Malware Analysis Report

2025-01-06 07:55

Sample ID 240603-fbzt8ada88
Target 9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe
SHA256 3edf785beb720c4387a57dcfc87a8679ef21078c957e81d2e7df869158703b54
Tags
evasion
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

3edf785beb720c4387a57dcfc87a8679ef21078c957e81d2e7df869158703b54

Threat Level: Known bad

The file 9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

evasion

Modifies firewall policy service

Checks computer location settings

Drops file in System32 directory

Enumerates physical storage devices

Program crash

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-03 04:42

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-03 04:42

Reported

2024-06-03 04:45

Platform

win7-20240508-en

Max time kernel

119s

Max time network

120s

Command Line

wininit.exe

Signatures

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\WINDOWS\SysWOW64\regedit.exe C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2828 wrote to memory of 380 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\wininit.exe
PID 2828 wrote to memory of 380 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\wininit.exe
PID 2828 wrote to memory of 380 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\wininit.exe
PID 2828 wrote to memory of 380 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\wininit.exe
PID 2828 wrote to memory of 380 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\wininit.exe
PID 2828 wrote to memory of 380 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\wininit.exe
PID 2828 wrote to memory of 380 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\wininit.exe
PID 2828 wrote to memory of 388 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\csrss.exe
PID 2828 wrote to memory of 388 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\csrss.exe
PID 2828 wrote to memory of 388 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\csrss.exe
PID 2828 wrote to memory of 388 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\csrss.exe
PID 2828 wrote to memory of 388 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\csrss.exe
PID 2828 wrote to memory of 388 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\csrss.exe
PID 2828 wrote to memory of 388 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\csrss.exe
PID 2828 wrote to memory of 428 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\winlogon.exe
PID 2828 wrote to memory of 428 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\winlogon.exe
PID 2828 wrote to memory of 428 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\winlogon.exe
PID 2828 wrote to memory of 428 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\winlogon.exe
PID 2828 wrote to memory of 428 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\winlogon.exe
PID 2828 wrote to memory of 428 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\winlogon.exe
PID 2828 wrote to memory of 428 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\winlogon.exe
PID 2828 wrote to memory of 472 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\services.exe
PID 2828 wrote to memory of 472 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\services.exe
PID 2828 wrote to memory of 472 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\services.exe
PID 2828 wrote to memory of 472 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\services.exe
PID 2828 wrote to memory of 472 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\services.exe
PID 2828 wrote to memory of 472 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\services.exe
PID 2828 wrote to memory of 472 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\services.exe
PID 2828 wrote to memory of 488 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\lsass.exe
PID 2828 wrote to memory of 488 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\lsass.exe
PID 2828 wrote to memory of 488 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\lsass.exe
PID 2828 wrote to memory of 488 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\lsass.exe
PID 2828 wrote to memory of 488 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\lsass.exe
PID 2828 wrote to memory of 488 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\lsass.exe
PID 2828 wrote to memory of 488 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\lsass.exe
PID 2828 wrote to memory of 496 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\lsm.exe
PID 2828 wrote to memory of 496 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\lsm.exe
PID 2828 wrote to memory of 496 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\lsm.exe
PID 2828 wrote to memory of 496 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\lsm.exe
PID 2828 wrote to memory of 496 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\lsm.exe
PID 2828 wrote to memory of 496 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\lsm.exe
PID 2828 wrote to memory of 496 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\lsm.exe
PID 2828 wrote to memory of 596 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\svchost.exe
PID 2828 wrote to memory of 596 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\svchost.exe
PID 2828 wrote to memory of 596 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\svchost.exe
PID 2828 wrote to memory of 596 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\svchost.exe
PID 2828 wrote to memory of 596 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\svchost.exe
PID 2828 wrote to memory of 596 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\svchost.exe
PID 2828 wrote to memory of 596 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\svchost.exe
PID 2828 wrote to memory of 672 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\svchost.exe
PID 2828 wrote to memory of 672 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\svchost.exe
PID 2828 wrote to memory of 672 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\svchost.exe
PID 2828 wrote to memory of 672 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\svchost.exe
PID 2828 wrote to memory of 672 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\svchost.exe
PID 2828 wrote to memory of 672 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\svchost.exe
PID 2828 wrote to memory of 672 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\svchost.exe
PID 2828 wrote to memory of 740 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\System32\svchost.exe
PID 2828 wrote to memory of 740 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\System32\svchost.exe
PID 2828 wrote to memory of 740 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\System32\svchost.exe
PID 2828 wrote to memory of 740 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\System32\svchost.exe
PID 2828 wrote to memory of 740 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\System32\svchost.exe
PID 2828 wrote to memory of 740 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\System32\svchost.exe
PID 2828 wrote to memory of 740 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\System32\svchost.exe
PID 2828 wrote to memory of 808 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\System32\svchost.exe

Processes

C:\Windows\system32\wininit.exe

wininit.exe

C:\Windows\system32\csrss.exe

%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16

C:\Windows\system32\winlogon.exe

winlogon.exe

C:\Windows\system32\services.exe

C:\Windows\system32\services.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\spoolsv.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\taskhost.exe

"taskhost.exe"

C:\Windows\system32\Dwm.exe

"C:\Windows\system32\Dwm.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\system32\sppsvc.exe

C:\Windows\system32\sppsvc.exe

C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe"

Network

N/A

Files

memory/2828-0-0x0000000001000000-0x000000000100D000-memory.dmp

memory/2828-2-0x00000000776F0000-0x00000000776F1000-memory.dmp

memory/2828-1-0x00000000776EF000-0x00000000776F0000-memory.dmp

memory/2828-3-0x0000000001000000-0x000000000100D000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-03 04:42

Reported

2024-06-03 04:45

Platform

win10v2004-20240226-en

Max time kernel

143s

Max time network

153s

Command Line

winlogon.exe

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe:*:enabled:@shell32.dll,-1" C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\WINDOWS\SysWOW64\REGEDIT.EXE C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A

Enumerates physical storage devices

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3580 wrote to memory of 620 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\winlogon.exe
PID 3580 wrote to memory of 620 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\winlogon.exe
PID 3580 wrote to memory of 620 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\winlogon.exe
PID 3580 wrote to memory of 620 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\winlogon.exe
PID 3580 wrote to memory of 620 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\winlogon.exe
PID 3580 wrote to memory of 620 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\winlogon.exe
PID 3580 wrote to memory of 676 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\lsass.exe
PID 3580 wrote to memory of 676 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\lsass.exe
PID 3580 wrote to memory of 676 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\lsass.exe
PID 3580 wrote to memory of 676 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\lsass.exe
PID 3580 wrote to memory of 676 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\lsass.exe
PID 3580 wrote to memory of 676 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\lsass.exe
PID 3580 wrote to memory of 776 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\fontdrvhost.exe
PID 3580 wrote to memory of 776 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\fontdrvhost.exe
PID 3580 wrote to memory of 776 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\fontdrvhost.exe
PID 3580 wrote to memory of 776 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\fontdrvhost.exe
PID 3580 wrote to memory of 776 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\fontdrvhost.exe
PID 3580 wrote to memory of 776 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\fontdrvhost.exe
PID 3580 wrote to memory of 784 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\fontdrvhost.exe
PID 3580 wrote to memory of 784 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\fontdrvhost.exe
PID 3580 wrote to memory of 784 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\fontdrvhost.exe
PID 3580 wrote to memory of 784 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\fontdrvhost.exe
PID 3580 wrote to memory of 784 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\fontdrvhost.exe
PID 3580 wrote to memory of 784 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\fontdrvhost.exe
PID 3580 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\svchost.exe
PID 3580 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\svchost.exe
PID 3580 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\svchost.exe
PID 3580 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\svchost.exe
PID 3580 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\svchost.exe
PID 3580 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\svchost.exe
PID 3580 wrote to memory of 904 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\svchost.exe
PID 3580 wrote to memory of 904 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\svchost.exe
PID 3580 wrote to memory of 904 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\svchost.exe
PID 3580 wrote to memory of 904 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\svchost.exe
PID 3580 wrote to memory of 904 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\svchost.exe
PID 3580 wrote to memory of 904 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\svchost.exe
PID 3580 wrote to memory of 956 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\svchost.exe
PID 3580 wrote to memory of 956 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\svchost.exe
PID 3580 wrote to memory of 956 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\svchost.exe
PID 3580 wrote to memory of 956 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\svchost.exe
PID 3580 wrote to memory of 956 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\svchost.exe
PID 3580 wrote to memory of 956 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\svchost.exe
PID 3580 wrote to memory of 60 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\dwm.exe
PID 3580 wrote to memory of 60 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\dwm.exe
PID 3580 wrote to memory of 60 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\dwm.exe
PID 3580 wrote to memory of 60 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\dwm.exe
PID 3580 wrote to memory of 60 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\dwm.exe
PID 3580 wrote to memory of 60 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\dwm.exe
PID 3580 wrote to memory of 736 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\svchost.exe
PID 3580 wrote to memory of 736 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\svchost.exe
PID 3580 wrote to memory of 736 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\svchost.exe
PID 3580 wrote to memory of 736 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\svchost.exe
PID 3580 wrote to memory of 736 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\svchost.exe
PID 3580 wrote to memory of 736 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\svchost.exe
PID 3580 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\svchost.exe
PID 3580 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\svchost.exe
PID 3580 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\svchost.exe
PID 3580 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\svchost.exe
PID 3580 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\svchost.exe
PID 3580 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\system32\svchost.exe
PID 3580 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\System32\svchost.exe
PID 3580 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\System32\svchost.exe
PID 3580 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\System32\svchost.exe
PID 3580 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe C:\Windows\System32\svchost.exe

Processes

C:\Windows\system32\winlogon.exe

winlogon.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DcomLaunch -p

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k RPCSS -p

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM

C:\Windows\system32\dwm.exe

"dwm.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s DsmSvc

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s nsi

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection

C:\Windows\System32\spoolsv.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc

C:\Windows\system32\sihost.exe

sihost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc

C:\Windows\system32\taskhostw.exe

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer

C:\Windows\sysmon.exe

C:\Windows\sysmon.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\system32\wbem\unsecapp.exe -Embedding

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe

"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe

"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k netsvcs -p

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe

"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service

C:\Windows\system32\SppExtComObj.exe

C:\Windows\system32\SppExtComObj.exe -Embedding

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe

"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.52 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff97c662e98,0x7ff97c662ea4,0x7ff97c662eb0

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2280 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=3224 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=3328 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --mojo-platform-channel-handle=5260 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --mojo-platform-channel-handle=5468 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:1

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\MusNotification.exe

C:\Windows\system32\MusNotification.exe

C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\9bec7f7fd6fa50a8b692db6df241c330_NeikiAnalytics.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3580 -ip 3580

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3580 -s 1596

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3768 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 egunio.com udp
US 8.8.8.8:53 pidmed.com udp
US 54.209.32.212:80 pidmed.com tcp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 212.32.209.54.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
GB 142.250.187.234:443 chromewebstore.googleapis.com tcp
US 8.8.8.8:53 pki.goog udp
US 8.8.8.8:53 pki.goog udp
US 216.239.32.29:80 pki.goog tcp
US 8.8.8.8:53 29.32.239.216.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 199.111.78.13.in-addr.arpa udp

Files

memory/3580-0-0x0000000001000000-0x000000000100D000-memory.dmp

memory/3580-2-0x0000000076FF2000-0x0000000076FF3000-memory.dmp

memory/3580-3-0x0000000076FF3000-0x0000000076FF4000-memory.dmp

memory/3580-1-0x000000007FE40000-0x000000007FE4C000-memory.dmp

memory/3580-4-0x000000007FE40000-0x000000007FE4C000-memory.dmp

memory/3580-5-0x000000007FE40000-0x000000007FE4C000-memory.dmp

memory/3580-6-0x000000007FE40000-0x000000007FE4C000-memory.dmp

memory/3580-7-0x000000007FE40000-0x000000007FE4C000-memory.dmp

memory/3580-9-0x0000000001000000-0x000000000100D000-memory.dmp