Analysis
-
max time kernel
148s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05-06-2024 10:47
Static task
static1
Behavioral task
behavioral1
Sample
50f6e215f2e575c658c0d5f6b30c0920_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
50f6e215f2e575c658c0d5f6b30c0920_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
50f6e215f2e575c658c0d5f6b30c0920_NeikiAnalytics.exe
-
Size
2.6MB
-
MD5
50f6e215f2e575c658c0d5f6b30c0920
-
SHA1
4854e9f40453c9ac5b24bfafebec97ffb4ff6993
-
SHA256
e11b94a331595019fca9839630dcd03ebc49e44fd78117b6c4b2744e211c9f54
-
SHA512
7c8e034b6c51d17a53ab5986d91c1e466406f09ef716231dfe43b5d8408fe2ae54dc0ddff82ddd44070ecea98a91497020dc3ed0a78e091a6fa8a1da91f2a3c8
-
SSDEEP
24576:ObCj2sObHtqQ4QEfCr7w7yvuqqNq8FroaSaPXRackmrM4Biq7MhLv9GImmVfq4eR:ObCjPKNqQEfsw43qtmVfq4w
Malware Config
Extracted
Protocol: smtp- Host:
smtp.mail.me.com - Port:
587 - Username:
[email protected] - Password:
RICHARD205lord
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 2900 jhdfkldfhndfkjdfnbfklfnf.exe 972 winmgr119.exe 2552 winmgr119.exe -
Loads dropped DLL 1 IoCs
pid Process 2504 50f6e215f2e575c658c0d5f6b30c0920_NeikiAnalytics.exe -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/968-23-0x0000000000400000-0x000000000048E000-memory.dmp upx behavioral1/memory/968-25-0x0000000000400000-0x000000000048E000-memory.dmp upx behavioral1/memory/968-24-0x0000000000400000-0x000000000048E000-memory.dmp upx behavioral1/memory/968-30-0x0000000000400000-0x000000000048E000-memory.dmp upx behavioral1/memory/2872-34-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral1/memory/2872-35-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral1/memory/2872-36-0x0000000000400000-0x0000000000491000-memory.dmp upx behavioral1/memory/2872-77-0x0000000000400000-0x0000000000491000-memory.dmp upx -
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts cvtres.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\jhdfkldfhndfkjdfnbfklfnf = "C:\\ProgramData\\jhdfkldfhndfkjdfnbfklfnf.exe" 50f6e215f2e575c658c0d5f6b30c0920_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\jhdfkldfhndfkjdfnbfklfnf = "C:\\ProgramData\\jhdfkldfhndfkjdfnbfklfnf.exe" jhdfkldfhndfkjdfnbfklfnf.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 icanhazip.com 6 ipinfo.io -
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/files/0x00280000000167db-2.dat autoit_exe behavioral1/files/0x000f00000000f680-9.dat autoit_exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 2900 set thread context of 2620 2900 jhdfkldfhndfkjdfnbfklfnf.exe 31 PID 2620 set thread context of 968 2620 RegAsm.exe 34 PID 2620 set thread context of 2872 2620 RegAsm.exe 37 PID 2620 set thread context of 3032 2620 RegAsm.exe 41 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 24 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2120 schtasks.exe 388 schtasks.exe 2796 schtasks.exe 2608 schtasks.exe 2944 schtasks.exe 1568 schtasks.exe 2684 schtasks.exe 2716 schtasks.exe 944 schtasks.exe 1628 schtasks.exe 836 schtasks.exe 624 schtasks.exe 1780 schtasks.exe 1228 schtasks.exe 2632 schtasks.exe 2464 schtasks.exe 2492 schtasks.exe 2204 schtasks.exe 1752 schtasks.exe 2592 schtasks.exe 796 schtasks.exe 880 schtasks.exe 2884 schtasks.exe 2692 schtasks.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 RegAsm.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e RegAsm.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d0030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e RegAsm.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa20f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e RegAsm.exe -
NTFS ADS 4 IoCs
description ioc Process File opened for modification C:\ProgramData\winmgr119.exe:Zone.Identifier:$DATA winmgr119.exe File created C:\Users\Admin\AppData\Local\Temp\50f6e215f2e575c658c0d5f6b30c0920_NeikiAnalytics.exe:Zone.Identifier:$DATA 50f6e215f2e575c658c0d5f6b30c0920_NeikiAnalytics.exe File created C:\ProgramData\jhdfkldfhndfkjdfnbfklfnf.exe:Zone.Identifier:$DATA jhdfkldfhndfkjdfnbfklfnf.exe File created C:\ProgramData\winmgr119.exe:Zone.Identifier:$DATA winmgr119.exe -
Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 2504 50f6e215f2e575c658c0d5f6b30c0920_NeikiAnalytics.exe 2900 jhdfkldfhndfkjdfnbfklfnf.exe 2900 jhdfkldfhndfkjdfnbfklfnf.exe 2620 RegAsm.exe 2620 RegAsm.exe 2620 RegAsm.exe 2620 RegAsm.exe 2620 RegAsm.exe 2620 RegAsm.exe 2620 RegAsm.exe 2620 RegAsm.exe 2900 jhdfkldfhndfkjdfnbfklfnf.exe 2620 RegAsm.exe 2620 RegAsm.exe 2900 jhdfkldfhndfkjdfnbfklfnf.exe 2900 jhdfkldfhndfkjdfnbfklfnf.exe 2900 jhdfkldfhndfkjdfnbfklfnf.exe 2900 jhdfkldfhndfkjdfnbfklfnf.exe 2900 jhdfkldfhndfkjdfnbfklfnf.exe 2620 RegAsm.exe 2620 RegAsm.exe 2620 RegAsm.exe 2620 RegAsm.exe 2620 RegAsm.exe 2620 RegAsm.exe 2900 jhdfkldfhndfkjdfnbfklfnf.exe 972 winmgr119.exe 2900 jhdfkldfhndfkjdfnbfklfnf.exe 2900 jhdfkldfhndfkjdfnbfklfnf.exe 2620 RegAsm.exe 2620 RegAsm.exe 2620 RegAsm.exe 2620 RegAsm.exe 2620 RegAsm.exe 2620 RegAsm.exe 2900 jhdfkldfhndfkjdfnbfklfnf.exe 2900 jhdfkldfhndfkjdfnbfklfnf.exe 2900 jhdfkldfhndfkjdfnbfklfnf.exe 2900 jhdfkldfhndfkjdfnbfklfnf.exe 2900 jhdfkldfhndfkjdfnbfklfnf.exe 2900 jhdfkldfhndfkjdfnbfklfnf.exe 2900 jhdfkldfhndfkjdfnbfklfnf.exe 2900 jhdfkldfhndfkjdfnbfklfnf.exe 2900 jhdfkldfhndfkjdfnbfklfnf.exe 2620 RegAsm.exe 2620 RegAsm.exe 2620 RegAsm.exe 2620 RegAsm.exe 2620 RegAsm.exe 2620 RegAsm.exe 2552 winmgr119.exe 2900 jhdfkldfhndfkjdfnbfklfnf.exe 2900 jhdfkldfhndfkjdfnbfklfnf.exe 2900 jhdfkldfhndfkjdfnbfklfnf.exe 2620 RegAsm.exe 2620 RegAsm.exe 2620 RegAsm.exe 2620 RegAsm.exe 2620 RegAsm.exe 2620 RegAsm.exe 2900 jhdfkldfhndfkjdfnbfklfnf.exe 2900 jhdfkldfhndfkjdfnbfklfnf.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2620 RegAsm.exe Token: SeDebugPrivilege 968 cvtres.exe Token: SeDebugPrivilege 2872 cvtres.exe Token: SeDebugPrivilege 3032 cvtres.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2620 RegAsm.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2504 wrote to memory of 2900 2504 50f6e215f2e575c658c0d5f6b30c0920_NeikiAnalytics.exe 28 PID 2504 wrote to memory of 2900 2504 50f6e215f2e575c658c0d5f6b30c0920_NeikiAnalytics.exe 28 PID 2504 wrote to memory of 2900 2504 50f6e215f2e575c658c0d5f6b30c0920_NeikiAnalytics.exe 28 PID 2504 wrote to memory of 2900 2504 50f6e215f2e575c658c0d5f6b30c0920_NeikiAnalytics.exe 28 PID 2900 wrote to memory of 2620 2900 jhdfkldfhndfkjdfnbfklfnf.exe 31 PID 2900 wrote to memory of 2620 2900 jhdfkldfhndfkjdfnbfklfnf.exe 31 PID 2900 wrote to memory of 2620 2900 jhdfkldfhndfkjdfnbfklfnf.exe 31 PID 2900 wrote to memory of 2620 2900 jhdfkldfhndfkjdfnbfklfnf.exe 31 PID 2900 wrote to memory of 2620 2900 jhdfkldfhndfkjdfnbfklfnf.exe 31 PID 2900 wrote to memory of 2620 2900 jhdfkldfhndfkjdfnbfklfnf.exe 31 PID 2900 wrote to memory of 2620 2900 jhdfkldfhndfkjdfnbfklfnf.exe 31 PID 2900 wrote to memory of 2620 2900 jhdfkldfhndfkjdfnbfklfnf.exe 31 PID 2900 wrote to memory of 2620 2900 jhdfkldfhndfkjdfnbfklfnf.exe 31 PID 2900 wrote to memory of 2592 2900 jhdfkldfhndfkjdfnbfklfnf.exe 32 PID 2900 wrote to memory of 2592 2900 jhdfkldfhndfkjdfnbfklfnf.exe 32 PID 2900 wrote to memory of 2592 2900 jhdfkldfhndfkjdfnbfklfnf.exe 32 PID 2900 wrote to memory of 2592 2900 jhdfkldfhndfkjdfnbfklfnf.exe 32 PID 2620 wrote to memory of 968 2620 RegAsm.exe 34 PID 2620 wrote to memory of 968 2620 RegAsm.exe 34 PID 2620 wrote to memory of 968 2620 RegAsm.exe 34 PID 2620 wrote to memory of 968 2620 RegAsm.exe 34 PID 2620 wrote to memory of 968 2620 RegAsm.exe 34 PID 2620 wrote to memory of 968 2620 RegAsm.exe 34 PID 2620 wrote to memory of 968 2620 RegAsm.exe 34 PID 2620 wrote to memory of 968 2620 RegAsm.exe 34 PID 2620 wrote to memory of 2872 2620 RegAsm.exe 37 PID 2620 wrote to memory of 2872 2620 RegAsm.exe 37 PID 2620 wrote to memory of 2872 2620 RegAsm.exe 37 PID 2620 wrote to memory of 2872 2620 RegAsm.exe 37 PID 2620 wrote to memory of 2872 2620 RegAsm.exe 37 PID 2620 wrote to memory of 2872 2620 RegAsm.exe 37 PID 2620 wrote to memory of 2872 2620 RegAsm.exe 37 PID 2620 wrote to memory of 2872 2620 RegAsm.exe 37 PID 2900 wrote to memory of 2492 2900 jhdfkldfhndfkjdfnbfklfnf.exe 39 PID 2900 wrote to memory of 2492 2900 jhdfkldfhndfkjdfnbfklfnf.exe 39 PID 2900 wrote to memory of 2492 2900 jhdfkldfhndfkjdfnbfklfnf.exe 39 PID 2900 wrote to memory of 2492 2900 jhdfkldfhndfkjdfnbfklfnf.exe 39 PID 2620 wrote to memory of 3032 2620 RegAsm.exe 41 PID 2620 wrote to memory of 3032 2620 RegAsm.exe 41 PID 2620 wrote to memory of 3032 2620 RegAsm.exe 41 PID 2620 wrote to memory of 3032 2620 RegAsm.exe 41 PID 2620 wrote to memory of 3032 2620 RegAsm.exe 41 PID 2620 wrote to memory of 3032 2620 RegAsm.exe 41 PID 2620 wrote to memory of 3032 2620 RegAsm.exe 41 PID 2900 wrote to memory of 1628 2900 jhdfkldfhndfkjdfnbfklfnf.exe 43 PID 2900 wrote to memory of 1628 2900 jhdfkldfhndfkjdfnbfklfnf.exe 43 PID 2900 wrote to memory of 1628 2900 jhdfkldfhndfkjdfnbfklfnf.exe 43 PID 2900 wrote to memory of 1628 2900 jhdfkldfhndfkjdfnbfklfnf.exe 43 PID 2900 wrote to memory of 388 2900 jhdfkldfhndfkjdfnbfklfnf.exe 45 PID 2900 wrote to memory of 388 2900 jhdfkldfhndfkjdfnbfklfnf.exe 45 PID 2900 wrote to memory of 388 2900 jhdfkldfhndfkjdfnbfklfnf.exe 45 PID 2900 wrote to memory of 388 2900 jhdfkldfhndfkjdfnbfklfnf.exe 45 PID 2900 wrote to memory of 2796 2900 jhdfkldfhndfkjdfnbfklfnf.exe 47 PID 2900 wrote to memory of 2796 2900 jhdfkldfhndfkjdfnbfklfnf.exe 47 PID 2900 wrote to memory of 2796 2900 jhdfkldfhndfkjdfnbfklfnf.exe 47 PID 2900 wrote to memory of 2796 2900 jhdfkldfhndfkjdfnbfklfnf.exe 47 PID 2900 wrote to memory of 2608 2900 jhdfkldfhndfkjdfnbfklfnf.exe 49 PID 2900 wrote to memory of 2608 2900 jhdfkldfhndfkjdfnbfklfnf.exe 49 PID 2900 wrote to memory of 2608 2900 jhdfkldfhndfkjdfnbfklfnf.exe 49 PID 2900 wrote to memory of 2608 2900 jhdfkldfhndfkjdfnbfklfnf.exe 49 PID 2900 wrote to memory of 2944 2900 jhdfkldfhndfkjdfnbfklfnf.exe 51 PID 2900 wrote to memory of 2944 2900 jhdfkldfhndfkjdfnbfklfnf.exe 51 PID 2900 wrote to memory of 2944 2900 jhdfkldfhndfkjdfnbfklfnf.exe 51 PID 2900 wrote to memory of 2944 2900 jhdfkldfhndfkjdfnbfklfnf.exe 51
Processes
-
C:\Users\Admin\AppData\Local\Temp\50f6e215f2e575c658c0d5f6b30c0920_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\50f6e215f2e575c658c0d5f6b30c0920_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\ProgramData\jhdfkldfhndfkjdfnbfklfnf.exeC:\ProgramData\jhdfkldfhndfkjdfnbfklfnf.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe03⤵
- Suspicious use of SetThreadContext
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe -f "C:\Users\Admin\AppData\Local\Temp\tmp2166.tmp"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:968
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe -f "C:\Users\Admin\AppData\Local\Temp\tmp23C7.tmp"4⤵
- Accesses Microsoft Outlook accounts
- Suspicious use of AdjustPrivilegeToken
PID:2872
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe -f "C:\Users\Admin\AppData\Local\Temp\tmp38B7.tmp"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3032
-
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
PID:2592
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
PID:2492
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
PID:1628
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
PID:388
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
PID:2796
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
PID:2608
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
PID:2944
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
PID:836
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
PID:796
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
PID:624
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
PID:1568
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
PID:1780
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
PID:2204
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
PID:880
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
PID:1752
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
PID:1228
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
PID:2884
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
PID:2684
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
PID:2632
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
PID:2464
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
PID:2716
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
PID:2120
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
PID:944
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f3⤵
- Creates scheduled task(s)
PID:2692
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {3F76BB83-854B-4485-804C-C86889BC547B} S-1-5-21-330940541-141609230-1670313778-1000:KXIPPCKF\Admin:Interactive:[1]1⤵PID:1064
-
C:\ProgramData\winmgr119.exeC:\ProgramData\winmgr119.exe2⤵
- Executes dropped EXE
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:972
-
-
C:\ProgramData\winmgr119.exeC:\ProgramData\winmgr119.exe2⤵
- Executes dropped EXE
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:2552
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8B
MD5dd8eba16ac1e3cabecc740db73b90377
SHA1b52960116e3ea5250ac56191ef994efa761ce312
SHA256c0fd592fcec1997702a4af8594e0892fe1bc52f3b128349f67ceb33bee0e5e0c
SHA512e56cd6918371614db2cb7455cbcafc4620b5a575bd5d97fcb06e71238d97494953430315086039a5765ca3c3041c9a4cdc5535559e4313455fd23008cf275c31
-
Filesize
2.6MB
MD511005cc6d92b7a59c1a06be594cdba74
SHA14f93f11228ef94aba91836772b3463fa40816885
SHA256154b0d5dfc1908a30908ba8c45f2a12c8cde9a2e65fe1551a782a94f637f664e
SHA512e40cd64928ce72b86b10ca323935943bdc4da48568aee2d0c9306813f15421bf203647716e6d84e9a9f03d9e16261d3b6faf0689b9abd1f5be7dd9442f1061b3
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
399B
MD5e4bf4f7accc657622fe419c0d62419ab
SHA1c2856936dd3de05bad0da5ca94d6b521e40ab5a2
SHA256b32fa68b79c5a7ceaa89e8e537efe33a963c499666202611329944bd2c09318e
SHA51285dc223e39a16ddeba53a4b3d6c9eff14d30ec67dfda1e650da2c9057f640edd033a31868915a31caac0d325d240a7f634f62cd52fbd2adc68bd1d9cb6281431
-
Filesize
400B
MD5de4e5ff058882957cf8a3b5f839a031f
SHA10b3d8279120fb5fa27efbd9eee89695aa040fc24
SHA256ef54f46b9f1e342fc12e035ae94f57c61ea4e8be4e116f0a1c6f86310f400f49
SHA512a6b0d557e9eec4e56630e5ba64495df318f4fd959fffbdcbf77831185b067906917c9117a0ecd6ac817c7860d5d831cce15820d715657d81e2d817d9fab9fb72
-
Filesize
391B
MD53525ea58bba48993ea0d01b65ea71381
SHA11b917678fdd969e5ee5916e5899e7c75a979cf4d
SHA256681bcee53cf679ac674e700136f9229b9184fe60ed6410dbd7a33d462ed13ae2
SHA5125aad8dca43ec85882daf50c469bd04dcf0b62affc8bc605b3e289496a2679d4d548fea8bb0aea7080bbfbcdcab9d275fc6797b9c95b64f9f97ecf79583a83986
-
Filesize
2.6MB
MD5dfc2d4d8c59d83cfd4132ad9edf23810
SHA1c4e7d486c353fe8ec5db2da5acebab5f84615f78
SHA256c25cfbac4e3c8cbd0f11d2656f468a874a1ec3959d5bef96a762b646b2bcdef0
SHA512b9eb75cec8aea78ad8f1144b27da010a61c269a10a32138f6b6f763b3cb132f96e7900d2e8efacd136d73d1ebf7e9b971fc5533c35d8ea3341dc21ac6e3764b3