Malware Analysis Report

2025-01-06 10:34

Sample ID 240601-ekv2yshg82
Target 8cb289f744a3bafac8a23b64448dc080_NeikiAnalytics.exe
SHA256 d6aa28b2c2adf47ea35bf96a70feb793429327efa89f4bb98c83ef6360c8c79f
Tags
evasion persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d6aa28b2c2adf47ea35bf96a70feb793429327efa89f4bb98c83ef6360c8c79f

Threat Level: Known bad

The file 8cb289f744a3bafac8a23b64448dc080_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

evasion persistence trojan

Detects BazaLoader malware

Modifies visiblity of hidden/system files in Explorer

Modifies WinLogon for persistence

Modifies Installed Components in the registry

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Suspicious use of SetWindowsHookEx

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-01 04:00

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-01 04:00

Reported

2024-06-01 04:03

Platform

win10v2004-20240426-en

Max time kernel

150s

Max time network

95s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8cb289f744a3bafac8a23b64448dc080_NeikiAnalytics.exe"

Signatures

Detects BazaLoader malware

trojan
Description Indicator Process Target
N/A N/A N/A N/A

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" \??\c:\windows\system\svchost.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\system\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\system\svchost.exe N/A

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\svchost.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} \??\c:\windows\system\svchost.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\explorer.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\svchost.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\svchost.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\spoolsv.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\spoolsv.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" \??\c:\windows\system\svchost.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification \??\c:\windows\system\explorer.exe C:\Users\Admin\AppData\Local\Temp\8cb289f744a3bafac8a23b64448dc080_NeikiAnalytics.exe N/A
File opened for modification \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\explorer.exe N/A
File opened for modification \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe N/A
File opened for modification \??\c:\windows\system\explorer.exe \??\c:\windows\system\explorer.exe N/A
File opened for modification \??\c:\windows\system\svchost.exe \??\c:\windows\system\svchost.exe N/A
File opened for modification C:\Windows\system\udsys.exe \??\c:\windows\system\explorer.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cb289f744a3bafac8a23b64448dc080_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cb289f744a3bafac8a23b64448dc080_NeikiAnalytics.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2148 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\8cb289f744a3bafac8a23b64448dc080_NeikiAnalytics.exe \??\c:\windows\system\explorer.exe
PID 2148 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\8cb289f744a3bafac8a23b64448dc080_NeikiAnalytics.exe \??\c:\windows\system\explorer.exe
PID 2148 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\8cb289f744a3bafac8a23b64448dc080_NeikiAnalytics.exe \??\c:\windows\system\explorer.exe
PID 2744 wrote to memory of 4888 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 2744 wrote to memory of 4888 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 2744 wrote to memory of 4888 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 4888 wrote to memory of 2676 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 4888 wrote to memory of 2676 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 4888 wrote to memory of 2676 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 2676 wrote to memory of 2072 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 2676 wrote to memory of 2072 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 2676 wrote to memory of 2072 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 2676 wrote to memory of 2848 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2676 wrote to memory of 2848 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2676 wrote to memory of 2848 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2676 wrote to memory of 1776 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2676 wrote to memory of 1776 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2676 wrote to memory of 1776 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2676 wrote to memory of 1260 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2676 wrote to memory of 1260 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2676 wrote to memory of 1260 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe

Processes

C:\Users\Admin\AppData\Local\Temp\8cb289f744a3bafac8a23b64448dc080_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\8cb289f744a3bafac8a23b64448dc080_NeikiAnalytics.exe"

\??\c:\windows\system\explorer.exe

c:\windows\system\explorer.exe

\??\c:\windows\system\spoolsv.exe

c:\windows\system\spoolsv.exe SE

\??\c:\windows\system\svchost.exe

c:\windows\system\svchost.exe

\??\c:\windows\system\spoolsv.exe

c:\windows\system\spoolsv.exe PR

C:\Windows\SysWOW64\at.exe

at 04:02 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

C:\Windows\SysWOW64\at.exe

at 04:03 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

C:\Windows\SysWOW64\at.exe

at 04:04 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp

Files

memory/2148-0-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2148-1-0x00000000001C0000-0x00000000001C4000-memory.dmp

memory/2148-3-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2148-2-0x0000000075760000-0x00000000758BD000-memory.dmp

memory/2148-4-0x0000000000401000-0x000000000042E000-memory.dmp

C:\Windows\System\explorer.exe

MD5 31ae92996268ad3f13b3110f28f8a5be
SHA1 9b1a675cf36a37eacd7fa9b12afe2d69ece5b1a6
SHA256 c00e52122d721eedfece5f61fbdd17e2f50addfaa9fe2b70a8e8b15d5d54711d
SHA512 a561fa1a4d917b1a025fb062ee97c9fdbaa578513e1a4e266b44547b2d3a2d938e81694c0f1b9aaa32e82843f89b7b258e1ecbba280800f1ce764a9c6e9656af

memory/2744-13-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2744-14-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2744-17-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2744-15-0x0000000075760000-0x00000000758BD000-memory.dmp

C:\Windows\System\spoolsv.exe

MD5 0993b0e55f6aebc79d723569b36e0ce5
SHA1 a7385c523c72f4210dc034ea6140d4f085a30cf2
SHA256 b538ac4b446aa78f0b13a7a56d6416c6e0b0bbf4f804823b5c40419956ee764a
SHA512 d58d687a5b56b428a75ef55f02afd9b3538301e021a826b1c36983e6b0633f9157db416058c662a38b860707a758b004f979466e1830cf6d6bf8895abd1b7874

memory/4888-26-0x0000000075760000-0x00000000758BD000-memory.dmp

memory/4888-31-0x0000000000400000-0x0000000000431000-memory.dmp

C:\Windows\System\svchost.exe

MD5 8bdc8efe8e8e6bfa3b93dc18d6b3c6dd
SHA1 550576bb6783a84e5751c7b87767d132938b2c68
SHA256 ab91b1ec713fe86357bfe4492fb832ed9adb120506570e3ee5d23ca578db41d2
SHA512 aecaccc6c4c28a6ffc78034787e96eb48d281d21f51abc6ac4f7ab063298d232901ba7de03beffeff90f8f34be83520ad2e78952e57bc099bf2ec6670b7fb699

memory/2676-37-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2676-42-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2676-38-0x0000000075760000-0x00000000758BD000-memory.dmp

memory/2072-45-0x0000000075760000-0x00000000758BD000-memory.dmp

memory/2072-53-0x0000000000400000-0x0000000000431000-memory.dmp

memory/4888-55-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2148-58-0x0000000000401000-0x000000000042E000-memory.dmp

memory/2148-57-0x0000000000400000-0x0000000000431000-memory.dmp

C:\Users\Admin\AppData\Roaming\mrsys.exe

MD5 5406d6dc743e6fc69b1b84c868b46908
SHA1 71d2795a73794dc0a8c27e136840cdb8ad5b81fe
SHA256 dd2070f7ff687c6002b6b0ab3f0a0f3d1b23f091e33802d231b9f34c5367b19e
SHA512 f345c4bafaca2e238384a4001a45c2d35e9969e65c656f969e68e17632cbafc2613fc15c950f18a28d2c0447ffa264439279a5ff86537ab1349b92fba0e61d4a

memory/2744-60-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2676-62-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2744-71-0x0000000000400000-0x0000000000431000-memory.dmp

\??\PIPE\atsvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-01 04:00

Reported

2024-06-01 04:02

Platform

win7-20240221-en

Max time kernel

150s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8cb289f744a3bafac8a23b64448dc080_NeikiAnalytics.exe"

Signatures

Detects BazaLoader malware

trojan
Description Indicator Process Target
N/A N/A N/A N/A

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" \??\c:\windows\system\explorer.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\system\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\system\svchost.exe N/A

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\svchost.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} \??\c:\windows\system\svchost.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\explorer.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\svchost.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\spoolsv.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\spoolsv.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" \??\c:\windows\system\explorer.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification \??\c:\windows\system\explorer.exe C:\Users\Admin\AppData\Local\Temp\8cb289f744a3bafac8a23b64448dc080_NeikiAnalytics.exe N/A
File opened for modification \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\explorer.exe N/A
File opened for modification \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe N/A
File opened for modification \??\c:\windows\system\explorer.exe \??\c:\windows\system\explorer.exe N/A
File opened for modification \??\c:\windows\system\svchost.exe \??\c:\windows\system\svchost.exe N/A
File opened for modification C:\Windows\system\udsys.exe \??\c:\windows\system\explorer.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cb289f744a3bafac8a23b64448dc080_NeikiAnalytics.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2176 wrote to memory of 2508 N/A C:\Users\Admin\AppData\Local\Temp\8cb289f744a3bafac8a23b64448dc080_NeikiAnalytics.exe \??\c:\windows\system\explorer.exe
PID 2176 wrote to memory of 2508 N/A C:\Users\Admin\AppData\Local\Temp\8cb289f744a3bafac8a23b64448dc080_NeikiAnalytics.exe \??\c:\windows\system\explorer.exe
PID 2176 wrote to memory of 2508 N/A C:\Users\Admin\AppData\Local\Temp\8cb289f744a3bafac8a23b64448dc080_NeikiAnalytics.exe \??\c:\windows\system\explorer.exe
PID 2176 wrote to memory of 2508 N/A C:\Users\Admin\AppData\Local\Temp\8cb289f744a3bafac8a23b64448dc080_NeikiAnalytics.exe \??\c:\windows\system\explorer.exe
PID 2508 wrote to memory of 2740 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 2508 wrote to memory of 2740 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 2508 wrote to memory of 2740 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 2508 wrote to memory of 2740 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 2740 wrote to memory of 2388 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 2740 wrote to memory of 2388 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 2740 wrote to memory of 2388 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 2740 wrote to memory of 2388 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 2388 wrote to memory of 2440 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 2388 wrote to memory of 2440 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 2388 wrote to memory of 2440 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 2388 wrote to memory of 2440 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 2388 wrote to memory of 1764 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2388 wrote to memory of 1764 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2388 wrote to memory of 1764 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2388 wrote to memory of 1764 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2388 wrote to memory of 2704 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2388 wrote to memory of 2704 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2388 wrote to memory of 2704 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2388 wrote to memory of 2704 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2388 wrote to memory of 1016 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2388 wrote to memory of 1016 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2388 wrote to memory of 1016 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2388 wrote to memory of 1016 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe

Processes

C:\Users\Admin\AppData\Local\Temp\8cb289f744a3bafac8a23b64448dc080_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\8cb289f744a3bafac8a23b64448dc080_NeikiAnalytics.exe"

\??\c:\windows\system\explorer.exe

c:\windows\system\explorer.exe

\??\c:\windows\system\spoolsv.exe

c:\windows\system\spoolsv.exe SE

\??\c:\windows\system\svchost.exe

c:\windows\system\svchost.exe

\??\c:\windows\system\spoolsv.exe

c:\windows\system\spoolsv.exe PR

C:\Windows\SysWOW64\at.exe

at 04:02 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

C:\Windows\SysWOW64\at.exe

at 04:03 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

C:\Windows\SysWOW64\at.exe

at 04:04 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

Network

N/A

Files

memory/2176-0-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2176-1-0x0000000000020000-0x0000000000024000-memory.dmp

memory/2176-2-0x0000000072940000-0x0000000072A93000-memory.dmp

memory/2176-3-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2176-4-0x0000000000401000-0x000000000042E000-memory.dmp

\Windows\system\explorer.exe

MD5 ddc36eed6e2df079de3b62374a00b7d5
SHA1 cecaded0162d96953982dbdfb73bdfd988452371
SHA256 28d10770a4fd76d2e9cdfa35323d281f78411e355166f1d351a6cb2db07e184a
SHA512 4307dbb01825eca8b7d00936fefcf60d34b0949382f04fc31d1ce0b676f4942d48cda7d6927370a8dd1d860268481454bd24c4d2bcc69dc8a7881cf5194b222a

memory/2176-16-0x0000000003270000-0x00000000032A1000-memory.dmp

memory/2508-18-0x0000000072940000-0x0000000072A93000-memory.dmp

memory/2508-20-0x0000000000400000-0x0000000000431000-memory.dmp

\Windows\system\spoolsv.exe

MD5 7d374161042201b07b31bcb4173b4414
SHA1 f8a1d63bc065ab5b5a331764ad1d1b3042145405
SHA256 872b608bfcde2fd6184db5d62a72aff8c2336462e2caf76959fe0921ec3e181a
SHA512 f1ea166392bd2de454a6c8829879b5e9737069f4278fd67f4ab2809794d5d5d7fe512f183650c92dc8f05a905d5d7a0220b4f7b5056ed9c34bfd23486d8b83e4

memory/2508-29-0x00000000027F0000-0x0000000002821000-memory.dmp

memory/2740-35-0x0000000072940000-0x0000000072A93000-memory.dmp

memory/2740-40-0x0000000000400000-0x0000000000431000-memory.dmp

\Windows\system\svchost.exe

MD5 a383196c53e650e968076779e0728361
SHA1 3a137c72c953e6d7c1e37629db1945f111ccb7c0
SHA256 99ac782e24c76d833e7daa6ecaa644afab8664f1d1e727f538d19efa8e89131f
SHA512 7030dc1ee598a41f05764005941e7babb4ae212c216b5ec89a51466eac579a53b92998f9bfd3e9e37a79b44c9340c6f887507751e1eec73d439a076cacf3ca8d

memory/2740-50-0x0000000001E80000-0x0000000001EB1000-memory.dmp

memory/2740-52-0x0000000001E80000-0x0000000001EB1000-memory.dmp

memory/2176-53-0x0000000000020000-0x0000000000024000-memory.dmp

memory/2388-54-0x0000000072940000-0x0000000072A93000-memory.dmp

memory/2388-55-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2388-62-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2176-61-0x0000000000401000-0x000000000042E000-memory.dmp

memory/2388-67-0x0000000001DB0000-0x0000000001DE1000-memory.dmp

memory/2508-66-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2440-68-0x0000000072940000-0x0000000072A93000-memory.dmp

memory/2440-74-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2176-78-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2176-79-0x0000000000401000-0x000000000042E000-memory.dmp

memory/2740-80-0x0000000000400000-0x0000000000431000-memory.dmp

C:\Users\Admin\AppData\Roaming\mrsys.exe

MD5 21556afa4d5e3d47297f63728636519e
SHA1 a529f68a202dd854c1f5cb10a37fd38a0fb5df49
SHA256 1233c6feb0593bad61ca56b6d1b5b0012edc466a268ab81c8267cafd0d6ae3fa
SHA512 f750fb03d7f9631d316f20f7d49aefecbb297c60e19f449741078fc411fe0d2bb340aaa1e34a4beb3002c0221d51a2355b1bd2c170192942567e9bdb6475734f

memory/2508-82-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2388-83-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2508-92-0x0000000000400000-0x0000000000431000-memory.dmp