Malware Analysis Report

2024-11-16 10:49

Sample ID 240614-cm8pqavgrk
Target 9a4c7160bfaf6f401fe670e344bb3d00_NeikiAnalytics.exe
SHA256 de4eae0e14a9519efaca31ff237a2315607cd412b0c023c697514b7bf826366d
Tags
evasion persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

de4eae0e14a9519efaca31ff237a2315607cd412b0c023c697514b7bf826366d

Threat Level: Known bad

The file 9a4c7160bfaf6f401fe670e344bb3d00_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

evasion persistence

Modifies visiblity of hidden/system files in Explorer

Modifies WinLogon for persistence

Modifies Installed Components in the registry

Loads dropped DLL

Executes dropped EXE

Adds Run key to start application

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Suspicious use of SetWindowsHookEx

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-14 02:12

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-14 02:12

Reported

2024-06-14 02:15

Platform

win7-20240220-en

Max time kernel

150s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\9a4c7160bfaf6f401fe670e344bb3d00_NeikiAnalytics.exe"

Signatures

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" \??\c:\windows\system\explorer.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\system\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\system\svchost.exe N/A

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\svchost.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} \??\c:\windows\system\svchost.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\explorer.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\svchost.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\spoolsv.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\spoolsv.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" \??\c:\windows\system\svchost.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification \??\c:\windows\system\explorer.exe C:\Users\Admin\AppData\Local\Temp\9a4c7160bfaf6f401fe670e344bb3d00_NeikiAnalytics.exe N/A
File opened for modification \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\explorer.exe N/A
File opened for modification \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe N/A
File opened for modification \??\c:\windows\system\explorer.exe \??\c:\windows\system\explorer.exe N/A
File opened for modification \??\c:\windows\system\svchost.exe \??\c:\windows\system\svchost.exe N/A
File opened for modification C:\Windows\system\udsys.exe \??\c:\windows\system\explorer.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\9a4c7160bfaf6f401fe670e344bb3d00_NeikiAnalytics.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2000 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\9a4c7160bfaf6f401fe670e344bb3d00_NeikiAnalytics.exe \??\c:\windows\system\explorer.exe
PID 2000 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\9a4c7160bfaf6f401fe670e344bb3d00_NeikiAnalytics.exe \??\c:\windows\system\explorer.exe
PID 2000 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\9a4c7160bfaf6f401fe670e344bb3d00_NeikiAnalytics.exe \??\c:\windows\system\explorer.exe
PID 2000 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\9a4c7160bfaf6f401fe670e344bb3d00_NeikiAnalytics.exe \??\c:\windows\system\explorer.exe
PID 2516 wrote to memory of 2636 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 2516 wrote to memory of 2636 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 2516 wrote to memory of 2636 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 2516 wrote to memory of 2636 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 2636 wrote to memory of 2412 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 2636 wrote to memory of 2412 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 2636 wrote to memory of 2412 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 2636 wrote to memory of 2412 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 2412 wrote to memory of 2444 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 2412 wrote to memory of 2444 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 2412 wrote to memory of 2444 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 2412 wrote to memory of 2444 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 2412 wrote to memory of 2548 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2412 wrote to memory of 2548 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2412 wrote to memory of 2548 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2412 wrote to memory of 2548 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2412 wrote to memory of 1624 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2412 wrote to memory of 1624 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2412 wrote to memory of 1624 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2412 wrote to memory of 1624 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2412 wrote to memory of 652 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2412 wrote to memory of 652 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2412 wrote to memory of 652 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2412 wrote to memory of 652 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe

Processes

C:\Users\Admin\AppData\Local\Temp\9a4c7160bfaf6f401fe670e344bb3d00_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\9a4c7160bfaf6f401fe670e344bb3d00_NeikiAnalytics.exe"

\??\c:\windows\system\explorer.exe

c:\windows\system\explorer.exe

\??\c:\windows\system\spoolsv.exe

c:\windows\system\spoolsv.exe SE

\??\c:\windows\system\svchost.exe

c:\windows\system\svchost.exe

\??\c:\windows\system\spoolsv.exe

c:\windows\system\spoolsv.exe PR

C:\Windows\SysWOW64\at.exe

at 02:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

C:\Windows\SysWOW64\at.exe

at 02:15 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

C:\Windows\SysWOW64\at.exe

at 02:16 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

Network

N/A

Files

memory/2000-1-0x0000000000020000-0x0000000000024000-memory.dmp

memory/2000-0-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2000-3-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2000-2-0x0000000072940000-0x0000000072A93000-memory.dmp

memory/2000-5-0x0000000000401000-0x000000000042E000-memory.dmp

\Windows\system\explorer.exe

MD5 969a46fec143202e023fabd52637c9bc
SHA1 8d7c7f73c6db4468b6ea307519de971f7b01197d
SHA256 846e4b70d3ea2b1c88637bc8f60400fb52fa0abe841bf8e45ad8cd6682023c43
SHA512 9f793cf96aa8e121a966760d19d9135efa3b6da3c3b5293625e693bd9b3c37f3edf2c9a96af0693a9191c41c2c5badffb0ac8b61afdb0bbf003450f8226dc2f4

memory/2516-17-0x0000000072940000-0x0000000072A93000-memory.dmp

memory/2000-19-0x0000000002870000-0x00000000028A1000-memory.dmp

memory/2516-21-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2000-20-0x0000000002870000-0x00000000028A1000-memory.dmp

\Windows\system\spoolsv.exe

MD5 b3635b306f4817846bc8d84ff2610bda
SHA1 9f4bd2ef422d03dc0b517c14afe1d5796768db42
SHA256 baa9f437e445bdd958f669632147e7fc5b9d895908ac49fd235f686b01f61779
SHA512 443c224f2f66ebc1b39e25b9ab31a6221687cab2da189d2276807f122c7e873ab96b373135728f9959b944f4b8c108d37aa851130630e8beed995cd91bf732d0

memory/2636-35-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2636-36-0x0000000072940000-0x0000000072A93000-memory.dmp

memory/2636-41-0x0000000000400000-0x0000000000431000-memory.dmp

\Windows\system\svchost.exe

MD5 714255d824e1e6c66095093eba286e03
SHA1 c05dde68b43a69680b92991a9b717b01d6c6ef78
SHA256 2fd69be63a3d1fadcc7e8db5b841672fc0537dbc9f94c6b30e6605df50a193ac
SHA512 086549cf19ced42582e6d102a53b75118bd025995c3b548a4502b9db80b3e31bcaea2dc855de188738be04cd3f8f04f6bbdf594af0b85686258d3252fc428687

memory/2412-52-0x0000000072940000-0x0000000072A93000-memory.dmp

memory/2412-58-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2412-57-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2444-63-0x0000000072940000-0x0000000072A93000-memory.dmp

memory/2444-68-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2000-74-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2636-72-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2000-76-0x0000000000401000-0x000000000042E000-memory.dmp

memory/2000-75-0x0000000000020000-0x0000000000024000-memory.dmp

C:\Users\Admin\AppData\Roaming\mrsys.exe

MD5 d3d29e127a86415c238c866d9c448bb5
SHA1 f552e92b8736940019827b87abe01e87e91cb022
SHA256 9626c2a5ae50883ba105c8f8a8acee7b6653b724961d000e901f25ef5c71ac08
SHA512 06c90e4b9a0ca1667f8f1e3deb7b5d30924ae8d21db16e57254a526e6cc796ce76c81b79c953cd9768eeae9bddad3f4bace9217e42c89f2a7a55e3e772e9bbf4

memory/2516-78-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2412-80-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2516-89-0x0000000000400000-0x0000000000431000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-14 02:12

Reported

2024-06-14 02:15

Platform

win10v2004-20240226-en

Max time kernel

151s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\9a4c7160bfaf6f401fe670e344bb3d00_NeikiAnalytics.exe"

Signatures

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" \??\c:\windows\system\svchost.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\system\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\system\svchost.exe N/A

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\svchost.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\svchost.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} \??\c:\windows\system\svchost.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\explorer.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\spoolsv.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\spoolsv.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" \??\c:\windows\system\svchost.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe N/A
File opened for modification \??\c:\windows\system\explorer.exe \??\c:\windows\system\explorer.exe N/A
File opened for modification \??\c:\windows\system\svchost.exe \??\c:\windows\system\svchost.exe N/A
File opened for modification C:\Windows\system\udsys.exe \??\c:\windows\system\explorer.exe N/A
File opened for modification \??\c:\windows\system\explorer.exe C:\Users\Admin\AppData\Local\Temp\9a4c7160bfaf6f401fe670e344bb3d00_NeikiAnalytics.exe N/A
File opened for modification \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\explorer.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\9a4c7160bfaf6f401fe670e344bb3d00_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9a4c7160bfaf6f401fe670e344bb3d00_NeikiAnalytics.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3604 wrote to memory of 3012 N/A C:\Users\Admin\AppData\Local\Temp\9a4c7160bfaf6f401fe670e344bb3d00_NeikiAnalytics.exe \??\c:\windows\system\explorer.exe
PID 3604 wrote to memory of 3012 N/A C:\Users\Admin\AppData\Local\Temp\9a4c7160bfaf6f401fe670e344bb3d00_NeikiAnalytics.exe \??\c:\windows\system\explorer.exe
PID 3604 wrote to memory of 3012 N/A C:\Users\Admin\AppData\Local\Temp\9a4c7160bfaf6f401fe670e344bb3d00_NeikiAnalytics.exe \??\c:\windows\system\explorer.exe
PID 3012 wrote to memory of 1884 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 3012 wrote to memory of 1884 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 3012 wrote to memory of 1884 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 1884 wrote to memory of 1768 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 1884 wrote to memory of 1768 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 1884 wrote to memory of 1768 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 1768 wrote to memory of 3724 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 1768 wrote to memory of 3724 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 1768 wrote to memory of 3724 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 1768 wrote to memory of 3448 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 1768 wrote to memory of 3448 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 1768 wrote to memory of 3448 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 1768 wrote to memory of 2152 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 1768 wrote to memory of 2152 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 1768 wrote to memory of 2152 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 1768 wrote to memory of 4568 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 1768 wrote to memory of 4568 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 1768 wrote to memory of 4568 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe

Processes

C:\Users\Admin\AppData\Local\Temp\9a4c7160bfaf6f401fe670e344bb3d00_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\9a4c7160bfaf6f401fe670e344bb3d00_NeikiAnalytics.exe"

\??\c:\windows\system\explorer.exe

c:\windows\system\explorer.exe

\??\c:\windows\system\spoolsv.exe

c:\windows\system\spoolsv.exe SE

\??\c:\windows\system\svchost.exe

c:\windows\system\svchost.exe

\??\c:\windows\system\spoolsv.exe

c:\windows\system\spoolsv.exe PR

C:\Windows\SysWOW64\at.exe

at 02:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4036 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:8

C:\Windows\SysWOW64\at.exe

at 02:15 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

C:\Windows\SysWOW64\at.exe

at 02:16 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
GB 96.16.110.114:80 tcp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 13.107.253.64:443 tcp
US 8.8.8.8:53 159.113.53.23.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
GB 216.58.212.234:443 chromewebstore.googleapis.com tcp
US 8.8.8.8:53 234.212.58.216.in-addr.arpa udp
US 8.8.8.8:53 199.111.78.13.in-addr.arpa udp

Files

memory/3604-0-0x0000000000400000-0x0000000000431000-memory.dmp

memory/3604-1-0x00000000001C0000-0x00000000001C4000-memory.dmp

memory/3604-3-0x0000000000400000-0x0000000000431000-memory.dmp

memory/3604-2-0x0000000075520000-0x000000007567D000-memory.dmp

memory/3604-4-0x0000000000401000-0x000000000042E000-memory.dmp

C:\Windows\System\explorer.exe

MD5 70ff2ffc60ef4e55b391e09c5ebebcac
SHA1 940a56d05d4edb44d539c076e7c95ea27ecabe1d
SHA256 3b5bc6618c11494d8a581c7bf48e79e8abd4db628e5a464978a7b7ace6e412c4
SHA512 83dee608fc09fbbdd1ba0c7d26a23c85ea6ced251d3683731af6a5a9e988815eb63cc7f7ac7677c107efef947df06308a58bbe2d618bc46b2cf833ed88bcfb97

memory/3012-13-0x0000000000400000-0x0000000000431000-memory.dmp

memory/3012-16-0x0000000000400000-0x0000000000431000-memory.dmp

memory/3012-14-0x0000000075520000-0x000000007567D000-memory.dmp

C:\Windows\System\spoolsv.exe

MD5 a9daa9feac887ea35a5305abd0778631
SHA1 9990624ec5741e7296d265d229e705fe57cab99a
SHA256 3c1fc159529a13d408376757eb8f02bb28a3190792f3c32987cd87397a3762e6
SHA512 9c7fe95b9ce56676563c64aed8f42b8e61f28f7410237ddd14a1f2c873eacdf79b0be8dc6478ea49b063db23f5091fff755f8b7bb22721a491875b66778804f5

memory/1884-25-0x0000000000400000-0x0000000000431000-memory.dmp

memory/1884-26-0x0000000075520000-0x000000007567D000-memory.dmp

memory/1884-31-0x0000000000400000-0x0000000000431000-memory.dmp

\??\c:\windows\system\svchost.exe

MD5 cbef1234bc530e9fd250b4202659e9dd
SHA1 e8067359ebcf352aebd0319290a269b4252841b4
SHA256 6427e05ba3bbb4a194cede3dca49f0be65e5efa0610784735b34a1983cf1e72a
SHA512 adc063ba3d8d0fb96fd9425260589ed7c1857a266dc66ca3322a4e22211aac5a4eb3d927322c0d20237eff5c5ca74a2800004cba76ce08afa1448c49edc080f0

memory/1768-37-0x0000000075520000-0x000000007567D000-memory.dmp

memory/1768-42-0x0000000000400000-0x0000000000431000-memory.dmp

memory/3604-41-0x00000000001C0000-0x00000000001C4000-memory.dmp

memory/3604-45-0x0000000000401000-0x000000000042E000-memory.dmp

memory/3724-46-0x0000000075520000-0x000000007567D000-memory.dmp

memory/3724-51-0x0000000000400000-0x0000000000431000-memory.dmp

memory/1884-54-0x0000000000400000-0x0000000000431000-memory.dmp

memory/3604-57-0x0000000000401000-0x000000000042E000-memory.dmp

memory/3604-56-0x0000000000400000-0x0000000000431000-memory.dmp

C:\Users\Admin\AppData\Roaming\mrsys.exe

MD5 b073bca2ee17dc16c856f0196229a9fc
SHA1 4b6caa4c53080022144e0c0626545098f8904eed
SHA256 f6f96c49e162e8d9ef735240ed4f7bd221178e9c0f81bd7d1188d223d44623a5
SHA512 1e00cd520ac0b37add806c51dc54dc0fc727ec57bae1ed3042e0a1f68c374ba7872bfa86c528df4401bb50131d751db4eeef506e7685f285b5f61ac5b8cd2dae

memory/3012-59-0x0000000000400000-0x0000000000431000-memory.dmp

memory/1768-61-0x0000000000400000-0x0000000000431000-memory.dmp

memory/3012-72-0x0000000000400000-0x0000000000431000-memory.dmp

\??\PIPE\atsvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e