Malware Analysis Report

2024-09-11 12:17

Sample ID 240617-nqhhgsyeph
Target 8578d5b49e77b239468fc1aed1eba560_NeikiAnalytics.exe
SHA256 1440803a96ffa06c71368fbc4c9b550bed0861aa91993cbeb0650e6a11d440ac
Tags
sality backdoor evasion persistence trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

1440803a96ffa06c71368fbc4c9b550bed0861aa91993cbeb0650e6a11d440ac

Threat Level: Known bad

The file 8578d5b49e77b239468fc1aed1eba560_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

sality backdoor evasion persistence trojan upx

UAC bypass

Modifies visibility of file extensions in Explorer

Modifies visiblity of hidden/system files in Explorer

Sality

Executes dropped EXE

Loads dropped DLL

UPX packed file

Checks computer location settings

Enumerates connected drives

Checks whether UAC is enabled

Adds Run key to start application

Drops file in Program Files directory

Drops file in Windows directory

Program crash

Enumerates physical storage devices

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

System policy modification

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Privilege Escalation
TA0004
Abuse Elevation Control Mechanism
T1548
Bypass User Account Control
T1548.002
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Defense Evasion
TA0005
Hide Artifacts
T1564
Hidden Files and Directories
T1564.001
Modify Registry
T1112
Abuse Elevation Control Mechanism
T1548
Bypass User Account Control
T1548.002
Impair Defenses
T1562
Disable or Modify Tools
T1562.001
Credential Access
TA0006
Discovery
TA0007
Query Registry
T1012
System Information Discovery
T1082
Peripheral Device Discovery
T1120
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-17 11:35

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-17 11:35

Reported

2024-06-17 11:38

Platform

win10v2004-20240611-en

Max time kernel

22s

Max time network

150s

Command Line

"fontdrvhost.exe"

Signatures

Modifies visibility of file extensions in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Users\Admin\AppData\Local\Temp\8578d5b49e77b239468fc1aed1eba560_NeikiAnalytics.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Users\Admin\AppData\Local\Temp\8578d5b49e77b239468fc1aed1eba560_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A

Sality

backdoor sality

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Roaming\Admin\WdExt.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\Admin\kb50145.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\Admin\WdExt.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\Admin\module_launcher.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8578d5b49e77b239468fc1aed1eba560_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Admin\WdExt.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Admin\module_launcher.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Admin\kb50145.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\injector_s.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Admin\WdExt.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Office\\rundll32.exe" C:\Users\Admin\AppData\Local\Temp\8578d5b49e77b239468fc1aed1eba560_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Defender Extension = "\"C:\\Users\\Admin\\AppData\\Roaming\\Admin\\module_launcher.exe\"" C:\Users\Admin\AppData\Roaming\Admin\module_launcher.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Roaming\Admin\WdExt.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\B: C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\SYSTEM.INI C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8578d5b49e77b239468fc1aed1eba560_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8578d5b49e77b239468fc1aed1eba560_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Admin\WdExt.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Admin\WdExt.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Admin\WdExt.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Admin\WdExt.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Admin\module_launcher.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Admin\module_launcher.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Admin\module_launcher.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Admin\module_launcher.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Admin\module_launcher.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Admin\module_launcher.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Admin\module_launcher.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Admin\module_launcher.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\8578d5b49e77b239468fc1aed1eba560_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3908 wrote to memory of 4144 N/A C:\Users\Admin\AppData\Local\Temp\8578d5b49e77b239468fc1aed1eba560_NeikiAnalytics.exe C:\Windows\SysWOW64\explorer.exe
PID 3908 wrote to memory of 4144 N/A C:\Users\Admin\AppData\Local\Temp\8578d5b49e77b239468fc1aed1eba560_NeikiAnalytics.exe C:\Windows\SysWOW64\explorer.exe
PID 3908 wrote to memory of 4144 N/A C:\Users\Admin\AppData\Local\Temp\8578d5b49e77b239468fc1aed1eba560_NeikiAnalytics.exe C:\Windows\SysWOW64\explorer.exe
PID 3908 wrote to memory of 4144 N/A C:\Users\Admin\AppData\Local\Temp\8578d5b49e77b239468fc1aed1eba560_NeikiAnalytics.exe C:\Windows\SysWOW64\explorer.exe
PID 3908 wrote to memory of 4144 N/A C:\Users\Admin\AppData\Local\Temp\8578d5b49e77b239468fc1aed1eba560_NeikiAnalytics.exe C:\Windows\SysWOW64\explorer.exe
PID 4144 wrote to memory of 1148 N/A C:\Windows\SysWOW64\explorer.exe C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe
PID 4144 wrote to memory of 1148 N/A C:\Windows\SysWOW64\explorer.exe C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe
PID 4144 wrote to memory of 1148 N/A C:\Windows\SysWOW64\explorer.exe C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe
PID 4144 wrote to memory of 1640 N/A C:\Windows\SysWOW64\explorer.exe C:\Users\Admin\AppData\Local\Temp\8578d5b49e77b239468fc1aed1eba560_NeikiAnalytics.exe
PID 4144 wrote to memory of 1640 N/A C:\Windows\SysWOW64\explorer.exe C:\Users\Admin\AppData\Local\Temp\8578d5b49e77b239468fc1aed1eba560_NeikiAnalytics.exe
PID 4144 wrote to memory of 1640 N/A C:\Windows\SysWOW64\explorer.exe C:\Users\Admin\AppData\Local\Temp\8578d5b49e77b239468fc1aed1eba560_NeikiAnalytics.exe
PID 1148 wrote to memory of 792 N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe C:\Windows\system32\fontdrvhost.exe
PID 1148 wrote to memory of 800 N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe C:\Windows\system32\fontdrvhost.exe
PID 1148 wrote to memory of 64 N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe C:\Windows\system32\dwm.exe
PID 1148 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe C:\Windows\system32\sihost.exe
PID 1148 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe C:\Windows\system32\svchost.exe
PID 1148 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe C:\Windows\system32\taskhostw.exe
PID 1148 wrote to memory of 3384 N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe C:\Windows\Explorer.EXE
PID 1148 wrote to memory of 3544 N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe C:\Windows\system32\svchost.exe
PID 1148 wrote to memory of 3736 N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe C:\Windows\system32\DllHost.exe
PID 1148 wrote to memory of 3828 N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 1148 wrote to memory of 3928 N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe C:\Windows\System32\RuntimeBroker.exe
PID 1148 wrote to memory of 4012 N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 1148 wrote to memory of 3768 N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe C:\Windows\System32\RuntimeBroker.exe
PID 1148 wrote to memory of 4328 N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe C:\Windows\System32\RuntimeBroker.exe
PID 1148 wrote to memory of 404 N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 1148 wrote to memory of 832 N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe C:\Windows\system32\backgroundTaskHost.exe
PID 1148 wrote to memory of 2380 N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe C:\Windows\system32\backgroundTaskHost.exe
PID 1148 wrote to memory of 4144 N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe C:\Windows\SysWOW64\explorer.exe
PID 1148 wrote to memory of 1640 N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe C:\Users\Admin\AppData\Local\Temp\8578d5b49e77b239468fc1aed1eba560_NeikiAnalytics.exe
PID 1148 wrote to memory of 1640 N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe C:\Users\Admin\AppData\Local\Temp\8578d5b49e77b239468fc1aed1eba560_NeikiAnalytics.exe
PID 1148 wrote to memory of 4588 N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe C:\Windows\SysWOW64\cmd.exe
PID 1148 wrote to memory of 4588 N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe C:\Windows\SysWOW64\cmd.exe
PID 1148 wrote to memory of 4588 N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe C:\Windows\SysWOW64\cmd.exe
PID 1148 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe C:\Windows\SysWOW64\cmd.exe
PID 1148 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe C:\Windows\SysWOW64\cmd.exe
PID 1148 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe C:\Windows\SysWOW64\cmd.exe
PID 4588 wrote to memory of 4976 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Admin\WdExt.exe
PID 4588 wrote to memory of 4976 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Admin\WdExt.exe
PID 4588 wrote to memory of 4976 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Admin\WdExt.exe
PID 4976 wrote to memory of 792 N/A C:\Users\Admin\AppData\Roaming\Admin\WdExt.exe C:\Windows\system32\fontdrvhost.exe
PID 4976 wrote to memory of 800 N/A C:\Users\Admin\AppData\Roaming\Admin\WdExt.exe C:\Windows\system32\fontdrvhost.exe
PID 4976 wrote to memory of 64 N/A C:\Users\Admin\AppData\Roaming\Admin\WdExt.exe C:\Windows\system32\dwm.exe
PID 4976 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Roaming\Admin\WdExt.exe C:\Windows\system32\sihost.exe
PID 4976 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Roaming\Admin\WdExt.exe C:\Windows\system32\svchost.exe
PID 4976 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Roaming\Admin\WdExt.exe C:\Windows\system32\taskhostw.exe
PID 4976 wrote to memory of 3384 N/A C:\Users\Admin\AppData\Roaming\Admin\WdExt.exe C:\Windows\Explorer.EXE
PID 4976 wrote to memory of 3544 N/A C:\Users\Admin\AppData\Roaming\Admin\WdExt.exe C:\Windows\system32\svchost.exe
PID 4976 wrote to memory of 3736 N/A C:\Users\Admin\AppData\Roaming\Admin\WdExt.exe C:\Windows\system32\DllHost.exe
PID 4976 wrote to memory of 3828 N/A C:\Users\Admin\AppData\Roaming\Admin\WdExt.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 4976 wrote to memory of 3928 N/A C:\Users\Admin\AppData\Roaming\Admin\WdExt.exe C:\Windows\System32\RuntimeBroker.exe
PID 4976 wrote to memory of 4012 N/A C:\Users\Admin\AppData\Roaming\Admin\WdExt.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 4976 wrote to memory of 3768 N/A C:\Users\Admin\AppData\Roaming\Admin\WdExt.exe C:\Windows\System32\RuntimeBroker.exe
PID 4976 wrote to memory of 4328 N/A C:\Users\Admin\AppData\Roaming\Admin\WdExt.exe C:\Windows\System32\RuntimeBroker.exe
PID 4976 wrote to memory of 404 N/A C:\Users\Admin\AppData\Roaming\Admin\WdExt.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 4976 wrote to memory of 832 N/A C:\Users\Admin\AppData\Roaming\Admin\WdExt.exe C:\Windows\system32\backgroundTaskHost.exe
PID 4976 wrote to memory of 2380 N/A C:\Users\Admin\AppData\Roaming\Admin\WdExt.exe C:\Windows\system32\backgroundTaskHost.exe
PID 4976 wrote to memory of 4160 N/A C:\Users\Admin\AppData\Roaming\Admin\WdExt.exe C:\Windows\system32\BackgroundTaskHost.exe
PID 4976 wrote to memory of 4588 N/A C:\Users\Admin\AppData\Roaming\Admin\WdExt.exe C:\Windows\SysWOW64\cmd.exe
PID 4976 wrote to memory of 4588 N/A C:\Users\Admin\AppData\Roaming\Admin\WdExt.exe C:\Windows\SysWOW64\cmd.exe
PID 4976 wrote to memory of 1864 N/A C:\Users\Admin\AppData\Roaming\Admin\WdExt.exe C:\Windows\System32\Conhost.exe
PID 4976 wrote to memory of 4932 N/A C:\Users\Admin\AppData\Roaming\Admin\WdExt.exe C:\Windows\SysWOW64\cmd.exe
PID 4976 wrote to memory of 4932 N/A C:\Users\Admin\AppData\Roaming\Admin\WdExt.exe C:\Windows\SysWOW64\cmd.exe
PID 4976 wrote to memory of 4932 N/A C:\Users\Admin\AppData\Roaming\Admin\WdExt.exe C:\Windows\SysWOW64\cmd.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Roaming\Admin\WdExt.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A

Processes

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\dwm.exe

"dwm.exe"

C:\Windows\system32\sihost.exe

sihost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

C:\Windows\system32\taskhostw.exe

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe

"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe

"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe

"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca

C:\Users\Admin\AppData\Local\Temp\8578d5b49e77b239468fc1aed1eba560_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\8578d5b49e77b239468fc1aed1eba560_NeikiAnalytics.exe"

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe

"C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe"

C:\Users\Admin\AppData\Local\Temp\8578d5b49e77b239468fc1aed1eba560_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\8578d5b49e77b239468fc1aed1eba560_NeikiAnalytics.exe"

C:\Windows\system32\BackgroundTaskHost.exe

"C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin0.bat" "

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat" "

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Users\Admin\AppData\Roaming\Admin\WdExt.exe

"C:\Users\Admin\AppData\Roaming\Admin\WdExt.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat" "

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Users\Admin\AppData\Roaming\Admin\module_launcher.exe

"C:\Users\Admin\AppData\Roaming\Admin\module_launcher.exe" /i 4976

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin2.bat" "

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe

C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Users\Admin\AppData\Roaming\Admin\kb50145.exe

"C:\Users\Admin\AppData\Roaming\Admin\kb50145.exe"

C:\Users\Admin\AppData\Roaming\injector_s.exe

"C:\Users\Admin\AppData\Roaming\injector_s.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\a0x.bat" "C:\Users\Admin\AppData\Roaming\Admin\kb50145.exe" "C:\Users\Admin\AppData\Local\Temp\a0x.bat""

Network

Country Destination Domain Proto
US 8.8.8.8:53 windowsupdate.microsoft.com udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 23.41.178.96:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 144.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 138.201.86.20.in-addr.arpa udp
US 8.8.8.8:53 96.178.41.23.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 17.14.97.104.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 226.162.46.104.in-addr.arpa udp

Files

memory/3908-0-0x0000000000400000-0x00000000004C1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\@AE5F27.tmp.exe

MD5 46329f893d9543e37c0603b01751fa81
SHA1 4acdc019085b51f8c7860ab47a09b293c385c1d9
SHA256 d594e1da162a7cd67be562c115b3f669c84040798353db154eb9f3ee305b5dab
SHA512 3493b422291f0db77f27bf5498d966ac6ebc304d292c3fbd8f108caca501c3ba4f64ad599e89e3ac15133e3843e0a6b0be043be5a992a76c09cf4cda110e89f8

C:\Users\Admin\AppData\Local\Temp\8578d5b49e77b239468fc1aed1eba560_NeikiAnalytics.exe

MD5 9887f7db7dc40ada587df7c33c42ff15
SHA1 d029cba559891ee96f15e410bc3b48b03afb92a5
SHA256 c0eac92d2eae3b0e4b24c214b9ea35e3bb267cb2a3abc0cf7cad3abe1b0b4611
SHA512 f4af32b4edce3635dac85b2867bd04e67cb3d287049e1e79c88a90f31dabaac8046a18f9ab517384de8ba7025fd24a066ccebbf68220a65039fecb32e65a779f

memory/1148-21-0x0000000000400000-0x000000000044C000-memory.dmp

memory/1148-20-0x0000000002270000-0x00000000032A0000-memory.dmp

memory/1148-23-0x0000000010000000-0x0000000010015000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\0E576169_Rar\@AE5F27.tmp.exe

MD5 8f1046ca47595761583046048791148f
SHA1 7e748ad90fd12006ad27a73de11df9bbca6722fd
SHA256 7f5df7922d82f03c8735fdc9f9cc1d787da8f1f13b1828f66aeb517422eb1e4b
SHA512 3424b17c5959678c4c5a629c8483d1fd19b78864ecdacdc7b2ef02b9a16ce1100a03e948854b2166764783e910579c6fa0e74b11d49cf72b71d75f6b6f8e0a51

C:\Users\Admin\AppData\Roaming\Temp\mydll.dll

MD5 8d7db101a7211fe3309dc4dc8cf2dd0a
SHA1 6c2781eadf53b3742d16dab2f164baf813f7ac85
SHA256 93db7c9699594caa19490280842fbebec3877278c92128b92e63d75fcd01397a
SHA512 8b139d447068519997f7bbc2c7c2fe3846b89ae1fba847258277c9ab92a93583b28fae7ffa444768929ed5852cc914c0270446cbf0bd20aca49bde6b6f809c83

memory/1148-28-0x0000000002270000-0x00000000032A0000-memory.dmp

memory/1640-286-0x0000000000400000-0x00000000004C1000-memory.dmp

memory/1148-317-0x00000000007A0000-0x00000000007A1000-memory.dmp

memory/1640-319-0x00000000032F0000-0x00000000032F1000-memory.dmp

memory/1148-316-0x0000000000790000-0x0000000000792000-memory.dmp

memory/1148-314-0x0000000002270000-0x00000000032A0000-memory.dmp

memory/1640-324-0x0000000000980000-0x0000000000982000-memory.dmp

memory/1640-325-0x0000000000980000-0x0000000000982000-memory.dmp

memory/1148-328-0x0000000000790000-0x0000000000792000-memory.dmp

memory/1148-330-0x0000000000790000-0x0000000000792000-memory.dmp

memory/1148-356-0x0000000002270000-0x00000000032A0000-memory.dmp

memory/1148-367-0x0000000000400000-0x000000000044C000-memory.dmp

C:\Users\Admin\AppData\Roaming\Temp\Admin0.bat

MD5 902a1098f800859502aec4eac3026495
SHA1 a6b209e9aa15087670e830af5de8179b31abc897
SHA256 ff5e923c453d3d61a7989b2b0f978b0bba924a7052667311c9eed54852a20cfd
SHA512 cf7f0197c78f9c7db81068fbc702596a00c5d7c8280751641965917056c0e71265a3a89f3daf6a3600faa13034b54fbedea50ea583723abbfc286f2e7e79fe77

C:\Users\Admin\AppData\Roaming\Admin\WdExt.exe

MD5 13df89033a11d6d1f9d4d2efe2ecac7b
SHA1 b3933036f1b4b82197dae195a32677de322d863a
SHA256 6943dccff33a9c1d4836c1bd4a75a9f472470d55e9e26c803ecb632fe5dfd3a7
SHA512 52dabf195959aaa3a6ad03fcf2892f6cfece245151402b81fe4e1ab2c178b6360be15e6710b472c71205c7349eb7f04ac8b33789bbfd5d2d72fe630db3714e49

memory/4976-374-0x0000000000400000-0x000000000044C000-memory.dmp

memory/4976-373-0x00000000021F0000-0x0000000003220000-memory.dmp

C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat

MD5 5778a86de524ee58a3831777464b40c5
SHA1 1d6bb825305df247f3f5210961ebe58063cfabab
SHA256 04e264de9c783c4f8413fda8ba870a911731dce8fd088852959b7a9d216e0e34
SHA512 fac3ffebf2f75c1e4201b28a891cd5f6174f5aab6540170cac2dddad145d98a71fcd9bebb5ba703e7e3b7426244665fd6c1dcb89bb9f80c6a22ba2b8a12dcfa9

C:\Windows\SYSTEM.INI

MD5 cae431b8a5b29273f85734bda934652e
SHA1 c5ecaa92ab1ce07353fcacbd0780c36fedd26574
SHA256 c7b2d8bde037dca5cc3dcb63539caf8896fdfd5b082ccb482ebb982d78b11383
SHA512 ce20add07cd9476b9a2f24670b3436a8e8a084b8c07b61d99b2e6c5eb8b90f808bec3bd92ea489f9dc9106d6ab66d7ad9d8e0161fcf83e0f0228db747f082a6e

memory/4976-376-0x00000000021F0000-0x0000000003220000-memory.dmp

memory/4976-943-0x0000000000630000-0x0000000000632000-memory.dmp

C:\Users\Admin\AppData\Roaming\Admin\module_launcher.exe

MD5 6ff3155e619e2c601db536c88741e094
SHA1 c71bfc0a9b11db33c801035e06d31a03e2901dd0
SHA256 b4febd6c6fc42b7d86b575f6c44f0d49fbe9ec02e98d3be00cb26b3e32a3a6d1
SHA512 8a3047ff46833003464f0979702a4b4f0cf3998c3e4aa865b2f61cfd377689eae706fb9017c2ca97a2fee7f65d6c17c73ae37e86940a6aefdd06d8f0281bcebc

C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat

MD5 20fcc080c32671b5e72b5c5e4e9aeeac
SHA1 b2792164f6be9b5f3f3727e19a29c1b114f50f06
SHA256 d8641d8e9e3558842f5a5eecb4985b96f46066de29f2f259bce6bce7913b77f6
SHA512 fb070849c810289f0b906079154d945121e6148e654f2cdfe3aeed7f4bfb83b6406cee89e4116fd8255716652ea6a1d2b196e172b8bd0572c8152e06cabbd88a

C:\Users\Admin\AppData\Local\Temp\tmp7034.tmp

MD5 ccf05ce9abe252cc7d68b2ff8ab6cfb7
SHA1 8739e9e007b62d9434bd5d06d5d312d255496a00
SHA256 a1d30db63fcb26cfcc1e128f4b840ac1c822267a8f17de45cc2e2fc19147e41f
SHA512 e2e56fa332b895fc54fd9a6ccd71952f11237f18d66b2342a47c7b707a65743d3f8b84efa5988257e657623cb748cb196e36a8839fb1cd5f600cb30623b2a29b

C:\Users\Admin\AppData\Local\Temp\tmp7023.tmp

MD5 b00a14a9f3b2c8ac19ada6992517ff77
SHA1 8469aa684cf86fcf627c828d40a9dc9688187173
SHA256 015caba690febdd5403ad86a04bb9763db7408a3b3f0be85f9c364580dac4649
SHA512 fea53117dc2efc23af186fae9ea8abc6ed15a516a820d62a5d312525447b0495fc0d81acf540017422427ea45754298fb7e334c9db8c47d49c4ce741f85bbf2c

C:\Users\Admin\AppData\Local\Temp\tmp7012.tmp

MD5 88c497ace0db30cc47fc259b7806ad8f
SHA1 a486cedff64cb60e62ffbefd25ee5df79e6a9714
SHA256 4a8ea33966592b337d31802f55ea7f901caec037b5b1bf18a9e2b6b044915781
SHA512 1748700a158b8f999658eb532e5d4ed80c844b21c47d3bf0d8682de22be4b47a424350196ee3d0538d71a67aca906b781282eb3192031e93e834f417b8134346

C:\Users\Admin\AppData\Local\Temp\tmp7011.tmp

MD5 ebc999a1ded4f76d648431350fe423bb
SHA1 b1a4abcb00364ede9185209d41e7e2532cd559a0
SHA256 ba6a7655e3860d01201ffbce06398dff71fd97acff99e95ac8cd2a3e3161d1c0
SHA512 aba5a33667e01857650f74ea5dd461c11a0ff121c22e08ab058b950b11b315119b00acaf0aaf7401a668a4131daf73d07717002c6dd55570a79ad5ba526e5ce4

C:\Users\Admin\AppData\Local\Temp\tmp7001.tmp

MD5 864484e1394eaaa2e9a8a63f01c97be0
SHA1 d02a92d866232f22a8477ab99e6d27354fa310f2
SHA256 e1a25be30164e6aca9bf97454be217f2b49e6f65fa4d3ac710637f6ef8a213a0
SHA512 16919202ee3626ab829070dbe2f43bb5caa9bbaebf63f5de3fb9930825f71edd074855cac6349241705d6bf979203e0eb7f9df2c25d2bfab95ee210ac350568c

memory/4588-400-0x0000000000E00000-0x0000000000E02000-memory.dmp

memory/4976-399-0x0000000000630000-0x0000000000632000-memory.dmp

memory/4976-398-0x0000000003360000-0x0000000003361000-memory.dmp

memory/4588-396-0x0000000001110000-0x0000000001111000-memory.dmp

memory/4976-946-0x00000000021F0000-0x0000000003220000-memory.dmp

memory/4976-954-0x0000000000400000-0x000000000044C000-memory.dmp

memory/4588-960-0x0000000000E00000-0x0000000000E02000-memory.dmp

memory/620-963-0x0000000000400000-0x00000000004C1000-memory.dmp

memory/1640-968-0x0000000000400000-0x00000000004C1000-memory.dmp

C:\Users\Admin\AppData\Roaming\Temp\Admin2.bat

MD5 85eb3280f9675f88d00040cbea92277f
SHA1 2fece0a30b2153b4a9fee72fe5a637dee1967a2f
SHA256 bf1b95975082845d3d9d8948999d69d666dfe50d741a36cdf81fa180fa4c777b
SHA512 2641b1dfa67216ed86d0394dbc6dd78f6124978c23673c73e4e1da66a93f98364acafc13c3df017fab682ed3d9a2c993f3d9bb562e07b7a1b0a01576e1381298

C:\Users\Admin\AppData\Roaming\Admin\kb50145.exe

MD5 8bf335774fbb62bbe1de03921dfe047a
SHA1 24fc750a20aebb52f23e84264d201f458106d95d
SHA256 048655d212b269073107e4636125ceeea262acce1d364fc512a0cc8f4783dcf7
SHA512 aed95f1c37cc99cee23d250e395a80c9c45c7c1c017ec7baef2af860711dbd5b540bf077d372e94582c9758961063f4c166a03fffce3b17e7fb468ce174b7aea

C:\Users\Admin\AppData\Roaming\injector_s.exe

MD5 1d1491e1759c1e39bf99a5df90311db3
SHA1 8bd6faed091bb00f879ef379715461130493e97f
SHA256 22c5c5bcb256c1dcaead463c92a70107ba1bac40564fe1e7d46594c6a3936778
SHA512 ac6ca48acbd288011849e55b0c66faf9ead479e39dc2deaecc7ad998e764f02a1807bb9227e03f12ce1a0b1f5c5b3072c3b86b5bae336e84d95d7a3e42cf5a1e

C:\Users\Admin\AppData\Local\Temp\a0x.bat

MD5 804bb96081db73d249b1d21573d8ea59
SHA1 abf76e8d0702ce245bb7afbb513cdcc8bac6ab35
SHA256 b1e4990bf84c402594a53a2a98011b8880239e790872de1f6c7b8b9cd1005cf5
SHA512 d037dea300ffe466ab83c2a1c2c9a55693c36b546dbbcfa0a7a1ef477a3ea5c33f9831d71389466cf4c74192b417bf9ed0b7e0ad88d927f1ca997fcba254414c

C:\Users\Admin\AppData\Local\Temp\0E57632E_Rar\8578d5b49e77b239468fc1aed1eba560_NeikiAnalytics.exe

MD5 fe9261575638dec5742ddfba5b5fb19c
SHA1 4dc2e4f6556cfcf86d594de9bdd5f66fd9979cac
SHA256 201f53068429e57f2aefa89699e780375f39d41267173966c1c2adc3f62b0227
SHA512 b771afc81c4bdab04256a5e40097c6ff0ff06fb4f07d107a347f8397abd0504384cad1311d9591ca10ea8fd59b4afc40212a371de006d09003cef0ea82308951

C:\Users\Admin\AppData\Local\Temp\0E576F54_Rar\WdExt.exe

MD5 15bf5b7ffd9ae1689f2872567d28f308
SHA1 84a75545eef1243a1c1886cbcd07795dada259d1
SHA256 9b0ad9eed0460d7d5d9a2405f5c43afd0288f35b30a205c76a5d7d855a8997a1
SHA512 eefafc4c48ddc42e9ff45ddb80b54be85c6eec129f69f119d821be0b28a176ea98cab83f3030dd5d9f61346994aa8491d2435ed6deabc501c111a80fdd84fcab

memory/620-1120-0x0000000000400000-0x00000000004C1000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-17 11:35

Reported

2024-06-17 11:38

Platform

win7-20231129-en

Max time kernel

119s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8578d5b49e77b239468fc1aed1eba560_NeikiAnalytics.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\@AEEA1.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8578d5b49e77b239468fc1aed1eba560_NeikiAnalytics.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\@AEEA1.tmp.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\8578d5b49e77b239468fc1aed1eba560_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1660 wrote to memory of 1940 N/A C:\Users\Admin\AppData\Local\Temp\8578d5b49e77b239468fc1aed1eba560_NeikiAnalytics.exe C:\Windows\SysWOW64\explorer.exe
PID 1660 wrote to memory of 1940 N/A C:\Users\Admin\AppData\Local\Temp\8578d5b49e77b239468fc1aed1eba560_NeikiAnalytics.exe C:\Windows\SysWOW64\explorer.exe
PID 1660 wrote to memory of 1940 N/A C:\Users\Admin\AppData\Local\Temp\8578d5b49e77b239468fc1aed1eba560_NeikiAnalytics.exe C:\Windows\SysWOW64\explorer.exe
PID 1660 wrote to memory of 1940 N/A C:\Users\Admin\AppData\Local\Temp\8578d5b49e77b239468fc1aed1eba560_NeikiAnalytics.exe C:\Windows\SysWOW64\explorer.exe
PID 1660 wrote to memory of 1940 N/A C:\Users\Admin\AppData\Local\Temp\8578d5b49e77b239468fc1aed1eba560_NeikiAnalytics.exe C:\Windows\SysWOW64\explorer.exe
PID 1660 wrote to memory of 1940 N/A C:\Users\Admin\AppData\Local\Temp\8578d5b49e77b239468fc1aed1eba560_NeikiAnalytics.exe C:\Windows\SysWOW64\explorer.exe
PID 1940 wrote to memory of 1344 N/A C:\Windows\SysWOW64\explorer.exe C:\Users\Admin\AppData\Local\Temp\@AEEA1.tmp.exe
PID 1940 wrote to memory of 1344 N/A C:\Windows\SysWOW64\explorer.exe C:\Users\Admin\AppData\Local\Temp\@AEEA1.tmp.exe
PID 1940 wrote to memory of 1344 N/A C:\Windows\SysWOW64\explorer.exe C:\Users\Admin\AppData\Local\Temp\@AEEA1.tmp.exe
PID 1940 wrote to memory of 1344 N/A C:\Windows\SysWOW64\explorer.exe C:\Users\Admin\AppData\Local\Temp\@AEEA1.tmp.exe
PID 1344 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\@AEEA1.tmp.exe C:\Windows\SysWOW64\WerFault.exe
PID 1344 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\@AEEA1.tmp.exe C:\Windows\SysWOW64\WerFault.exe
PID 1344 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\@AEEA1.tmp.exe C:\Windows\SysWOW64\WerFault.exe
PID 1344 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\@AEEA1.tmp.exe C:\Windows\SysWOW64\WerFault.exe
PID 1940 wrote to memory of 2380 N/A C:\Windows\SysWOW64\explorer.exe C:\Users\Admin\AppData\Local\Temp\8578d5b49e77b239468fc1aed1eba560_NeikiAnalytics.exe
PID 1940 wrote to memory of 2380 N/A C:\Windows\SysWOW64\explorer.exe C:\Users\Admin\AppData\Local\Temp\8578d5b49e77b239468fc1aed1eba560_NeikiAnalytics.exe
PID 1940 wrote to memory of 2380 N/A C:\Windows\SysWOW64\explorer.exe C:\Users\Admin\AppData\Local\Temp\8578d5b49e77b239468fc1aed1eba560_NeikiAnalytics.exe
PID 1940 wrote to memory of 2380 N/A C:\Windows\SysWOW64\explorer.exe C:\Users\Admin\AppData\Local\Temp\8578d5b49e77b239468fc1aed1eba560_NeikiAnalytics.exe
PID 2380 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\8578d5b49e77b239468fc1aed1eba560_NeikiAnalytics.exe C:\Windows\SysWOW64\WerFault.exe
PID 2380 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\8578d5b49e77b239468fc1aed1eba560_NeikiAnalytics.exe C:\Windows\SysWOW64\WerFault.exe
PID 2380 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\8578d5b49e77b239468fc1aed1eba560_NeikiAnalytics.exe C:\Windows\SysWOW64\WerFault.exe
PID 2380 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\8578d5b49e77b239468fc1aed1eba560_NeikiAnalytics.exe C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Users\Admin\AppData\Local\Temp\8578d5b49e77b239468fc1aed1eba560_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\8578d5b49e77b239468fc1aed1eba560_NeikiAnalytics.exe"

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Users\Admin\AppData\Local\Temp\@AEEA1.tmp.exe

"C:\Users\Admin\AppData\Local\Temp\@AEEA1.tmp.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 92

C:\Users\Admin\AppData\Local\Temp\8578d5b49e77b239468fc1aed1eba560_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\8578d5b49e77b239468fc1aed1eba560_NeikiAnalytics.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 188

Network

N/A

Files

memory/1660-0-0x0000000000400000-0x00000000004C1000-memory.dmp

memory/1660-1-0x0000000000400000-0x00000000004C1000-memory.dmp

\Users\Admin\AppData\Local\Temp\@AEEA1.tmp.exe

MD5 46329f893d9543e37c0603b01751fa81
SHA1 4acdc019085b51f8c7860ab47a09b293c385c1d9
SHA256 d594e1da162a7cd67be562c115b3f669c84040798353db154eb9f3ee305b5dab
SHA512 3493b422291f0db77f27bf5498d966ac6ebc304d292c3fbd8f108caca501c3ba4f64ad599e89e3ac15133e3843e0a6b0be043be5a992a76c09cf4cda110e89f8

memory/1344-15-0x0000000000400000-0x000000000044C000-memory.dmp

memory/1940-14-0x0000000002910000-0x000000000295C000-memory.dmp

memory/1940-13-0x0000000002910000-0x000000000295C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\8578d5b49e77b239468fc1aed1eba560_NeikiAnalytics.exe

MD5 9887f7db7dc40ada587df7c33c42ff15
SHA1 d029cba559891ee96f15e410bc3b48b03afb92a5
SHA256 c0eac92d2eae3b0e4b24c214b9ea35e3bb267cb2a3abc0cf7cad3abe1b0b4611
SHA512 f4af32b4edce3635dac85b2867bd04e67cb3d287049e1e79c88a90f31dabaac8046a18f9ab517384de8ba7025fd24a066ccebbf68220a65039fecb32e65a779f

memory/2380-22-0x0000000000400000-0x00000000004C1000-memory.dmp

memory/1940-19-0x0000000002910000-0x00000000029D1000-memory.dmp