nanocore | 6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b

Analysis

max time kernel
137s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28-06-2024 02:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
Size

243KB
MD5

21a74c8ef323e2da70e8e456371a5e90
SHA1

1cdc4206ff216e5e36a203a96e49b7912799aa0a
SHA256

6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b
SHA512

5c9642696157994360c282616e089cd6edb0e719a1f811f399cd6cbec2dd9afa56cf912b6531aacac0825412e46e32fbabc0a56c3945724716ae34e1829cbbea
SSDEEP

6144:k9dta6dtJmakIM5Q2bTnvHbLOupQe4li2+YLV6h:stpmkRizzLVpEs2+YLV6h

Score

10^/10

nanocore neshta evasion keylogger persistence spyware stealer trojan

Malware Config

Signatures

Detect Neshta payload 4 IoCs

Processes:

resource	yara_rule
C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE	family_neshta
behavioral2/memory/3548-104-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/3548-106-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/3548-110-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

Processes:

6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe

pid process

2272 6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

Processes:

6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DDP Host = "C:\\Program Files (x86)\\DDP Host\\ddphost.exe"	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe

Drops file in Program Files directory 64 IoCs

Processes:

6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe

description	ioc	process
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.37\MICROS~1.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.37\MICROS~4.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpshare.exe	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpconfig.exe	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{D87AE~1\WINDOW~1.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\DDPHOS~1\ddphost.exe	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.37\MICROS~3.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13187~1.37\MICROS~1.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF5AF~1\WINDOW~1.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmplayer.exe	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\setup_wm.exe	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{63880~1\WINDOW~1.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File created	C:\Program Files (x86)\DDP Host\ddphost.exe	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.37\MI391D~1.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wab.exe	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.37\MI9C33~1.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.37\MICROS~2.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wabmig.exe	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\DDP Host\ddphost.exe	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe

Drops file in Windows directory 1 IoCs

Processes:

6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe

description ioc process

File opened for modification C:\Windows\svchost.com 6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\svchost.com	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe

Modifies registry class 1 IoCs

Processes:

6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe

pid	process
2272	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
2272	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
2272	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe

pid process

2272 6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe

description pid process

Token: SeDebugPrivilege 2272 6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe

description	pid	process
Token: SeDebugPrivilege	2272	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe

description	pid	process	target process
PID 3548 wrote to memory of 2272	3548	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
PID 3548 wrote to memory of 2272	3548	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
PID 3548 wrote to memory of 2272	3548	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3548

C:\Users\Admin\AppData\Local\Temp\3582-490\6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3582-490\6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2272

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE
Filesize
86KB

MD5
3b73078a714bf61d1c19ebc3afc0e454

SHA1
9abeabd74613a2f533e2244c9ee6f967188e4e7e

SHA256
ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29

SHA512
75959d4e8a7649c3268b551a2a378e6d27c0bfb03d2422ebeeb67b0a3f78c079473214057518930f2d72773ce79b106fd2d78405e8e3d8883459dcbb49c163c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
Filesize
202KB

MD5
9c4dcf741e76d2c6fd7ddd651e1e41cc

SHA1
4f4b01a8ccdcfcfe59e4afdf79df2375d65aa968

SHA256
f5e04ad6c516a27d72b4ba6c00c273fb8ef5db587b3a8042c1a589ce00e4324a

SHA512
0c861e0f7ce7ae2181c03248961d98f9786626bbb9e140305658518bcbc654f35ae2ab0d1672852b7c5f370920602941b0b2336ac80e093992cab2796a1700a6

Download Submit
memory/2272-107-0x00000000736A2000-0x00000000736A3000-memory.dmp

Filesize
4KB

Download
memory/2272-11-0x00000000736A0000-0x0000000073C51000-memory.dmp

Filesize
5.7MB

Download
memory/2272-14-0x00000000736A0000-0x0000000073C51000-memory.dmp

Filesize
5.7MB

Download
memory/2272-10-0x00000000736A0000-0x0000000073C51000-memory.dmp

Filesize
5.7MB

Download
memory/2272-105-0x00000000736A0000-0x0000000073C51000-memory.dmp

Filesize
5.7MB

Download
memory/2272-9-0x00000000736A2000-0x00000000736A3000-memory.dmp

Filesize
4KB

Download
memory/2272-108-0x00000000736A0000-0x0000000073C51000-memory.dmp

Filesize
5.7MB

Download
memory/2272-111-0x00000000736A0000-0x0000000073C51000-memory.dmp

Filesize
5.7MB

Download
memory/3548-104-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3548-106-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3548-110-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download