neshta | 731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9

Analysis

max time kernel
19s
max time network
156s
platform
windows7_x64
resource
win7-20240611-en
submitted
22/06/2024, 00:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
Size 4.8MB
Sample240622-ar1hsssamn
SHA256 731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9
MD5 818fdf6427bd80cda82b12b7e6058240
SHA1 341f2b36dc1a23312534dff236cbaa6b66f05703
SHA512 90e0720c9317500522eb98b2510f1ab2ad4b2358342f9a62c374f4a3ced88d62ba74ac8f4e7ccb7d66da028db49ef15878e3ac2b00d69704506838c2ed42c7f3
SSDEEP 49152:6Hyjtk2MYC5GDKHyjtk2MYC5GDXB9N7nwvZQbh1lMg8h9f/47/nOn9:6mtk2azmtk2aaRwOPagU9InOn9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neshta xred backdoor discovery persistence spyware stealer

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Detect Neshta payload 48 IoCs

resource	yara_rule
behavioral1/files/0x00230000000133e4-4.dat	family_neshta
behavioral1/files/0x0001000000010315-13.dat	family_neshta
behavioral1/memory/1664-16-0x0000000000400000-0x00000000008BE000-memory.dmp	family_neshta
behavioral1/files/0x000900000001414b-22.dat	family_neshta
behavioral1/files/0x0016000000013a0d-39.dat	family_neshta
behavioral1/files/0x0001000000010313-42.dat	family_neshta
behavioral1/files/0x000b000000010328-41.dat	family_neshta
behavioral1/memory/1664-54-0x0000000000400000-0x00000000008BE000-memory.dmp	family_neshta
behavioral1/files/0x000100000001048f-40.dat	family_neshta
behavioral1/memory/2672-64-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/1696-94-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/728-106-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/1932-99-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/1628-112-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/2020-119-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/1480-130-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/files/0x000100000000f7dd-141.dat	family_neshta
behavioral1/files/0x000100000000f77b-143.dat	family_neshta
behavioral1/files/0x000100000000f7d8-140.dat	family_neshta
behavioral1/files/0x000100000000f832-151.dat	family_neshta
behavioral1/files/0x0001000000010f30-163.dat	family_neshta
behavioral1/files/0x0001000000010c11-160.dat	family_neshta
behavioral1/memory/2784-212-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/2492-213-0x0000000000400000-0x00000000008BE000-memory.dmp	family_neshta
behavioral1/memory/1912-244-0x0000000000400000-0x00000000008BE000-memory.dmp	family_neshta
behavioral1/memory/1696-245-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/2784-246-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/2492-247-0x0000000000400000-0x00000000008BE000-memory.dmp	family_neshta
behavioral1/memory/1696-249-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/2492-251-0x0000000000400000-0x00000000008BE000-memory.dmp	family_neshta
behavioral1/memory/2784-250-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/1912-252-0x0000000000400000-0x00000000008BE000-memory.dmp	family_neshta
behavioral1/memory/1696-253-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/2784-254-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/1696-257-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/2784-258-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/1696-261-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/2784-262-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/1696-267-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/2784-268-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/1696-297-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/2784-300-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/2492-301-0x0000000000400000-0x00000000008BE000-memory.dmp	family_neshta
behavioral1/memory/1696-303-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/2784-304-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/1696-307-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/2784-308-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/1696-310-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Neshta family
neshta
Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred

Executes dropped EXE 13 IoCs

pid	Process
1664	731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
2784	._cache_731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
2672	svchost.com
2492	Synaptics.exe
2992	_CACHE~1.EXE
2832	._cache__CACHE~1.EXE
1932	._cache_Synaptics.exe
1912	Synaptics.exe
1628	._cache_Synaptics.exe
728	svchost.com
2020	svchost.com
1480	svchost.com
2004	_CACHE~2.EXE

Loads dropped DLL 33 IoCs

pid	Process
1696	731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
1696	731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
1664	731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
1664	731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
1664	731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
1664	731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
1664	731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
2672	svchost.com
2672	svchost.com
2992	_CACHE~1.EXE
2992	_CACHE~1.EXE
2492	Synaptics.exe
2492	Synaptics.exe
2492	Synaptics.exe
2992	_CACHE~1.EXE
1912	Synaptics.exe
1912	Synaptics.exe
1912	Synaptics.exe
1912	Synaptics.exe
1480	svchost.com
2004	_CACHE~2.EXE
2004	_CACHE~2.EXE
2004	_CACHE~2.EXE
1696	731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
2784	._cache_731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
2784	._cache_731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
1696	731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
1696	731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
2784	._cache_731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
1888	EXCEL.EXE
1888	EXCEL.EXE
1888	EXCEL.EXE
1888	EXCEL.EXE

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	_CACHE~1.EXE

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE	731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE	._cache_731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	._cache_731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE	._cache_731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE	._cache_731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	._cache_731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\WinMail.exe	._cache_731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\WinMail.exe	731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE	._cache_731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE	731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe	731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE	731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE	._cache_731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\OIS.EXE	._cache_731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE	731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE	._cache_731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wabmig.exe	._cache_731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE	731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE	731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE	731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe	._cache_731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE	731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpshare.exe	731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE	731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE	731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE	731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\WI4223~1\sidebar.exe	._cache_731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	._cache_731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE	731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe	731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe	731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE	._cache_731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE	731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE	._cache_731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\WMPDMC.exe	731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE	._cache_731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE	._cache_731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE	._cache_731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE	731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE	._cache_731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE	._cache_731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE	._cache_731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE	731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE	._cache_731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe	731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	._cache_731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE	._cache_731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmplayer.exe	731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe	731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe	._cache_731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe	._cache_731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\setup_wm.exe	731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmlaunch.exe	._cache_731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\ImagingDevices.exe	._cache_731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe	._cache_731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE	731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE	._cache_731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\svchost.com	._cache_Synaptics.exe
File opened for modification	C:\Windows\svchost.com	._cache_Synaptics.exe
File opened for modification	C:\Windows\svchost.com	svchost.com
File opened for modification	C:\Windows\directx.sys	._cache_Synaptics.exe
File opened for modification	C:\Windows\directx.sys	svchost.com
File opened for modification	C:\Windows\svchost.com	svchost.com
File opened for modification	C:\Windows\svchost.com	svchost.com
File opened for modification	C:\Windows\directx.sys	svchost.com
File opened for modification	C:\Windows\directx.sys	svchost.com
File opened for modification	C:\Windows\directx.sys	._cache_Synaptics.exe
File opened for modification	C:\Windows\directx.sys	svchost.com
File opened for modification	C:\Windows\svchost.com	svchost.com
File opened for modification	C:\Windows\svchost.com	731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
File opened for modification	C:\Windows\svchost.com	._cache_731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache__CACHE~1.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_CACHE~1.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_CACHE~2.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\MenuExt	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	EXCEL.EXE

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system"	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel"	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1888	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2004	_CACHE~2.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2832	._cache__CACHE~1.EXE
Token: SeDebugPrivilege	2004	_CACHE~2.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1888	EXCEL.EXE

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 1664	1696	731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe	28
PID 1696 wrote to memory of 1664	1696	731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe	28
PID 1696 wrote to memory of 1664	1696	731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe	28
PID 1696 wrote to memory of 1664	1696	731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe	28
PID 1664 wrote to memory of 2784	1664	731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe	29
PID 1664 wrote to memory of 2784	1664	731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe	29
PID 1664 wrote to memory of 2784	1664	731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe	29
PID 1664 wrote to memory of 2784	1664	731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe	29
PID 2784 wrote to memory of 2672	2784	._cache_731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe	30
PID 2784 wrote to memory of 2672	2784	._cache_731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe	30
PID 2784 wrote to memory of 2672	2784	._cache_731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe	30
PID 2784 wrote to memory of 2672	2784	._cache_731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe	30
PID 1664 wrote to memory of 2492	1664	731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe	31
PID 1664 wrote to memory of 2492	1664	731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe	31
PID 1664 wrote to memory of 2492	1664	731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe	31
PID 1664 wrote to memory of 2492	1664	731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe	31
PID 2672 wrote to memory of 2992	2672	svchost.com	32
PID 2672 wrote to memory of 2992	2672	svchost.com	32
PID 2672 wrote to memory of 2992	2672	svchost.com	32
PID 2672 wrote to memory of 2992	2672	svchost.com	32
PID 2992 wrote to memory of 2832	2992	_CACHE~1.EXE	33
PID 2992 wrote to memory of 2832	2992	_CACHE~1.EXE	33
PID 2992 wrote to memory of 2832	2992	_CACHE~1.EXE	33
PID 2992 wrote to memory of 2832	2992	_CACHE~1.EXE	33
PID 2492 wrote to memory of 1932	2492	Synaptics.exe	35
PID 2492 wrote to memory of 1932	2492	Synaptics.exe	35
PID 2492 wrote to memory of 1932	2492	Synaptics.exe	35
PID 2492 wrote to memory of 1932	2492	Synaptics.exe	35
PID 2992 wrote to memory of 1912	2992	_CACHE~1.EXE	36
PID 2992 wrote to memory of 1912	2992	_CACHE~1.EXE	36
PID 2992 wrote to memory of 1912	2992	_CACHE~1.EXE	36
PID 2992 wrote to memory of 1912	2992	_CACHE~1.EXE	36
PID 1912 wrote to memory of 1628	1912	Synaptics.exe	37
PID 1912 wrote to memory of 1628	1912	Synaptics.exe	37
PID 1912 wrote to memory of 1628	1912	Synaptics.exe	37
PID 1912 wrote to memory of 1628	1912	Synaptics.exe	37
PID 1932 wrote to memory of 728	1932	._cache_Synaptics.exe	38
PID 1932 wrote to memory of 728	1932	._cache_Synaptics.exe	38
PID 1932 wrote to memory of 728	1932	._cache_Synaptics.exe	38
PID 1932 wrote to memory of 728	1932	._cache_Synaptics.exe	38
PID 1628 wrote to memory of 2020	1628	._cache_Synaptics.exe	39
PID 1628 wrote to memory of 2020	1628	._cache_Synaptics.exe	39
PID 1628 wrote to memory of 2020	1628	._cache_Synaptics.exe	39
PID 1628 wrote to memory of 2020	1628	._cache_Synaptics.exe	39
PID 2832 wrote to memory of 1480	2832	._cache__CACHE~1.EXE	40
PID 2832 wrote to memory of 1480	2832	._cache__CACHE~1.EXE	40
PID 2832 wrote to memory of 1480	2832	._cache__CACHE~1.EXE	40
PID 2832 wrote to memory of 1480	2832	._cache__CACHE~1.EXE	40
PID 1480 wrote to memory of 2004	1480	svchost.com	41
PID 1480 wrote to memory of 2004	1480	svchost.com	41
PID 1480 wrote to memory of 2004	1480	svchost.com	41
PID 1480 wrote to memory of 2004	1480	svchost.com	41

C:\Users\Admin\AppData\Local\Temp\731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Users\Admin\AppData\Local\Temp\3582-490\731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\3582-490\731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1664
- - C:\Users\Admin\AppData\Local\Temp\._cache_731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2784
  - - C:\Windows\svchost.com
      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2672
    - - C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2992
      - C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~1.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~1.EXE"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2832
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\_CACHE~2.EXE"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1480
        
        C:\Users\Admin\AppData\Local\Temp\_CACHE~2.EXE
        
        C:\Users\Admin\AppData\Local\Temp\_CACHE~2.EXE
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2004
      - C:\ProgramData\Synaptics\Synaptics.exe
        
        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1912
        
        C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1628
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_Synaptics.exe" InjUpdate
        8⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2020
- - C:\ProgramData\Synaptics\Synaptics.exe
    "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2492
  - - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1932
    - - C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_Synaptics.exe" InjUpdate
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:728

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DW20.EXE

Path C:\MSOCache\ALLUSE~1\{90140~1\DW20.EXE
Size 859KB
SHA256 ead58c483cb20bcd57464f8a4929079539d634f469b213054bf737d227c026dc
MD5 02ee6a3424782531461fb2f10713d3c1
SHA1 b581a2c365d93ebb629e8363fd9f69afc673123f
SHA512 6c9272cb1b6bde3ee887e1463ab30ea76568cb1a285d11393337b78c4ad1c3b7e6ce47646a92ab6d70bff4b02ab9d699b84af9437b720e52dcd35579fe2693ec
SSDEEP 24576:XWq1lx7SqE0xJ2pm8FiWCm3LHgZpJEHp37d:XWq171dxJ6mAQm3LHkJEJLd
MD5 SHA1 SHA512 SSDEEP

Submit Download

dwtrig20.exe

Path C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe
Size 547KB
SHA256 593e60cc30ae0789448547195af77f550387f6648d45847ea244dd0dd7abf03d
MD5 cf6c595d3e5e9667667af096762fd9c4
SHA1 9bb44da8d7f6457099cb56e4f7d1026963dce7ce
SHA512 ff4f789df9e6a6d0fbe12b3250f951fcf11e857906c65e96a30bb46266e7e1180d6103a03db2f3764e0d1346b2de7afba8259ba080057e4a268e45e8654dfa80
SSDEEP 12288:4wXwNSO5X3IA1iBihI7XHgZQKhJgeCmvz016:4ew0O1IA1UiuLHgZpJEGgg
MD5 SHA1 SHA512 SSDEEP

Submit Download

ose.exe

Path C:\MSOCache\ALLUSE~1\{9A861~1\ose.exe
Size 186KB
SHA256 2a0aa0763fdef9c38c5dd4d50703f0c7e27f4903c139804ec75e55f8388139ae
MD5 58b58875a50a0d8b5e7be7d6ac685164
SHA1 1e0b89c1b2585c76e758e9141b846ed4477b0662
SHA512 d67214077162a105d01b11a8e207fab08b45b08fbfba0615a2ea146e1dd99eea35e4f02958a1754d3192292c00caf777f186f0a362e4b8b0da51fabbdb76375b
SSDEEP 3072:sr85Ca4Kw6JrokFyF5Zat/Vq09oe4QgNOd3z7:k9X6rokFyENNjOc7
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\MSOCache\ALLUSE~1\{9A861~1\setup.exe
Size 1.1MB
SHA256 e17cd94c08fc0e001a49f43a0801cea4625fb9aee211b6dfebebec446c21f460
MD5 566ed4f62fdc96f175afedd811fa0370
SHA1 d4b47adc40e0d5a9391d3f6f2942d1889dd2a451
SHA512 cdf8f508d396a1a0d2e0fc25f2ae46398b25039a0dafa0919737cc44e3e926ebae4c3aa26f1a3441511430f1a36241f8e61c515a5d9bd98ad4740d4d0f7b8db7
SSDEEP 12288:buphfCWQIbDUhUOvF7CehnLQie+I7XHgZQKhJgeCmyDLFSLfmLU7ksep:befCnE7Oduehsi0LHgZpJEdDZSx7ksep
MD5 SHA1 SHA512 SSDEEP

Submit Download

A3DUTI~1.EXE

Path C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE
Size 285KB
SHA256 a8f78ac26c738b13564252f1048ca784bf152ef048b829d3d22650b7f62078f0
MD5 831270ac3db358cdbef5535b0b3a44e6
SHA1 c0423685c09bbe465f6bb7f8672c936e768f05a3
SHA512 f64a00977d4b6f8c43f53cee7bb450f3c8cbef08525975055fde5d8c515db32d2bfad92e99313b3a10a72a50dd09b4ffe28e9af4c148c6480622ba486776e450
SSDEEP 6144:k9yW+qQbdy5SahDbyLxoROmeOprx3vFhdFT:bqQZy5SfOROg/
MD5 SHA1 SHA512 SSDEEP

Submit Download

ACROBR~1.EXE

Path C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE
Size 313KB
SHA256 85f7249bfac06b5ee9b20c7f520e3fdc905be7d64cfbefb7dcd82cd8d44686d5
MD5 8c4f4eb73490ca2445d8577cf4bb3c81
SHA1 0f7d1914b7aeabdb1f1e4caedd344878f48be075
SHA512 65453075c71016b06430246c1ee2876b7762a03112caf13cff4699b7b40487616c88a1160d31e86697083e2992e0dd88ebf1721679981077799187efaa0a1769
SSDEEP 3072:sr85C1KEUyHKpwhSjQaJ90IkGR68obMs7mTjNeYYfQ3LOot9Ge9SslDjoyxrNKO0:k91KDAX0jH0o2zq9DmQ3LOotL4gQObi5
MD5 SHA1 SHA512 SSDEEP

Submit Download

AcroRd32.exe

Path C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe
Size 422KB
SHA256 a89419fc4ba9bf5f7ac6b348428ee57403fec3b5964f9e49b6eea49d779f4071
MD5 8bb6d1d1f40099aa6a629fbb036a8cb3
SHA1 8b388ca335032e3b04b0a7d1351ce25c61b4ba52
SHA512 3015b210c79a4c61143fa56d62caabc5aebfe8d95b20753aa7f52ed0bcd4faf801134e5ee614c3714d95da666e0548f88db4d3df96d6d7e0e124c5a5add23a81
SSDEEP 1536:JxqjQ+P04wsmJCDP9aJfXgY1zUTyr5hVaSal6WZPFoacFYwo+e9nyLUYZQgO59OQ:sr85CT+XgTTSjMS3u45knkZlO5xr85C
MD5 SHA1 SHA512 SSDEEP

Submit Download

ADOBEU~1.EXE

Path C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE
Size 130KB
SHA256 81a3a1dc3104973a100bf8d114b6be35da03767a0cbbaf925f970ffcbe5f217c
MD5 7ce8bcabb035b3de517229dbe7c5e67d
SHA1 8e43cd79a7539d240e7645f64fd7f6e9e0f90ab9
SHA512 be7fcd50b4f71b458ca001b7c019bf1169ec089d7a1ce05355134b11cbe75a5a29811f9efec803877aeb1a1d576ea2628926e0131361db23214275af6e89e80c
SSDEEP 1536:JxqjQ+P04wsmJC3JRS4mV1teQX8owNYSNgIvasZSGCG8+obZdyJG3vxIKpb:sr85CZmV1tvX8owUCveBbjqoIKpb
MD5 SHA1 SHA512 SSDEEP

Submit Download

FLTLDR.EXE

Path C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE
Size 157KB
SHA256 5d13230eae7cd9b4869145c3280f7208788a8e68c9930a5c9aa3e822684a963d
MD5 a24fbb149eddf7a0fe981bd06a4c5051
SHA1 fce5bb381a0c449efad3d01bbd02c78743c45093
SHA512 1c73b762c340a8d7ea580985ba034a404c859d814690390a6e0b6786575c219db9ca20880ea20313bb244560e36cf24e4dda90229b3084d770495f4ceedfd5de
SSDEEP 3072:sr85Co6cKZSKZneLFZJgdTSeGOjw1qLT49oTCpyCxUawypmgPBQoo:k9qKZSen86dTS9OTLkACfxUawyoEBQN
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSOICONS.EXE

Path C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE
Size 503KB
SHA256 31c10320edb2de22f37faee36611558db83b78a9c3c71ea0ed13c8dce25bf711
MD5 3f67da7e800cd5b4af2283a9d74d2808
SHA1 f9288d052b20a9f4527e5a0f87f4249f5e4440f7
SHA512 6a40f4629ddae102d8737e921328e95717274cea16eb5f23bff6a6627c6047d7f27e7f6eb5cb52f53152e326e53b6ee44d9a9ee8eca7534a2f62fa457ac3d4e3
SSDEEP 3072:sr85CrzdP4ZVGKJGs404W7NV7Q3XV4Eti79l6GdTdJd9dsfTxP4VW9o2I4Ytkeds:k9rzB4ZVFJGw4W7UDkQWjNds
MD5 SHA1 SHA512 SSDEEP

Submit Download

._cache__CACHE~1.EXE

Path C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~1.EXE
Size 2.5MB
SHA256 d68a74254c0130ca84cf8e915f596b1c56a246c5a8dcd3fdffe3a1a10bbaa1d5
MD5 26e8cb237d43b4b4ca14eec2ed60f614
SHA1 2ffbaac9666f1440f48c0dc99ac7cab5ad1ac2df
SHA512 6228f8a2433469596f10bb568fe6a0ff99c82bb12b6046d9e7a07425f4873e2f61ba0bbbcc897c516159246eb15450f841cd380087e260773e27eb4b77443b11
SSDEEP 24576:VJJJJJJyB5xLSMQVL2Zn/TnPS9LzzVqynla3aQA0fZZl5lP6pg8h9DcQZyheT/47:EB9N7nwvZQbh1lMg8h9f/47
MD5 SHA1 SHA512 SSDEEP

Submit Download

_CACHE~1.EXE

Path C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE
Size 3.6MB
SHA256 25cb2d57a68edd3c9ed9d905becca6f3883819b4f8229f26bb5b8b877253c0df
MD5 e9da1ac879bc20ea2b6d2207d622b0e3
SHA1 ac174db1849a20458bea02ded5bd324da113373f
SHA512 21b117478de0e1fee5ef6679680119a4c850eca2c2f2d6ea8b8ad406659af2f118478254a1fd21b3170a8a7953333046b25589f96d1b74fe9ef2b33b52010665
SSDEEP 49152:snsHyjtk2MYC5GDXB9N7nwvZQbh1lMg8h9f/47u:snsmtk2aaRwOPagU9j
MD5 SHA1 SHA512 SSDEEP

Submit Download

directx.sys

Path C:\Windows\directx.sys
Size 66B
SHA256 b1304d541b965969b360d5f0a4e3441d52dd1202aecb32ec32e68b82f8951f4b
MD5 b0bf31abfa7b64da8a3f257366eb0e01
SHA1 958444a8449749a409f0dfbfc84f65069fb4f799
SHA512 baf49da82bf90f84bcdab2e95c5d5bff9ba715c4c502ec5036f22076c65e2dcc1b10bab4b11fb97ae257ef1b4ee68240cac8a8ce8981c5d44074acb63e045f09
MD5 SHA1 SHA512

Submit Download

directx.sys

Path C:\Windows\directx.sys
Size 48B
SHA256 6692dcebc7a902ff867b0754f3107d577cc6c7289a46b684416cec685bd81d7f
MD5 96d716bb2a2b72e7d2d0badb3c473eb5
SHA1 a0cd13f6c49e8610b006d2cc0d677b31ba91a79e
SHA512 988e0d46a9e4affdc69b9e364a8b348dda79496f178c3459c198368364b3b3c005bf3b58aac3d861c4b6d923abbad9977630d54a80dea59314c333cd112e211b
MD5 SHA1 SHA512

Submit Download

svchost.com

Path C:\Windows\svchost.com
Size 40KB
SHA256 ff787f8231bb6f6a30eb61f46d56920e742ae22dd047622f8fbe6266d8bb864d
MD5 2ff724ca136d4a831421dfd891e167c6
SHA1 5416f8de17ae4a8d9ea2e2d4570c5dd9ba7e5eb8
SHA512 5ad202eb3222b9a95695ee1ffcebdaa3cd7235dbc8a1bf845e560736f514d9d7c92bc509c7089f53ff391bcd1d053050ccf0d889102a2b53b373d211dfbd9dc0
SSDEEP 768:eyxqjQl/EMQt4Oei7RwsHxyP7nbxzOQdJzGmy:JxqjQ+P04wsmJC
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOGTRA~1.EXE

Path \PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE
Size 252KB
SHA256 8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043
MD5 9e2b9928c89a9d0da1d3e8f4bd96afa7
SHA1 ec66cda99f44b62470c6930e5afda061579cde35
SHA512 2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156
SSDEEP 6144:gMTi0+lfh+L5qe9T5q4GAFzWTBPMmC1UC6fOaU:gMTi0uhMqe9ts2zWTpMmCG7W
MD5 SHA1 SHA512 SSDEEP

Submit Download

._cache_731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe

Path \Users\Admin\AppData\Local\Temp\._cache_731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
Size 3.6MB
SHA256 49813b0ced67a8b2ef0872ea992937b421583e8ddbecff1c90d004e92d6b9a1b
MD5 69dceacd9bd9e02d1f51a285d6d0767b
SHA1 02cb546bd7ab388ba99ea99caa8f160345cf8c52
SHA512 881657d8a10dddee03835ca209439190d3572a6846b8360d5c5d957397cff032ef9d2f425033d1abd0336ea56fb93ce123437de1f20ec41f75400eb6d82d083a
SSDEEP 49152:6Hyjtk2MYC5GDXB9N7nwvZQbh1lMg8h9f/47/n9:6mtk2aaRwOPagU9In9
MD5 SHA1 SHA512 SSDEEP

Submit Download

731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe

Path \Users\Admin\AppData\Local\Temp\3582-490\731c62a6d58d1e6e241223aac7e8944953dfc455f49d5d52c76fe190aa5a79e9_NeikiAnalytics.exe
Size 4.7MB
SHA256 ee843704e00f865c128c05a0d5181a594c621d1ed80a8f33a4e7bfe5401fff28
MD5 868bd10e76594c74b13998c9bb88fc2d
SHA1 3402fe581fa7d8dce8f8e83faaf00799e1a1e35b
SHA512 73422710573f9a1065f92992b3c96917905b7c279dedc31fb0416eb149dd899edc42d68a8055c0a7bc3aecf83d524c12dec8ca8b7c78b2b10811a183c58c1f47
SSDEEP 49152:2nsHyjtk2MYC5GDKHyjtk2MYC5GDXB9N7nwvZQbh1lMg8h9f/47/nr:2nsmtk2azmtk2aaRwOPagU9Inr
MD5 SHA1 SHA512 SSDEEP

Submit Download

XPlugin.dll

Path \Users\Admin\AppData\Local\Temp\XPlugin.dll
Size 8KB
SHA256 a67643858f5e1c7c08e563d6c281f9644dff1dcf020eeb88f912cf368671381d
MD5 195eb26d43dd473543b2c943dce3f90a
SHA1 9c3db151a417f4abb13836e4d3cdeec7a8651987
SHA512 f171e6d12678a6fa360eb7ca8c4f959c0ae91421850836c038bfb6d75ffb7b91f0cf59e1f053ef73c928b21ab5485bf676fad7b4426618bed316a16bcfd10a68
SSDEEP 96:8nSUlDqlBqDRMcY1MUTuaFAyXL/htVM/oGOh4BpteXw7Gdxi:8f3VMT1MUCaFAWiTOh40Xw+
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/728-106-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/1480-130-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/1628-112-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/1664-54-0x0000000000400000-0x00000000008BE000-memory.dmp

Download

memory/1664-16-0x0000000000400000-0x00000000008BE000-memory.dmp

Download

memory/1696-267-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/1696-245-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/1696-310-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/1696-261-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/1696-94-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/1696-307-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/1696-257-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/1696-253-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/1696-297-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/1696-249-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/1696-303-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/1888-210-0x000000005FFF0000-0x0000000060000000-memory.dmp

Download

memory/1912-244-0x0000000000400000-0x00000000008BE000-memory.dmp

Download

memory/1912-252-0x0000000000400000-0x00000000008BE000-memory.dmp

Download

memory/1932-99-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2004-133-0x00000000004F0000-0x00000000004F3000-memory.dmp

Download

memory/2004-132-0x00000000004F0000-0x00000000004F3000-memory.dmp

Download

memory/2020-119-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2492-251-0x0000000000400000-0x00000000008BE000-memory.dmp

Download

memory/2492-247-0x0000000000400000-0x00000000008BE000-memory.dmp

Download

memory/2492-301-0x0000000000400000-0x00000000008BE000-memory.dmp

Download

memory/2492-213-0x0000000000400000-0x00000000008BE000-memory.dmp

Download

memory/2672-64-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2784-262-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2784-258-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2784-254-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2784-268-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2784-250-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2784-300-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2784-246-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2784-212-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2784-304-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2784-308-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2832-107-0x0000000000340000-0x0000000000343000-memory.dmp

Download

memory/2832-108-0x0000000000340000-0x0000000000343000-memory.dmp

Download

memory/2992-86-0x0000000000400000-0x000000000079D000-memory.dmp

Download