223.183 N/A N/A
Destination IP 107.178.223.183 N/A N/A
Destination IP 104.155.138.21 N/A N/A
Destination IP 104.155.138.21 N/A N/A
Destination IP 107.178.223.183 N/A N/A
Destination IP 107.178.223.183 N/A N/A
Destination IP 104.155.138.21 N/A N/A
Destination IP 107.178.223.183 N/A N/A
Destination IP 107.178.223.183 N/A N/A
Destination IP 104.155.138.21 N/A N/A
Destination IP 107.178.223.183 N/A N/A
Destination IP 104.155.138.21 N/A N/A
Destination IP 104.155.138.21 N/A N/A
Destination IP 107.178.223.183 N/A N/A
Destination IP 104.155.138.21 N/A N/A
Destination IP 104.155.138.21 N/A N/A
Destination IP 104.155.138.21 N/A N/A
Destination IP 104.155.138.21 N/A N/A
Destination IP 107.178.223.183 N/A N/A
Destination IP 107.178.223.183 N/A N/A
Destination IP 104.155.138.21 N/A N/A
Destination IP 104.155.138.21 N/A N/A
Destination IP 104.155.138.21 N/A N/A
Destination IP 107.178.223.183 N/A N/A
Destination IP 104.155.138.21 N/A N/A
Destination IP 104.155.138.21 N/A N/A
Destination IP 104.155.138.21 N/A N/A
Destination IP 104.155.138.21 N/A N/A
Destination IP 104.155.138.21 N/A N/A
Destination IP 107.178.223.183 N/A N/A
Destination IP 107.178.223.183 N/A N/A
Destination IP 104.155.138.21 N/A N/A
Destination IP 104.155.138.21 N/A N/A
Destination IP 104.155.138.21 N/A N/A
Destination IP 104.155.138.21 N/A N/A
Destination IP 107.178.223.183 N/A N/A
Destination IP 107.178.223.183 N/A N/A
Destination IP 107.178.223.183 N/A N/A
Destination IP 104.155.138.21 N/A N/A
Destination IP 107.178.223.183 N/A N/A
Destination IP 107.178.223.183 N/A N/A
Destination IP 104.155.138.21 N/A N/A
Destination IP 107.178.223.183 N/A N/A
Destination IP 107.178.223.183 N/A N/A
Destination IP 104.155.138.21 N/A N/A
Destination IP 104.155.138.21 N/A N/A
Destination IP 107.178.223.183 N/A N/A
Destination IP 107.178.223.183 N/A N/A
Destination IP 107.178.223.183 N/A N/A
Destination IP 107.178.223.183 N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\gqcvnixafwk = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\kqtcdv.exe\"" C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\win.ini C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2856 wrote to memory of 1848 N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe C:\Windows\SysWOW64\nslookup.exe
PID 2856 wrote to memory of 1848 N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe C:\Windows\SysWOW64\nslookup.exe
PID 2856 wrote to memory of 1848 N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe C:\Windows\SysWOW64\nslookup.exe
PID 2856 wrote to memory of 1848 N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe C:\Windows\SysWOW64\nslookup.exe
PID 2856 wrote to memory of 2028 N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe C:\Windows\SysWOW64\nslookup.exe
PID 2856 wrote to memory of 2028 N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe C:\Windows\SysWOW64\nslookup.exe
PID 2856 wrote to memory of 2028 N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe C:\Windows\SysWOW64\nslookup.exe
PID 2856 wrote to memory of 2028 N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe C:\Windows\SysWOW64\nslookup.exe
PID 2856 wrote to memory of 1192 N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe C:\Windows\SysWOW64\nslookup.exe
PID 2856 wrote to memory of 1192 N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe C:\Windows\SysWOW64\nslookup.exe
PID 2856 wrote to memory of 1192 N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe C:\Windows\SysWOW64\nslookup.exe
PID 2856 wrote to memory of 1192 N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe C:\Windows\SysWOW64\nslookup.exe
PID 2856 wrote to memory of 1672 N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe C:\Windows\SysWOW64\nslookup.exe
PID 2856 wrote to memory of 1672 N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe C:\Windows\SysWOW64\nslookup.exe
PID 2856 wrote to memory of 1672 N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe C:\Windows\SysWOW64\nslookup.exe
PID 2856 wrote to memory of 1672 N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe C:\Windows\SysWOW64\nslookup.exe
PID 2856 wrote to memory of 1076 N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe C:\Windows\SysWOW64\nslookup.exe
PID 2856 wrote to memory of 1076 N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe C:\Windows\SysWOW64\nslookup.exe
PID 2856 wrote to memory of 1076 N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe C:\Windows\SysWOW64\nslookup.exe
PID 2856 wrote to memory of 1076 N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe C:\Windows\SysWOW64\nslookup.exe
PID 2856 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe C:\Windows\SysWOW64\nslookup.exe
PID 2856 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe C:\Windows\SysWOW64\nslookup.exe
PID 2856 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe C:\Windows\SysWOW64\nslookup.exe
PID 2856 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe C:\Windows\SysWOW64\nslookup.exe
PID 2856 wrote to memory of 932 N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe C:\Windows\SysWOW64\nslookup.exe
PID 2856 wrote to memory of 932 N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe C:\Windows\SysWOW64\nslookup.exe
PID 2856 wrote to memory of 932 N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe C:\Windows\SysWOW64\nslookup.exe
PID 2856 wrote to memory of 932 N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe C:\Windows\SysWOW64\nslookup.exe
PID 2856 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe C:\Windows\SysWOW64\nslookup.exe
PID 2856 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe C:\Windows\SysWOW64\nslookup.exe
PID 2856 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe C:\Windows\SysWOW64\nslookup.exe
PID 2856 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe C:\Windows\SysWOW64\nslookup.exe
PID 2856 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe C:\Windows\SysWOW64\nslookup.exe
PID 2856 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe C:\Windows\SysWOW64\nslookup.exe
PID 2856 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe C:\Windows\SysWOW64\nslookup.exe
PID 2856 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe C:\Windows\SysWOW64\nslookup.exe
PID 2856 wrote to memory of 1916 N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe C:\Windows\SysWOW64\nslookup.exe
PID 2856 wrote to memory of 1916 N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe C:\Windows\SysWOW64\nslookup.exe
PID 2856 wrote to memory of 1916 N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe C:\Windows\SysWOW64\nslookup.exe
PID 2856 wrote to memory of 1916 N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe C:\Windows\SysWOW64\nslookup.exe
PID 2856 wrote to memory of 3064 N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe C:\Windows\SysWOW64\nslookup.exe
PID 2856 wrote to memory of 3064 N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe C:\Windows\SysWOW64\nslookup.exe
PID 2856 wrote to memory of 3064 N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe C:\Windows\SysWOW64\nslookup.exe
PID 2856 wrote to memory of 3064 N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe C:\Windows\SysWOW64\nslookup.exe
PID 2856 wrote to memory of 2164 N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe C:\Windows\SysWOW64\nslookup.exe
PID 2856 wrote to memory of 2164 N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe C:\Windows\SysWOW64\nslookup.exe
PID 2856 wrote to memory of 2164 N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe C:\Windows\SysWOW64\nslookup.exe
PID 2856 wrote to memory of 2164 N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe C:\Windows\SysWOW64\nslookup.exe
PID 2856 wrote to memory of 1588 N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe C:\Windows\SysWOW64\nslookup.exe
PID 2856 wrote to memory of 1588 N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe C:\Windows\SysWOW64\nslookup.exe
PID 2856 wrote to memory of 1588 N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe C:\Windows\SysWOW64\nslookup.exe
PID 2856 wrote to memory of 1588 N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe C:\Windows\SysWOW64\nslookup.exe
PID 2856 wrote to memory of 2308 N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe C:\Windows\SysWOW64\nslookup.exe
PID 2856 wrote to memory of 2308 N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe C:\Windows\SysWOW64\nslookup.exe
PID 2856 wrote to memory of 2308 N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe C:\Windows\SysWOW64\nslookup.exe
PID 2856 wrote to memory of 2308 N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe C:\Windows\SysWOW64\nslookup.exe
PID 2856 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe C:\Windows\SysWOW64\nslookup.exe
PID 2856 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe C:\Windows\SysWOW64\nslookup.exe
PID 2856 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe C:\Windows\SysWOW64\nslookup.exe
PID 2856 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe C:\Windows\SysWOW64\nslookup.exe
PID 2856 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe C:\Windows\SysWOW64\nslookup.exe
PID 2856 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe C:\Windows\SysWOW64\nslookup.exe
PID 2856 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe C:\Windows\SysWOW64\nslookup.exe
PID 2856 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe C:\Windows\SysWOW64\nslookup.exe

Processes

C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe"

C:\Windows\SysWOW64\nslookup.exe

nslookup carder.bit ns1.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup ransomware.bit ns2.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup carder.bit ns2.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup ransomware.bit ns1.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup carder.bit ns1.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup ransomware.bit ns2.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup carder.bit ns2.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup ransomware.bit ns1.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup carder.bit ns1.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup ransomware.bit ns2.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup carder.bit ns2.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup ransomware.bit ns1.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup carder.bit ns1.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup ransomware.bit ns2.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup carder.bit ns2.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup ransomware.bit ns1.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup carder.bit ns1.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup ransomware.bit ns2.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup carder.bit ns2.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup ransomware.bit ns1.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup carder.bit ns1.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup ransomware.bit ns2.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup carder.bit ns2.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup ransomware.bit ns1.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup carder.bit ns1.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup ransomware.bit ns2.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup carder.bit ns2.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup ransomware.bit ns1.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup carder.bit ns1.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup ransomware.bit ns2.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup carder.bit ns2.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup ransomware.bit ns1.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup carder.bit ns1.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup ransomware.bit ns2.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup carder.bit ns2.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup ransomware.bit ns1.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup carder.bit ns1.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup ransomware.bit ns2.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup carder.bit ns2.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup ransomware.bit ns1.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup carder.bit ns1.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup ransomware.bit ns2.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup carder.bit ns2.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup ransomware.bit ns1.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup carder.bit ns1.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup ransomware.bit ns2.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup carder.bit ns2.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup ransomware.bit ns1.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup carder.bit ns1.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup ransomware.bit ns2.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup carder.bit ns2.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup ransomware.bit ns1.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup carder.bit ns1.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup ransomware.bit ns2.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup carder.bit ns2.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup ransomware.bit ns1.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup carder.bit ns1.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup ransomware.bit ns2.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup carder.bit ns2.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup ransomware.bit ns1.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup carder.bit ns1.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup ransomware.bit ns2.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup carder.bit ns2.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup ransomware.bit ns1.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup carder.bit ns1.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup ransomware.bit ns2.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup carder.bit ns2.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup ransomware.bit ns1.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup carder.bit ns1.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup ransomware.bit ns2.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup carder.bit ns2.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup ransomware.bit ns1.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup carder.bit ns1.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup ransomware.bit ns2.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup carder.bit ns2.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup ransomware.bit ns1.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup carder.bit ns1.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup ransomware.bit ns2.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup carder.bit ns2.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup ransomware.bit ns1.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup carder.bit ns1.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup ransomware.bit ns2.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup carder.bit ns2.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup ransomware.bit ns1.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup carder.bit ns1.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup ransomware.bit ns2.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup carder.bit ns2.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup ransomware.bit ns1.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup carder.bit ns1.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup ransomware.bit ns2.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup carder.bit ns2.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup ransomware.bit ns1.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup carder.bit ns1.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup ransomware.bit ns2.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup carder.bit ns2.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup ransomware.bit ns1.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup carder.bit ns1.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup ransomware.bit ns2.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup carder.bit ns2.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup ransomware.bit ns1.wowservers.ru

C:\Windows\SysWOW64\nslookup.exe

nslookup carder.bit ns1.wowservers.ru

Network

Country Destination Domain Proto
US 8.8.8.8:53 ipv4bot.whatismyipaddress.com udp
US 8.8.8.8:53 ns1.wowservers.ru udp
US 107.178.223.183:53 ns1.wowservers.ru udp
US 107.178.223.183:53 ns1.wowservers.ru udp
US 107.178.223.183:53 ns1.wowservers.ru udp
US 8.8.8.8:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 104.155.138.21:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp
US 107.178.223.183:53 ns2.wowservers.ru udp

Files

C:\Windows\win.ini

MD5 e599271cae366299082271411dad5c10
SHA1 a2137e22ad70d837abc2d7aeea64938810026eac
SHA256 562875d8df2b159eba5f0fb02aa670b5549e9b1aa13185d9eb3da72a0fb2e3b0
SHA512 833d60dba45f904c3f52df0fd85563443dec442b7c8ae3e850f18e8a26691be047d2d4d7b457f2cba0c984847fc1f856de9a0f0e7541ef9a77e8e84b1a8b30c3

C:\Windows\win.ini

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/2856-257-0x0000000000D20000-0x0000000000E20000-memory.dmp

memory/2856-258-0x0000000000400000-0x000000000042C000-memory.dmp

memory/2856-260-0x0000000000260000-0x0000000000277000-memory.dmp

memory/2856-259-0x0000000000400000-0x0000000000B4C000-memory.dmp

memory/2856-262-0x0000000000400000-0x0000000000B4C000-memory.dmp

memory/2856-271-0x0000000000400000-0x000000000042C000-memory.dmp

memory/2856-270-0x0000000000D20000-0x0000000000E20000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-31 06:44

Reported

2024-05-31 06:47

Platform

win10v2004-20240426-en

Max time kernel

93s

Max time network

95s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe"

Signatures

GandCrab payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gandcrab

ransomware backdoor gandcrab

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\win.ini C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Service C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\UpperFilters C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\LowerFilters C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Filters C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Filters C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\UpperFilters C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\LowerFilters C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\7b5a79d0a46bb286f8c04342f4359a60_NeikiAnalytics.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 316 -ip 316

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 316 -s 468

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 203.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp

Files

C:\Windows\win.ini

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/316-258-0x0000000000400000-0x000000000042C000-memory.dmp

memory/316-257-0x0000000000CC0000-0x0000000000DC0000-memory.dmp

memory/316-260-0x0000000002760000-0x0000000002777000-memory.dmp

memory/316-259-0x0000000000400000-0x0000000000B4C000-memory.dmp

memory/316-262-0x0000000000400000-0x0000000000B4C000-memory.dmp

memory/316-265-0x0000000000400000-0x000000000042C000-memory.dmp