Analysis
-
max time kernel
95s -
max time network
106s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
06/06/2024, 18:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
General
-
Target
4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe
-
Size
92KB
-
MD5
4c54f8da617ef5b25583399abdfb4850
-
SHA1
d6b177cdd1b17b29d994e2ed6b6647e4ecb1b8c1
-
SHA256
cd1c7028405eb9d015f763b9c27567399ea86920d0fe1be8068e7004a78b279f
-
SHA512
8287b84b0fe6da6fc54550045b6e58a0cca0745b93d69c66deb7ecc8031021fe2f6bc49659f28bad2df31f57b2240acf6463bc162aac8cd7d4ee2f3b98d6e9b9
-
SSDEEP
1536:/JvJnBpwdaMIOOnToIfiV6pdQcTUgahoIDo:/JvxKaCqTBfiooXgEoID
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\SysWOW64\WBEM\WMIADAP.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\GRPCONV.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\ICACLS.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\REKEYWIZ.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\ROBOCOPY.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\SHRPUBW.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\SPATIALAUDIOLICENSESRV.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\UNLODCTR.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\CHARMAP.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\MSIEXEC.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\W32TM.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\WERMGR.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\IME\SHARED\IMEWDBLD.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\RDPSAPROXY.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\WHERE.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\BYTECODEGENERATOR.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\EASEOFACCESSDIALOG.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\MAKECAB.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\RASERVER.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\SETTINGSYNCHOST.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\SYSTEMPROPERTIESPERFORMANCE.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\USERINIT.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\CERTREQ.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\DVDPLAY.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\EDPNOTIFY.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\NETSTAT.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\USER.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\MRINFO.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\SYSTEMPROPERTIESDATAEXECUTIONPREVENTION.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\COMP.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\DISKPERF.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\MFPMP.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\NETCFGNOTIFYOBJECTHOST.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\NETSH.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\REG.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\SECINIT.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\WEVTUTIL.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\PSR.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\RPCPING.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\SYSTEMUWPLAUNCHER.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\DPAPIMIG.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\PASSWORDONWAKESETTINGFLYOUT.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\RDPSA.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\RDPSAUACHELPER.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\TRACERT.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\CHKNTFS.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\RMACTIVATE.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\RMACTIVATE_ISV.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\CHKDSK.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\DISM\DISMHOST.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\EXPAND.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\PREVHOST.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\PRINTUI.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\SFC.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\WRITE.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\AGENTACTIVATIONRUNTIMESTARTER.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\ATTRIB.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\CLICONFG.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\MSINFO32.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\QUICKASSIST.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\WEXTRACT.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\WINRSHOST.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\WSCRIPT.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\DISM.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES\DOTNET\DOTNET.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\DOTNET\SHARED\MICROSOFT.NETCORE.APP\8.0.2\CREATEDUMP.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\MSOEV.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESCOMMONX64\MICROSOFT SHARED\OFFICE16\FLTLDR.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.MSPAINT_6.1907.29027.0_X64__8WEKYB3D8BBWE\PAINTSTUDIO.VIEW.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\VSTO\10.0\VSTOINSTALLER.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MEDIA PLAYER\WMPSHARE.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\EXCELCNV.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\VIDEOLAN\VLC\VLC.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.OFFICE.ONENOTE_16001.12026.20112.0_X64__8WEKYB3D8BBWE\ONENOTESHARE.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.YOURPHONE_0.19051.7.0_X64__8WEKYB3D8BBWE\YOURPHONE.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\MSINFO\MSINFO32.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\DOTNET\SHARED\MICROSOFT.NETCORE.APP\7.0.16\CREATEDUMP.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\INTERNET EXPLORER\IEINSTAL.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JAVA-RMI.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\ORACLE\JAVA\JAVAPATH\JAVAW.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JJS.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JPS.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\SERVERTOOL.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.MICROSOFTSOLITAIRECOLLECTION_4.4.8204.0_X64__8WEKYB3D8BBWE\SOLITAIRE.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\RMIC.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\JAVA.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\SETLANG.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE_BK\1.3.185.29\MICROSOFTEDGECOMREGISTERSHELLARM64.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\XJC.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\JABSWITCH.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\WORDICON.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\PRIVATE_BROWSING.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\JAVA\JAVA UPDATE\JUCHECK.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\CHROME_PROXY.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JRUNSCRIPT.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\FIREFOX.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.XBOXGAMINGOVERLAY_2.34.28001.0_X64__8WEKYB3D8BBWE\GAMEBAR.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JDEPS.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\ACROTEXTEXTRACTOR.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESX86\MICROSOFT OFFICE\OFFICE16\DCF\DATABASECOMPARE.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\92.0.902.67\MSEDGE_PWA_LAUNCHER.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JINFO.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\JAVACPL.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\KINIT.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESCOMMONX64\MICROSOFT SHARED\SMART TAG\SMARTTAGINSTALL.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\GRV_ICONS.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-001F-0C0A-1000-0000000FF1CE}\MISC.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.WINDOWSCOMMUNICATIONSAPPS_16005.11629.20316.0_X64__8WEKYB3D8BBWE\HXCALENDARAPPIMM.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JCONSOLE.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\RMID.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\RMID.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\CLVIEW.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.549981C3F5F10_1.1911.21713.0_X64__8WEKYB3D8BBWE\WIN32BRIDGE.SERVER.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.WALLET_2.4.18324.0_X64__8WEKYB3D8BBWE\MICROSOFT.WALLET.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\INK\INPUTPERSONALIZATION.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\KEYTOOL.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\ONENOTE.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\JOTICON.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\SSVAGENT.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\WINDOWS MAIL\WAB.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\92.0.902.67\ELEVATION_SERVICE.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\CRASHREPORTER.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.SKYPEAPP_14.53.77.0_X64__KZF8QXF38ZG5C\SKYPEBACKGROUNDHOST.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.WINDOWSALARMS_10.1906.2182.0_X64__8WEKYB3D8BBWE\TIME.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\ORACLE\JAVA\JAVAPATH\JAVAWS.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\110.0.5481.104\CHROME_PWA_LAUNCHER.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\ADDINS\MICROSOFT POWER QUERY FOR EXCEL INTEGRATED\BIN\MICROSOFT.MASHUP.CONTAINER.LOADER.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VBC.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\CASPOL.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_ADDINPROCESS_B77A5C561934E089_4.0.15805.0_NONE_74BABA51266F3010\ADDINPROCESS.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_COMSVCCONFIG_B03F5F7F11D50A3A_4.0.15805.0_NONE_468E01FABFC37212\COMSVCCONFIG.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-HYPER-V-DRIVERS-HYPERVISOR_31BF3856AD364E35_10.0.19041.264_NONE_0E32F443C4669FED\HVAX64.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.0\WINDOWS COMMUNICATION FOUNDATION\WSATCONFIG.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFT.LOCKAPP_CW5N1H2TXYEWY\LOCKAPP.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SPEECH\COMMON\SAPISVR.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.0\WPF\XAMLVIEWER\XAMLVIEWER_V0300.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_HYPERV-COMMANDLINE-TOOL_31BF3856AD364E35_10.0.19041.928_NONE_0B17415AE0DD0379\R\HVC.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-HYPER-V-VSTACK-VMMS_31BF3856AD364E35_10.0.19041.1266_NONE_AB5BDB26141E0BE5\R\VMMS.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\DFSVC\V4.0_4.0.0.0__B03F5F7F11D50A3A\DFSVC.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\REGSVCS.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\VBC.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_HYPERV-COMPUTE-GUESTCOMPUTESERVICE_31BF3856AD364E35_10.0.19041.264_NONE_6B6699B671C8F5A8\R\VMCOMPUTEAGENT.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-CLIENT-LI..M-SERVICE-MIGRATION_31BF3856AD364E35_10.0.19041.1052_NONE_0BDE546BCAF8E34A\F\CLIPUP.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.0\WINDOWS COMMUNICATION FOUNDATION\SMCONFIGINSTALLER.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\WSATCONFIG.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\ILASM.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\ADDINPROCESS32.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\ASPNET_WP.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\NGEN.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\WSATCONFIG.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFT.WINDOWS.APPREP.CHXAPP_CW5N1H2TXYEWY\CHXSMARTSCREEN.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CVTRES.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-HYPER-V-D..S-VMSWITCH-NETSETUP_31BF3856AD364E35_10.0.19041.1288_NONE_F92F7256107C0E35\R\NVSPINFO.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\ADDINPROCESS.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-HYPER-V-VSTACK-VMWP_31BF3856AD364E35_10.0.19041.264_NONE_13222F28BEAA00A7\VMWP.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-ONECORE-E..TAPROTECTIONCLEANUP_31BF3856AD364E35_10.0.19041.789_NONE_B38221AF158E5881\EDPCLEANUP.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\IEEXEC.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\ASPNET_REGSQL.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-HYPER-V-VSTACK-VMMS_31BF3856AD364E35_10.0.19041.264_NONE_1477A882BDCE0DF2\R\VMMS.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-ONECORE-I..ATEDUSERMODE-KERNEL_31BF3856AD364E35_10.0.19041.207_NONE_C5E1B9DEF3522696\SECUREKERNEL.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-ONECORE-PNP-DRVINST_31BF3856AD364E35_10.0.19041.1_NONE_0B4EEB140948562C\DRVINST.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\INSTALLER\$PATCHCACHE$\MANAGED\68AB67CA7DA73301B744CAF070E41400\15.7.20033\ADOBECOLLABSYNC.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V3.0\WPF\PRESENTATIONFONTCACHE.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-HYPER-V-DRIVERS-HYPERVISOR_31BF3856AD364E35_10.0.19041.264_NONE_0E32F443C4669FED\R\HVAX64.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\ASSEMBLY\GAC_MSIL\WSATCONFIG\3.0.0.0__B03F5F7F11D50A3A\WSATCONFIG.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\WSATCONFIG\V4.0_4.0.0.0__B03F5F7F11D50A3A\WSATCONFIG.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\ADDINUTIL.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\NGENTASK.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_HYPERV-COMMANDLINE-TOOL_31BF3856AD364E35_10.0.19041.1_NONE_E2F75FDA217D5015\HVC.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-HYPER-V-DRIVERS-HYPERVISOR_31BF3856AD364E35_10.0.19041.1288_NONE_A518F9EB1AB503D0\R\HVIX64.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-HYPER-V-VSTACK-VMWP_31BF3856AD364E35_10.0.19041.264_NONE_13222F28BEAA00A7\F\VMWP.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-ONECORE-ONLINESETUP-COMPONENT_31BF3856AD364E35_10.0.19041.746_NONE_4B0A936D86CDD479\F\OOBELDR.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\COMSVCCONFIG\V4.0_4.0.0.0__B03F5F7F11D50A3A\COMSVCCONFIG.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\NETFXSBS10.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\SERVICEMODELREG.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_ADOBE-FLASH-FOR-WINDOWS_31BF3856AD364E35_10.0.19041.82_NONE_2358A116979CC599\FLASHUTIL_ACTIVEX.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_CASPOL_B03F5F7F11D50A3A_4.0.15805.0_NONE_C6DC1994DB088235\CASPOL.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_HYPERV-COMMANDLINE-TOOL_31BF3856AD364E35_10.0.19041.928_NONE_0B17415AE0DD0379\HVC.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\BITLOCKERDISCOVERYVOLUMECONTENTS\BITLOCKERTOGO.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\EDMGEN.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_EDMGEN_B77A5C561934E089_4.0.15805.0_NONE_AE80A3049486A75F\EDMGEN.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-CLIENT-LI..M-SERVICE-MIGRATION_31BF3856AD364E35_10.0.19041.84_NONE_8EA6A37043F4AE90\F\CLIPUP.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-ONECORE-D..ECTXDATABASEUPDATER_31BF3856AD364E35_10.0.19041.928_NONE_138FB436497565F4\DIRECTXDATABASEUPDATER.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\DW20.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DATASVCUTIL.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\SMSVCHOST.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-ONECORE-C..PERIENCEHOST-BROKER_31BF3856AD364E35_10.0.19041.746_NONE_1CE3C0F12FB5F8EC\CLOUDEXPERIENCEHOSTBROKER.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-ONECORE-ONLINESETUP-COMPONENT_31BF3856AD364E35_10.0.19041.746_NONE_4B0A936D86CDD479\R\OOBELDR.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\ASPNET_COMPILER.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SERVICING\TRUSTEDINSTALLER.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFT.WINDOWS.APPRESOLVERUX_CW5N1H2TXYEWY\APPRESOLVERUX.EXE 4c54f8da617ef5b25583399abdfb4850_NeikiAnalytics.exe