Malware Analysis Report

2024-09-11 11:13

Sample ID 240610-r8e2vszeme
Target 1a6105823608bb808f68cd927e834150_NeikiAnalytics.exe
SHA256 4d95e36ccf6520119c5a1d5331d381b86d2238e60c9f52d8a500faf481683a50
Tags
amadey 9a3efc trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

4d95e36ccf6520119c5a1d5331d381b86d2238e60c9f52d8a500faf481683a50

Threat Level: Known bad

The file 1a6105823608bb808f68cd927e834150_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

amadey 9a3efc trojan

Amadey

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

Suspicious use of SetThreadContext

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Suspicious use of WriteProcessMemory

Suspicious use of FindShellTrayWindow

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Privilege Escalation
TA0004
Defense Evasion
TA0005
Credential Access
TA0006
Discovery
TA0007
Query Registry
T1012
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-10 14:51

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-10 14:51

Reported

2024-06-10 14:54

Platform

win10v2004-20240508-en

Max time kernel

143s

Max time network

54s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1a6105823608bb808f68cd927e834150_NeikiAnalytics.exe"

Signatures

Amadey

trojan amadey

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1a6105823608bb808f68cd927e834150_NeikiAnalytics.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1540 set thread context of 316 N/A C:\Users\Admin\AppData\Local\Temp\1a6105823608bb808f68cd927e834150_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\1a6105823608bb808f68cd927e834150_NeikiAnalytics.exe
PID 2220 set thread context of 3580 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 1996 set thread context of 432 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 5024 set thread context of 2396 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 2072 set thread context of 1012 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\Dctooux.job C:\Users\Admin\AppData\Local\Temp\1a6105823608bb808f68cd927e834150_NeikiAnalytics.exe N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1540 wrote to memory of 316 N/A C:\Users\Admin\AppData\Local\Temp\1a6105823608bb808f68cd927e834150_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\1a6105823608bb808f68cd927e834150_NeikiAnalytics.exe
PID 1540 wrote to memory of 316 N/A C:\Users\Admin\AppData\Local\Temp\1a6105823608bb808f68cd927e834150_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\1a6105823608bb808f68cd927e834150_NeikiAnalytics.exe
PID 1540 wrote to memory of 316 N/A C:\Users\Admin\AppData\Local\Temp\1a6105823608bb808f68cd927e834150_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\1a6105823608bb808f68cd927e834150_NeikiAnalytics.exe
PID 1540 wrote to memory of 316 N/A C:\Users\Admin\AppData\Local\Temp\1a6105823608bb808f68cd927e834150_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\1a6105823608bb808f68cd927e834150_NeikiAnalytics.exe
PID 1540 wrote to memory of 316 N/A C:\Users\Admin\AppData\Local\Temp\1a6105823608bb808f68cd927e834150_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\1a6105823608bb808f68cd927e834150_NeikiAnalytics.exe
PID 1540 wrote to memory of 316 N/A C:\Users\Admin\AppData\Local\Temp\1a6105823608bb808f68cd927e834150_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\1a6105823608bb808f68cd927e834150_NeikiAnalytics.exe
PID 1540 wrote to memory of 316 N/A C:\Users\Admin\AppData\Local\Temp\1a6105823608bb808f68cd927e834150_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\1a6105823608bb808f68cd927e834150_NeikiAnalytics.exe
PID 1540 wrote to memory of 316 N/A C:\Users\Admin\AppData\Local\Temp\1a6105823608bb808f68cd927e834150_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\1a6105823608bb808f68cd927e834150_NeikiAnalytics.exe
PID 1540 wrote to memory of 316 N/A C:\Users\Admin\AppData\Local\Temp\1a6105823608bb808f68cd927e834150_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\1a6105823608bb808f68cd927e834150_NeikiAnalytics.exe
PID 1540 wrote to memory of 316 N/A C:\Users\Admin\AppData\Local\Temp\1a6105823608bb808f68cd927e834150_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\1a6105823608bb808f68cd927e834150_NeikiAnalytics.exe
PID 316 wrote to memory of 2220 N/A C:\Users\Admin\AppData\Local\Temp\1a6105823608bb808f68cd927e834150_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 316 wrote to memory of 2220 N/A C:\Users\Admin\AppData\Local\Temp\1a6105823608bb808f68cd927e834150_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 316 wrote to memory of 2220 N/A C:\Users\Admin\AppData\Local\Temp\1a6105823608bb808f68cd927e834150_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 2220 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 2220 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 2220 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 2220 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 2220 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 2220 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 2220 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 2220 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 2220 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 2220 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 1996 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 1996 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 1996 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 1996 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 1996 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 1996 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 1996 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 1996 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 1996 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 1996 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 5024 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 5024 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 5024 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 5024 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 5024 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 5024 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 5024 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 5024 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 5024 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 5024 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 2072 wrote to memory of 1012 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 2072 wrote to memory of 1012 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 2072 wrote to memory of 1012 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 2072 wrote to memory of 1012 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 2072 wrote to memory of 1012 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 2072 wrote to memory of 1012 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 2072 wrote to memory of 1012 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 2072 wrote to memory of 1012 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 2072 wrote to memory of 1012 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 2072 wrote to memory of 1012 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe

Processes

C:\Users\Admin\AppData\Local\Temp\1a6105823608bb808f68cd927e834150_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\1a6105823608bb808f68cd927e834150_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\1a6105823608bb808f68cd927e834150_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\1a6105823608bb808f68cd927e834150_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe

"C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe"

C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe

"C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe"

C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe

C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe

C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe

C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe

C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe

C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe

C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe

C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe

C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe

C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe

C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe

C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 techolivls.in udp
US 8.8.8.8:53 dnschnj.at udp
US 8.8.8.8:53 check-ftp.ru udp
US 8.8.8.8:53 check-ftp.ru udp
US 8.8.8.8:53 techolivls.in udp
US 8.8.8.8:53 dnschnj.at udp
US 8.8.8.8:53 check-ftp.ru udp

Files

memory/1540-1-0x0000000000880000-0x0000000000980000-memory.dmp

memory/1540-2-0x0000000002320000-0x000000000238B000-memory.dmp

memory/316-3-0x0000000000400000-0x0000000000470000-memory.dmp

memory/316-4-0x0000000000400000-0x0000000000470000-memory.dmp

memory/316-5-0x0000000000400000-0x0000000000470000-memory.dmp

memory/316-6-0x0000000000400000-0x0000000000470000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe

MD5 1a6105823608bb808f68cd927e834150
SHA1 6bc10e071b73898da4dccdd825d6af5d6ea21849
SHA256 4d95e36ccf6520119c5a1d5331d381b86d2238e60c9f52d8a500faf481683a50
SHA512 bc08629987940ae78af7adffa973b163722ec36935ead8eaedc870efba97c4a6dac8826820bd641a1101426c0b3d5076426f71e57385ea90b842862a23db0b5a

memory/316-20-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2220-22-0x0000000000400000-0x00000000006B3000-memory.dmp

memory/3580-25-0x0000000000400000-0x0000000000470000-memory.dmp

memory/3580-26-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2220-27-0x0000000000400000-0x00000000006B3000-memory.dmp

memory/3580-28-0x0000000000400000-0x0000000000470000-memory.dmp

memory/3580-29-0x0000000000400000-0x0000000000470000-memory.dmp

memory/3580-37-0x0000000000400000-0x0000000000470000-memory.dmp

memory/432-42-0x0000000000400000-0x0000000000470000-memory.dmp

memory/432-43-0x0000000000400000-0x0000000000470000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\558294865367

MD5 a6addc09b13ca42532363e0b8178f5e8
SHA1 bc51107be196b4520f41d56bfacf6607be6a7742
SHA256 6a2c1084f6e5acad07e2e8114428eb398f2f999adc1693c5d9d03a21ad2a282f
SHA512 d92f0ca953decb95470e0f5d778adb45dfb3fc7f190c86713bffd6957223161576aef4e7c80e4aa7cc60eddc98092a303e8ed1dc3587ef0ddee3642447c972fe

memory/3580-57-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2396-66-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2396-67-0x0000000000400000-0x0000000000470000-memory.dmp

memory/1012-79-0x0000000000400000-0x0000000000470000-memory.dmp

memory/1012-80-0x0000000000400000-0x0000000000470000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-10 14:51

Reported

2024-06-10 14:54

Platform

win7-20240508-en

Max time kernel

143s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1a6105823608bb808f68cd927e834150_NeikiAnalytics.exe"

Signatures

Amadey

trojan amadey

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1a6105823608bb808f68cd927e834150_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1a6105823608bb808f68cd927e834150_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2140 set thread context of 1712 N/A C:\Users\Admin\AppData\Local\Temp\1a6105823608bb808f68cd927e834150_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\1a6105823608bb808f68cd927e834150_NeikiAnalytics.exe
PID 2684 set thread context of 2736 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\Dctooux.job C:\Users\Admin\AppData\Local\Temp\1a6105823608bb808f68cd927e834150_NeikiAnalytics.exe N/A

Enumerates physical storage devices

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1a6105823608bb808f68cd927e834150_NeikiAnalytics.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2140 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\1a6105823608bb808f68cd927e834150_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\1a6105823608bb808f68cd927e834150_NeikiAnalytics.exe
PID 2140 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\1a6105823608bb808f68cd927e834150_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\1a6105823608bb808f68cd927e834150_NeikiAnalytics.exe
PID 2140 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\1a6105823608bb808f68cd927e834150_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\1a6105823608bb808f68cd927e834150_NeikiAnalytics.exe
PID 2140 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\1a6105823608bb808f68cd927e834150_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\1a6105823608bb808f68cd927e834150_NeikiAnalytics.exe
PID 2140 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\1a6105823608bb808f68cd927e834150_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\1a6105823608bb808f68cd927e834150_NeikiAnalytics.exe
PID 2140 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\1a6105823608bb808f68cd927e834150_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\1a6105823608bb808f68cd927e834150_NeikiAnalytics.exe
PID 2140 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\1a6105823608bb808f68cd927e834150_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\1a6105823608bb808f68cd927e834150_NeikiAnalytics.exe
PID 2140 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\1a6105823608bb808f68cd927e834150_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\1a6105823608bb808f68cd927e834150_NeikiAnalytics.exe
PID 2140 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\1a6105823608bb808f68cd927e834150_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\1a6105823608bb808f68cd927e834150_NeikiAnalytics.exe
PID 2140 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\1a6105823608bb808f68cd927e834150_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\1a6105823608bb808f68cd927e834150_NeikiAnalytics.exe
PID 2140 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\1a6105823608bb808f68cd927e834150_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\1a6105823608bb808f68cd927e834150_NeikiAnalytics.exe
PID 1712 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\1a6105823608bb808f68cd927e834150_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 1712 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\1a6105823608bb808f68cd927e834150_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 1712 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\1a6105823608bb808f68cd927e834150_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 1712 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\1a6105823608bb808f68cd927e834150_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 2684 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 2684 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 2684 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 2684 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 2684 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 2684 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 2684 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 2684 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 2684 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 2684 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
PID 2684 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe

Processes

C:\Users\Admin\AppData\Local\Temp\1a6105823608bb808f68cd927e834150_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\1a6105823608bb808f68cd927e834150_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\1a6105823608bb808f68cd927e834150_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\1a6105823608bb808f68cd927e834150_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe

"C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe"

C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe

"C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 techolivls.in udp
US 8.8.8.8:53 check-ftp.ru udp
US 8.8.8.8:53 dnschnj.at udp
US 8.8.8.8:53 check-ftp.ru udp
US 8.8.8.8:53 techolivls.in udp
US 8.8.8.8:53 dnschnj.at udp
US 8.8.8.8:53 dnschnj.at udp
US 8.8.8.8:53 check-ftp.ru udp
US 8.8.8.8:53 techolivls.in udp

Files

memory/2140-1-0x0000000000880000-0x0000000000980000-memory.dmp

memory/2140-5-0x0000000000230000-0x000000000029B000-memory.dmp

memory/1712-4-0x0000000000400000-0x0000000000470000-memory.dmp

memory/1712-2-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1712-7-0x0000000000400000-0x0000000000470000-memory.dmp

memory/1712-8-0x0000000000400000-0x0000000000470000-memory.dmp

memory/1712-10-0x0000000000400000-0x0000000000470000-memory.dmp

\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe

MD5 1a6105823608bb808f68cd927e834150
SHA1 6bc10e071b73898da4dccdd825d6af5d6ea21849
SHA256 4d95e36ccf6520119c5a1d5331d381b86d2238e60c9f52d8a500faf481683a50
SHA512 bc08629987940ae78af7adffa973b163722ec36935ead8eaedc870efba97c4a6dac8826820bd641a1101426c0b3d5076426f71e57385ea90b842862a23db0b5a

memory/1712-24-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2684-28-0x0000000000400000-0x00000000006B3000-memory.dmp

memory/2684-33-0x0000000000400000-0x00000000006B3000-memory.dmp

memory/2736-35-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2736-36-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2736-37-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2736-45-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2140-46-0x0000000000230000-0x000000000029B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\691908287377

MD5 2f92477acb0d7e14cfc3a6c45196cbaf
SHA1 c5e9e6337e2ce26837acce0fe7692b1a8b229c34
SHA256 75d0190bc387667df73ad5af8de8e7287ca0e0fd30050dfccbb8ffa172ba6e33
SHA512 0f61f63f3708f5ffefa9fa22d7edcc04586b98e16b75572fffe7adb63cfe4e89ee6e0196cbcae6ff5f48b9c19a95ca54e05c7aa24397cc37eb472ae59a69046e

memory/2736-51-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2736-58-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2736-62-0x0000000000400000-0x0000000000470000-memory.dmp