374bbdb6377151af64999e284c7b41b212b1fc5df2819c27ebd281c810c38dd1

Analysis

max time kernel
142s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 08:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6be5c87d1c3f4c5ea01ddf6ec14e7d10_NeikiAnalytics.exe
Size 468KB
Sample240613-j4prhavbkn
SHA256 374bbdb6377151af64999e284c7b41b212b1fc5df2819c27ebd281c810c38dd1
MD5 6be5c87d1c3f4c5ea01ddf6ec14e7d10
SHA1 ec83428d6be2ed436b6724fa10161eef6096779c
SHA512 8d79ffc1757f3eb15e427c5a1af54ead768b1ad83dc689ac780678aaf66f04ca16af18c6664b382c3d4a528b777dd16166bb2060fcf16b91a4fbcda9b8fb39ef
SSDEEP 6144:CqppuGRYx4H712f/SBTpzZA6rXD40b+7TJDAMyyNFSlfyveN56+:CqpNtb1YIp9AI4FDAMyyo
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 26 IoCs

pid	Process
4180	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202.exe
864	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202a.exe
768	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202b.exe
3232	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202c.exe
2908	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202d.exe
3940	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202e.exe
4292	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202f.exe
1600	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202g.exe
2212	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202h.exe
2424	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202i.exe
2304	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202j.exe
2276	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202k.exe
1468	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202l.exe
1440	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202m.exe
3992	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202n.exe
4708	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202o.exe
3728	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202p.exe
4168	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202q.exe
4392	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202r.exe
5088	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202s.exe
728	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202t.exe
2160	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202u.exe
2904	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202v.exe
1144	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202w.exe
1212	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202x.exe
3600	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202y.exe

Adds Run key to start application 2 TTPs 26 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Modifies registry class 54 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 4a2ed1cdcdebda0e	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202k.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202v.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 4a2ed1cdcdebda0e	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202j.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202d.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202h.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 4a2ed1cdcdebda0e	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202h.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202j.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 4a2ed1cdcdebda0e	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202n.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 4a2ed1cdcdebda0e	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202p.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202i.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202k.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202p.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 4a2ed1cdcdebda0e	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202u.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 4a2ed1cdcdebda0e	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 4a2ed1cdcdebda0e	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202d.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 4a2ed1cdcdebda0e	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202l.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 4a2ed1cdcdebda0e	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202m.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202n.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202t.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202y.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 4a2ed1cdcdebda0e	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202c.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202f.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 4a2ed1cdcdebda0e	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202v.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202c.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 4a2ed1cdcdebda0e	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202f.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 4a2ed1cdcdebda0e	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202i.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202m.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202q.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 4a2ed1cdcdebda0e	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202q.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202x.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 4a2ed1cdcdebda0e	6be5c87d1c3f4c5ea01ddf6ec14e7d10_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202o.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202r.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 4a2ed1cdcdebda0e	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202x.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202b.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202e.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 4a2ed1cdcdebda0e	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202e.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 4a2ed1cdcdebda0e	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202s.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202s.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202w.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 4a2ed1cdcdebda0e	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202a.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202g.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202l.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	6be5c87d1c3f4c5ea01ddf6ec14e7d10_NeikiAnalytics.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 4a2ed1cdcdebda0e	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202r.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202u.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202a.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 4a2ed1cdcdebda0e	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202b.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 4a2ed1cdcdebda0e	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202g.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 4a2ed1cdcdebda0e	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202t.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 4a2ed1cdcdebda0e	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202w.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 4a2ed1cdcdebda0e	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202o.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 4a2ed1cdcdebda0e	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202y.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 832 wrote to memory of 4180	832	6be5c87d1c3f4c5ea01ddf6ec14e7d10_NeikiAnalytics.exe	89
PID 832 wrote to memory of 4180	832	6be5c87d1c3f4c5ea01ddf6ec14e7d10_NeikiAnalytics.exe	89
PID 832 wrote to memory of 4180	832	6be5c87d1c3f4c5ea01ddf6ec14e7d10_NeikiAnalytics.exe	89
PID 4180 wrote to memory of 864	4180	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202.exe	90
PID 4180 wrote to memory of 864	4180	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202.exe	90
PID 4180 wrote to memory of 864	4180	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202.exe	90
PID 864 wrote to memory of 768	864	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202a.exe	91
PID 864 wrote to memory of 768	864	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202a.exe	91
PID 864 wrote to memory of 768	864	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202a.exe	91
PID 768 wrote to memory of 3232	768	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202b.exe	92
PID 768 wrote to memory of 3232	768	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202b.exe	92
PID 768 wrote to memory of 3232	768	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202b.exe	92
PID 3232 wrote to memory of 2908	3232	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202c.exe	93
PID 3232 wrote to memory of 2908	3232	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202c.exe	93
PID 3232 wrote to memory of 2908	3232	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202c.exe	93
PID 2908 wrote to memory of 3940	2908	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202d.exe	94
PID 2908 wrote to memory of 3940	2908	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202d.exe	94
PID 2908 wrote to memory of 3940	2908	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202d.exe	94
PID 3940 wrote to memory of 4292	3940	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202e.exe	96
PID 3940 wrote to memory of 4292	3940	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202e.exe	96
PID 3940 wrote to memory of 4292	3940	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202e.exe	96
PID 4292 wrote to memory of 1600	4292	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202f.exe	98
PID 4292 wrote to memory of 1600	4292	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202f.exe	98
PID 4292 wrote to memory of 1600	4292	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202f.exe	98
PID 1600 wrote to memory of 2212	1600	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202g.exe	99
PID 1600 wrote to memory of 2212	1600	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202g.exe	99
PID 1600 wrote to memory of 2212	1600	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202g.exe	99
PID 2212 wrote to memory of 2424	2212	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202h.exe	100
PID 2212 wrote to memory of 2424	2212	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202h.exe	100
PID 2212 wrote to memory of 2424	2212	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202h.exe	100
PID 2424 wrote to memory of 2304	2424	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202i.exe	102
PID 2424 wrote to memory of 2304	2424	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202i.exe	102
PID 2424 wrote to memory of 2304	2424	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202i.exe	102
PID 2304 wrote to memory of 2276	2304	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202j.exe	103
PID 2304 wrote to memory of 2276	2304	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202j.exe	103
PID 2304 wrote to memory of 2276	2304	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202j.exe	103
PID 2276 wrote to memory of 1468	2276	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202k.exe	104
PID 2276 wrote to memory of 1468	2276	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202k.exe	104
PID 2276 wrote to memory of 1468	2276	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202k.exe	104
PID 1468 wrote to memory of 1440	1468	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202l.exe	105
PID 1468 wrote to memory of 1440	1468	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202l.exe	105
PID 1468 wrote to memory of 1440	1468	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202l.exe	105
PID 1440 wrote to memory of 3992	1440	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202m.exe	106
PID 1440 wrote to memory of 3992	1440	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202m.exe	106
PID 1440 wrote to memory of 3992	1440	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202m.exe	106
PID 3992 wrote to memory of 4708	3992	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202n.exe	107
PID 3992 wrote to memory of 4708	3992	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202n.exe	107
PID 3992 wrote to memory of 4708	3992	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202n.exe	107
PID 4708 wrote to memory of 3728	4708	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202o.exe	108
PID 4708 wrote to memory of 3728	4708	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202o.exe	108
PID 4708 wrote to memory of 3728	4708	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202o.exe	108
PID 3728 wrote to memory of 4168	3728	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202p.exe	109
PID 3728 wrote to memory of 4168	3728	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202p.exe	109
PID 3728 wrote to memory of 4168	3728	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202p.exe	109
PID 4168 wrote to memory of 4392	4168	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202q.exe	110
PID 4168 wrote to memory of 4392	4168	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202q.exe	110
PID 4168 wrote to memory of 4392	4168	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202q.exe	110
PID 4392 wrote to memory of 5088	4392	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202r.exe	111
PID 4392 wrote to memory of 5088	4392	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202r.exe	111
PID 4392 wrote to memory of 5088	4392	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202r.exe	111
PID 5088 wrote to memory of 728	5088	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202s.exe	112
PID 5088 wrote to memory of 728	5088	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202s.exe	112
PID 5088 wrote to memory of 728	5088	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202s.exe	112
PID 728 wrote to memory of 2160	728	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202t.exe	113

C:\Users\Admin\AppData\Local\Temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_NeikiAnalytics.exe"
1⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:832
- \??\c:\users\admin\appdata\local\temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202.exe
  c:\users\admin\appdata\local\temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4180
- - \??\c:\users\admin\appdata\local\temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202a.exe
    c:\users\admin\appdata\local\temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202a.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:864
  - - \??\c:\users\admin\appdata\local\temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202b.exe
      c:\users\admin\appdata\local\temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202b.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:768
    - - \??\c:\users\admin\appdata\local\temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202c.exe
        
        c:\users\admin\appdata\local\temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202c.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3232
      - \??\c:\users\admin\appdata\local\temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202d.exe
        
        c:\users\admin\appdata\local\temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202d.exe
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2908
        
        \??\c:\users\admin\appdata\local\temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202e.exe
        
        c:\users\admin\appdata\local\temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202e.exe
        7⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3940
        
        \??\c:\users\admin\appdata\local\temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202f.exe
        
        c:\users\admin\appdata\local\temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202f.exe
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4292
        
        \??\c:\users\admin\appdata\local\temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202g.exe
        
        c:\users\admin\appdata\local\temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202g.exe
        9⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1600
        
        \??\c:\users\admin\appdata\local\temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202h.exe
        
        c:\users\admin\appdata\local\temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202h.exe
        10⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2212
        
        \??\c:\users\admin\appdata\local\temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202i.exe
        
        c:\users\admin\appdata\local\temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202i.exe
        11⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2424
        
        \??\c:\users\admin\appdata\local\temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202j.exe
        
        c:\users\admin\appdata\local\temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202j.exe
        12⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2304
        
        \??\c:\users\admin\appdata\local\temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202k.exe
        
        c:\users\admin\appdata\local\temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202k.exe
        13⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2276
        
        \??\c:\users\admin\appdata\local\temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202l.exe
        
        c:\users\admin\appdata\local\temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202l.exe
        14⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1468
        
        \??\c:\users\admin\appdata\local\temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202m.exe
        
        c:\users\admin\appdata\local\temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202m.exe
        15⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1440
        
        \??\c:\users\admin\appdata\local\temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202n.exe
        
        c:\users\admin\appdata\local\temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202n.exe
        16⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3992
        
        \??\c:\users\admin\appdata\local\temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202o.exe
        
        c:\users\admin\appdata\local\temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202o.exe
        17⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4708
        
        \??\c:\users\admin\appdata\local\temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202p.exe
        
        c:\users\admin\appdata\local\temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202p.exe
        18⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3728
        
        \??\c:\users\admin\appdata\local\temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202q.exe
        
        c:\users\admin\appdata\local\temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202q.exe
        19⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4168
        
        \??\c:\users\admin\appdata\local\temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202r.exe
        
        c:\users\admin\appdata\local\temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202r.exe
        20⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4392
        
        \??\c:\users\admin\appdata\local\temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202s.exe
        
        c:\users\admin\appdata\local\temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202s.exe
        21⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5088
        
        \??\c:\users\admin\appdata\local\temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202t.exe
        
        c:\users\admin\appdata\local\temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202t.exe
        22⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:728
        
        \??\c:\users\admin\appdata\local\temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202u.exe
        
        c:\users\admin\appdata\local\temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202u.exe
        23⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        
        PID:2160
        
        \??\c:\users\admin\appdata\local\temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202v.exe
        
        c:\users\admin\appdata\local\temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202v.exe
        24⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        
        PID:2904
        
        \??\c:\users\admin\appdata\local\temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202w.exe
        
        c:\users\admin\appdata\local\temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202w.exe
        25⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        
        PID:1144
        
        \??\c:\users\admin\appdata\local\temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202x.exe
        
        c:\users\admin\appdata\local\temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202x.exe
        26⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        
        PID:1212
        
        \??\c:\users\admin\appdata\local\temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202y.exe
        
        c:\users\admin\appdata\local\temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202y.exe
        27⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3600

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4196,i,1999448010053300448,1112699187621658374,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:8
1⤵
PID:4564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202.exe

Path C:\Users\Admin\AppData\Local\Temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202.exe
Size 468KB
SHA256 f1a77eafe66501f85d38827a72052fa0fb53431ea770048eebce9c96e64060a6
MD5 31b2fbb05a0626082acb142f10d2e8ae
SHA1 a20bbd0dbfa2ee01d86fea28ad51b5a724135176
SHA512 9f6a807d510f3f1d6334dd084638f45556256a1726d1842c6351bad66d96ab1233f9000c9428320e01c3d71a9af9089c828605b69f342641e57d52c7862015b1
SSDEEP 6144:CqppuGRYx4H712f/SBTpzZA6rXD40b+7TJDAMyyNFSlfyveN569:CqpNtb1YIp9AI4FDAMyy3
MD5 SHA1 SHA512 SSDEEP

Submit Download

6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202d.exe

Path C:\Users\Admin\AppData\Local\Temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202d.exe
Size 469KB
SHA256 734e4099eb04bf4fab0d3845318e7242589e8d9bab137da0fa296d444fa886af
MD5 543e2a6f5f33808de1d1f6826dd51608
SHA1 355ac1238b090ea5bb52aa0c4e4dfcf89e14bb83
SHA512 1775c85c8b9be613a5792768b860624c5940bbafa5e0e1b6972018cad3574cc09b5796ca3911d9acfeea1676b4871c2c7bc96a435f34576e57dc55dbe02e5ebe
SSDEEP 6144:CqppuGRYx4H712f/SBTpzZA6rXD40b+7TJDAMyyNFSlfyveN564:CqpNtb1YIp9AI4FDAMyye
MD5 SHA1 SHA512 SSDEEP

Submit Download

6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202e.exe

Path C:\Users\Admin\AppData\Local\Temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202e.exe
Size 470KB
SHA256 11928d3d57c549906ec6c2d615f892fb8b3c2b021c546e6dbb953e84e8a05b2e
MD5 ebb4adf201d2947972817498970dfff0
SHA1 dc5ca763fa399ab316dbec444df3caea6f34d697
SHA512 20d2b447ae86d9500211e19bd4df24976f8352dc756cb4e5628618283f943a1f3c0304d19f082094f8f810ad3f661af096fbfd4f7db15143ef241bcdceb8093e
SSDEEP 6144:CqppuGRYx4H712f/SBTpzZA6rXD40b+7TJDAMyyNFSlfyveN56N:CqpNtb1YIp9AI4FDAMyyL
MD5 SHA1 SHA512 SSDEEP

Submit Download

6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202f.exe

Path C:\Users\Admin\AppData\Local\Temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202f.exe
Size 470KB
SHA256 07201d8e1ef718c3bdd2d04aa646e5a51e81fc7eb8eb7e769f6e08bcac5a3025
MD5 53cb813b027ed1cfffea449c1f8f497b
SHA1 68ba4d8551be7ec61f255d8912ca0c468c6627ca
SHA512 28decb35c9e34ec54668bf89faf9eed0cdc7480b62570c9ccd1e75da89ff30b35e864f8701f5fcf5020f2d450d3322f9899cd0d6a79165ba0ae76f78bf821885
SSDEEP 6144:CqppuGRYx4H712f/SBTpzZA6rXD40b+7TJDAMyyNFSlfyveN56Y:CqpNtb1YIp9AI4FDAMyym
MD5 SHA1 SHA512 SSDEEP

Submit Download

6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202g.exe

Path C:\Users\Admin\AppData\Local\Temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202g.exe
Size 470KB
SHA256 d28cce49ba502266315a641051e75ddf787d2eead903b72f95ac9e345288aec7
MD5 8f12215e70ba9a989c3d51a3fb185e0a
SHA1 a841d09b7c81894153c43620d30e18dfce45d115
SHA512 a6bbf360c43965ab9e139c4d5169804de938e10c1f144bfa39ac7938060918df65b31c3cc07173b96f42d1e0bfb537ab806e22384ae967f8af9c675cc8169a55
SSDEEP 6144:CqppuGRYx4H712f/SBTpzZA6rXD40b+7TJDAMyyNFSlfyveN56M:CqpNtb1YIp9AI4FDAMyy+
MD5 SHA1 SHA512 SSDEEP

Submit Download

6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202k.exe

Path C:\Users\Admin\AppData\Local\Temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202k.exe
Size 471KB
SHA256 8d248f38f57492f7118768ff52689da797b32e5f55f8d7bb4406cbe91a8af2af
MD5 ef44d5899ae5c7da838b5c86d5f29a50
SHA1 29e9ff948232beebf88a451080f13c6eed2397e3
SHA512 898725de0c5bdff08d0eef256fbecd21b254e70da9201e5d58622ce96f7dd557dfcd7f5d6f520df81bf5f4900640e65101c439ca883f090b10edb890309626e0
SSDEEP 6144:CqppuGRYx4H712f/SBTpzZA6rXD40b+7TJDAMyyNFSlfyveN562:CqpNtb1YIp9AI4FDAMyyI
MD5 SHA1 SHA512 SSDEEP

Submit Download

6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202l.exe

Path C:\Users\Admin\AppData\Local\Temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202l.exe
Size 471KB
SHA256 3614cf995d40074361dd2f14eb4ac4bfa49844dc752edb64205a44f68bb203d2
MD5 43180d3ffb3a33b53cbc9fa36a20ea6d
SHA1 9a768e6c829477f7d552f28ff8578554e2c30eec
SHA512 813a6f226b0b8a3124106c28848b635780eacf4116fdae9fcb0fd3228ce6688b3dd2e896ee71f1cdb7f9fdd46e8802dd91d6196d8199914dd93d5144447b3084
SSDEEP 6144:CqppuGRYx4H712f/SBTpzZA6rXD40b+7TJDAMyyNFSlfyveN56e:CqpNtb1YIp9AI4FDAMyyo
MD5 SHA1 SHA512 SSDEEP

Submit Download

6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202m.exe

Path C:\Users\Admin\AppData\Local\Temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202m.exe
Size 472KB
SHA256 8e841b0b8dba479b6dd12912abe3ab1767aacb12c91eee770043c9cb364dab27
MD5 9f0540406ed5cb8cec7c762262e70ac0
SHA1 fb014147d474e314c6293a53788b0214d3fb410b
SHA512 20cc6be882039a315138ce5077c59867b58ba19e3c2872d143167a23dbdcce832dd37fa74d0cc19ee2fc6da42f939431df517ec13b30a689a7c6a5f9e327035f
SSDEEP 6144:CqppuGRYx4H712f/SBTpzZA6rXD40b+7TJDAMyyNFSlfyveN56L:CqpNtb1YIp9AI4FDAMyyN
MD5 SHA1 SHA512 SSDEEP

Submit Download

6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202n.exe

Path C:\Users\Admin\AppData\Local\Temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202n.exe
Size 472KB
SHA256 063987bc2f82d569358a319399d2c3b21cd5c6e38f0e6412a725c51007811f9d
MD5 3da5c6e45f56b3f1c9c7c11c24775c19
SHA1 647476e04a38629613c06106be1c20b5434f69f6
SHA512 7d3fa793a850296b2539646d0a42f7a0c6c0bd84987a9160a3d4f6e277b65965e0120da89042d6d931e30cb594297c5e9ffaa8fe737196af367ad41d49e97e0f
SSDEEP 6144:CqppuGRYx4H712f/SBTpzZA6rXD40b+7TJDAMyyNFSlfyveN562:CqpNtb1YIp9AI4FDAMyy4
MD5 SHA1 SHA512 SSDEEP

Submit Download

6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202p.exe

Path C:\Users\Admin\AppData\Local\Temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202p.exe
Size 472KB
SHA256 97f37bd103c27ce1850954249e3fcbe632ff715ee88c0df63ad897655557bfef
MD5 d658aef3b49b3a29c7bc9de619c98c8c
SHA1 11ceb5436ab29e31c401aabe912bb100a7c4513e
SHA512 ed708b32babaef0ce48dfb535ec0277879e3417b1816ef2a6234e19c09d169fe95e3c0892c945b1afbcbd4e67526f3dc2434462475f97b227e1676e43a1ee6af
SSDEEP 6144:CqppuGRYx4H712f/SBTpzZA6rXD40b+7TJDAMyyNFSlfyveN56u:CqpNtb1YIp9AI4FDAMyyA
MD5 SHA1 SHA512 SSDEEP

Submit Download

6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202r.exe

Path C:\Users\Admin\AppData\Local\Temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202r.exe
Size 473KB
SHA256 feb246b192cf72cc04004ee330458d2ac1ca35dfed273751351132e8f24532b3
MD5 542663fca7291431f9a938a2d8fb42e7
SHA1 deee3c9e818893bd6794d3fd6ae7950ccea555e5
SHA512 b43c29eea0e15d14bc7d749f6c6ba979b2117db0bf195cb38443ce8c863c34a233753f7b7e506dc3a41437d81d97571a008d604a9f51e73b3bb10a6393a521d2
SSDEEP 6144:CqppuGRYx4H712f/SBTpzZA6rXD40b+7TJDAMyyNFSlfyveN56h:CqpNtb1YIp9AI4FDAMyy7
MD5 SHA1 SHA512 SSDEEP

Submit Download

6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202s.exe

Path C:\Users\Admin\AppData\Local\Temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202s.exe
Size 473KB
SHA256 8cb08529813c600ab0bfaac9079c1fd59d08a89f32d7cc37c7e039157441203b
MD5 e81db21d1ea658557609508e14aef932
SHA1 e0d1eb9d463c34a1dd93699091c91ce21f60e910
SHA512 2f69228a4f765fe4889187c43e2d8f9b768d45c8a7d4bd7277a20a40d613c4701ae341943e1b1327c75e7fe8bf7a0abce229c3c6dffc570410d74ee1febec3e7
SSDEEP 6144:CqppuGRYx4H712f/SBTpzZA6rXD40b+7TJDAMyyNFSlfyveN56S:CqpNtb1YIp9AI4FDAMyyc
MD5 SHA1 SHA512 SSDEEP

Submit Download

6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202u.exe

Path C:\Users\Admin\AppData\Local\Temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202u.exe
Size 473KB
SHA256 16b552772a5b0f3755cff7fd0045f07ad927f222cfac56d3195e6233f4c3c392
MD5 bfdc531e7e76cd4a3f428fb087675bcc
SHA1 865367be15071595fb83b293b643979b0daced35
SHA512 3b86f1a3a6497f19bbc5001d6baae5ad044d91499f1689554a9b1047292a51e56a4e459d54c763183b4568e549109f4abd1ea0b9f011bda224bb2407c261e344
SSDEEP 6144:CqppuGRYx4H712f/SBTpzZA6rXD40b+7TJDAMyyNFSlfyveN56s:CqpNtb1YIp9AI4FDAMyy2
MD5 SHA1 SHA512 SSDEEP

Submit Download

6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202v.exe

Path C:\Users\Admin\AppData\Local\Temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202v.exe
Size 474KB
SHA256 1d780e15c902121eacfa739e68e0ad62f072600cdce0a318b961687287136c32
MD5 849182f714466b86241e33e500fccdf0
SHA1 f279e13baadb4178a511c5fb8095f5913d8e865c
SHA512 702df73dfd92d0caaac4dd0c42a966b15badf487ac80af9bdb6f2637874566c3b5b1261261ef09ff2d63d1cdc00a279d025d38b4f58fcf656c140bd3a00c2ea1
SSDEEP 6144:CqppuGRYx4H712f/SBTpzZA6rXD40b+7TJDAMyyNFSlfyveN56I:CqpNtb1YIp9AI4FDAMyyu
MD5 SHA1 SHA512 SSDEEP

Submit Download

6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202w.exe

Path C:\Users\Admin\AppData\Local\Temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202w.exe
Size 474KB
SHA256 30d2ef73e7cdd2bd66d69c923605a1197b6b33351ae090ae46c57278a1cc72ab
MD5 6ae81f66e0ecfb3c25c5f97c599f4afb
SHA1 f31827faa0f2fec51a27b6837baec633cbccd91e
SHA512 cb4ac70caf1bf05e3dd18968a5384b5abc0fc218783a58779f3d69f867a004eb89f777931c03af32b88fe5c143b22a4ce3383fde7cdf617b5bd7c785c1ea8243
SSDEEP 6144:CqppuGRYx4H712f/SBTpzZA6rXD40b+7TJDAMyyNFSlfyveN565:CqpNtb1YIp9AI4FDAMyy3
MD5 SHA1 SHA512 SSDEEP

Submit Download

6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202y.exe

Path C:\Users\Admin\AppData\Local\Temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202y.exe
Size 474KB
SHA256 ed9956acadeb58a8dcde797c141500705d91f5d22fa2a0a6dfe3ef13c71ac288
MD5 b875c0ba84f101c7f0483099d03e7fd3
SHA1 db8844e1162362c7126595fd0657012743ee27d8
SHA512 aff2a0ee1255fecb0b0a4f9f815df2ebcd755a152103b18f27b2532ab7f1f5e8880b48a7c14f478b0ca236d10757e0fc10c96b37e71a713e09745353ab7d9864
SSDEEP 6144:CqppuGRYx4H712f/SBTpzZA6rXD40b+7TJDAMyyNFSlfyveN56t:CqpNtb1YIp9AI4FDAMyyT
MD5 SHA1 SHA512 SSDEEP

Submit Download

6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202a.exe

Path \??\c:\users\admin\appdata\local\temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202a.exe
Size 469KB
SHA256 b764bc8544d62dba5fd4cabc1618bb885f0af38c669464f9f25f3b7bb566a848
MD5 b01db866e04e3007bc5cbc8d01719dd3
SHA1 9523ced42b17b84a118e246b895e1057d709988e
SHA512 eab0d47a94837c6e9cc4c30e1a0d8be533259c15c27183a4430a146cf10a240ac932ce4e71d009cdec76e4a766e6c663f4ebf7df323ff7d09bf7a927bb20e476
SSDEEP 6144:CqppuGRYx4H712f/SBTpzZA6rXD40b+7TJDAMyyNFSlfyveN56u:CqpNtb1YIp9AI4FDAMyyg
MD5 SHA1 SHA512 SSDEEP

Submit Download

6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202b.exe

Path \??\c:\users\admin\appdata\local\temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202b.exe
Size 469KB
SHA256 dc097e7973cfbe85a3c13409c49280fdb1fd099cc549564d8a77c1168edef4da
MD5 dc3ecafc2bc518515ad3cd679c7c6765
SHA1 5eddf89f02251be0c6c10f450209bc5fe0bdbec1
SHA512 be3c7996b69533ea9326df2ecc2094e5dd633297035b355c6419412ead622f65423a9dd8cb6b77ab7cc5c72e5e4d89a27efa2eac43e53fbcfe18346ad773f078
SSDEEP 6144:CqppuGRYx4H712f/SBTpzZA6rXD40b+7TJDAMyyNFSlfyveN56h:CqpNtb1YIp9AI4FDAMyyT
MD5 SHA1 SHA512 SSDEEP

Submit Download

6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202c.exe

Path \??\c:\users\admin\appdata\local\temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202c.exe
Size 469KB
SHA256 36305e066e5e66895d09337659ef5d8a345ac9b77709fb3a943e38238db27a3c
MD5 6bfcf01ec43c1dfdd691314226a4539a
SHA1 ed952ebbb30d7ba76ade2a2ab4a2dbe71ba0f029
SHA512 bcd3912866148599ea910a32430745e59d4c1e9da1130d959b8f8d787e049ad1dc7eaf410ead83423d55bde979e7c586dd0462f9a59ff5e000414d747b673ec6
SSDEEP 6144:CqppuGRYx4H712f/SBTpzZA6rXD40b+7TJDAMyyNFSlfyveN56N:CqpNtb1YIp9AI4FDAMyyj
MD5 SHA1 SHA512 SSDEEP

Submit Download

6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202h.exe

Path \??\c:\users\admin\appdata\local\temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202h.exe
Size 470KB
SHA256 4a226f698f74848eeda68bf71e2636fd7f89b08b00bc7b592ec9c270e74a185e
MD5 3ba89d5e8a14b8d311bc9a0ce94442e2
SHA1 9fab2367a6eb7b517e2b3555a1efb57f25634fad
SHA512 64d357929acd816fce1672dc60b13c0f9f135e97b96f0a709d7b55f6f29c387d5c1e16dc51aa8dad9586896db96fda154251272b6d7db6faa426197d5be688de
SSDEEP 6144:CqppuGRYx4H712f/SBTpzZA6rXD40b+7TJDAMyyNFSlfyveN56N:CqpNtb1YIp9AI4FDAMyyH
MD5 SHA1 SHA512 SSDEEP

Submit Download

6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202i.exe

Path \??\c:\users\admin\appdata\local\temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202i.exe
Size 471KB
SHA256 dcc083d11cbef4c572a5ad7a0e149b442b655772196915f2e664169d698212c6
MD5 62eca53a9c75cf8a20ce8e7772d2a970
SHA1 0d3d90f949b446ff87161c0d3a70f149d3b6e070
SHA512 0bdb274d5c7567d77431924e7f76a7ea3abaa6e3ba0769b14498aad76171c09b195c880713251f25e9157ef5713f8d1402160b2dac63a9bd4b573a4175167bf8
SSDEEP 6144:CqppuGRYx4H712f/SBTpzZA6rXD40b+7TJDAMyyNFSlfyveN56S:CqpNtb1YIp9AI4FDAMyy8
MD5 SHA1 SHA512 SSDEEP

Submit Download

6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202j.exe

Path \??\c:\users\admin\appdata\local\temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202j.exe
Size 471KB
SHA256 5ef704431f32fc7c6254ce251cb5daca1b1cd9120773de9b316e02257a2cf2ac
MD5 bc07e18ee82f1ee28a599384c36396ac
SHA1 3f8ac2d5a47dd8c27bb05f5d53935131d3f9aa6b
SHA512 6c39c70b5df4c0d471d770fabd9bfb04c45b3c1d19c8c1f4725b9d7d3c5a8d133a1c9bb5d0d02aa3f5e2a4460b4ac8a3d8bb10b7954bb073386487ec4c8ebc6b
SSDEEP 6144:CqppuGRYx4H712f/SBTpzZA6rXD40b+7TJDAMyyNFSlfyveN56d:CqpNtb1YIp9AI4FDAMyyX
MD5 SHA1 SHA512 SSDEEP

Submit Download

6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202o.exe

Path \??\c:\users\admin\appdata\local\temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202o.exe
Size 472KB
SHA256 4b46939fc75bdf26f145cc92ddf68db8923dbb9aefcee7320403ffd485ebd6aa
MD5 cd0f377768845375012a984fb0c97b89
SHA1 cf8564814609a1c118adb45f3a1edb7c21453ad4
SHA512 619833c3fdec9a7796360234d8e50c2b539e891a066eda99bdb59d9024e92bbda8ff2671246766f851c892cfd9591e740c9647de120ef40d8b3810380c41c899
SSDEEP 6144:CqppuGRYx4H712f/SBTpzZA6rXD40b+7TJDAMyyNFSlfyveN56b:CqpNtb1YIp9AI4FDAMyyd
MD5 SHA1 SHA512 SSDEEP

Submit Download

6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202q.exe

Path \??\c:\users\admin\appdata\local\temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202q.exe
Size 472KB
SHA256 b5af4f0fd7a5af1e30f191ddd846915e3e752c594df396310c594f96a5d96ffc
MD5 f6e5823f84cb2aa7bae33aec99a2b08e
SHA1 f98f260ab1b5f081cbfc96938d3e6fea79b031f7
SHA512 fe8cf4575542791309d790808635d588153a4cd1016f3e9c5f4e1e43f97e44e284b43baf5e515bd7a9025cc84970a4631edf5b180aed1c463e0254aa90d412bc
SSDEEP 6144:CqppuGRYx4H712f/SBTpzZA6rXD40b+7TJDAMyyNFSlfyveN56m:CqpNtb1YIp9AI4FDAMyyA
MD5 SHA1 SHA512 SSDEEP

Submit Download

6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202t.exe

Path \??\c:\users\admin\appdata\local\temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202t.exe
Size 473KB
SHA256 af14e3b34655b7504ef69dbc1f441aa311cd2cb88618595aff5ebd77b70bbac3
MD5 1dcc670f538cc7dedb011416eca816a4
SHA1 a5fe7229c674bddf93c9a55842eae9785a6fd845
SHA512 e3ffa7f49d865c47ec6d357ac3ce2465f5561d130a04d11c768b40b636eb16a88b2f4b6db4464b489fcfc63eae863ed996dc1dce5e8bb05ebd2f1d7f67128621
SSDEEP 6144:CqppuGRYx4H712f/SBTpzZA6rXD40b+7TJDAMyyNFSlfyveN56Z:CqpNtb1YIp9AI4FDAMyyL
MD5 SHA1 SHA512 SSDEEP

Submit Download

6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202x.exe

Path \??\c:\users\admin\appdata\local\temp\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202x.exe
Size 474KB
SHA256 4c7d5a4c9c05aa0d1d5ab8f029b73fe8304928eff93d403550834222f8a62917
MD5 8486e8489cd35593c3875175f66026ef
SHA1 94c96ae8e26bfdd8c7fec057117c58a4a92a3593
SHA512 7dc3f5be9d726cc844fa877f41e47b7466c596aa0ea6bc404e2809f90c96816044bb06a5aa152051cbce2d0d80fef5383a1f62e7b803f8d86b4ff30ee2f9ddf2
SSDEEP 6144:CqppuGRYx4H712f/SBTpzZA6rXD40b+7TJDAMyyNFSlfyveN56c:CqpNtb1YIp9AI4FDAMyyy
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/728-226-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/728-231-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/768-42-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/768-32-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/832-0-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/832-15-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/864-26-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/864-31-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1144-250-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1144-260-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1212-270-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1440-157-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1468-149-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1600-95-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2160-239-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2212-111-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2212-101-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2276-139-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2276-134-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2304-128-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2304-116-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2424-123-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2424-112-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2904-257-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2908-64-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2908-54-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/3232-48-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/3232-52-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/3600-274-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/3728-189-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/3940-74-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/3940-65-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/3992-168-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4168-199-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4180-17-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4292-84-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4392-207-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4708-177-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/5088-219-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/5088-210-0x0000000000400000-0x0000000000442000-memory.dmp

Download

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202s.exe\""	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202r.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202v.exe\""	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202u.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202d.exe\""	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202i.exe\""	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202h.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202j.exe\""	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202i.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202o.exe\""	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202n.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202.exe\""	6be5c87d1c3f4c5ea01ddf6ec14e7d10_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202g.exe\""	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202p.exe\""	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202o.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202q.exe\""	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202p.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202u.exe\""	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202t.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202x.exe\""	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202w.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202c.exe\""	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202r.exe\""	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202q.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202t.exe\""	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202s.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202a.exe\""	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202b.exe\""	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202h.exe\""	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202g.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202k.exe\""	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202j.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202n.exe\""	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202m.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202e.exe\""	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202m.exe\""	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202l.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202f.exe\""	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202l.exe\""	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202k.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202y.exe\""	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202x.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202w.exe\""	6be5c87d1c3f4c5ea01ddf6ec14e7d10_neikianalytics_3202v.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads