Malware Analysis Report

2024-11-16 10:54

Sample ID 240614-b6f85szhqf
Target 985ead3ac7ee0a59ac917d983f6110f0_NeikiAnalytics.exe
SHA256 eca91107e8fe4eae5b1ff5b02c7f99b69511c127ad6f6dbe40ca5e4565641db4
Tags
evasion persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

eca91107e8fe4eae5b1ff5b02c7f99b69511c127ad6f6dbe40ca5e4565641db4

Threat Level: Known bad

The file 985ead3ac7ee0a59ac917d983f6110f0_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

evasion persistence

Modifies visiblity of hidden/system files in Explorer

Modifies WinLogon for persistence

Modifies Installed Components in the registry

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-14 01:45

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-14 01:45

Reported

2024-06-14 01:47

Platform

win10v2004-20240611-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\985ead3ac7ee0a59ac917d983f6110f0_NeikiAnalytics.exe"

Signatures

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" \??\c:\windows\system\svchost.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\system\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\system\explorer.exe N/A

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\svchost.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\svchost.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\svchost.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} \??\c:\windows\system\svchost.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\explorer.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\spoolsv.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\spoolsv.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" \??\c:\windows\system\explorer.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\system\udsys.exe \??\c:\windows\system\explorer.exe N/A
File opened for modification \??\c:\windows\system\explorer.exe C:\Users\Admin\AppData\Local\Temp\985ead3ac7ee0a59ac917d983f6110f0_NeikiAnalytics.exe N/A
File opened for modification \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\explorer.exe N/A
File opened for modification \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe N/A
File opened for modification \??\c:\windows\system\explorer.exe \??\c:\windows\system\explorer.exe N/A
File opened for modification \??\c:\windows\system\svchost.exe \??\c:\windows\system\svchost.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\985ead3ac7ee0a59ac917d983f6110f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\985ead3ac7ee0a59ac917d983f6110f0_NeikiAnalytics.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1128 wrote to memory of 4656 N/A C:\Users\Admin\AppData\Local\Temp\985ead3ac7ee0a59ac917d983f6110f0_NeikiAnalytics.exe \??\c:\windows\system\explorer.exe
PID 1128 wrote to memory of 4656 N/A C:\Users\Admin\AppData\Local\Temp\985ead3ac7ee0a59ac917d983f6110f0_NeikiAnalytics.exe \??\c:\windows\system\explorer.exe
PID 1128 wrote to memory of 4656 N/A C:\Users\Admin\AppData\Local\Temp\985ead3ac7ee0a59ac917d983f6110f0_NeikiAnalytics.exe \??\c:\windows\system\explorer.exe
PID 4656 wrote to memory of 220 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 4656 wrote to memory of 220 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 4656 wrote to memory of 220 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 220 wrote to memory of 1264 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 220 wrote to memory of 1264 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 220 wrote to memory of 1264 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 1264 wrote to memory of 4492 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 1264 wrote to memory of 4492 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 1264 wrote to memory of 4492 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 1264 wrote to memory of 4908 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 1264 wrote to memory of 4908 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 1264 wrote to memory of 4908 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 1264 wrote to memory of 216 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 1264 wrote to memory of 216 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 1264 wrote to memory of 216 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 1264 wrote to memory of 1580 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 1264 wrote to memory of 1580 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 1264 wrote to memory of 1580 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe

Processes

C:\Users\Admin\AppData\Local\Temp\985ead3ac7ee0a59ac917d983f6110f0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\985ead3ac7ee0a59ac917d983f6110f0_NeikiAnalytics.exe"

\??\c:\windows\system\explorer.exe

c:\windows\system\explorer.exe

\??\c:\windows\system\spoolsv.exe

c:\windows\system\spoolsv.exe SE

\??\c:\windows\system\svchost.exe

c:\windows\system\svchost.exe

\??\c:\windows\system\spoolsv.exe

c:\windows\system\spoolsv.exe PR

C:\Windows\SysWOW64\at.exe

at 01:47 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

C:\Windows\SysWOW64\at.exe

at 01:48 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

C:\Windows\SysWOW64\at.exe

at 01:49 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 udp

Files

memory/1128-0-0x0000000000400000-0x0000000000431000-memory.dmp

memory/1128-1-0x00000000001C0000-0x00000000001C4000-memory.dmp

memory/1128-2-0x0000000075900000-0x0000000075A5D000-memory.dmp

memory/1128-3-0x0000000000400000-0x0000000000431000-memory.dmp

memory/1128-6-0x0000000000401000-0x000000000042E000-memory.dmp

\??\c:\windows\system\explorer.exe

MD5 4827b40350ab7b34605cdb427514411f
SHA1 9a45d38775421b71df4c9fe6a57798f7ea33e13b
SHA256 983b2a1d9fc1bb2775adb638291bf01d4c180dfff8a6bb6af0135f0ec5379091
SHA512 f4051a635132a017a9c7777ccd80b2364f5e9c12d989a664eb054c7bb79d4fe364fc9b52b9a7b50779d813f3fb275dca587e43b85b227a9e8d01b7fddfc7edba

memory/4656-16-0x0000000000400000-0x0000000000431000-memory.dmp

memory/4656-14-0x0000000075900000-0x0000000075A5D000-memory.dmp

memory/4656-13-0x0000000000400000-0x0000000000431000-memory.dmp

C:\Windows\System\spoolsv.exe

MD5 ea9275b7855307ec54496d340341c130
SHA1 bcfe56b9de0774a0aad9b1268afc4f8f461f3dd9
SHA256 0f90ef255c24b7f15cbedffcf025f29a0bd8601ffb2524a3d0b433f287911859
SHA512 80d9ad6eba3300a760730324d34dba5738f6ea73e7058991c09b2f80e6e3f96a93a447dd6382fa1d275c0f865cbaf29a98f89b969b825fd5883ee915b4b2a453

memory/220-25-0x0000000000400000-0x0000000000431000-memory.dmp

memory/220-26-0x0000000075900000-0x0000000075A5D000-memory.dmp

memory/220-30-0x0000000000400000-0x0000000000431000-memory.dmp

C:\Windows\System\svchost.exe

MD5 6d4d3daaa3cdaa536afac2ca4ebfdcf1
SHA1 acb68070181d76d64cb678373ed5433f789a6098
SHA256 40489255856a034630bcc26d17e066e96f000821959da6eb7ce48bd5161d792f
SHA512 250cf96cc77ddf1e28700c79f8a066b5f9799c34959db33616adaf51da8cbfeb4466a51fa625d85ea1f5e124a8b04b64f209aab97e753c3207ebda362fe371f6

memory/1264-37-0x0000000075900000-0x0000000075A5D000-memory.dmp

memory/1264-41-0x0000000000400000-0x0000000000431000-memory.dmp

memory/4492-44-0x0000000075900000-0x0000000075A5D000-memory.dmp

memory/4492-50-0x0000000000400000-0x0000000000431000-memory.dmp

memory/1128-57-0x0000000000401000-0x000000000042E000-memory.dmp

memory/1128-56-0x0000000000400000-0x0000000000431000-memory.dmp

memory/220-54-0x0000000000400000-0x0000000000431000-memory.dmp

C:\Users\Admin\AppData\Roaming\mrsys.exe

MD5 6bd31fa4bf95b4298830ef15f8471256
SHA1 9bb821fedaf75ea955f60b05d86b29876ff60a07
SHA256 2a7596c557521202a7a3d50dcc60a8207ed790fc9c8fcdb7f8be7ebffb49a4ca
SHA512 ff466905b9aab8f8ceb54c46c4e6b0bae926e96c7cbcf8432da9978559ba7865060626f1fcc249b71966963574c2efc1c2bd16aa085f15223b25d56f04c91d24

memory/4656-59-0x0000000000400000-0x0000000000431000-memory.dmp

memory/4656-60-0x0000000000400000-0x0000000000431000-memory.dmp

memory/1264-62-0x0000000000400000-0x0000000000431000-memory.dmp

memory/4656-71-0x0000000000400000-0x0000000000431000-memory.dmp

\??\PIPE\atsvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-14 01:45

Reported

2024-06-14 01:47

Platform

win7-20240221-en

Max time kernel

150s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\985ead3ac7ee0a59ac917d983f6110f0_NeikiAnalytics.exe"

Signatures

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" \??\c:\windows\system\svchost.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\system\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\system\svchost.exe N/A

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\explorer.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\svchost.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\svchost.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\svchost.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} \??\c:\windows\system\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\spoolsv.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\spoolsv.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" \??\c:\windows\system\svchost.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification \??\c:\windows\system\explorer.exe C:\Users\Admin\AppData\Local\Temp\985ead3ac7ee0a59ac917d983f6110f0_NeikiAnalytics.exe N/A
File opened for modification \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\explorer.exe N/A
File opened for modification \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe N/A
File opened for modification \??\c:\windows\system\explorer.exe \??\c:\windows\system\explorer.exe N/A
File opened for modification \??\c:\windows\system\svchost.exe \??\c:\windows\system\svchost.exe N/A
File opened for modification C:\Windows\system\udsys.exe \??\c:\windows\system\explorer.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\985ead3ac7ee0a59ac917d983f6110f0_NeikiAnalytics.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2120 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\985ead3ac7ee0a59ac917d983f6110f0_NeikiAnalytics.exe \??\c:\windows\system\explorer.exe
PID 2120 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\985ead3ac7ee0a59ac917d983f6110f0_NeikiAnalytics.exe \??\c:\windows\system\explorer.exe
PID 2120 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\985ead3ac7ee0a59ac917d983f6110f0_NeikiAnalytics.exe \??\c:\windows\system\explorer.exe
PID 2120 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\985ead3ac7ee0a59ac917d983f6110f0_NeikiAnalytics.exe \??\c:\windows\system\explorer.exe
PID 2644 wrote to memory of 2612 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 2644 wrote to memory of 2612 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 2644 wrote to memory of 2612 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 2644 wrote to memory of 2612 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 2612 wrote to memory of 2620 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 2612 wrote to memory of 2620 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 2612 wrote to memory of 2620 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 2612 wrote to memory of 2620 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 2620 wrote to memory of 2208 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 2620 wrote to memory of 2208 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 2620 wrote to memory of 2208 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 2620 wrote to memory of 2208 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 2620 wrote to memory of 2704 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2620 wrote to memory of 2704 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2620 wrote to memory of 2704 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2620 wrote to memory of 2704 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2620 wrote to memory of 1700 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2620 wrote to memory of 1700 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2620 wrote to memory of 1700 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2620 wrote to memory of 1700 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2620 wrote to memory of 1796 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2620 wrote to memory of 1796 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2620 wrote to memory of 1796 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2620 wrote to memory of 1796 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe

Processes

C:\Users\Admin\AppData\Local\Temp\985ead3ac7ee0a59ac917d983f6110f0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\985ead3ac7ee0a59ac917d983f6110f0_NeikiAnalytics.exe"

\??\c:\windows\system\explorer.exe

c:\windows\system\explorer.exe

\??\c:\windows\system\spoolsv.exe

c:\windows\system\spoolsv.exe SE

\??\c:\windows\system\svchost.exe

c:\windows\system\svchost.exe

\??\c:\windows\system\spoolsv.exe

c:\windows\system\spoolsv.exe PR

C:\Windows\SysWOW64\at.exe

at 01:47 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

C:\Windows\SysWOW64\at.exe

at 01:48 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

C:\Windows\SysWOW64\at.exe

at 01:49 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

Network

N/A

Files

memory/2120-0-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2120-1-0x0000000000020000-0x0000000000024000-memory.dmp

memory/2120-2-0x0000000072940000-0x0000000072A93000-memory.dmp

memory/2120-4-0x0000000000401000-0x000000000042E000-memory.dmp

memory/2120-3-0x0000000000400000-0x0000000000431000-memory.dmp

\Windows\system\explorer.exe

MD5 97cb21010e19f1faf33a6630c8da1edf
SHA1 f340131e5a994691a15307b5afc8b6546f472120
SHA256 00d0772462c560c1ee3617bec8f095c90d3fe8a4c3ac2d0a7ad05ee978943799
SHA512 349dab28e51fd4d4db6e674f8f9bfbe0d2ec0c804bb84911cb4587a3b2a35c3e7de255fb1565dffd19983451c7c1350fbc6191d78dcb014271dfc78cffda1ed6

memory/2644-21-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2644-19-0x0000000072940000-0x0000000072A93000-memory.dmp

memory/2644-18-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2120-17-0x0000000000540000-0x0000000000571000-memory.dmp

\Windows\system\spoolsv.exe

MD5 ef955a24cf67b599157c03b97287771e
SHA1 1f248867bf40d8b66c15feaf13555ac7cbd9d112
SHA256 5fbbcdbb2baf174403204bac112ccc8c83876b06206b5f7e064dbccbfdb99477
SHA512 11b1bbfae5a92a5e2c1a663c467292362f214833628c631df2bfe8ce32373a28a57dc9bf5537d6b9887f8784c4f407ab500d82c45a52a2cb276ebde18326fff9

memory/2612-35-0x0000000072940000-0x0000000072A93000-memory.dmp

memory/2612-39-0x0000000000400000-0x0000000000431000-memory.dmp

\Windows\system\svchost.exe

MD5 f93b72ab4a82a580ef79515b50afb466
SHA1 515610fd8a27372a08664e44db31b695a50ff90a
SHA256 d5581aecd88534f53fc1fea2a6b831ec25de6dc9712d9dfce31cb97643144c2d
SHA512 a48e19c77759f872bd66286950b9383293405036cf5e289a106e2c1da2e8872879efda11103d2cfcec006f4f957f951642dbba1b065893028c5a2ba51d2d8b64

memory/2620-53-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2612-52-0x0000000001EA0000-0x0000000001ED1000-memory.dmp

memory/2620-51-0x0000000072940000-0x0000000072A93000-memory.dmp

memory/2620-61-0x0000000002540000-0x0000000002571000-memory.dmp

memory/2120-63-0x0000000000020000-0x0000000000024000-memory.dmp

memory/2208-64-0x0000000072940000-0x0000000072A93000-memory.dmp

memory/2612-69-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2208-72-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2120-73-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2120-74-0x0000000000401000-0x000000000042E000-memory.dmp

C:\Users\Admin\AppData\Roaming\mrsys.exe

MD5 b66c134686ce52a34ecf7f942fa35818
SHA1 12a1dee3493215feb31d84edf9a3870d3c3fb4d0
SHA256 7b3d1042de9f52d10fe8d5492cba6d41f01c3280f4381e90b4ae06656e7a8f10
SHA512 90afa682a3b66e3273c95157afd38235015dd7ad3f33966a143b2be73aa065079c93ad2a2b32961e0375c2817d9636635d1305cf6237135057533ab8b3a53655

memory/2644-76-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2620-78-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2644-87-0x0000000000400000-0x0000000000431000-memory.dmp

\??\PIPE\atsvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e