Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\646a83e2de4cc71d8cead71580104ade9b4dc38e00fd491c658dfd5c6a9898bc_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\646a83e2de4cc71d8cead71580104ade9b4dc38e00fd491c658dfd5c6a9898bc_NeikiAnalytics.exe	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File created	C:\Windows\Tasks\Dctooux.job	C:\Users\Admin\AppData\Local\Temp\646a83e2de4cc71d8cead71580104ade9b4dc38e00fd491c658dfd5c6a9898bc_NeikiAnalytics.exe	N/A

Enumerates physical storage devices

Suspicious use of FindShellTrayWindow

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\646a83e2de4cc71d8cead71580104ade9b4dc38e00fd491c658dfd5c6a9898bc_NeikiAnalytics.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2200 wrote to memory of 2532	N/A	C:\Users\Admin\AppData\Local\Temp\646a83e2de4cc71d8cead71580104ade9b4dc38e00fd491c658dfd5c6a9898bc_NeikiAnalytics.exe	C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
PID 2200 wrote to memory of 2532	N/A	C:\Users\Admin\AppData\Local\Temp\646a83e2de4cc71d8cead71580104ade9b4dc38e00fd491c658dfd5c6a9898bc_NeikiAnalytics.exe	C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
PID 2200 wrote to memory of 2532	N/A	C:\Users\Admin\AppData\Local\Temp\646a83e2de4cc71d8cead71580104ade9b4dc38e00fd491c658dfd5c6a9898bc_NeikiAnalytics.exe	C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
PID 2200 wrote to memory of 2532	N/A	C:\Users\Admin\AppData\Local\Temp\646a83e2de4cc71d8cead71580104ade9b4dc38e00fd491c658dfd5c6a9898bc_NeikiAnalytics.exe	C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe

Processes

C:\Users\Admin\AppData\Local\Temp\646a83e2de4cc71d8cead71580104ade9b4dc38e00fd491c658dfd5c6a9898bc_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\646a83e2de4cc71d8cead71580104ade9b4dc38e00fd491c658dfd5c6a9898bc_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe

"C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe"

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	osdhs.in.ne	udp
US	8.8.8.8:53	greendag.ru	udp
US	8.8.8.8:53	jkshb.su	udp
MK	95.86.30.3:80	jkshb.su	tcp
MK	95.86.30.3:80	jkshb.su	tcp
MK	95.86.30.3:80	jkshb.su	tcp
US	8.8.8.8:53	greendag.ru	udp
US	8.8.8.8:53	greendag.ru	udp

Files

memory/2200-1-0x0000000000590000-0x0000000000690000-memory.dmp

memory/2200-2-0x0000000000340000-0x00000000003AB000-memory.dmp

memory/2200-3-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2200-5-0x0000000000400000-0x000000000047E000-memory.dmp

\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe

MD5	3e30840e15905c863d3975deef294810
SHA1	925f3af7bcb75a8eb2f8a06fe0cad5a6b5f5fbf6
SHA256	646a83e2de4cc71d8cead71580104ade9b4dc38e00fd491c658dfd5c6a9898bc
SHA512	08d1b5a7af629d8e4535aeede77aaddf0d9aca07247f94c9e809c7b43f0286dd31528b39ebe4387f5c6fbad0bb7ab195be250663dbf647056d3c55483e5e5af7

memory/2200-20-0x0000000000400000-0x000000000047E000-memory.dmp

memory/2200-19-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2200-18-0x0000000000340000-0x00000000003AB000-memory.dmp

memory/2532-22-0x0000000000400000-0x000000000047E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\627615824406

MD5	210a18ff21125e5664da965102165864
SHA1	16213b1886a4b0d65efbe9faed7174cf6f2899bc
SHA256	8c10cd73b42875a0a83bb343c122fb47ccf7ec25ee4d2c637b20c594a020ce84
SHA512	2e1a92d51b656eabe985b5ae7e0dfd85970371ffeeefdeccd430c510bd3b9dac553422888fab01d10183ab40ba2556578c412a3c4a6dc389788791a119b9f79d

memory/2532-32-0x0000000000400000-0x000000000047E000-memory.dmp

memory/2532-40-0x0000000000400000-0x000000000047E000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-21 10:53

Reported

2024-06-21 10:55

Platform

win10v2004-20240508-en

Max time kernel

145s

Max time network

93s

Command Line

"C:\Users\Admin\AppData\Local\Temp\646a83e2de4cc71d8cead71580104ade9b4dc38e00fd491c658dfd5c6a9898bc_NeikiAnalytics.exe"

Signatures

Amadey

trojan amadey

Checks computer location settings

Description	Indicator	Process	Target
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\646a83e2de4cc71d8cead71580104ade9b4dc38e00fd491c658dfd5c6a9898bc_NeikiAnalytics.exe	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File created	C:\Windows\Tasks\Dctooux.job	C:\Users\Admin\AppData\Local\Temp\646a83e2de4cc71d8cead71580104ade9b4dc38e00fd491c658dfd5c6a9898bc_NeikiAnalytics.exe	N/A

Enumerates physical storage devices

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\646a83e2de4cc71d8cead71580104ade9b4dc38e00fd491c658dfd5c6a9898bc_NeikiAnalytics.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\646a83e2de4cc71d8cead71580104ade9b4dc38e00fd491c658dfd5c6a9898bc_NeikiAnalytics.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\646a83e2de4cc71d8cead71580104ade9b4dc38e00fd491c658dfd5c6a9898bc_NeikiAnalytics.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\646a83e2de4cc71d8cead71580104ade9b4dc38e00fd491c658dfd5c6a9898bc_NeikiAnalytics.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\646a83e2de4cc71d8cead71580104ade9b4dc38e00fd491c658dfd5c6a9898bc_NeikiAnalytics.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\646a83e2de4cc71d8cead71580104ade9b4dc38e00fd491c658dfd5c6a9898bc_NeikiAnalytics.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\646a83e2de4cc71d8cead71580104ade9b4dc38e00fd491c658dfd5c6a9898bc_NeikiAnalytics.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\646a83e2de4cc71d8cead71580104ade9b4dc38e00fd491c658dfd5c6a9898bc_NeikiAnalytics.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\646a83e2de4cc71d8cead71580104ade9b4dc38e00fd491c658dfd5c6a9898bc_NeikiAnalytics.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\646a83e2de4cc71d8cead71580104ade9b4dc38e00fd491c658dfd5c6a9898bc_NeikiAnalytics.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe

Suspicious use of FindShellTrayWindow

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\646a83e2de4cc71d8cead71580104ade9b4dc38e00fd491c658dfd5c6a9898bc_NeikiAnalytics.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 100 wrote to memory of 1752	N/A	C:\Users\Admin\AppData\Local\Temp\646a83e2de4cc71d8cead71580104ade9b4dc38e00fd491c658dfd5c6a9898bc_NeikiAnalytics.exe	C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
PID 100 wrote to memory of 1752	N/A	C:\Users\Admin\AppData\Local\Temp\646a83e2de4cc71d8cead71580104ade9b4dc38e00fd491c658dfd5c6a9898bc_NeikiAnalytics.exe	C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
PID 100 wrote to memory of 1752	N/A	C:\Users\Admin\AppData\Local\Temp\646a83e2de4cc71d8cead71580104ade9b4dc38e00fd491c658dfd5c6a9898bc_NeikiAnalytics.exe	C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe

Processes

C:\Users\Admin\AppData\Local\Temp\646a83e2de4cc71d8cead71580104ade9b4dc38e00fd491c658dfd5c6a9898bc_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\646a83e2de4cc71d8cead71580104ade9b4dc38e00fd491c658dfd5c6a9898bc_NeikiAnalytics.exe"