Malware Analysis Report

2024-09-11 09:44

Sample ID 240626-t5qqasshpb
Target 057cdca456ab6f349e7a0c5d266607f865a2925c1fcc221a965f62783fd100a4_NeikiAnalytics.exe
SHA256 057cdca456ab6f349e7a0c5d266607f865a2925c1fcc221a965f62783fd100a4
Tags
redline sectoprat cheat execution infostealer rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

057cdca456ab6f349e7a0c5d266607f865a2925c1fcc221a965f62783fd100a4

Threat Level: Known bad

The file 057cdca456ab6f349e7a0c5d266607f865a2925c1fcc221a965f62783fd100a4_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

redline sectoprat cheat execution infostealer rat trojan

SectopRAT payload

SectopRAT

RedLine

RedLine payload

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Suspicious use of SetThreadContext

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Scheduled Task/Job: Scheduled Task

Suspicious use of WriteProcessMemory

Suspicious use of FindShellTrayWindow

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Command and Scripting Interpreter
T1059
PowerShell
T1059.001
Scheduled Task/Job
T1053
Scheduled Task
T1053.005
Persistence
TA0003
Scheduled Task/Job
T1053
Scheduled Task
T1053.005
Privilege Escalation
TA0004
Scheduled Task/Job
T1053
Scheduled Task
T1053.005
Defense Evasion
TA0005
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-26 16:38

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-26 16:38

Reported

2024-06-26 16:41

Platform

win7-20240508-en

Max time kernel

147s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\057cdca456ab6f349e7a0c5d266607f865a2925c1fcc221a965f62783fd100a4_NeikiAnalytics.exe"

Signatures

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

SectopRAT

trojan rat sectoprat

SectopRAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\057cdca456ab6f349e7a0c5d266607f865a2925c1fcc221a965f62783fd100a4_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\057cdca456ab6f349e7a0c5d266607f865a2925c1fcc221a965f62783fd100a4_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\057cdca456ab6f349e7a0c5d266607f865a2925c1fcc221a965f62783fd100a4_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\057cdca456ab6f349e7a0c5d266607f865a2925c1fcc221a965f62783fd100a4_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2728 set thread context of 2792 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe

Enumerates physical storage devices

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\DllHost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2228 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\057cdca456ab6f349e7a0c5d266607f865a2925c1fcc221a965f62783fd100a4_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 2228 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\057cdca456ab6f349e7a0c5d266607f865a2925c1fcc221a965f62783fd100a4_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 2228 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\057cdca456ab6f349e7a0c5d266607f865a2925c1fcc221a965f62783fd100a4_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 2228 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\057cdca456ab6f349e7a0c5d266607f865a2925c1fcc221a965f62783fd100a4_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 2728 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2728 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2728 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2728 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2728 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2728 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2728 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2728 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2728 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\schtasks.exe
PID 2728 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\schtasks.exe
PID 2728 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\schtasks.exe
PID 2728 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\schtasks.exe
PID 2728 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 2728 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 2728 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 2728 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 2728 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 2728 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 2728 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 2728 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 2728 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe

Processes

C:\Users\Admin\AppData\Local\Temp\057cdca456ab6f349e7a0c5d266607f865a2925c1fcc221a965f62783fd100a4_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\057cdca456ab6f349e7a0c5d266607f865a2925c1fcc221a965f62783fd100a4_NeikiAnalytics.exe"

C:\Windows\SysWOW64\DllHost.exe

C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}

C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\DRIaUJaxClxFyS.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DRIaUJaxClxFyS" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5F30.tmp"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"

Network

Country Destination Domain Proto
NL 185.222.58.70:55615 tcp
NL 185.222.58.70:55615 tcp
NL 185.222.58.70:55615 tcp
NL 185.222.58.70:55615 tcp
NL 185.222.58.70:55615 tcp
NL 185.222.58.70:55615 tcp

Files

memory/2228-4-0x0000000000620000-0x0000000000622000-memory.dmp

memory/2488-5-0x0000000000140000-0x0000000000142000-memory.dmp

memory/2488-6-0x0000000000410000-0x0000000000411000-memory.dmp

\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe

MD5 01403de5e5b173a6459964ebc76ea44c
SHA1 e0e0badffcd445fb5a9940d5d9894f9faf2d3c15
SHA256 c97a7970e247697ee931d61c10242a1f0f2b24d4e8ef784b26e7b8409ae13131
SHA512 497a95bc5175c83c2346b9359af4ffae020fdfc5adab9d1aa3df11e59bc53f8f6e830e3fe4a9a62d912242923dc9ace81390ecec0425b7d64538b5e07507b950

memory/2728-21-0x0000000000ED0000-0x0000000000F50000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.jpg

MD5 e83ccb51ee74efd2a221be293d23c69a
SHA1 4365ca564f7cdd7337cf0f83ac5fd64317fb4c32
SHA256 da931852a19a707d01c3edf138622b8601056c42525f8ac40cb48af43a7410cc
SHA512 0252e629fbdafdb66ff63ef76d18f25d1ca46ac3eff019f012361db45ebd34d1a7a9ad35f7a2fc5830676c771997633f3abf1dc3224bd8f6bd55456b0a554a46

memory/2728-23-0x0000000004E80000-0x0000000004EF6000-memory.dmp

memory/2728-24-0x00000000005A0000-0x00000000005B2000-memory.dmp

memory/2728-25-0x0000000000700000-0x0000000000708000-memory.dmp

memory/2728-26-0x0000000000710000-0x000000000071C000-memory.dmp

memory/2728-27-0x00000000053F0000-0x0000000005450000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp5F30.tmp

MD5 0809b88444f65d3ba4b62e9ad8ab6daa
SHA1 dcefee9e1fe4cece9a7ebaf8823922120a5785ca
SHA256 95be6d13249c4f858455bd2b121fc730f96e9c61c02b1ac2a280cea00d4d81bc
SHA512 3e271d481e241d11738bbd1da245de7544fd334a82047da39d7bd589df409be28f25dded351532c32659c3bb77abc454c3cf9fc0ced396f488504159dab0abf9

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 894dfffbbfc0df3f39f8de138fa0419b
SHA1 4dfe9d251a1311460d2466fcac23d166031a7762
SHA256 e7f29b8e6ec90bc13d57b2d74fbbfa126659d5a1250ba15d1e7eb70c3a4e27d0
SHA512 ab3751d5bc4853cd953ac1b0c69ad31e3d5e040755d2300d3a7d2145c14a14c42b49be1567783b1f92f3b641fae9832f2da21758f5699011d3f70736d58879ac

memory/2792-41-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2792-50-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2792-49-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2792-47-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2792-45-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2792-43-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2792-52-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2792-53-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2488-54-0x0000000000410000-0x0000000000411000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-26 16:38

Reported

2024-06-26 16:41

Platform

win10v2004-20240508-en

Max time kernel

129s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\057cdca456ab6f349e7a0c5d266607f865a2925c1fcc221a965f62783fd100a4_NeikiAnalytics.exe"

Signatures

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A

SectopRAT

trojan rat sectoprat

SectopRAT payload

Description Indicator Process Target
N/A N/A N/A N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\057cdca456ab6f349e7a0c5d266607f865a2925c1fcc221a965f62783fd100a4_NeikiAnalytics.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3708 set thread context of 4504 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe

Enumerates physical storage devices

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1340 wrote to memory of 3708 N/A C:\Users\Admin\AppData\Local\Temp\057cdca456ab6f349e7a0c5d266607f865a2925c1fcc221a965f62783fd100a4_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 1340 wrote to memory of 3708 N/A C:\Users\Admin\AppData\Local\Temp\057cdca456ab6f349e7a0c5d266607f865a2925c1fcc221a965f62783fd100a4_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 1340 wrote to memory of 3708 N/A C:\Users\Admin\AppData\Local\Temp\057cdca456ab6f349e7a0c5d266607f865a2925c1fcc221a965f62783fd100a4_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 3708 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3708 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3708 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3708 wrote to memory of 1528 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3708 wrote to memory of 1528 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3708 wrote to memory of 1528 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3708 wrote to memory of 3128 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\schtasks.exe
PID 3708 wrote to memory of 3128 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\schtasks.exe
PID 3708 wrote to memory of 3128 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Windows\SysWOW64\schtasks.exe
PID 3708 wrote to memory of 3192 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 3708 wrote to memory of 3192 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 3708 wrote to memory of 3192 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 3708 wrote to memory of 4504 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 3708 wrote to memory of 4504 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 3708 wrote to memory of 4504 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 3708 wrote to memory of 4504 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 3708 wrote to memory of 4504 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 3708 wrote to memory of 4504 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 3708 wrote to memory of 4504 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
PID 3708 wrote to memory of 4504 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe

Processes

C:\Users\Admin\AppData\Local\Temp\057cdca456ab6f349e7a0c5d266607f865a2925c1fcc221a965f62783fd100a4_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\057cdca456ab6f349e7a0c5d266607f865a2925c1fcc221a965f62783fd100a4_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\DRIaUJaxClxFyS.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DRIaUJaxClxFyS" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA325.tmp"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"

Network

Country Destination Domain Proto
NL 185.222.58.70:55615 tcp
NL 185.222.58.70:55615 tcp
NL 185.222.58.70:55615 tcp
NL 185.222.58.70:55615 tcp
NL 185.222.58.70:55615 tcp

Files

C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe

MD5 01403de5e5b173a6459964ebc76ea44c
SHA1 e0e0badffcd445fb5a9940d5d9894f9faf2d3c15
SHA256 c97a7970e247697ee931d61c10242a1f0f2b24d4e8ef784b26e7b8409ae13131
SHA512 497a95bc5175c83c2346b9359af4ffae020fdfc5adab9d1aa3df11e59bc53f8f6e830e3fe4a9a62d912242923dc9ace81390ecec0425b7d64538b5e07507b950

memory/3708-14-0x000000007279E000-0x000000007279F000-memory.dmp

memory/3708-15-0x00000000001D0000-0x0000000000250000-memory.dmp

memory/3708-16-0x00000000050E0000-0x0000000005684000-memory.dmp

memory/3708-17-0x0000000004C30000-0x0000000004CC2000-memory.dmp

memory/3708-18-0x0000000004CF0000-0x0000000004CFA000-memory.dmp

memory/3708-19-0x0000000072790000-0x0000000072F40000-memory.dmp

memory/3708-20-0x0000000005BC0000-0x00000000060EC000-memory.dmp

memory/3708-21-0x0000000004F90000-0x000000000502C000-memory.dmp

memory/3708-22-0x0000000005030000-0x00000000050A6000-memory.dmp

memory/3708-23-0x0000000005790000-0x00000000057A2000-memory.dmp

memory/3708-24-0x0000000006B00000-0x0000000006B08000-memory.dmp

memory/3708-25-0x0000000006B10000-0x0000000006B1C000-memory.dmp

memory/3708-26-0x0000000006D70000-0x0000000006DD0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.jpg

MD5 e83ccb51ee74efd2a221be293d23c69a
SHA1 4365ca564f7cdd7337cf0f83ac5fd64317fb4c32
SHA256 da931852a19a707d01c3edf138622b8601056c42525f8ac40cb48af43a7410cc
SHA512 0252e629fbdafdb66ff63ef76d18f25d1ca46ac3eff019f012361db45ebd34d1a7a9ad35f7a2fc5830676c771997633f3abf1dc3224bd8f6bd55456b0a554a46

memory/2268-32-0x0000000002150000-0x0000000002186000-memory.dmp

memory/2268-33-0x0000000004CF0000-0x0000000005318000-memory.dmp

memory/2268-34-0x0000000004AC0000-0x0000000004AE2000-memory.dmp

memory/2268-40-0x0000000004C60000-0x0000000004CC6000-memory.dmp

memory/2268-41-0x0000000005420000-0x0000000005486000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpA325.tmp

MD5 1568e4e16caf22d596a96a6b8433cdc4
SHA1 85edbe1f2278c28961ec0671f13bece2bfe81b76
SHA256 5f75d8261cd81c031ae3d8fada92c4bcce3c39d585fb4f2a52263df45eb3ac9b
SHA512 7092a5cca62637613493ff6f0aa615db91396c15ba23fb9db12e41ffc2cae20382353031de55e35667794b6378800652ed29fc939f5d517b5d56e9df66c25eb0

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tivimxz4.ttk.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/2268-47-0x0000000005490000-0x00000000057E4000-memory.dmp

memory/4504-49-0x0000000000400000-0x000000000041E000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PO.exe.log

MD5 6f8f3a9a57cb30e686d3355e656031e0
SHA1 acccd6befb1a2f40e662280bc5182e086a0d079b
SHA256 283586e83b25099a5698cb9caf9c594a37060d11e0f55c81bb9c6d4f728448ea
SHA512 8f11d645ff4f8d5b1c45b06eb52cd45319659255306d60e80e33abfd04b9e3b1164679f11a8a23bd493e4b3f6b9841d70e553a01835eeaf6035b4d05e4fd7b54

memory/3708-53-0x0000000072790000-0x0000000072F40000-memory.dmp

memory/4504-54-0x0000000005580000-0x0000000005B98000-memory.dmp

memory/4504-64-0x0000000005060000-0x0000000005072000-memory.dmp

memory/4504-65-0x00000000050C0000-0x00000000050FC000-memory.dmp

memory/4504-66-0x0000000005100000-0x000000000514C000-memory.dmp

memory/2268-67-0x0000000005A60000-0x0000000005A7E000-memory.dmp

memory/4504-68-0x0000000005350000-0x000000000545A000-memory.dmp

memory/2268-70-0x000000006FE90000-0x000000006FEDC000-memory.dmp

memory/2268-69-0x0000000006A20000-0x0000000006A52000-memory.dmp

memory/2268-80-0x0000000006050000-0x000000000606E000-memory.dmp

memory/2268-82-0x0000000006C60000-0x0000000006D03000-memory.dmp

memory/1528-81-0x000000006FE90000-0x000000006FEDC000-memory.dmp

memory/1528-92-0x0000000007940000-0x0000000007FBA000-memory.dmp

memory/2268-93-0x0000000006D90000-0x0000000006DAA000-memory.dmp

memory/1528-94-0x0000000007370000-0x000000000737A000-memory.dmp

memory/2268-95-0x0000000007010000-0x00000000070A6000-memory.dmp

memory/1528-96-0x0000000007500000-0x0000000007511000-memory.dmp

memory/1528-97-0x0000000007530000-0x000000000753E000-memory.dmp

memory/2268-98-0x0000000006FD0000-0x0000000006FE4000-memory.dmp

memory/2268-99-0x00000000070D0000-0x00000000070EA000-memory.dmp

memory/1528-100-0x0000000007620000-0x0000000007628000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 875aa62e33c7c6afa3ce3cc5d2741122
SHA1 00bbb4c4c7b8812226f0a83ea9fa41539af94f70
SHA256 1004f6f21caa2ee7e6c89d226f977e7494d61f824913d97f76d0cebdc8e0ebfe
SHA512 974b47976f0188c56f7cdbbbc27a9c6feead7a023e9fafee3998f6ffd5c9ba35748f0d42367adce1ae75823c5fdff0159a8561e7a33030ce33efafc5437b30d5