Malware Analysis Report

2025-01-06 10:33

Sample ID 240601-dymr3agg85
Target 8bb51ee2239a715db7b236cf078df950_NeikiAnalytics.exe
SHA256 249eaab870fb533bb617ba40df097e83df9a781f585ffe2176d5942402d68f98
Tags
evasion persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

249eaab870fb533bb617ba40df097e83df9a781f585ffe2176d5942402d68f98

Threat Level: Known bad

The file 8bb51ee2239a715db7b236cf078df950_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

evasion persistence trojan

Windows security bypass

Modifies Installed Components in the registry

Sets file execution options in registry

Executes dropped EXE

Loads dropped DLL

Windows security modification

Modifies WinLogon

Drops file in System32 directory

Unsigned PE

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-01 03:25

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-01 03:25

Reported

2024-06-01 03:27

Platform

win7-20240215-en

Max time kernel

149s

Max time network

117s

Command Line

winlogon.exe

Signatures

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" C:\Windows\SysWOW64\advesag-ecum.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" C:\Windows\SysWOW64\advesag-ecum.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" C:\Windows\SysWOW64\advesag-ecum.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" C:\Windows\SysWOW64\advesag-ecum.exe N/A

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4748505A-5247-4643-4748-505A52474643} C:\Windows\SysWOW64\advesag-ecum.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4748505A-5247-4643-4748-505A52474643}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" C:\Windows\SysWOW64\advesag-ecum.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4748505A-5247-4643-4748-505A52474643}\IsInstalled = "1" C:\Windows\SysWOW64\advesag-ecum.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4748505A-5247-4643-4748-505A52474643}\StubPath = "C:\\Windows\\system32\\oukbookib.exe" C:\Windows\SysWOW64\advesag-ecum.exe N/A

Sets file execution options in registry

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe C:\Windows\SysWOW64\advesag-ecum.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" C:\Windows\SysWOW64\advesag-ecum.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\intudook-oufex.exe" C:\Windows\SysWOW64\advesag-ecum.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" C:\Windows\SysWOW64\advesag-ecum.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" C:\Windows\SysWOW64\advesag-ecum.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" C:\Windows\SysWOW64\advesag-ecum.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" C:\Windows\SysWOW64\advesag-ecum.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" C:\Windows\SysWOW64\advesag-ecum.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\ecsoavac.dll" C:\Windows\SysWOW64\advesag-ecum.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" C:\Windows\SysWOW64\advesag-ecum.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} C:\Windows\SysWOW64\advesag-ecum.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify C:\Windows\SysWOW64\advesag-ecum.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\oukbookib.exe C:\Windows\SysWOW64\advesag-ecum.exe N/A
File opened for modification C:\Windows\SysWOW64\ecsoavac.dll C:\Windows\SysWOW64\advesag-ecum.exe N/A
File created C:\Windows\SysWOW64\ecsoavac.dll C:\Windows\SysWOW64\advesag-ecum.exe N/A
File opened for modification C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\SysWOW64\advesag-ecum.exe N/A
File opened for modification C:\Windows\SysWOW64\advesag-ecum.exe C:\Users\Admin\AppData\Local\Temp\8bb51ee2239a715db7b236cf078df950_NeikiAnalytics.exe N/A
File created C:\Windows\SysWOW64\advesag-ecum.exe C:\Users\Admin\AppData\Local\Temp\8bb51ee2239a715db7b236cf078df950_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\intudook-oufex.exe C:\Windows\SysWOW64\advesag-ecum.exe N/A
File created C:\Windows\SysWOW64\intudook-oufex.exe C:\Windows\SysWOW64\advesag-ecum.exe N/A
File created C:\Windows\SysWOW64\oukbookib.exe C:\Windows\SysWOW64\advesag-ecum.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1512 wrote to memory of 2220 N/A C:\Users\Admin\AppData\Local\Temp\8bb51ee2239a715db7b236cf078df950_NeikiAnalytics.exe C:\Windows\SysWOW64\advesag-ecum.exe
PID 1512 wrote to memory of 2220 N/A C:\Users\Admin\AppData\Local\Temp\8bb51ee2239a715db7b236cf078df950_NeikiAnalytics.exe C:\Windows\SysWOW64\advesag-ecum.exe
PID 1512 wrote to memory of 2220 N/A C:\Users\Admin\AppData\Local\Temp\8bb51ee2239a715db7b236cf078df950_NeikiAnalytics.exe C:\Windows\SysWOW64\advesag-ecum.exe
PID 1512 wrote to memory of 2220 N/A C:\Users\Admin\AppData\Local\Temp\8bb51ee2239a715db7b236cf078df950_NeikiAnalytics.exe C:\Windows\SysWOW64\advesag-ecum.exe
PID 2220 wrote to memory of 436 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\system32\winlogon.exe
PID 2220 wrote to memory of 1208 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1208 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 280 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\SysWOW64\advesag-ecum.exe
PID 2220 wrote to memory of 280 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\SysWOW64\advesag-ecum.exe
PID 2220 wrote to memory of 280 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\SysWOW64\advesag-ecum.exe
PID 2220 wrote to memory of 280 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\SysWOW64\advesag-ecum.exe
PID 2220 wrote to memory of 1208 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1208 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1208 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1208 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1208 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1208 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1208 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1208 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1208 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1208 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1208 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1208 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1208 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1208 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1208 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1208 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1208 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1208 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1208 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1208 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1208 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1208 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1208 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1208 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1208 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1208 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1208 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1208 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1208 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1208 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1208 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1208 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1208 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1208 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1208 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1208 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1208 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1208 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1208 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1208 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1208 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1208 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1208 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1208 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1208 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1208 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1208 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1208 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1208 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1208 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1208 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1208 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1208 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\system32\winlogon.exe

winlogon.exe

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\8bb51ee2239a715db7b236cf078df950_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\8bb51ee2239a715db7b236cf078df950_NeikiAnalytics.exe"

C:\Windows\SysWOW64\advesag-ecum.exe

"C:\Windows\SysWOW64\advesag-ecum.exe"

C:\Windows\SysWOW64\advesag-ecum.exe

--k33p

Network

Country Destination Domain Proto
US 8.8.8.8:53 twivbh.mp udp
US 8.8.8.8:53 twivbh.mp udp

Files

\Windows\SysWOW64\advesag-ecum.exe

MD5 5801854a757e40fa0464da95cdc6f0f9
SHA1 a603fe7cd49fb62ecdac2b6d65df179b24d8aed1
SHA256 24df84b875c1b0978ab551c7cc428e5875ad1d9681dc1d41d5d044c0f701a745
SHA512 4278d70db48b29eba39cc2ea10cf1589e7f86bf81decef48ca9eaec1f5647c8f869140e5453f88bd5ad13ac5b3de72b5edbd9b199061cf7f79e1a9e3e805f80e

memory/1512-7-0x0000000000400000-0x0000000000403000-memory.dmp

C:\Windows\SysWOW64\oukbookib.exe

MD5 fb5cc137fd0d90d73785d2f2f067cf1a
SHA1 7a8e9676d36819dc816ae44c3236aaa9cf5bbfc6
SHA256 4c1f101f4027331281ceade7f8d6210097a94354616d076dfb6234b6665d1dc4
SHA512 380b2a7591bbda126b73f739ff6f582a63963f78b162b806d997eda560f52e6e1bf92c13584cee52eef36039d3c5968d450efa154c742792a84ad3fe96445e06

C:\Windows\SysWOW64\ecsoavac.dll

MD5 f37b21c00fd81bd93c89ce741a88f183
SHA1 b2796500597c68e2f5638e1101b46eaf32676c1c
SHA256 76cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
SHA512 252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4

C:\Windows\SysWOW64\intudook-oufex.exe

MD5 0a97728065047f42b0074fe15a797cf5
SHA1 35f54820b3932015538129e351e2a65f0894e4d2
SHA256 2a6579dd5eff40b13491d64c5645dc8094999d512c8c7a10c20dfba5218d0f38
SHA512 e1b8cad17998408da14485ff7e12c7bb35507ac0265158ee417edf8d4b5efd90bf4ca8416e8de658fbc5277f34e0907ab4a2e8f7c751bae218d7df0ae2be7ae4

memory/2220-53-0x0000000000400000-0x0000000000414000-memory.dmp

memory/280-54-0x0000000000400000-0x0000000000414000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-01 03:25

Reported

2024-06-01 03:27

Platform

win10v2004-20240426-en

Max time kernel

149s

Max time network

138s

Command Line

winlogon.exe

Signatures

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" C:\Windows\SysWOW64\advesag-ecum.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" C:\Windows\SysWOW64\advesag-ecum.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" C:\Windows\SysWOW64\advesag-ecum.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" C:\Windows\SysWOW64\advesag-ecum.exe N/A

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4C4C5844-4845-5743-4C4C-584448455743} C:\Windows\SysWOW64\advesag-ecum.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4C4C5844-4845-5743-4C4C-584448455743}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" C:\Windows\SysWOW64\advesag-ecum.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4C4C5844-4845-5743-4C4C-584448455743}\IsInstalled = "1" C:\Windows\SysWOW64\advesag-ecum.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4C4C5844-4845-5743-4C4C-584448455743}\StubPath = "C:\\Windows\\system32\\oukbookib.exe" C:\Windows\SysWOW64\advesag-ecum.exe N/A

Sets file execution options in registry

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe C:\Windows\SysWOW64\advesag-ecum.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" C:\Windows\SysWOW64\advesag-ecum.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\intudook-oufex.exe" C:\Windows\SysWOW64\advesag-ecum.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" C:\Windows\SysWOW64\advesag-ecum.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" C:\Windows\SysWOW64\advesag-ecum.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" C:\Windows\SysWOW64\advesag-ecum.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" C:\Windows\SysWOW64\advesag-ecum.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} C:\Windows\SysWOW64\advesag-ecum.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify C:\Windows\SysWOW64\advesag-ecum.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" C:\Windows\SysWOW64\advesag-ecum.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\ecsoavac.dll" C:\Windows\SysWOW64\advesag-ecum.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" C:\Windows\SysWOW64\advesag-ecum.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\intudook-oufex.exe C:\Windows\SysWOW64\advesag-ecum.exe N/A
File opened for modification C:\Windows\SysWOW64\oukbookib.exe C:\Windows\SysWOW64\advesag-ecum.exe N/A
File created C:\Windows\SysWOW64\ecsoavac.dll C:\Windows\SysWOW64\advesag-ecum.exe N/A
File opened for modification C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\SysWOW64\advesag-ecum.exe N/A
File opened for modification C:\Windows\SysWOW64\ecsoavac.dll C:\Windows\SysWOW64\advesag-ecum.exe N/A
File opened for modification C:\Windows\SysWOW64\advesag-ecum.exe C:\Users\Admin\AppData\Local\Temp\8bb51ee2239a715db7b236cf078df950_NeikiAnalytics.exe N/A
File created C:\Windows\SysWOW64\advesag-ecum.exe C:\Users\Admin\AppData\Local\Temp\8bb51ee2239a715db7b236cf078df950_NeikiAnalytics.exe N/A
File created C:\Windows\SysWOW64\intudook-oufex.exe C:\Windows\SysWOW64\advesag-ecum.exe N/A
File created C:\Windows\SysWOW64\oukbookib.exe C:\Windows\SysWOW64\advesag-ecum.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A
N/A N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\advesag-ecum.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1412 wrote to memory of 5500 N/A C:\Users\Admin\AppData\Local\Temp\8bb51ee2239a715db7b236cf078df950_NeikiAnalytics.exe C:\Windows\SysWOW64\advesag-ecum.exe
PID 1412 wrote to memory of 5500 N/A C:\Users\Admin\AppData\Local\Temp\8bb51ee2239a715db7b236cf078df950_NeikiAnalytics.exe C:\Windows\SysWOW64\advesag-ecum.exe
PID 1412 wrote to memory of 5500 N/A C:\Users\Admin\AppData\Local\Temp\8bb51ee2239a715db7b236cf078df950_NeikiAnalytics.exe C:\Windows\SysWOW64\advesag-ecum.exe
PID 5500 wrote to memory of 2564 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\SysWOW64\advesag-ecum.exe
PID 5500 wrote to memory of 2564 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\SysWOW64\advesag-ecum.exe
PID 5500 wrote to memory of 2564 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\SysWOW64\advesag-ecum.exe
PID 5500 wrote to memory of 612 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\system32\winlogon.exe
PID 5500 wrote to memory of 3492 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 5500 wrote to memory of 3492 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 5500 wrote to memory of 3492 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 5500 wrote to memory of 3492 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 5500 wrote to memory of 3492 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 5500 wrote to memory of 3492 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 5500 wrote to memory of 3492 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 5500 wrote to memory of 3492 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 5500 wrote to memory of 3492 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 5500 wrote to memory of 3492 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 5500 wrote to memory of 3492 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 5500 wrote to memory of 3492 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 5500 wrote to memory of 3492 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 5500 wrote to memory of 3492 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 5500 wrote to memory of 3492 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 5500 wrote to memory of 3492 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 5500 wrote to memory of 3492 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 5500 wrote to memory of 3492 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 5500 wrote to memory of 3492 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 5500 wrote to memory of 3492 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 5500 wrote to memory of 3492 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 5500 wrote to memory of 3492 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 5500 wrote to memory of 3492 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 5500 wrote to memory of 3492 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 5500 wrote to memory of 3492 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 5500 wrote to memory of 3492 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 5500 wrote to memory of 3492 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 5500 wrote to memory of 3492 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 5500 wrote to memory of 3492 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 5500 wrote to memory of 3492 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 5500 wrote to memory of 3492 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 5500 wrote to memory of 3492 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 5500 wrote to memory of 3492 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 5500 wrote to memory of 3492 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 5500 wrote to memory of 3492 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 5500 wrote to memory of 3492 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 5500 wrote to memory of 3492 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 5500 wrote to memory of 3492 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 5500 wrote to memory of 3492 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 5500 wrote to memory of 3492 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 5500 wrote to memory of 3492 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 5500 wrote to memory of 3492 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 5500 wrote to memory of 3492 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 5500 wrote to memory of 3492 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 5500 wrote to memory of 3492 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 5500 wrote to memory of 3492 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 5500 wrote to memory of 3492 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 5500 wrote to memory of 3492 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 5500 wrote to memory of 3492 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 5500 wrote to memory of 3492 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 5500 wrote to memory of 3492 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 5500 wrote to memory of 3492 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 5500 wrote to memory of 3492 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 5500 wrote to memory of 3492 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 5500 wrote to memory of 3492 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 5500 wrote to memory of 3492 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE
PID 5500 wrote to memory of 3492 N/A C:\Windows\SysWOW64\advesag-ecum.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\system32\winlogon.exe

winlogon.exe

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\8bb51ee2239a715db7b236cf078df950_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\8bb51ee2239a715db7b236cf078df950_NeikiAnalytics.exe"

C:\Windows\SysWOW64\advesag-ecum.exe

"C:\Windows\SysWOW64\advesag-ecum.exe"

C:\Windows\SysWOW64\advesag-ecum.exe

--k33p

Network

Country Destination Domain Proto
US 8.8.8.8:53 sykqfwslacl.ws udp
US 64.70.19.203:80 sykqfwslacl.ws tcp
US 8.8.8.8:53 utbidet-ugeas.biz udp
US 34.193.97.35:80 utbidet-ugeas.biz tcp
US 8.8.8.8:53 utbidet-ugeas.biz udp
US 34.193.97.35:80 utbidet-ugeas.biz tcp
US 8.8.8.8:53 35.97.193.34.in-addr.arpa udp
US 8.8.8.8:53 203.19.70.64.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp

Files

memory/1412-2-0x0000000000400000-0x0000000000403000-memory.dmp

C:\Windows\SysWOW64\advesag-ecum.exe

MD5 5801854a757e40fa0464da95cdc6f0f9
SHA1 a603fe7cd49fb62ecdac2b6d65df179b24d8aed1
SHA256 24df84b875c1b0978ab551c7cc428e5875ad1d9681dc1d41d5d044c0f701a745
SHA512 4278d70db48b29eba39cc2ea10cf1589e7f86bf81decef48ca9eaec1f5647c8f869140e5453f88bd5ad13ac5b3de72b5edbd9b199061cf7f79e1a9e3e805f80e

C:\Windows\SysWOW64\ecsoavac.dll

MD5 f37b21c00fd81bd93c89ce741a88f183
SHA1 b2796500597c68e2f5638e1101b46eaf32676c1c
SHA256 76cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
SHA512 252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4

C:\Windows\SysWOW64\intudook-oufex.exe

MD5 c10e4f260c575aa01b57b2eb3cfdf91c
SHA1 e8f54317819b1f11bdf424d82227407aa2357401
SHA256 d35aecacf98a5aaeb7b6d42047507e4354552cfcc69e1c8f779b4afe78991f51
SHA512 0b7204ec1bc9a386de629ad47efce53c0ad46b3d1b146fe0e60de06c97e5573026f4d77b90d85badebf02f064b79724195f3b003a55be546bbe2aa78ade6a1a3

C:\Windows\SysWOW64\oukbookib.exe

MD5 389093cde6b0978c70d7ab274f0003c4
SHA1 181999b09010d2e0a8a8c6d6d1e6c9ad8e555322
SHA256 69606601262fa0628c083e7e7fb2dcadfddd9e11da4a54f477d4a4be5093dee5
SHA512 d5440e625c810c900fb728ad1ce008b94f710d7e59f50c70cca3778a093f13cf7b565453967dbd5411f12a5db6e614398215fee6ec25688cde9d8598bd656530

memory/5500-47-0x0000000000400000-0x0000000000414000-memory.dmp

memory/2564-48-0x0000000000400000-0x0000000000414000-memory.dmp