Malware Analysis Report

2024-09-11 00:53

Sample ID 240614-g68w2sycka
Target a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe
SHA256 5289b24fffc10365b10bfc5ba13c397f8db13bfe2986243fa0b61ae5d1f444aa
Tags
neshta persistence spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

5289b24fffc10365b10bfc5ba13c397f8db13bfe2986243fa0b61ae5d1f444aa

Threat Level: Known bad

The file a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

neshta persistence spyware stealer

Neshta

Neshta family

Detect Neshta payload

Reads user/profile data of web browsers

Loads dropped DLL

Checks computer location settings

Modifies system executable filetype association

Executes dropped EXE

Drops file in Windows directory

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Modifies registry class

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-06-14 06:26

Signatures

Detect Neshta payload

Description Indicator Process Target
N/A N/A N/A N/A

Neshta family

neshta

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-14 06:26

Reported

2024-06-14 06:28

Platform

win7-20240611-en

Max time kernel

120s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe"

Signatures

Detect Neshta payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Neshta

persistence spyware neshta

Modifies system executable filetype association

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1876 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\3582-490\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe
PID 1876 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\3582-490\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe
PID 1876 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\3582-490\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe
PID 1876 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\3582-490\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe
PID 2516 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\nsdE44.tmp\AMDBugReportForm.exe
PID 2516 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\nsdE44.tmp\AMDBugReportForm.exe
PID 2516 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\nsdE44.tmp\AMDBugReportForm.exe
PID 2516 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\nsdE44.tmp\AMDBugReportForm.exe
PID 2624 wrote to memory of 356 N/A C:\Users\Admin\AppData\Local\Temp\nsdE44.tmp\AMDBugReportForm.exe C:\Windows\system32\cmd.exe
PID 2624 wrote to memory of 356 N/A C:\Users\Admin\AppData\Local\Temp\nsdE44.tmp\AMDBugReportForm.exe C:\Windows\system32\cmd.exe
PID 2624 wrote to memory of 356 N/A C:\Users\Admin\AppData\Local\Temp\nsdE44.tmp\AMDBugReportForm.exe C:\Windows\system32\cmd.exe
PID 356 wrote to memory of 1016 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 356 wrote to memory of 1016 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 356 wrote to memory of 1016 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

Processes

C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\3582-490\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\3582-490\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\nsdE44.tmp\AMDBugReportForm.exe

"C:\Users\Admin\AppData\Local\Temp\nsdE44.tmp\AMDBugReportForm.exe" "C:\Users\Admin\AppData\Local\Temp\3582-490\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe"

C:\Windows\system32\cmd.exe

"cmd" /c C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe "Get-AppxPackage -name AdvancedMicroDevicesInc-2.AMDLink | Select InstallLocation | format-table -autosize"

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe "Get-AppxPackage -name AdvancedMicroDevicesInc-2.AMDLink | Select InstallLocation | format-table -autosize"

Network

N/A

Files

\Users\Admin\AppData\Local\Temp\3582-490\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe

MD5 fe05ca8cb8b519d39ed8392f4f8326d7
SHA1 9a09122b8084d019569c4ef25988aecd44d7d50c
SHA256 725c07db303ef21ad9479520f95da8b0c1d80aee4223bc8329d00f2962c88411
SHA512 05719d6992d2400338349d753efcb5d75e89c5026c1da40b3c3fccd85331088391fb71ba882bef7c2daeb52a09a12d03a895298e6ca0aa6f0f7d871a8ad5686b

C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe

MD5 cf6c595d3e5e9667667af096762fd9c4
SHA1 9bb44da8d7f6457099cb56e4f7d1026963dce7ce
SHA256 593e60cc30ae0789448547195af77f550387f6648d45847ea244dd0dd7abf03d
SHA512 ff4f789df9e6a6d0fbe12b3250f951fcf11e857906c65e96a30bb46266e7e1180d6103a03db2f3764e0d1346b2de7afba8259ba080057e4a268e45e8654dfa80

\Users\Admin\AppData\Local\Temp\nsdE44.tmp\AMDBugReportForm.exe

MD5 93bab554abfa0f0ca0ceb2b79dcc051d
SHA1 b7ed4cafd427cf5f3931f1e579264f5285076a9c
SHA256 d6f3eb2608ec88728baf99189ad7db3cc4ce2b79f07193995bfcec65a752ea6b
SHA512 d5c785a3eaae57e8a4d7be66298bb3ccd3e9d41ea48e74ffeff26e019baa4b0c46378b0059424b766accf4955b69c169ca603792613406a7492f3469667d6d41

memory/2624-69-0x000007FEF5523000-0x000007FEF5524000-memory.dmp

memory/2624-70-0x000000013FB80000-0x000000013FCB6000-memory.dmp

memory/2624-71-0x000000001B870000-0x000000001B940000-memory.dmp

\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE

MD5 9e2b9928c89a9d0da1d3e8f4bd96afa7
SHA1 ec66cda99f44b62470c6930e5afda061579cde35
SHA256 8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043
SHA512 2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

memory/2624-77-0x000007FEF5520000-0x000007FEF5F0C000-memory.dmp

memory/1016-151-0x000000001B6C0000-0x000000001B9A2000-memory.dmp

memory/1016-152-0x0000000001F40000-0x0000000001F48000-memory.dmp

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

MD5 3ec4922dbca2d07815cf28144193ded9
SHA1 75cda36469743fbc292da2684e76a26473f04a6d
SHA256 0587fd366ea7e94b3ae500874b1c5d684b5357fcc7389682d5a13c3301a28801
SHA512 956c3a1f2689cb72600edd2e90d652b77592a8a81d319dce026e88f6c02231af06aebd57d68460eb406de00c113522173423cb1b339a41a3918f379c7dc311f7

C:\Program Files (x86)\Microsoft Office\Office14\INFOPATH.EXE

MD5 33cb3cf0d9917a68f54802460cbbc452
SHA1 4f2e4447fabee92be16806f33983bb71e921792b
SHA256 1230b2032d2d35a55cd86d1215eb38fa18bcf590c3c19b9ac4dda5350c24e10a
SHA512 851f0a098020cb1da3f5f48febce3b9eaef3b885df9134b3fb6b364f3a7572a8c516456710a15f66f0a44eff59cfa50f2dc8bb5d274e5c093294b2ea96fd49cb

C:\Program Files (x86)\Microsoft Office\Office14\ONENOTE.EXE

MD5 08ee3d1a6a5ed48057783b0771abbbea
SHA1 ebf911c5899f611b490e2792695924df1c69117d
SHA256 3f6decd82b72a5ba1ee224b52d9fbd6486be22a0b855e28eaad47ae92df266f0
SHA512 1711d023c60d4b047d553a654797bc3a2eecd951b310698c1a2c549e136c33f55e0fc1167a4a38f793b7796f7cfc3fb30017935127b147a21da2812eb38faac5

C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE

MD5 6b63036a88f260b7a08da9814cf17ce0
SHA1 cac1bd549343a1c3fcefacc2d588155a00c4467b
SHA256 8f9fb3c2ce132a64e157738feaf82bb512ec03d03fa2da95c26470defeef513d
SHA512 383b8676a85e0f2447536bd15019c23bed15a51d633dafe5ac7bcbea75d8064ef9fd938461eab25df7f3eae3de18b87640e8cc12e95f7b58de1209937d8da284

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE

MD5 5ae9c0c497949584ffa06f028a6605ab
SHA1 eb24dbd3c8952ee20411691326d650f98d24e992
SHA256 07dd9364be7babc5f9a08f0ccd828a9a55137845df1782b147f12943f234ea4e
SHA512 2e99bb500c281c367cc54fa283905b2537905ea4fe8986f676adbb1aaf58460dd2db082bb46a3dbe9dc836fbae3ee8832990839432dd99c74de58cc9b9295788

C:\Program Files (x86)\Microsoft Office\Office14\MSTORE.EXE

MD5 a2dddf04b395f8a08f12001318cc72a4
SHA1 1bd72e6e9230d94f07297c6fcde3d7f752563198
SHA256 b35e60f1551870c1281d673380fe3101cd91b1f0b4d3c14c2383060f5e120373
SHA512 2159df98d90467720b738be68bee5aba38980d2449c18d2ea4b7b9bae7d222b4a85845d0f9597017d0ee417964190bc3d95cb4809e33aac16b6cfa6ec200dce3

C:\Program Files (x86)\Microsoft Office\Office14\OIS.EXE

MD5 4545e2b5fa4062259d5ddd56ecbbd386
SHA1 c021dc8488a73bd364cb98758559fe7ba1337263
SHA256 318f1f3fbdd1cf17c176cb68b4bc2cf899338186161a16a1adc29426114fb4f8
SHA512 cf07436e0219ca5868e11046f2a497583066a9cf68262e7cca22daad72aded665ac66afea8db76182c172041c45fcef1628ea6852751c4bf97969c9af6cfefa1

memory/1876-160-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1876-162-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2624-163-0x000007FEF5523000-0x000007FEF5524000-memory.dmp

memory/2624-164-0x000007FEF5520000-0x000007FEF5F0C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-14 06:26

Reported

2024-06-14 06:28

Platform

win10v2004-20240508-en

Max time kernel

52s

Max time network

51s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe"

Signatures

Detect Neshta payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Neshta

persistence spyware neshta

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmprph.exe C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.37\MI391D~1.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13187~1.37\MICROS~1.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\setup_wm.exe C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{D87AE~1\WINDOW~1.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.37\MI9C33~1.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.37\MICROS~1.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.37\MICROS~2.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\WI8A19~1\ImagingDevices.exe C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.37\MICROS~3.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.37\MIA062~1.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.37\MICROS~4.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~2\wab.exe C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmlaunch.exe C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ExtExport.exe C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4388 wrote to memory of 3112 N/A C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\3582-490\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe
PID 4388 wrote to memory of 3112 N/A C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\3582-490\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe
PID 4388 wrote to memory of 3112 N/A C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\3582-490\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe
PID 3112 wrote to memory of 3520 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\nss4D75.tmp\AMDBugReportForm.exe
PID 3112 wrote to memory of 3520 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\nss4D75.tmp\AMDBugReportForm.exe
PID 3520 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\nss4D75.tmp\AMDBugReportForm.exe C:\Windows\SYSTEM32\cmd.exe
PID 3520 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\nss4D75.tmp\AMDBugReportForm.exe C:\Windows\SYSTEM32\cmd.exe
PID 2352 wrote to memory of 1044 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 2352 wrote to memory of 1044 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

Processes

C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\3582-490\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\3582-490\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\nss4D75.tmp\AMDBugReportForm.exe

"C:\Users\Admin\AppData\Local\Temp\nss4D75.tmp\AMDBugReportForm.exe" "C:\Users\Admin\AppData\Local\Temp\3582-490\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe"

C:\Windows\SYSTEM32\cmd.exe

"cmd" /c C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe "Get-AppxPackage -name AdvancedMicroDevicesInc-2.AMDLink | Select InstallLocation | format-table -autosize"

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe "Get-AppxPackage -name AdvancedMicroDevicesInc-2.AMDLink | Select InstallLocation | format-table -autosize"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\3582-490\a92fe2b3d0a9f61951fe5b7c7d2bfd20_NeikiAnalytics.exe

MD5 fe05ca8cb8b519d39ed8392f4f8326d7
SHA1 9a09122b8084d019569c4ef25988aecd44d7d50c
SHA256 725c07db303ef21ad9479520f95da8b0c1d80aee4223bc8329d00f2962c88411
SHA512 05719d6992d2400338349d753efcb5d75e89c5026c1da40b3c3fccd85331088391fb71ba882bef7c2daeb52a09a12d03a895298e6ca0aa6f0f7d871a8ad5686b

C:\Users\Admin\AppData\Local\Temp\nss4D75.tmp\AMDBugReportForm.exe

MD5 93bab554abfa0f0ca0ceb2b79dcc051d
SHA1 b7ed4cafd427cf5f3931f1e579264f5285076a9c
SHA256 d6f3eb2608ec88728baf99189ad7db3cc4ce2b79f07193995bfcec65a752ea6b
SHA512 d5c785a3eaae57e8a4d7be66298bb3ccd3e9d41ea48e74ffeff26e019baa4b0c46378b0059424b766accf4955b69c169ca603792613406a7492f3469667d6d41

memory/3520-65-0x00007FFE80DA3000-0x00007FFE80DA5000-memory.dmp

memory/3520-66-0x0000027A53F40000-0x0000027A54076000-memory.dmp

memory/3520-67-0x0000027A55CF0000-0x0000027A55DC0000-memory.dmp

memory/3520-68-0x00007FFE80DA0000-0x00007FFE81861000-memory.dmp

memory/3520-69-0x0000027A6EA10000-0x0000027A6EA22000-memory.dmp

memory/3520-70-0x00007FFE80DA0000-0x00007FFE81861000-memory.dmp

C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE

MD5 3b73078a714bf61d1c19ebc3afc0e454
SHA1 9abeabd74613a2f533e2244c9ee6f967188e4e7e
SHA256 ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29
SHA512 75959d4e8a7649c3268b551a2a378e6d27c0bfb03d2422ebeeb67b0a3f78c079473214057518930f2d72773ce79b106fd2d78405e8e3d8883459dcbb49c163c4

memory/3520-85-0x00007FFE80DA0000-0x00007FFE81861000-memory.dmp

memory/1044-86-0x000002ADC2FF0000-0x000002ADC3012000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5aelul1o.ywe.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/1044-145-0x000002ADC3040000-0x000002ADC3056000-memory.dmp

memory/1044-146-0x000002ADC3060000-0x000002ADC306A000-memory.dmp

memory/1044-147-0x000002ADDB520000-0x000002ADDB546000-memory.dmp

memory/3520-156-0x0000027A71790000-0x0000027A71806000-memory.dmp

memory/3520-162-0x0000027A71A60000-0x0000027A71A7E000-memory.dmp

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

MD5 8ffc3bdf4a1903d9e28b99d1643fc9c7
SHA1 919ba8594db0ae245a8abd80f9f3698826fc6fe5
SHA256 8268d3fefe8ca96a25a73690d14bacf644170ab5e9e70d2f8eeb350a4c83f9f6
SHA512 0b94ead97374d74eaee87e7614ddd3911d2cf66d4c49abbfd06b02c03e5dd56fd00993b4947e8a4bcd9d891fa39cab18cc6b61efc7d0812e91eb3aea9cd1a427

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

MD5 5119e350591269f44f732b470024bb7c
SHA1 4ccd48e4c6ba6e162d1520760ee3063e93e2c014
SHA256 2b3aa9642b291932ba7f9f3d85221402a9d27078f56ef0e9c6bca633616e3873
SHA512 599b4ec673169d42a348d1117737b4ad4d7539574153df5a5c7689130c9ac5ff5cd00f3c8ec39adf32ff2b56be074081efcabb6456272c649703c3ea6cdaded4

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe

MD5 3a3a71a5df2d162555fcda9bc0993d74
SHA1 95c7400f85325eba9b0a92abd80ea64b76917a1a
SHA256 0a023355d1cc0a2348475d63aaf6aa0521d11e12a5c70102d7b3ebde092849e8
SHA512 9ad76ccce76ccfe8292bca8def5bc7255e7ea0ba6d92130c4350da49a3d7faef2d46b08aaef1955f3f4ea0a2e22451562b5e08783a79f794724584e409cf7837

memory/4388-179-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4388-180-0x0000000000400000-0x000000000041B000-memory.dmp

memory/3520-181-0x00007FFE80DA3000-0x00007FFE80DA5000-memory.dmp

memory/3520-182-0x00007FFE80DA0000-0x00007FFE81861000-memory.dmp

memory/3520-183-0x00007FFE80DA0000-0x00007FFE81861000-memory.dmp

memory/4388-185-0x0000000000400000-0x000000000041B000-memory.dmp