fcdac25bc688a0b96f952f7ebf65d375d9743282e65bbd34c075e22aa29ad5de

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 01:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1fbef48403b0bd3016a9265f3c5e9030_NeikiAnalytics.exe
Size 481KB
Sample240602-b9ymlafd77
SHA256 fcdac25bc688a0b96f952f7ebf65d375d9743282e65bbd34c075e22aa29ad5de
MD5 1fbef48403b0bd3016a9265f3c5e9030
SHA1 8c737e2a8afe847539d81e88c71ef6b1e80589a1
SHA512 8ad5c08fc5a114e9af7e087554eaa17138c2833d29f3fcfdc325a08402ca36d4328310c9fcbf660375b822c22d09d79794b8d219c06cc564910f6868ad53b167
SSDEEP 6144:it03a62hzpSNxV2qcJVLNyTiY6wDyIJ2r/blQLQJ:Os52hzpHq8eTi30yIQrDl/
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 26 IoCs

pid	Process
4352	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202.exe
1932	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202a.exe
3332	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202b.exe
2296	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202c.exe
5056	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202d.exe
620	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202e.exe
3172	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202f.exe
4816	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202g.exe
3752	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202h.exe
1316	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202i.exe
4800	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202j.exe
4852	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202k.exe
2380	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202l.exe
2940	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202m.exe
1172	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202n.exe
1988	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202o.exe
1076	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202p.exe
868	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202q.exe
2196	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202r.exe
2424	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202s.exe
672	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202t.exe
744	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202u.exe
996	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202v.exe
3464	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202w.exe
4780	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202x.exe
1168	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202y.exe

Adds Run key to start application 2 TTPs 26 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Modifies registry class 54 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 8487dc031379771a	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202k.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202p.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202x.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 8487dc031379771a	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202c.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202k.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 8487dc031379771a	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202b.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202n.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 8487dc031379771a	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202o.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 8487dc031379771a	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202p.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	1fbef48403b0bd3016a9265f3c5e9030_NeikiAnalytics.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 8487dc031379771a	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202d.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 8487dc031379771a	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202f.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 8487dc031379771a	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202i.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202m.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202t.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 8487dc031379771a	1fbef48403b0bd3016a9265f3c5e9030_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202b.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202f.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 8487dc031379771a	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202q.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202r.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 8487dc031379771a	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202r.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 8487dc031379771a	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202y.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 8487dc031379771a	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202e.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202c.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202i.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 8487dc031379771a	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202l.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202o.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202y.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202l.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 8487dc031379771a	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202w.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 8487dc031379771a	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202h.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202j.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 8487dc031379771a	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202s.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202a.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 8487dc031379771a	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202d.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 8487dc031379771a	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202g.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 8487dc031379771a	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202n.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 8487dc031379771a	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202t.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 8487dc031379771a	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202j.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202s.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202u.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202v.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 8487dc031379771a	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202v.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 8487dc031379771a	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202a.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 8487dc031379771a	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202m.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 8487dc031379771a	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202u.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202w.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202e.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202g.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202h.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 8487dc031379771a	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202x.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202q.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3440 wrote to memory of 4352	3440	1fbef48403b0bd3016a9265f3c5e9030_NeikiAnalytics.exe	85
PID 3440 wrote to memory of 4352	3440	1fbef48403b0bd3016a9265f3c5e9030_NeikiAnalytics.exe	85
PID 3440 wrote to memory of 4352	3440	1fbef48403b0bd3016a9265f3c5e9030_NeikiAnalytics.exe	85
PID 4352 wrote to memory of 1932	4352	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202.exe	86
PID 4352 wrote to memory of 1932	4352	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202.exe	86
PID 4352 wrote to memory of 1932	4352	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202.exe	86
PID 1932 wrote to memory of 3332	1932	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202a.exe	87
PID 1932 wrote to memory of 3332	1932	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202a.exe	87
PID 1932 wrote to memory of 3332	1932	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202a.exe	87
PID 3332 wrote to memory of 2296	3332	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202b.exe	88
PID 3332 wrote to memory of 2296	3332	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202b.exe	88
PID 3332 wrote to memory of 2296	3332	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202b.exe	88
PID 2296 wrote to memory of 5056	2296	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202c.exe	89
PID 2296 wrote to memory of 5056	2296	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202c.exe	89
PID 2296 wrote to memory of 5056	2296	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202c.exe	89
PID 5056 wrote to memory of 620	5056	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202d.exe	90
PID 5056 wrote to memory of 620	5056	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202d.exe	90
PID 5056 wrote to memory of 620	5056	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202d.exe	90
PID 620 wrote to memory of 3172	620	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202e.exe	91
PID 620 wrote to memory of 3172	620	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202e.exe	91
PID 620 wrote to memory of 3172	620	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202e.exe	91
PID 3172 wrote to memory of 4816	3172	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202f.exe	92
PID 3172 wrote to memory of 4816	3172	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202f.exe	92
PID 3172 wrote to memory of 4816	3172	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202f.exe	92
PID 4816 wrote to memory of 3752	4816	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202g.exe	93
PID 4816 wrote to memory of 3752	4816	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202g.exe	93
PID 4816 wrote to memory of 3752	4816	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202g.exe	93
PID 3752 wrote to memory of 1316	3752	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202h.exe	94
PID 3752 wrote to memory of 1316	3752	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202h.exe	94
PID 3752 wrote to memory of 1316	3752	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202h.exe	94
PID 1316 wrote to memory of 4800	1316	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202i.exe	95
PID 1316 wrote to memory of 4800	1316	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202i.exe	95
PID 1316 wrote to memory of 4800	1316	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202i.exe	95
PID 4800 wrote to memory of 4852	4800	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202j.exe	96
PID 4800 wrote to memory of 4852	4800	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202j.exe	96
PID 4800 wrote to memory of 4852	4800	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202j.exe	96
PID 4852 wrote to memory of 2380	4852	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202k.exe	97
PID 4852 wrote to memory of 2380	4852	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202k.exe	97
PID 4852 wrote to memory of 2380	4852	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202k.exe	97
PID 2380 wrote to memory of 2940	2380	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202l.exe	98
PID 2380 wrote to memory of 2940	2380	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202l.exe	98
PID 2380 wrote to memory of 2940	2380	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202l.exe	98
PID 2940 wrote to memory of 1172	2940	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202m.exe	99
PID 2940 wrote to memory of 1172	2940	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202m.exe	99
PID 2940 wrote to memory of 1172	2940	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202m.exe	99
PID 1172 wrote to memory of 1988	1172	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202n.exe	101
PID 1172 wrote to memory of 1988	1172	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202n.exe	101
PID 1172 wrote to memory of 1988	1172	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202n.exe	101
PID 1988 wrote to memory of 1076	1988	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202o.exe	102
PID 1988 wrote to memory of 1076	1988	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202o.exe	102
PID 1988 wrote to memory of 1076	1988	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202o.exe	102
PID 1076 wrote to memory of 868	1076	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202p.exe	105
PID 1076 wrote to memory of 868	1076	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202p.exe	105
PID 1076 wrote to memory of 868	1076	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202p.exe	105
PID 868 wrote to memory of 2196	868	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202q.exe	107
PID 868 wrote to memory of 2196	868	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202q.exe	107
PID 868 wrote to memory of 2196	868	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202q.exe	107
PID 2196 wrote to memory of 2424	2196	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202r.exe	108
PID 2196 wrote to memory of 2424	2196	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202r.exe	108
PID 2196 wrote to memory of 2424	2196	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202r.exe	108
PID 2424 wrote to memory of 672	2424	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202s.exe	109
PID 2424 wrote to memory of 672	2424	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202s.exe	109
PID 2424 wrote to memory of 672	2424	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202s.exe	109
PID 672 wrote to memory of 744	672	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202t.exe	111

C:\Users\Admin\AppData\Local\Temp\1fbef48403b0bd3016a9265f3c5e9030_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\1fbef48403b0bd3016a9265f3c5e9030_NeikiAnalytics.exe"
1⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3440
- \??\c:\users\admin\appdata\local\temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202.exe
  c:\users\admin\appdata\local\temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4352
- - \??\c:\users\admin\appdata\local\temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202a.exe
    c:\users\admin\appdata\local\temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202a.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1932
  - - \??\c:\users\admin\appdata\local\temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202b.exe
      c:\users\admin\appdata\local\temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202b.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3332
    - - \??\c:\users\admin\appdata\local\temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202c.exe
        
        c:\users\admin\appdata\local\temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202c.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2296
      - \??\c:\users\admin\appdata\local\temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202d.exe
        
        c:\users\admin\appdata\local\temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202d.exe
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5056
        
        \??\c:\users\admin\appdata\local\temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202e.exe
        
        c:\users\admin\appdata\local\temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202e.exe
        7⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:620
        
        \??\c:\users\admin\appdata\local\temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202f.exe
        
        c:\users\admin\appdata\local\temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202f.exe
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3172
        
        \??\c:\users\admin\appdata\local\temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202g.exe
        
        c:\users\admin\appdata\local\temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202g.exe
        9⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4816
        
        \??\c:\users\admin\appdata\local\temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202h.exe
        
        c:\users\admin\appdata\local\temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202h.exe
        10⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3752
        
        \??\c:\users\admin\appdata\local\temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202i.exe
        
        c:\users\admin\appdata\local\temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202i.exe
        11⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1316
        
        \??\c:\users\admin\appdata\local\temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202j.exe
        
        c:\users\admin\appdata\local\temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202j.exe
        12⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4800
        
        \??\c:\users\admin\appdata\local\temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202k.exe
        
        c:\users\admin\appdata\local\temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202k.exe
        13⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4852
        
        \??\c:\users\admin\appdata\local\temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202l.exe
        
        c:\users\admin\appdata\local\temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202l.exe
        14⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2380
        
        \??\c:\users\admin\appdata\local\temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202m.exe
        
        c:\users\admin\appdata\local\temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202m.exe
        15⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2940
        
        \??\c:\users\admin\appdata\local\temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202n.exe
        
        c:\users\admin\appdata\local\temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202n.exe
        16⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1172
        
        \??\c:\users\admin\appdata\local\temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202o.exe
        
        c:\users\admin\appdata\local\temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202o.exe
        17⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1988
        
        \??\c:\users\admin\appdata\local\temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202p.exe
        
        c:\users\admin\appdata\local\temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202p.exe
        18⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1076
        
        \??\c:\users\admin\appdata\local\temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202q.exe
        
        c:\users\admin\appdata\local\temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202q.exe
        19⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:868
        
        \??\c:\users\admin\appdata\local\temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202r.exe
        
        c:\users\admin\appdata\local\temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202r.exe
        20⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2196
        
        \??\c:\users\admin\appdata\local\temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202s.exe
        
        c:\users\admin\appdata\local\temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202s.exe
        21⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2424
        
        \??\c:\users\admin\appdata\local\temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202t.exe
        
        c:\users\admin\appdata\local\temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202t.exe
        22⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:672
        
        \??\c:\users\admin\appdata\local\temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202u.exe
        
        c:\users\admin\appdata\local\temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202u.exe
        23⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        
        PID:744
        
        \??\c:\users\admin\appdata\local\temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202v.exe
        
        c:\users\admin\appdata\local\temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202v.exe
        24⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        
        PID:996
        
        \??\c:\users\admin\appdata\local\temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202w.exe
        
        c:\users\admin\appdata\local\temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202w.exe
        25⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        
        PID:3464
        
        \??\c:\users\admin\appdata\local\temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202x.exe
        
        c:\users\admin\appdata\local\temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202x.exe
        26⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        
        PID:4780
        
        \??\c:\users\admin\appdata\local\temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202y.exe
        
        c:\users\admin\appdata\local\temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202y.exe
        27⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202b.exe

Path C:\Users\Admin\AppData\Local\Temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202b.exe
Size 482KB
SHA256 9787266f449958bafe1e5d48926e438313714c4b39c72fdd4bf190643950d18d
MD5 6989d8a50400ccc5172029ad9f3d87f4
SHA1 985930015db822ecefcb27b1fba9ed8234600198
SHA512 09bc47727e193bc3869bf8f0435e5b652871ff1d85a3ec6b263db35935f344dde5c00c694e946cec5f405c8dc9cf357fa3f4657f706428e0bab6aa280de2f41b
SSDEEP 6144:it03a62hzpSNxV2qcJVLNyTiY6wDyIJ2r/blQLQb:Os52hzpHq8eTi30yIQrDlB
MD5 SHA1 SHA512 SSDEEP

Submit Download

1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202c.exe

Path C:\Users\Admin\AppData\Local\Temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202c.exe
Size 482KB
SHA256 dcc8968c85f5d0627e14c842f086accd3580e3b645d88e8a66903bedbc8dab34
MD5 3813c35c04d1128f09babf52b204ba75
SHA1 54955f835beaaba3b1a536de5e8826b3d31dffd7
SHA512 078f957bc076ae8a8fb76a697dfcceb491df139dbf0d1b7fff4a178f196c6676f0b5aca0cd0a840c34f0c22536e51d0694ae8124507933c308b285fc5c07bef0
SSDEEP 6144:it03a62hzpSNxV2qcJVLNyTiY6wDyIJ2r/blQLQb:Os52hzpHq8eTi30yIQrDlZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202d.exe

Path C:\Users\Admin\AppData\Local\Temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202d.exe
Size 483KB
SHA256 675d21adffa8666626e2c736018fa7602da82e6e9624f541369fc9958e0dd9b8
MD5 214d4e94319d43d6eb6c93bfee7aacf0
SHA1 233c9889ab30b033fc5ea7ccdad84bc8001450ca
SHA512 94629318ad8378d36c9c71d50159e4427b50bd7f6b5c3505b7a48348068d9fbfa9d2bd61ed7c131f4e2b6599cb674b50de6cd68ec0a169e35e3b100331aeb1a7
SSDEEP 6144:it03a62hzpSNxV2qcJVLNyTiY6wDyIJ2r/blQLQF:Os52hzpHq8eTi30yIQrDlL
MD5 SHA1 SHA512 SSDEEP

Submit Download

1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202g.exe

Path C:\Users\Admin\AppData\Local\Temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202g.exe
Size 483KB
SHA256 63eb3136f364f6ab4a27f3ebdb3e4a2a8835a5bf68410178b8bf1d834fd6349b
MD5 1cae5499b13398a9e5d61e1f3471acc9
SHA1 92f4d9c406cf308ad08201eb7994a7f6784aed2d
SHA512 aeab9a91c02ebb7e8993d69defe23e5906ede558b0998e3e38ccdc2c74207a0b4db5db382a5e90386f6ebe137b3c07eafaddaba5a4a27acd9998f9709fc43b88
SSDEEP 6144:it03a62hzpSNxV2qcJVLNyTiY6wDyIJ2r/blQLQr:Os52hzpHq8eTi30yIQrDl5
MD5 SHA1 SHA512 SSDEEP

Submit Download

1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202i.exe

Path C:\Users\Admin\AppData\Local\Temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202i.exe
Size 484KB
SHA256 82769760d91fc83eacd98a37cbf0e7f6111a37b1e2f44fdfb85592717ae0450c
MD5 4d83880516928e037d2f7a691308de2c
SHA1 80458ed3c213a9a0a833ff9272eca423ae80c3bc
SHA512 0b83119be323f99d91a8ef5bf409c4c76215d9cb27e0530db136220208614bdb58bc72c871639d505608b36ef122cb24a7125a4e0a58ed32e66b3d6c10089507
SSDEEP 6144:it03a62hzpSNxV2qcJVLNyTiY6wDyIJ2r/blQLQm:Os52hzpHq8eTi30yIQrDlo
MD5 SHA1 SHA512 SSDEEP

Submit Download

1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202j.exe

Path C:\Users\Admin\AppData\Local\Temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202j.exe
Size 484KB
SHA256 2a01d458a248f9ecac8cd9396dae6e90fb0fb11d98bf258c17d7293c32e3c8c7
MD5 eaa491228fdd56ce18bdc9330c4224a6
SHA1 a3163225c7b42c270ae1ba96576901ab1a4545d3
SHA512 8f3de3a55c044273ca2ce9a17edf81b95abb94ab11bf37a8dabf1b7f31dfa3b2e13a978747de18e400700b275c27e52308608dcb3d4c55a21f2e2fa8132f0109
SSDEEP 6144:it03a62hzpSNxV2qcJVLNyTiY6wDyIJ2r/blQLQV:Os52hzpHq8eTi30yIQrDlr
MD5 SHA1 SHA512 SSDEEP

Submit Download

1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202k.exe

Path C:\Users\Admin\AppData\Local\Temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202k.exe
Size 484KB
SHA256 ac34d9099eb1f9550451e75502599413b4e2eb5f1f94c1467ccbf394c05b126f
MD5 536d3fad170c267efeaeb8641007cbc1
SHA1 adfd883274f4cb0b4057143e4e567ba114ebc671
SHA512 a7955e16da1386c5eba8245a081eb12d97ff920c16c8eac6b01c5ac3878356a3c1f605d54bac2692f924c8d4250251f5d48eda05d6897bb844aee80620411c0a
SSDEEP 6144:it03a62hzpSNxV2qcJVLNyTiY6wDyIJ2r/blQLQ+:Os52hzpHq8eTi30yIQrDl4
MD5 SHA1 SHA512 SSDEEP

Submit Download

1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202l.exe

Path C:\Users\Admin\AppData\Local\Temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202l.exe
Size 484KB
SHA256 fd7127b8b789a963e3df8d39ef92ab19555a01acdb0ecade26b552b9f3baa9cf
MD5 f08c495f3a3dbe9e3ec7b1dd39e1242c
SHA1 2ea64c482071d695f4d804b30f1d890ef12a3f8b
SHA512 7613c307849450c53173c4bf94abce9aaee0a9e8be66449d6e730e2531ffc7b040461380277b95693968e761bf403b8809bf21c37946d7775a60301a7beb324b
SSDEEP 6144:it03a62hzpSNxV2qcJVLNyTiY6wDyIJ2r/blQLQl:Os52hzpHq8eTi30yIQrDlz
MD5 SHA1 SHA512 SSDEEP

Submit Download

1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202m.exe

Path C:\Users\Admin\AppData\Local\Temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202m.exe
Size 485KB
SHA256 97f11ed5a47e975b3ec1c6f4f01578cbd776c73de5edbe9589b1ddeb2417b173
MD5 e69ec0eff0ec2e5215b94ffc6e40b45e
SHA1 8fd39eff9eab7eaeadafbfbb450d4685e0cb5742
SHA512 28709d3034080ba4b1a34eb43cfa42ae9f110e0015c41498e2029c7cc5b578102c533b32b458f7d161999e3c336067e6be66794b715b0de48e9dc87a8a3982c0
SSDEEP 6144:it03a62hzpSNxV2qcJVLNyTiY6wDyIJ2r/blQLQH:Os52hzpHq8eTi30yIQrDld
MD5 SHA1 SHA512 SSDEEP

Submit Download

1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202n.exe

Path C:\Users\Admin\AppData\Local\Temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202n.exe
Size 485KB
SHA256 3d2742643b7ca19af480667abc42063f4da4024ac961ed0bd2669622e11f464e
MD5 df5999ee1233a89abc8350d2b07ae9d4
SHA1 363bc0eac4dc5e39541984b942bd8a44f850cd54
SHA512 9edf1d527aba9a05f51b64facc487b4950a34343067b9afc666dfdcd432f041d95a32cb811e7f7d75d610e3b190b7ff3620c0035101ac3e87eef2360a7f7d5ff
SSDEEP 6144:it03a62hzpSNxV2qcJVLNyTiY6wDyIJ2r/blQLQu:Os52hzpHq8eTi30yIQrDlo
MD5 SHA1 SHA512 SSDEEP

Submit Download

1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202p.exe

Path C:\Users\Admin\AppData\Local\Temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202p.exe
Size 485KB
SHA256 3a89373b827196f866a006cc174850dbc6e4df3beefd1f27da15396fffce1a8b
MD5 49f3fa4acca9ec79f0c10fdd7453c4dd
SHA1 81c6e92c59fd8c9122c8f1aa51cdc39a448f26b6
SHA512 36dfdeb2605898d9b374e18db2898f933bdb037cd24887d7c5ad51979923600d1faf1a14daccf57e382372f4676127958a486ad3e39c47ac1da08b8ad4fc50e1
SSDEEP 6144:it03a62hzpSNxV2qcJVLNyTiY6wDyIJ2r/blQLQS:Os52hzpHq8eTi30yIQrDlE
MD5 SHA1 SHA512 SSDEEP

Submit Download

1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202r.exe

Path C:\Users\Admin\AppData\Local\Temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202r.exe
Size 486KB
SHA256 fe25070150cb3d7ff461bdee06660b0c93634c93102bca712b77f9df9283bb02
MD5 124f361490fabf26a9f9caf0d4ef4b7d
SHA1 c0006e1790e60b1e6b820b7f45330eb2503aaad8
SHA512 afc197741bb08adf5e95df97ec1b976aa2f1c890e1b91dc5ca9a666d0a81f1255a55e4c2f852940e4eabbabe94c495626033ed08e6c52786187dd1e9463a398a
SSDEEP 6144:it03a62hzpSNxV2qcJVLNyTiY6wDyIJ2r/blQLQ0:Os52hzpHq8eTi30yIQrDl+
MD5 SHA1 SHA512 SSDEEP

Submit Download

1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202s.exe

Path C:\Users\Admin\AppData\Local\Temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202s.exe
Size 486KB
SHA256 2bce1dc821d6ffad3a515f85cccbe5d056816e305c20e5e0acba6687a8a206d9
MD5 e092497d18cc9b136160e0508b0b6a4a
SHA1 2e055a2da81e5752f9a3d90b212d50be30b8cd44
SHA512 25efeb54f871d420a180c293136f1b75f41ed52d27afffcdb48b7940374ee17fe0b7b886e4685956891d6b2ac087649e38aabbbdceb600f68d152b96ef335086
SSDEEP 6144:it03a62hzpSNxV2qcJVLNyTiY6wDyIJ2r/blQLQT:Os52hzpHq8eTi30yIQrDlJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202t.exe

Path C:\Users\Admin\AppData\Local\Temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202t.exe
Size 486KB
SHA256 08a8875a7dd94abba28004327dca0f5f2f292e445a61a21cb4c5db75afd88c42
MD5 c8493a341e296241673530658a8f1617
SHA1 c9c25065f747f66528b9747f0a36baee726afb02
SHA512 fd2cbb5fe7f6057fee5c1a45911bdbd1f1ce8a212818160802332759ac2286ded0823636fe32da4d129988af5515a45c8c52be994d0f3cc04a612151dcaac01f
SSDEEP 6144:it03a62hzpSNxV2qcJVLNyTiY6wDyIJ2r/blQLQg:Os52hzpHq8eTi30yIQrDlK
MD5 SHA1 SHA512 SSDEEP

Submit Download

1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202u.exe

Path C:\Users\Admin\AppData\Local\Temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202u.exe
Size 486KB
SHA256 03a3a593fa7f06523532a2f329d174750bb84e16589954b1f8a5bffcc19bdc45
MD5 37b653e2c1b57117bd77e09da04e9574
SHA1 015e88805005211ced46c2b14bc3e35ebfe7bc92
SHA512 7bc43436b9236c0081ae3604684a6bb8de57424da871defbf0a50d0ef1ef91825bdfb1f5e395422b0e60ca53c5fc43d27102a13363c463ab2b2193c87684602f
SSDEEP 6144:it03a62hzpSNxV2qcJVLNyTiY6wDyIJ2r/blQLQn:Os52hzpHq8eTi30yIQrDlV
MD5 SHA1 SHA512 SSDEEP

Submit Download

1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202v.exe

Path C:\Users\Admin\AppData\Local\Temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202v.exe
Size 487KB
SHA256 5eeb0bfc25e2e57aa30ebf8a8be51d5b08cdd99c00542583ca3bc283a641b3c8
MD5 9dd3651c7da7d1ddf4b35324a011d823
SHA1 13eae0b8752a3307845c9bf83e4d3300ea259373
SHA512 b60e3c87ffa600a0ece3459a7964e923fe0fb20f638193c7fd967a7046439d97648a626e1be64f3c9b4c971267f33793623c2a5a4a26406aa3bf6bd7193a5c0f
SSDEEP 6144:it03a62hzpSNxV2qcJVLNyTiY6wDyIJ2r/blQLQk:Os52hzpHq8eTi30yIQrDlW
MD5 SHA1 SHA512 SSDEEP

Submit Download

1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202w.exe

Path C:\Users\Admin\AppData\Local\Temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202w.exe
Size 487KB
SHA256 58fc2a5b1a4d897ae823b6ef42689c71d37164e9dadddb4a7f1a1185d532d963
MD5 77ad51b4762710a14e46b32ca643514e
SHA1 3a283ddd56f05bc8c05bd40a03dd4a5832748a38
SHA512 a172d82a17fb30a4930b1372d67c93dcdad8f76a84eda996fd35e444548c8c038b182b70a5c4e5aa160e96ff12ce5697ae151cda0dd6171afcab1cb5b9bf0bdf
SSDEEP 6144:it03a62hzpSNxV2qcJVLNyTiY6wDyIJ2r/blQLQl:Os52hzpHq8eTi30yIQrDlD
MD5 SHA1 SHA512 SSDEEP

Submit Download

1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202x.exe

Path C:\Users\Admin\AppData\Local\Temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202x.exe
Size 487KB
SHA256 5a1d0e63bd15fdb8e036b61dc9da552091fe269c5bdc5e0b53ba8579d4e7f20c
MD5 0c0d87b08825c428f67eb7dfe7335571
SHA1 c71d04c3cabb2f81d16973f9e9e06459680119a1
SHA512 9598bd61809f7dcd985471328470f7fb4dba7ca717c22455bbaca6e91646a5d96a14e5319e9d912c42d8c22f0341545bf9161e3f478c49e997304c0bc6bc9d26
SSDEEP 6144:it03a62hzpSNxV2qcJVLNyTiY6wDyIJ2r/blQLQw:Os52hzpHq8eTi30yIQrDl6
MD5 SHA1 SHA512 SSDEEP

Submit Download

1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202y.exe

Path C:\Users\Admin\AppData\Local\Temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202y.exe
Size 487KB
SHA256 299a52569b6e8ce328135a1d3d80e0c8347c1b73fe761b0f315dec57e2c3c4f2
MD5 6d8fcc3cde432402bc0c215611b9cf65
SHA1 83dcb90812f7b22fcb2456e1f0f1c59d04ec5979
SHA512 5e0ac25e418a55c13f1c8ed2baaccf530a4c7348d48e5f8d1533be3d3548071ada86475e296c67824fe8aaca1d23185eb050b724b27befd4101f0655fb5b3be9
SSDEEP 6144:it03a62hzpSNxV2qcJVLNyTiY6wDyIJ2r/blQLQN:Os52hzpHq8eTi30yIQrDlD
MD5 SHA1 SHA512 SSDEEP

Submit Download

1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202.exe

Path \??\c:\users\admin\appdata\local\temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202.exe
Size 482KB
SHA256 02f44c556aa0d54ba939064d738964f42b5f8fe091a45ce0799b23ba4ebbea3f
MD5 6af1cdb9cb7782d8d2ff27f5cbd4a5eb
SHA1 2cc4d0fa25158f063f362310c1a074dd64889f87
SHA512 e05afecf2e9b2d5c182d64bb33e29f5316b92731500596c7dbec67be1bdc2d00d5c370b6e188ec5f1e3e434fc0dfe92eb0cc7cd5cd90997d308bf80d4c059074
SSDEEP 6144:it03a62hzpSNxV2qcJVLNyTiY6wDyIJ2r/blQLQz:Os52hzpHq8eTi30yIQrDlp
MD5 SHA1 SHA512 SSDEEP

Submit Download

1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202a.exe

Path \??\c:\users\admin\appdata\local\temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202a.exe
Size 482KB
SHA256 560f334031c6a1c1824142831e9940daee09f8ebfff7fd9a02407cd926221cd2
MD5 15f029b90316ea8916ceff269f02ba26
SHA1 fa324379bb1b75e46f9160a76b2be5736e13b81d
SHA512 350f4feb82c84098a851e54a3a4fc72d7cf4b895abb1205dcce368a52714c16b151c5698fbb5dac7196f12b2d3c521348d5d8473b0dda3e0b1069224e9e8701e
SSDEEP 6144:it03a62hzpSNxV2qcJVLNyTiY6wDyIJ2r/blQLQV:Os52hzpHq8eTi30yIQrDlb
MD5 SHA1 SHA512 SSDEEP

Submit Download

1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202e.exe

Path \??\c:\users\admin\appdata\local\temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202e.exe
Size 483KB
SHA256 b68c83ec67d2040ea20ac86c6d6cdce8d104af0c0068a3befeeb47cafcb5eb48
MD5 85f1b75d080ddb068f2af2a7e88b222a
SHA1 8d71fa449bf00708120f3a8df25e834d98e21d79
SHA512 615e8ace318078ff0d54d8fb2a47ba48eea7c5185cd3e84816ce6341bc040528a6959046a6859ac36d49cacbf5d94da13c4968c4fbde5b350a4ab053283a15a8
SSDEEP 6144:it03a62hzpSNxV2qcJVLNyTiY6wDyIJ2r/blQLQ7:Os52hzpHq8eTi30yIQrDlJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202f.exe

Path \??\c:\users\admin\appdata\local\temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202f.exe
Size 483KB
SHA256 363e26705ba4ff6e0f500f156a688dbb46b299540f3d95129e6b8b91d329a529
MD5 aadc0ac1d538a39bfb81c76f453e7026
SHA1 41305eee2865d4270a0f9009836fb0134ba47cd2
SHA512 1122aad89b77d9902ab14176936bd0641cc7f42c55985dfaf20d78a6fd8db31296e913c725d3d6957d6d3b1fc1911a6e20f3026282cb6933ef4ac31c64123195
SSDEEP 6144:it03a62hzpSNxV2qcJVLNyTiY6wDyIJ2r/blQLQp:Os52hzpHq8eTi30yIQrDl3
MD5 SHA1 SHA512 SSDEEP

Submit Download

1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202h.exe

Path \??\c:\users\admin\appdata\local\temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202h.exe
Size 483KB
SHA256 ac60f2176f65b1e3892a7ff2525c72793a4d6fd967846dcc740b168c03fdb244
MD5 f2ee4994eff9a5da901e1217beaf143e
SHA1 f998c7d7a33d0b66c6e7ff602da6969691158b19
SHA512 fa9f60a22ac8bb4f186de81a43ea5ff2bbe9beff8cb0f282df9b839b75f96bcf9a4b33d8d246cd1451596a61c1c0d206b3925588f9658624fdd5f183dc58bb65
SSDEEP 6144:it03a62hzpSNxV2qcJVLNyTiY6wDyIJ2r/blQLQl:Os52hzpHq8eTi30yIQrDlT
MD5 SHA1 SHA512 SSDEEP

Submit Download

1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202o.exe

Path \??\c:\users\admin\appdata\local\temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202o.exe
Size 485KB
SHA256 944ed495261d32856d1067e8b33351b62527d154ed756c57160d9ed0451bc4fb
MD5 46c2e3299f0e1c410eacc22d521c4d5c
SHA1 a981056815b013013f3ddda927162831d1af4d48
SHA512 923685fba377d5999ad85c48977471a8b329f5acf2f426e3ee37341b9ca55f1a4e9ec53abae567e39c8352cd5850a6e6364337fac31a6eaf22deb618e43f4b34
SSDEEP 6144:it03a62hzpSNxV2qcJVLNyTiY6wDyIJ2r/blQLQP:Os52hzpHq8eTi30yIQrDl1
MD5 SHA1 SHA512 SSDEEP

Submit Download

1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202q.exe

Path \??\c:\users\admin\appdata\local\temp\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202q.exe
Size 486KB
SHA256 9c27e067a5cea09d11ea4568cc7b8068c66e3e30f78aa78b0853c5d514c90e54
MD5 f4e66accae8a3fed40df7567eb27690f
SHA1 9e3692bc31bfbc6e01d21174d5440860a1287aa5
SHA512 d4374752e3895936df16532b247fc83d9fc41777c840ea223d36a66b4926f69e6f35ceea086d668d50880c597c109077e7022f78ad062b098a091c78fea2e53e
SSDEEP 6144:it03a62hzpSNxV2qcJVLNyTiY6wDyIJ2r/blQLQH:Os52hzpHq8eTi30yIQrDl9
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/620-74-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/620-69-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/672-233-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/744-243-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/868-193-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/868-202-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/996-255-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/996-245-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/1076-192-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/1076-182-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/1168-278-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/1172-160-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/1172-171-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/1316-113-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/1316-116-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/1932-20-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/1932-31-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/1988-179-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/1988-169-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/2196-213-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/2196-204-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/2296-51-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/2296-43-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/2380-146-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/2424-223-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/2940-159-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/2940-149-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/3172-86-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/3172-75-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/3332-41-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/3440-10-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/3440-0-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/3464-261-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/3464-265-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/3752-105-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/3752-97-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/4352-27-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/4352-14-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/4780-274-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/4800-126-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/4816-84-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/4816-96-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/4852-138-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/5056-68-0x0000000000400000-0x0000000000479000-memory.dmp

Download

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202n.exe\""	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202m.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202.exe\""	1fbef48403b0bd3016a9265f3c5e9030_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202j.exe\""	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202i.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202l.exe\""	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202k.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202d.exe\""	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202h.exe\""	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202g.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202i.exe\""	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202h.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202m.exe\""	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202l.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202s.exe\""	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202r.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202y.exe\""	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202x.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202b.exe\""	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202g.exe\""	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202r.exe\""	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202q.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202t.exe\""	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202s.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202u.exe\""	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202t.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202e.exe\""	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202f.exe\""	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202k.exe\""	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202j.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202q.exe\""	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202p.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202v.exe\""	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202u.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202x.exe\""	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202w.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202a.exe\""	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202c.exe\""	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202o.exe\""	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202n.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202p.exe\""	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202o.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202w.exe\""	1fbef48403b0bd3016a9265f3c5e9030_neikianalytics_3202v.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads