Malware Analysis Report

2024-09-11 09:55

Sample ID 240625-addrwasgjm
Target 14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe
SHA256 14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3
Tags
redline sectoprat cheat execution infostealer rat trojan discovery spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3

Threat Level: Known bad

The file 14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

redline sectoprat cheat execution infostealer rat trojan discovery spyware stealer

RedLine

SectopRAT payload

SectopRAT

RedLine payload

Command and Scripting Interpreter: PowerShell

Reads user/profile data of web browsers

Checks computer location settings

Checks installed software on the system

Accesses cryptocurrency files/wallets, possible credential harvesting

Suspicious use of SetThreadContext

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Scheduled Task/Job: Scheduled Task

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Command and Scripting Interpreter
T1059
PowerShell
T1059.001
Scheduled Task/Job
T1053
Scheduled Task
T1053.005
Persistence
TA0003
Scheduled Task/Job
T1053
Scheduled Task
T1053.005
Privilege Escalation
TA0004
Scheduled Task/Job
T1053
Scheduled Task
T1053.005
Defense Evasion
TA0005
Credential Access
TA0006
Unsecured Credentials
T1552
Credentials In Files
T1552.001
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Lateral Movement
TA0008
Collection
TA0009
Data from Local System
T1005
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-25 00:05

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-25 00:05

Reported

2024-06-25 00:08

Platform

win7-20240508-en

Max time kernel

147s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe"

Signatures

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

SectopRAT

trojan rat sectoprat

SectopRAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2116 set thread context of 2516 N/A C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe

Enumerates physical storage devices

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2116 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2116 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2116 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2116 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2116 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2116 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2116 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2116 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2116 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe C:\Windows\SysWOW64\schtasks.exe
PID 2116 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe C:\Windows\SysWOW64\schtasks.exe
PID 2116 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe C:\Windows\SysWOW64\schtasks.exe
PID 2116 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe C:\Windows\SysWOW64\schtasks.exe
PID 2116 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe
PID 2116 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe
PID 2116 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe
PID 2116 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe
PID 2116 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe
PID 2116 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe
PID 2116 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe
PID 2116 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe
PID 2116 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe
PID 2116 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe
PID 2116 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe
PID 2116 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe
PID 2116 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe

Processes

C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\lYrtmsGR.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\lYrtmsGR" /XML "C:\Users\Admin\AppData\Local\Temp\tmp64EB.tmp"

C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe"

Network

Country Destination Domain Proto
NL 185.222.58.91:55615 tcp
NL 185.222.58.91:55615 tcp
NL 185.222.58.91:55615 tcp
NL 185.222.58.91:55615 tcp
NL 185.222.58.91:55615 tcp
NL 185.222.58.91:55615 tcp

Files

memory/2116-0-0x00000000748DE000-0x00000000748DF000-memory.dmp

memory/2116-1-0x0000000000070000-0x0000000000108000-memory.dmp

memory/2116-2-0x00000000748D0000-0x0000000074FBE000-memory.dmp

memory/2116-3-0x0000000000690000-0x00000000006A2000-memory.dmp

memory/2116-4-0x00000000006B0000-0x00000000006B8000-memory.dmp

memory/2116-5-0x00000000006C0000-0x00000000006CC000-memory.dmp

memory/2116-6-0x00000000042B0000-0x0000000004310000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 94baa69d00985a52953a861da5c243e4
SHA1 ef2ef81243bc65433823164114ea32b471662201
SHA256 99ef63638b1431b26fbec06338d7d63ff79c2e74c63102676bc5b4adc441eb6e
SHA512 fdedfcfde9469ecde19a71e1a869e04316d4e23d9ba6ca0e08716757d66627e96dddd15cfe596152e56318272aa9e46d615ae1e97b42c2c0e3c9e4c5bf435e50

C:\Users\Admin\AppData\Local\Temp\tmp64EB.tmp

MD5 6c633f104aa9f8123611be0c0c47dea4
SHA1 7cfb83ce4c4b5256b9223f3624a2c5c34d9cc5b7
SHA256 2808383925943c4f4d8a7e04bb74696d357f5ee713a8b81c9d043b5ae77dbd98
SHA512 f00b67e1279ddea1d63277b24107db9eaa74dd5368f18c8662440dddeba9dd5c1520ded9ecaa6dad1b1a1404fd4949089e6db74472753bd150ab2c42b9968c92

memory/2516-19-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2516-21-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2516-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2516-28-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2516-25-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2516-23-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2516-29-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2516-30-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2116-31-0x00000000748D0000-0x0000000074FBE000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-25 00:05

Reported

2024-06-25 00:08

Platform

win10v2004-20240226-en

Max time kernel

142s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe"

Signatures

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A

SectopRAT

trojan rat sectoprat

SectopRAT payload

Description Indicator Process Target
N/A N/A N/A N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4888 set thread context of 4620 N/A C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe

Enumerates physical storage devices

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4888 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4888 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4888 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4888 wrote to memory of 4904 N/A C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4888 wrote to memory of 4904 N/A C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4888 wrote to memory of 4904 N/A C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4888 wrote to memory of 4664 N/A C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe C:\Windows\SysWOW64\schtasks.exe
PID 4888 wrote to memory of 4664 N/A C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe C:\Windows\SysWOW64\schtasks.exe
PID 4888 wrote to memory of 4664 N/A C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe C:\Windows\SysWOW64\schtasks.exe
PID 4888 wrote to memory of 4620 N/A C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe
PID 4888 wrote to memory of 4620 N/A C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe
PID 4888 wrote to memory of 4620 N/A C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe
PID 4888 wrote to memory of 4620 N/A C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe
PID 4888 wrote to memory of 4620 N/A C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe
PID 4888 wrote to memory of 4620 N/A C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe
PID 4888 wrote to memory of 4620 N/A C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe
PID 4888 wrote to memory of 4620 N/A C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe

Processes

C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1416 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\lYrtmsGR.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\lYrtmsGR" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD05B.tmp"

C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe"

Network

Country Destination Domain Proto
GB 96.16.110.114:80 tcp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 80.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 164.189.21.2.in-addr.arpa udp
GB 142.250.187.234:443 tcp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 13.107.246.64:443 tcp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
NL 185.222.58.91:55615 185.222.58.91 tcp
US 8.8.8.8:53 91.58.222.185.in-addr.arpa udp
US 8.8.8.8:53 api.ip.sb udp
US 172.67.75.172:443 api.ip.sb tcp
US 8.8.8.8:53 172.75.67.172.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 85.65.42.20.in-addr.arpa udp

Files

memory/4888-0-0x0000000074EEE000-0x0000000074EEF000-memory.dmp

memory/4888-1-0x0000000000C90000-0x0000000000D28000-memory.dmp

memory/4888-2-0x0000000005C00000-0x00000000061A4000-memory.dmp

memory/4888-3-0x0000000005710000-0x00000000057A2000-memory.dmp

memory/4888-4-0x0000000074EE0000-0x0000000075690000-memory.dmp

memory/4888-5-0x00000000058D0000-0x00000000058DA000-memory.dmp

memory/4888-6-0x0000000005A00000-0x0000000005A12000-memory.dmp

memory/4888-7-0x0000000074EEE000-0x0000000074EEF000-memory.dmp

memory/4888-8-0x0000000005B30000-0x0000000005B38000-memory.dmp

memory/4888-9-0x0000000005B40000-0x0000000005B4C000-memory.dmp

memory/4888-10-0x0000000008480000-0x00000000084E0000-memory.dmp

memory/4888-11-0x000000000AC60000-0x000000000ACFC000-memory.dmp

memory/4888-12-0x0000000074EE0000-0x0000000075690000-memory.dmp

memory/2784-13-0x0000000074EE0000-0x0000000075690000-memory.dmp

memory/2784-14-0x0000000074EE0000-0x0000000075690000-memory.dmp

memory/2784-15-0x0000000000F70000-0x0000000000FA6000-memory.dmp

memory/2784-16-0x0000000074EE0000-0x0000000075690000-memory.dmp

memory/2784-17-0x0000000005110000-0x0000000005738000-memory.dmp

memory/4904-22-0x0000000074EE0000-0x0000000075690000-memory.dmp

memory/4904-23-0x0000000074EE0000-0x0000000075690000-memory.dmp

memory/4904-24-0x0000000074EE0000-0x0000000075690000-memory.dmp

memory/4904-25-0x0000000004F80000-0x0000000004FA2000-memory.dmp

memory/2784-26-0x0000000004E90000-0x0000000004EF6000-memory.dmp

memory/2784-27-0x0000000004F00000-0x0000000004F66000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpD05B.tmp

MD5 43d5df07ba98eab2fc03b3bc7780c0d8
SHA1 c763ca072b5b1376e52ca6ce2c10330e129ca35b
SHA256 711860bd54f2ae1c2cf5a54d94902aca88e188526a7cee16d13ecf914cf5e4e4
SHA512 70b3c4c9c4268f1dd9db662a69636c47e7704e1b8a286eca2dab7b61d3207276d07d3527d4867740f2067f9ba8b3add9d466302cc45923bbc522c34cfe79851c

memory/4620-29-0x0000000000400000-0x000000000041E000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\14cd493a12d574d93b87302e3f76517b5e05ebca0c7572595f5256305d2fc6c3_NeikiAnalytics.exe.log

MD5 8ec831f3e3a3f77e4a7b9cd32b48384c
SHA1 d83f09fd87c5bd86e045873c231c14836e76a05c
SHA256 7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
SHA512 26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

memory/4888-32-0x0000000074EE0000-0x0000000075690000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jccq0ljo.qnx.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4620-43-0x0000000005650000-0x0000000005C68000-memory.dmp

memory/4620-44-0x0000000004E80000-0x0000000004E92000-memory.dmp

memory/4620-53-0x0000000004EE0000-0x0000000004F1C000-memory.dmp

memory/2784-54-0x0000000074EE0000-0x0000000075690000-memory.dmp

memory/4904-55-0x0000000005A90000-0x0000000005DE4000-memory.dmp

memory/4620-56-0x0000000004F20000-0x0000000004F6C000-memory.dmp

memory/2784-57-0x0000000005ED0000-0x0000000005EEE000-memory.dmp

memory/2784-58-0x0000000074EE0000-0x0000000075690000-memory.dmp

memory/4620-59-0x0000000005180000-0x000000000528A000-memory.dmp

memory/4904-60-0x0000000074EE0000-0x0000000075690000-memory.dmp

memory/4904-63-0x00000000712A0000-0x00000000712EC000-memory.dmp

memory/2784-62-0x00000000712A0000-0x00000000712EC000-memory.dmp

memory/2784-61-0x0000000006530000-0x0000000006562000-memory.dmp

memory/2784-82-0x0000000006510000-0x000000000652E000-memory.dmp

memory/2784-83-0x0000000007140000-0x00000000071E3000-memory.dmp

memory/4904-84-0x0000000074EE0000-0x0000000075690000-memory.dmp

memory/4904-85-0x0000000007970000-0x0000000007FEA000-memory.dmp

memory/4904-86-0x00000000072B0000-0x00000000072CA000-memory.dmp

memory/2784-87-0x00000000072E0000-0x00000000072EA000-memory.dmp

memory/4904-88-0x0000000074EE0000-0x0000000075690000-memory.dmp

memory/4620-89-0x0000000006460000-0x0000000006622000-memory.dmp

memory/4620-90-0x0000000006B60000-0x000000000708C000-memory.dmp

memory/2784-91-0x00000000074E0000-0x0000000007576000-memory.dmp

memory/4620-92-0x0000000006630000-0x00000000066A6000-memory.dmp

memory/2784-93-0x0000000007260000-0x0000000007271000-memory.dmp

memory/4620-94-0x0000000006810000-0x000000000682E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp5197.tmp

MD5 02d2c46697e3714e49f46b680b9a6b83
SHA1 84f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256 522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA512 60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

C:\Users\Admin\AppData\Local\Temp\tmp5344.tmp

MD5 4c2e2189b87f507edc2e72d7d55583a0
SHA1 1f06e340f76d41ea0d1e8560acd380a901b2a5bd
SHA256 99a5f8dea08b5cf512ed888b3e533cc77c08dc644078793dc870abd8828c1bca
SHA512 8b6b49e55afe8a697aaf71d975fab9e906143339827f75a57876a540d0d7b9e3cbbcdd8b5435d6198900a73895cc52d2082e66ee8cec342e72f2e427dde71600

C:\Users\Admin\AppData\Local\Temp\tmp53BD.tmp

MD5 d444c807029c83b8a892ac0c4971f955
SHA1 fa58ce7588513519dc8fed939b26b05dc25e53b5
SHA256 8297a7698f19bb81539a18363db100c55e357fa73f773c2b883d2c4161f6a259
SHA512 b7958b843639d4223bef65cdc6c664d7d15b76ac4e0a8b1575201dd47a32899feff32389dcc047314f47944ebe7b774cd59e51d49202f49541bbd70ecbb31a2e

C:\Users\Admin\AppData\Local\Temp\tmp53D3.tmp

MD5 81620562c4675ca374611f0e4e6ca87d
SHA1 63b41176e26ea870ba321720cb98350d3d92d9e3
SHA256 b9848e1bf3c92606cc359dc74effdc2e9403af1b96f1b4f944be01292f70f652
SHA512 203f86ab40f3a78eed13ec7f72e50673b627d74f9b352cd32527638f4c1554a52e43f6a54e68b851e750a3d982c648299574af1f983b267aa0d7ffceb68d3a4d

C:\Users\Admin\AppData\Local\Temp\tmp540D.tmp

MD5 d367ddfda80fdcf578726bc3b0bc3e3c
SHA1 23fcd5e4e0e5e296bee7e5224a8404ecd92cf671
SHA256 0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0
SHA512 40e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77

memory/2784-246-0x0000000007290000-0x000000000729E000-memory.dmp

memory/2784-247-0x00000000074C0000-0x00000000074D4000-memory.dmp

memory/2784-248-0x00000000075B0000-0x00000000075CA000-memory.dmp

memory/4904-249-0x0000000007640000-0x0000000007648000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 a9a1be69ee3025c09b7545606b593bc1
SHA1 6665fde5f48e5198fe2f137279544166e7997295
SHA256 f91dd3db5542be59c5e2a69facfdf12ae3d68c44a31ffba20e0d17eb6e5a791c
SHA512 fbb4f0578d435e8170330161875f01113a1632cba8521ba2a8d595eac765976b2ff82907f2443824fa5dc7d9d5267295c09c7688eb1f8ec355767e8683b40ff7

memory/4904-255-0x0000000074EE0000-0x0000000075690000-memory.dmp

memory/2784-254-0x0000000074EE0000-0x0000000075690000-memory.dmp