description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	d064228c4138fbebb897dd0d74a69450ae58f1240ac9a33be7bb8e211f87a7db.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	koeafi.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\	koeafi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\koeafi = "C:\\Users\\Admin\\koeafi.exe /q"	koeafi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\koeafi = "C:\\Users\\Admin\\koeafi.exe /b"	koeafi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\koeafi = "C:\\Users\\Admin\\koeafi.exe /s"	koeafi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\koeafi = "C:\\Users\\Admin\\koeafi.exe /n"	koeafi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\koeafi = "C:\\Users\\Admin\\koeafi.exe /y"	koeafi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\koeafi = "C:\\Users\\Admin\\koeafi.exe /t"	koeafi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\koeafi = "C:\\Users\\Admin\\koeafi.exe /a"	koeafi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\koeafi = "C:\\Users\\Admin\\koeafi.exe /k"	koeafi.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\	d064228c4138fbebb897dd0d74a69450ae58f1240ac9a33be7bb8e211f87a7db.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\koeafi = "C:\\Users\\Admin\\koeafi.exe /r"	koeafi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\koeafi = "C:\\Users\\Admin\\koeafi.exe /o"	koeafi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\koeafi = "C:\\Users\\Admin\\koeafi.exe /j"	koeafi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\koeafi = "C:\\Users\\Admin\\koeafi.exe /u"	koeafi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\koeafi = "C:\\Users\\Admin\\koeafi.exe /i"	d064228c4138fbebb897dd0d74a69450ae58f1240ac9a33be7bb8e211f87a7db.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\koeafi = "C:\\Users\\Admin\\koeafi.exe /v"	koeafi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\koeafi = "C:\\Users\\Admin\\koeafi.exe /l"	koeafi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\koeafi = "C:\\Users\\Admin\\koeafi.exe /m"	koeafi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\koeafi = "C:\\Users\\Admin\\koeafi.exe /h"	koeafi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\koeafi = "C:\\Users\\Admin\\koeafi.exe /i"	koeafi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\koeafi = "C:\\Users\\Admin\\koeafi.exe /x"	koeafi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\koeafi = "C:\\Users\\Admin\\koeafi.exe /w"	koeafi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\koeafi = "C:\\Users\\Admin\\koeafi.exe /g"	koeafi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\koeafi = "C:\\Users\\Admin\\koeafi.exe /z"	koeafi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\koeafi = "C:\\Users\\Admin\\koeafi.exe /e"	koeafi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\koeafi = "C:\\Users\\Admin\\koeafi.exe /p"	koeafi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\koeafi = "C:\\Users\\Admin\\koeafi.exe /d"	koeafi.exe

pid	Process
364	d064228c4138fbebb897dd0d74a69450ae58f1240ac9a33be7bb8e211f87a7db.exe
1868	koeafi.exe
1868	koeafi.exe
1868	koeafi.exe
1868	koeafi.exe
1868	koeafi.exe
1868	koeafi.exe
1868	koeafi.exe
1868	koeafi.exe
1868	koeafi.exe
1868	koeafi.exe
1868	koeafi.exe
1868	koeafi.exe
1868	koeafi.exe
1868	koeafi.exe
1868	koeafi.exe
1868	koeafi.exe
1868	koeafi.exe
1868	koeafi.exe
1868	koeafi.exe
1868	koeafi.exe
1868	koeafi.exe
1868	koeafi.exe
1868	koeafi.exe
1868	koeafi.exe
1868	koeafi.exe
1868	koeafi.exe
1868	koeafi.exe
1868	koeafi.exe
1868	koeafi.exe
1868	koeafi.exe
1868	koeafi.exe
1868	koeafi.exe
1868	koeafi.exe
1868	koeafi.exe
1868	koeafi.exe
1868	koeafi.exe
1868	koeafi.exe
1868	koeafi.exe
1868	koeafi.exe
1868	koeafi.exe
1868	koeafi.exe
1868	koeafi.exe
1868	koeafi.exe
1868	koeafi.exe
1868	koeafi.exe
1868	koeafi.exe
1868	koeafi.exe
1868	koeafi.exe
1868	koeafi.exe

description	pid	Process	procid_target
PID 364 wrote to memory of 1868	364	d064228c4138fbebb897dd0d74a69450ae58f1240ac9a33be7bb8e211f87a7db.exe	26
PID 364 wrote to memory of 1868	364	d064228c4138fbebb897dd0d74a69450ae58f1240ac9a33be7bb8e211f87a7db.exe	26
PID 364 wrote to memory of 1868	364	d064228c4138fbebb897dd0d74a69450ae58f1240ac9a33be7bb8e211f87a7db.exe	26
PID 364 wrote to memory of 1868	364	d064228c4138fbebb897dd0d74a69450ae58f1240ac9a33be7bb8e211f87a7db.exe	26

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.