4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
20-06-2024 06:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_NeikiAnalytics.exe
Size

395KB
MD5

caa424bd1828c9f2238e4c3d60a2fa50
SHA1

ecb1eb8a684df90badfc657157d9c6dbfed0b556
SHA256

4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6
SHA512

02c7755aad2d1addf2a3073f48b93ba65c031fd9d0a68a37e9b88e5c486e5eda050ddc3c0d6ec40a2ab51183f600a052db31192e446ca565a497620040f7b50c
SSDEEP

6144:it03a62hzpSNxV2qcJVLNyTiY6wDyIJ2r/bDu:Os52hzpHq8eTi30yIQrDDu

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 26 IoCs

pid	Process
112	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202.exe
208	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202a.exe
1000	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202b.exe
3220	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202c.exe
2220	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202d.exe
1736	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202e.exe
2116	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202f.exe
1512	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202g.exe
4056	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202h.exe
1628	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202i.exe
3724	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202j.exe
3800	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202k.exe
1384	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202l.exe
3360	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202m.exe
2832	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202n.exe
4984	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202o.exe
2496	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202p.exe
636	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202q.exe
3352	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202r.exe
1944	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202s.exe
2488	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202t.exe
3124	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202u.exe
3244	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202v.exe
4604	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202w.exe
1268	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202x.exe
4484	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202y.exe

Adds Run key to start application 2 TTPs 26 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Modifies registry class 54 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = d54097d614a8b8dc	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202g.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = d54097d614a8b8dc	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202p.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = d54097d614a8b8dc	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202k.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202n.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202k.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = d54097d614a8b8dc	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202w.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = d54097d614a8b8dc	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202y.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202l.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = d54097d614a8b8dc	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202r.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = d54097d614a8b8dc	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202a.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202h.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202w.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = d54097d614a8b8dc	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = d54097d614a8b8dc	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202f.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202j.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = d54097d614a8b8dc	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202s.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = d54097d614a8b8dc	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202h.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = d54097d614a8b8dc	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202m.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = d54097d614a8b8dc	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202o.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202u.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = d54097d614a8b8dc	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202v.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202x.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = d54097d614a8b8dc	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202b.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202c.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = d54097d614a8b8dc	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202i.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202v.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202g.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202p.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = d54097d614a8b8dc	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202d.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202t.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202e.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = d54097d614a8b8dc	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202l.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202o.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202r.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = d54097d614a8b8dc	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202t.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = d54097d614a8b8dc	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202u.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202q.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = d54097d614a8b8dc	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202q.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202b.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202f.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202s.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202y.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202m.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = d54097d614a8b8dc	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202e.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = d54097d614a8b8dc	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202j.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = d54097d614a8b8dc	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202n.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = d54097d614a8b8dc	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202a.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = d54097d614a8b8dc	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202c.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202d.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202i.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = d54097d614a8b8dc	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202x.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 112	1964	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_NeikiAnalytics.exe	85
PID 1964 wrote to memory of 112	1964	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_NeikiAnalytics.exe	85
PID 1964 wrote to memory of 112	1964	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_NeikiAnalytics.exe	85
PID 112 wrote to memory of 208	112	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202.exe	86
PID 112 wrote to memory of 208	112	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202.exe	86
PID 112 wrote to memory of 208	112	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202.exe	86
PID 208 wrote to memory of 1000	208	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202a.exe	87
PID 208 wrote to memory of 1000	208	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202a.exe	87
PID 208 wrote to memory of 1000	208	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202a.exe	87
PID 1000 wrote to memory of 3220	1000	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202b.exe	88
PID 1000 wrote to memory of 3220	1000	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202b.exe	88
PID 1000 wrote to memory of 3220	1000	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202b.exe	88
PID 3220 wrote to memory of 2220	3220	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202c.exe	89
PID 3220 wrote to memory of 2220	3220	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202c.exe	89
PID 3220 wrote to memory of 2220	3220	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202c.exe	89
PID 2220 wrote to memory of 1736	2220	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202d.exe	90
PID 2220 wrote to memory of 1736	2220	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202d.exe	90
PID 2220 wrote to memory of 1736	2220	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202d.exe	90
PID 1736 wrote to memory of 2116	1736	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202e.exe	91
PID 1736 wrote to memory of 2116	1736	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202e.exe	91
PID 1736 wrote to memory of 2116	1736	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202e.exe	91
PID 2116 wrote to memory of 1512	2116	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202f.exe	93
PID 2116 wrote to memory of 1512	2116	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202f.exe	93
PID 2116 wrote to memory of 1512	2116	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202f.exe	93
PID 1512 wrote to memory of 4056	1512	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202g.exe	94
PID 1512 wrote to memory of 4056	1512	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202g.exe	94
PID 1512 wrote to memory of 4056	1512	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202g.exe	94
PID 4056 wrote to memory of 1628	4056	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202h.exe	96
PID 4056 wrote to memory of 1628	4056	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202h.exe	96
PID 4056 wrote to memory of 1628	4056	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202h.exe	96
PID 1628 wrote to memory of 3724	1628	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202i.exe	97
PID 1628 wrote to memory of 3724	1628	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202i.exe	97
PID 1628 wrote to memory of 3724	1628	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202i.exe	97
PID 3724 wrote to memory of 3800	3724	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202j.exe	98
PID 3724 wrote to memory of 3800	3724	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202j.exe	98
PID 3724 wrote to memory of 3800	3724	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202j.exe	98
PID 3800 wrote to memory of 1384	3800	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202k.exe	100
PID 3800 wrote to memory of 1384	3800	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202k.exe	100
PID 3800 wrote to memory of 1384	3800	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202k.exe	100
PID 1384 wrote to memory of 3360	1384	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202l.exe	101
PID 1384 wrote to memory of 3360	1384	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202l.exe	101
PID 1384 wrote to memory of 3360	1384	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202l.exe	101
PID 3360 wrote to memory of 2832	3360	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202m.exe	102
PID 3360 wrote to memory of 2832	3360	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202m.exe	102
PID 3360 wrote to memory of 2832	3360	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202m.exe	102
PID 2832 wrote to memory of 4984	2832	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202n.exe	103
PID 2832 wrote to memory of 4984	2832	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202n.exe	103
PID 2832 wrote to memory of 4984	2832	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202n.exe	103
PID 4984 wrote to memory of 2496	4984	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202o.exe	104
PID 4984 wrote to memory of 2496	4984	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202o.exe	104
PID 4984 wrote to memory of 2496	4984	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202o.exe	104
PID 2496 wrote to memory of 636	2496	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202p.exe	105
PID 2496 wrote to memory of 636	2496	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202p.exe	105
PID 2496 wrote to memory of 636	2496	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202p.exe	105
PID 636 wrote to memory of 3352	636	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202q.exe	106
PID 636 wrote to memory of 3352	636	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202q.exe	106
PID 636 wrote to memory of 3352	636	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202q.exe	106
PID 3352 wrote to memory of 1944	3352	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202r.exe	107
PID 3352 wrote to memory of 1944	3352	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202r.exe	107
PID 3352 wrote to memory of 1944	3352	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202r.exe	107
PID 1944 wrote to memory of 2488	1944	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202s.exe	108
PID 1944 wrote to memory of 2488	1944	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202s.exe	108
PID 1944 wrote to memory of 2488	1944	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202s.exe	108
PID 2488 wrote to memory of 3124	2488	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202t.exe	109

C:\Users\Admin\AppData\Local\Temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_NeikiAnalytics.exe"
1⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1964
- \??\c:\users\admin\appdata\local\temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202.exe
  c:\users\admin\appdata\local\temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:112
- - \??\c:\users\admin\appdata\local\temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202a.exe
    c:\users\admin\appdata\local\temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202a.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:208
  - - \??\c:\users\admin\appdata\local\temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202b.exe
      c:\users\admin\appdata\local\temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202b.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:1000
    - - \??\c:\users\admin\appdata\local\temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202c.exe
        
        c:\users\admin\appdata\local\temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202c.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3220
      - \??\c:\users\admin\appdata\local\temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202d.exe
        
        c:\users\admin\appdata\local\temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202d.exe
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2220
        
        \??\c:\users\admin\appdata\local\temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202e.exe
        
        c:\users\admin\appdata\local\temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202e.exe
        7⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1736
        
        \??\c:\users\admin\appdata\local\temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202f.exe
        
        c:\users\admin\appdata\local\temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202f.exe
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2116
        
        \??\c:\users\admin\appdata\local\temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202g.exe
        
        c:\users\admin\appdata\local\temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202g.exe
        9⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1512
        
        \??\c:\users\admin\appdata\local\temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202h.exe
        
        c:\users\admin\appdata\local\temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202h.exe
        10⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4056
        
        \??\c:\users\admin\appdata\local\temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202i.exe
        
        c:\users\admin\appdata\local\temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202i.exe
        11⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1628
        
        \??\c:\users\admin\appdata\local\temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202j.exe
        
        c:\users\admin\appdata\local\temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202j.exe
        12⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3724
        
        \??\c:\users\admin\appdata\local\temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202k.exe
        
        c:\users\admin\appdata\local\temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202k.exe
        13⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3800
        
        \??\c:\users\admin\appdata\local\temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202l.exe
        
        c:\users\admin\appdata\local\temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202l.exe
        14⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1384
        
        \??\c:\users\admin\appdata\local\temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202m.exe
        
        c:\users\admin\appdata\local\temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202m.exe
        15⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3360
        
        \??\c:\users\admin\appdata\local\temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202n.exe
        
        c:\users\admin\appdata\local\temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202n.exe
        16⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2832
        
        \??\c:\users\admin\appdata\local\temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202o.exe
        
        c:\users\admin\appdata\local\temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202o.exe
        17⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4984
        
        \??\c:\users\admin\appdata\local\temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202p.exe
        
        c:\users\admin\appdata\local\temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202p.exe
        18⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2496
        
        \??\c:\users\admin\appdata\local\temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202q.exe
        
        c:\users\admin\appdata\local\temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202q.exe
        19⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:636
        
        \??\c:\users\admin\appdata\local\temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202r.exe
        
        c:\users\admin\appdata\local\temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202r.exe
        20⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3352
        
        \??\c:\users\admin\appdata\local\temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202s.exe
        
        c:\users\admin\appdata\local\temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202s.exe
        21⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1944
        
        \??\c:\users\admin\appdata\local\temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202t.exe
        
        c:\users\admin\appdata\local\temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202t.exe
        22⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2488
        
        \??\c:\users\admin\appdata\local\temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202u.exe
        
        c:\users\admin\appdata\local\temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202u.exe
        23⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        
        PID:3124
        
        \??\c:\users\admin\appdata\local\temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202v.exe
        
        c:\users\admin\appdata\local\temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202v.exe
        24⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        
        PID:3244
        
        \??\c:\users\admin\appdata\local\temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202w.exe
        
        c:\users\admin\appdata\local\temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202w.exe
        25⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        
        PID:4604
        
        \??\c:\users\admin\appdata\local\temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202x.exe
        
        c:\users\admin\appdata\local\temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202x.exe
        26⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        
        PID:1268
        
        \??\c:\users\admin\appdata\local\temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202y.exe
        
        c:\users\admin\appdata\local\temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202y.exe
        27⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202.exe

Filesize
395KB

MD5
b6f5360e5c2aab6a7dc69a5911237281

SHA1
269a3dca713733fa57099e3d44c2dbfbdbfcab46

SHA256
340df0797f4373c15ab7dd01daa944d8674e862b1e6b9804dab964ae1bccd3ac

SHA512
3f79804053a1afa08c21b9ba39984b5aa3809b761f266e02496f2c80bd43ab3d1da732eeb57bd84d49e4f930b428bbe9396f797aff6ecd62426d55698d585c20

Download Submit
C:\Users\Admin\AppData\Local\Temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202a.exe

Filesize
395KB

MD5
4543a22224d19df7d95a6a43a8544ab1

SHA1
84511ce972a15f75b8f16d288d041a2f1735f7fd

SHA256
261f4247274b3a2bac4cbe6412d254e232b8996639b7115be4dcef8eb07d3917

SHA512
e3d0f661e51cb5c054417535814695f94ea6fe0ca19a75beb7917163f7012900a34b331f3c004292d0cac7f5d3798edcc7222fe9ff390d36fb1313a19447da5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202e.exe

Filesize
396KB

MD5
2f6b0613b0c7d1d5f49f3f3889ebe39c

SHA1
ecdcfbb9bdbd86444af589dce6a29c4d3c2f3042

SHA256
f781d55e3a78c16f41b43a672c9981482670448bf57c5439458ab303889fdad0

SHA512
b5e8729560271799aeaa9535ed50f8c414ec79a31fca06666185899a833ba723da078719967423337c98af1d3c44decf82eedf9edae048504c95927b505cfa3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202f.exe

Filesize
396KB

MD5
97d10ea0b0e84842f28c0429498ebba0

SHA1
b8f4c07c88afd3408f735440d8b2522a0787d209

SHA256
c460fac139d9c23b77a3042fc4c416fd75deccae781564802714cfeb5ea789dc

SHA512
288639b598d345a458f63e1c2934e4a445d2d97dd218104ac81ad672a3d5dd7b1289554d02d3129078dcc12a8c4582b8e97c00736d1a4b41bee7dda6cd4a7a20

Download Submit
C:\Users\Admin\AppData\Local\Temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202i.exe

Filesize
397KB

MD5
e358b5a9a308c3f464bbfb8fb140d24f

SHA1
d97fb0cceda8f1456ff3d5792cc0c17d325fdd97

SHA256
aefe0cb3d12141fed78e65faa60b908232a8bd0d9fbee2a5014a39d014f18508

SHA512
ada1adc2689d92ccfb12c686d4a380c670d9dcaae8cc52e2816be51471694dfb175f0b14bfa2a234d6e90deb2be65940945f799f44f2df8f9587230a84f168ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202j.exe

Filesize
397KB

MD5
e5b17fb286a1571f4ec5552bdd40059e

SHA1
0262b7f561b907cc9aedc7ea40e608944364ec9f

SHA256
4132cff8356594e7095c72cd79e988a2986198d4413b4e9b97084ae304fa7bd3

SHA512
95af8192a03fc48e3a6e7e4562350f974d135373728d92198820073375b7a2e9df21624afc35a084ad33ca3e2db4b89b9bad42ebd139d480ad6c47a0083ea8af

Download Submit
C:\Users\Admin\AppData\Local\Temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202l.exe

Filesize
398KB

MD5
8cd303e9c2be3f1350695e2e2bd848d5

SHA1
1dabeea375fcba29153a5616e29a34fb6ba3d1e7

SHA256
6c0bdf4a73eab2e5ab9b962a29b23396948d3ce029b49c625ae696d8fe9a4ca4

SHA512
972c61acf82e4aa943d8fb64cf4a7bdcfcbc3d040126f062e61eefadd836dea079ea148dfd327a8bf6ebe87034bbd1de019ae31fd0406d432150423cadaa3c45

Download Submit
C:\Users\Admin\AppData\Local\Temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202m.exe

Filesize
398KB

MD5
3247bdd83c95c3287cc7f1f74d498b10

SHA1
0628e641d616a69db1ad5f3a17f8c9d26acf02b4

SHA256
ba0b9534b43aefb3a1999b2222f80d35b42d5ee2f1873356a2d188377445bc3c

SHA512
62d2918e4ce347843a57634cf0f66c6d60601e1f71e7c281be189bfbb627e117fabc9e36adeacfe99d1fd7811a09f593cf8ea8f7dd40b7948c13387c0be50851

Download Submit
C:\Users\Admin\AppData\Local\Temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202n.exe

Filesize
398KB

MD5
9bc0e4a8728a5f5fc32738c6c4c26691

SHA1
bdce8f0d928a13fade8278289eaf6b2355bed1ca

SHA256
f5ae6bef0fd82c9e2c9bbe65c737e209be9e1320462cc3a69ecc17781f8d4a29

SHA512
04a53b510a67dfe2d4575b588e5604157fab82dfba039f11ba78f34bef1e4eece3d75e77eaace5d3f4a240ca0285a298439ccdc08244770d74c167ddd745ad63

Download Submit
C:\Users\Admin\AppData\Local\Temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202p.exe

Filesize
399KB

MD5
1beb9a6cdf9dec5a03a20ab9729f0bef

SHA1
e26a105484232fc6c0fa3ee648c02da1973a0200

SHA256
50fc22082df999ea9bc0b01974ac122ed2f0104e89a55f5034e8af3fe8904c74

SHA512
9b2364e136942bc5999e6e2774f56af6e1b85d9281952520eb83cdccea463f91958576de78993322a6377bfdb7155c16e0fe344bff99e3901aaa3fc89fca657d

Download Submit
C:\Users\Admin\AppData\Local\Temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202q.exe

Filesize
399KB

MD5
e866cc6becd2b449fad2eb37c1921058

SHA1
112e567626b1076b8b7cf25a760e7f14db09295d

SHA256
c8b7c560dfc223e9e939f967f0a3f1460f7714ee635e3065a4e5bebe19db94d3

SHA512
d4c665dc6a5d5e7d3d27ef0a31bca95104520a835deee734b9676c9cff4d1f779a41d0910779469c7725cd333411d79cc297ae788c5afd5b91a28d031304a208

Download Submit
C:\Users\Admin\AppData\Local\Temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202t.exe

Filesize
400KB

MD5
4a6720e38f3786b439cb8a81b403f9b1

SHA1
bc6c58c548b82bf1aab60533d2c65d605dc36a73

SHA256
46d57c015e29a07118eaacc5d26b3841271e948288fa6cc38f694679a15b37f5

SHA512
4739d14b83f9d289c88ba76079234fbf125230c63c670381698ab1579b711090e321beda02f003f3b45fc62045e2f36fbea8cadd19edd547623e094ab46eee04

Download Submit
C:\Users\Admin\AppData\Local\Temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202u.exe

Filesize
400KB

MD5
68345d13bd383e3e5d59fc25f3d2e0c7

SHA1
e8218d509afa41e1be3b1103c8d4eb3eb3df82dd

SHA256
2930cf1c83f39ecdaec9d530cbb2ee3c371bda60cbbafea8cb764a02d58587f0

SHA512
faee51728fdbf7720ebe10b86708bd9211162e222adba08f9a125cfe6ca43c99e7dc855d6a4adb52299d1ac88b706af815d8d8e93cec4cf7158695812d5698ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202w.exe

Filesize
400KB

MD5
9f6171af5dabecef16aff2d463e7e130

SHA1
ea3f05782dc4030f3b93c601abb2ee5af264192c

SHA256
bc93c6505faac3767cf1784408f2435c6a0c68cb5645d6a86ccceaf7c11c1281

SHA512
67beba5ddd41a7e4f8f18455b2ac0d2985d1637fedbcf47229fa1db195b8c840a01348b2ce7c1a7e6544cca82a92f843b6f5621b7130eaa058f0898271522027

Download Submit
\??\c:\users\admin\appdata\local\temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202b.exe

Filesize
395KB

MD5
abaa393beaf5161b7afd5a06481e57c2

SHA1
1d30bf82e50a1f43ed8da2bfa4e8ac5025f48aa2

SHA256
41f460c55c403790d34b8869bb8a984ea15426c8588038589851ffd90bc8d91d

SHA512
48a8af49cd1a3a9049cd61f9b8641bb90bd07ecd4353e7759804826a68b0b8296221ac2e6a0c318a0368ed5a1feb74d74da6b147f11e0a6600f41f0720125a70

Download Submit
\??\c:\users\admin\appdata\local\temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202c.exe

Filesize
396KB

MD5
9c0f51550a1d0cf1dcc81956586819c7

SHA1
47b90ec5fce40ef1cef40398aff57f3b264d0eca

SHA256
6fbe61b3cf0e2f1e04fd65c4f21ac1199be492f0bce19151243d311c7c3972ac

SHA512
2481d957683e0c8e3a54b1129a4b117d3e5968fb992cee32848105f6a42fc764cf9cd35b406030a2fb3d2b4f4a36073b95f5f7ed7f6b7d32b47d5ed573567d53

Download Submit
\??\c:\users\admin\appdata\local\temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202d.exe

Filesize
396KB

MD5
3d77c9ff40ea6ec7ed1c6be1660409ca

SHA1
f39ac8d335a2e636c1756d0e652f5bfae91be47e

SHA256
7617f8bb660f99511b1092fd76f061af3516f2b6f1c9c5afbfb66cdd390ab9a7

SHA512
ed07da5cd2214e3ec16d175eb7a3abf3c53998c85519ea771d40ec2d0e390d51fba6d352a18aeb16ae762a08c73a8dfa1aadd975dfb4380ec96a1205a19ae457

Download Submit
\??\c:\users\admin\appdata\local\temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202g.exe

Filesize
397KB

MD5
82f3d946f066572a89d1d42689d952d5

SHA1
3a57b1e3d367d3b80e66d9b1718c385f6756c200

SHA256
b823a31631998808672cc81173f25e8a309643f8d5fd48d93691f3c85910e106

SHA512
0f40b53907ff752b91524ae29c26bc13eea67dc7ca31aab95d6a949b3d22dc7da74dd0ca5802f2e96aad06e8d7dce57322b1cc8647c6450a2a0d825712fade82

Download Submit
\??\c:\users\admin\appdata\local\temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202h.exe

Filesize
397KB

MD5
2068e97684fcc285aac7819d7bf4fede

SHA1
2e97fa04ad3ec1a44c089c9e0bb56c9af5cb700f

SHA256
17cf19f9945c718b0923a1581be4241b528637ca6a791073f51ff7acdb727c3c

SHA512
65e2acdd07867243f3081dc67f564ae6804957f2013095fb091ce59903a3484814e3863e9c9add0c5be0b1c556e4a960e63beca9fa787fea94fe2519e6ba94ef

Download Submit
\??\c:\users\admin\appdata\local\temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202k.exe

Filesize
397KB

MD5
55395ebbcdad2940432a14e67d8266d3

SHA1
7f868d050ee09f0906608af7a2ef4f2cfa9ee02a

SHA256
e59c87134418b0b1bf0193f36a33c7a47c09fb5893f46245ae724d647ed93a6f

SHA512
f56f872ef7682a96df39e0aa1c3a87f371161e48e9b15c4de49971f775b89f3f3f8cf9efcce4ff405dacabe2b3fcc0160660480a26b2b4983863d8451d1fc4bd

Download Submit
\??\c:\users\admin\appdata\local\temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202o.exe

Filesize
398KB

MD5
284833f1bb10713d3e6f3fa66b766674

SHA1
a8d7f23f89fcb932ca62d13b085d65f427b358e0

SHA256
c463d722258d67dc6fa284233a403df7e1607bfc79e2dcf314bd8e9d7920bbc4

SHA512
5422795712ca7a772eb506e71086b798fe3137ef2cd02c6a1f5164a431599d4bc1f2d32841c4b32c9a1603a15b9b83c97e043b743d7f949cedd9362330b9c817

Download Submit
\??\c:\users\admin\appdata\local\temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202r.exe

Filesize
399KB

MD5
7bfba0089eff1c139fcaf9eabfe083d7

SHA1
09861fa1cd65ef00023ddc8d74deb72d9aba4a94

SHA256
aa969370d091ef17ef5626ec79e079f1bce4db3570f5560e625004cff159d6ce

SHA512
e7b11b50e041f7004cc1f6f083e581826c13750a24c705c2e7a9ea7677de4f103a33c8efeb78591e1d30176634265268550fabde220ae22256331e77bde40168

Download Submit
\??\c:\users\admin\appdata\local\temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202s.exe

Filesize
399KB

MD5
9a11b6552b1c0f958937fa4969ba6f6a

SHA1
0658b50e0995d7a8ff90d689193b3313a3b30b48

SHA256
ec76498b1091612a82fdb67113407d6bac20621a613360a93d65b1a6b21e8831

SHA512
6b81760be2806f648b7ae2bc7d6dd7ca35730afcb118c33820612fbfe7cfc577eb494bce6b0a2e9166e018d6ba09cf8dab4f7a925c98e892fb2b1d163fb81284

Download Submit
\??\c:\users\admin\appdata\local\temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202v.exe

Filesize
400KB

MD5
b51267387fd16df8d804e34a15868e3e

SHA1
68bb613a6affca0346f01c096aa966ae8cd4ee4c

SHA256
49371d3026cc23fc0d2beb9cf179593ecd574dfa036934dbc36758a4f8a2e2bb

SHA512
b4f3f3e9b816bc448edb86b890c184fd768a5e76bd97ec9cdbd620054bb8812dc52560ce0e7fe40e8bbed553a51089575347888cb6a2bea7e609b0442e142fb9

Download Submit
\??\c:\users\admin\appdata\local\temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202x.exe

Filesize
400KB

MD5
e667dd6a04011413d376165187e14bd1

SHA1
b8aecaeedca1a791da9845a5d9c11707af5fca76

SHA256
34a1f15dfef175f3cb84a93055f7b2169f9351457b8474b9b97579271dc2e603

SHA512
10ef004884fd9b27b777ca9ebb60932a04eb654289c1f97beff11fc118273737767587ea7a5a271c0b0c9c7896ccc8f2e3d176d1a06267f56f4c0dd04416bdec

Download Submit
\??\c:\users\admin\appdata\local\temp\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202y.exe

Filesize
401KB

MD5
8a22a45b909168d0871d17b3b9e5fbf8

SHA1
8d8e55e24a1618bce0f17a7740a5b048ff7e8a4b

SHA256
e944ecf5211fd7a6128f8b90c747fd0fc4ff4741f8d20cecb2a09c5b98946b4e

SHA512
fa7f13afdcacd391a295a98464fb903ad015d1c0c2591c587594a44deb0c055f7f2f99faaca4240fa87ad238e8af7ffdb7166433f699b58879acce317d003814

Download Submit
memory/112-18-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/208-20-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/208-36-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/636-197-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/636-189-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1000-34-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1000-46-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1268-270-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1384-136-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1384-145-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1512-93-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1628-115-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1628-104-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1736-73-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1944-219-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1944-210-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1964-0-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1964-8-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2116-83-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2220-51-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2220-63-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2488-230-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2488-226-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2496-188-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2496-178-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2832-166-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/3124-241-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/3220-47-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/3220-53-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/3244-252-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/3244-242-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/3352-208-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/3360-154-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/3724-124-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/3724-114-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/3800-133-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/4056-102-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/4484-274-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/4484-276-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/4604-253-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/4604-268-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/4984-167-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/4984-177-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202o.exe\""	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202n.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202t.exe\""	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202s.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202u.exe\""	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202t.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202a.exe\""	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202v.exe\""	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202u.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202c.exe\""	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202i.exe\""	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202h.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202g.exe\""	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202s.exe\""	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202r.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202.exe\""	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202k.exe\""	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202j.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202l.exe\""	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202k.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202y.exe\""	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202x.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202j.exe\""	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202i.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202e.exe\""	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202m.exe\""	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202l.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202b.exe\""	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202n.exe\""	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202m.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202p.exe\""	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202o.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202q.exe\""	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202p.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202x.exe\""	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202w.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202f.exe\""	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202d.exe\""	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202h.exe\""	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202g.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202r.exe\""	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202q.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202w.exe\""	4043e0dbdfff46f7a5bc4bf02fd2804896ccfd87030042b042018010a82e06c6_neikianalytics_3202v.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads