11685d196a61e19fa4e061ab7e7c29599cd1c7842f52f6e7aedf08a4bc0a8d46

Analysis

max time kernel
117s
max time network
132s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
02-11-2023 17:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.91d478419bab7b6fbe7becf712618db6_JC.exe
Size

77KB
MD5

91d478419bab7b6fbe7becf712618db6
SHA1

ba7f3ee6c95f3899c334a281596fc47e0cc274c4
SHA256

11685d196a61e19fa4e061ab7e7c29599cd1c7842f52f6e7aedf08a4bc0a8d46
SHA512

f4abb39b3d600b97a8f67b0b57b8c26e093b779ba709d16a313844a303bf3ad230c21a5be9edfef96ac77da9f0457d8b77af0fc75f2dd32b41ca31aefd926255
SSDEEP

1536:M8gbkcU2jAa5QM33ibvDJz3YazZkl2LtCwfi+TjRC/D:M8gQcPxQgCLJzT3Qwf1TjYD

Score

10^/10

dropper persistence trojan

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	NEAS.91d478419bab7b6fbe7becf712618db6_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	NEAS.91d478419bab7b6fbe7becf712618db6_JC.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Naimccpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Naimccpo.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nmpnhdfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Npagjpcd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ngkogj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nmpnhdfc.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngibaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ngibaj32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Npagjpcd.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngkogj32.exe

Malware Backdoor - Berbew 45 IoCs

Berbew is a malware infection classified as a 'backdoor' Trojan. This malicious program's primary function is to cause chain infections - it can download/install additional malware such as other Trojans, ransomware, and cryptominers.

persistence dropper trojan

resource	yara_rule
behavioral1/memory/2944-0-0x0000000000400000-0x0000000000440000-memory.dmp	family_berbew
behavioral1/files/0x0009000000012023-5.dat	family_berbew
behavioral1/memory/2944-6-0x00000000001B0000-0x00000000001F0000-memory.dmp	family_berbew
behavioral1/files/0x0009000000012023-9.dat	family_berbew
behavioral1/files/0x0009000000012023-13.dat	family_berbew
behavioral1/memory/2088-18-0x0000000000400000-0x0000000000440000-memory.dmp	family_berbew
behavioral1/files/0x001b000000015586-19.dat	family_berbew
behavioral1/files/0x0009000000012023-12.dat	family_berbew
behavioral1/files/0x0009000000012023-8.dat	family_berbew
behavioral1/files/0x001b000000015586-28.dat	family_berbew
behavioral1/memory/1264-27-0x0000000000400000-0x0000000000440000-memory.dmp	family_berbew
behavioral1/files/0x001b000000015586-23.dat	family_berbew
behavioral1/files/0x001b000000015586-22.dat	family_berbew
behavioral1/files/0x0007000000015c30-33.dat	family_berbew
behavioral1/files/0x0007000000015c30-39.dat	family_berbew
behavioral1/files/0x0007000000015c30-36.dat	family_berbew
behavioral1/files/0x0007000000015c30-35.dat	family_berbew
behavioral1/files/0x001b000000015586-26.dat	family_berbew
behavioral1/memory/2636-40-0x0000000000400000-0x0000000000440000-memory.dmp	family_berbew
behavioral1/files/0x0007000000015c30-41.dat	family_berbew
behavioral1/files/0x0009000000015c57-54.dat	family_berbew
behavioral1/memory/2652-53-0x0000000000400000-0x0000000000440000-memory.dmp	family_berbew
behavioral1/files/0x0009000000015c57-52.dat	family_berbew
behavioral1/files/0x0009000000015c57-49.dat	family_berbew
behavioral1/files/0x0009000000015c57-48.dat	family_berbew
behavioral1/files/0x0006000000015ca0-59.dat	family_berbew
behavioral1/files/0x0009000000015c57-46.dat	family_berbew
behavioral1/files/0x0006000000015ca0-62.dat	family_berbew
behavioral1/files/0x0006000000015ca0-67.dat	family_berbew
behavioral1/memory/2288-72-0x0000000000400000-0x0000000000440000-memory.dmp	family_berbew
behavioral1/files/0x0006000000015ca0-66.dat	family_berbew
behavioral1/memory/2652-65-0x0000000000220000-0x0000000000260000-memory.dmp	family_berbew
behavioral1/files/0x0006000000015ca0-61.dat	family_berbew
behavioral1/files/0x0006000000015cc9-73.dat	family_berbew
behavioral1/files/0x0006000000015cc9-77.dat	family_berbew
behavioral1/files/0x0006000000015cc9-76.dat	family_berbew
behavioral1/memory/2288-75-0x0000000000220000-0x0000000000260000-memory.dmp	family_berbew
behavioral1/memory/2652-83-0x0000000000400000-0x0000000000440000-memory.dmp	family_berbew
behavioral1/memory/2668-81-0x0000000000400000-0x0000000000440000-memory.dmp	family_berbew
behavioral1/memory/2288-82-0x0000000000400000-0x0000000000440000-memory.dmp	family_berbew
behavioral1/files/0x0006000000015cc9-80.dat	family_berbew
behavioral1/memory/2636-87-0x0000000000400000-0x0000000000440000-memory.dmp	family_berbew
behavioral1/memory/1264-86-0x0000000000400000-0x0000000000440000-memory.dmp	family_berbew
behavioral1/memory/2944-85-0x0000000000400000-0x0000000000440000-memory.dmp	family_berbew
behavioral1/memory/2088-84-0x0000000000400000-0x0000000000440000-memory.dmp	family_berbew

Executes dropped EXE 6 IoCs

pid	Process
2088	Naimccpo.exe
1264	Nmpnhdfc.exe
2636	Ngibaj32.exe
2652	Npagjpcd.exe
2288	Ngkogj32.exe
2668	Nlhgoqhh.exe

Loads dropped DLL 12 IoCs

pid	Process
2944	NEAS.91d478419bab7b6fbe7becf712618db6_JC.exe
2944	NEAS.91d478419bab7b6fbe7becf712618db6_JC.exe
2088	Naimccpo.exe
2088	Naimccpo.exe
1264	Nmpnhdfc.exe
1264	Nmpnhdfc.exe
2636	Ngibaj32.exe
2636	Ngibaj32.exe
2652	Npagjpcd.exe
2652	Npagjpcd.exe
2288	Ngkogj32.exe
2288	Ngkogj32.exe

Drops file in System32 directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Nmpnhdfc.exe	Naimccpo.exe
File opened for modification	C:\Windows\SysWOW64\Ngibaj32.exe	Nmpnhdfc.exe
File created	C:\Windows\SysWOW64\Nlhgoqhh.exe	Ngkogj32.exe
File created	C:\Windows\SysWOW64\Eppddhlj.dll	NEAS.91d478419bab7b6fbe7becf712618db6_JC.exe
File created	C:\Windows\SysWOW64\Lmnppf32.dll	Naimccpo.exe
File created	C:\Windows\SysWOW64\Jmbckb32.dll	Nmpnhdfc.exe
File created	C:\Windows\SysWOW64\Mahqjm32.dll	Ngibaj32.exe
File created	C:\Windows\SysWOW64\Kklcab32.dll	Npagjpcd.exe
File opened for modification	C:\Windows\SysWOW64\Nlhgoqhh.exe	Ngkogj32.exe
File created	C:\Windows\SysWOW64\Naimccpo.exe	NEAS.91d478419bab7b6fbe7becf712618db6_JC.exe
File created	C:\Windows\SysWOW64\Npagjpcd.exe	Ngibaj32.exe
File created	C:\Windows\SysWOW64\Ngkogj32.exe	Npagjpcd.exe
File opened for modification	C:\Windows\SysWOW64\Ngkogj32.exe	Npagjpcd.exe
File opened for modification	C:\Windows\SysWOW64\Naimccpo.exe	NEAS.91d478419bab7b6fbe7becf712618db6_JC.exe
File created	C:\Windows\SysWOW64\Nmpnhdfc.exe	Naimccpo.exe
File created	C:\Windows\SysWOW64\Ngibaj32.exe	Nmpnhdfc.exe
File opened for modification	C:\Windows\SysWOW64\Npagjpcd.exe	Ngibaj32.exe
File created	C:\Windows\SysWOW64\Lamajm32.dll	Ngkogj32.exe

Modifies registry class 21 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ngkogj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mahqjm32.dll"	Ngibaj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ngibaj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Npagjpcd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Npagjpcd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lamajm32.dll"	Ngkogj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	NEAS.91d478419bab7b6fbe7becf712618db6_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	NEAS.91d478419bab7b6fbe7becf712618db6_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eppddhlj.dll"	NEAS.91d478419bab7b6fbe7becf712618db6_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Naimccpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lmnppf32.dll"	Naimccpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Naimccpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nmpnhdfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kklcab32.dll"	Npagjpcd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	NEAS.91d478419bab7b6fbe7becf712618db6_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ngkogj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	NEAS.91d478419bab7b6fbe7becf712618db6_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nmpnhdfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jmbckb32.dll"	Nmpnhdfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ngibaj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	NEAS.91d478419bab7b6fbe7becf712618db6_JC.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 2088	2944	NEAS.91d478419bab7b6fbe7becf712618db6_JC.exe	28
PID 2944 wrote to memory of 2088	2944	NEAS.91d478419bab7b6fbe7becf712618db6_JC.exe	28
PID 2944 wrote to memory of 2088	2944	NEAS.91d478419bab7b6fbe7becf712618db6_JC.exe	28
PID 2944 wrote to memory of 2088	2944	NEAS.91d478419bab7b6fbe7becf712618db6_JC.exe	28
PID 2088 wrote to memory of 1264	2088	Naimccpo.exe	29
PID 2088 wrote to memory of 1264	2088	Naimccpo.exe	29
PID 2088 wrote to memory of 1264	2088	Naimccpo.exe	29
PID 2088 wrote to memory of 1264	2088	Naimccpo.exe	29
PID 1264 wrote to memory of 2636	1264	Nmpnhdfc.exe	30
PID 1264 wrote to memory of 2636	1264	Nmpnhdfc.exe	30
PID 1264 wrote to memory of 2636	1264	Nmpnhdfc.exe	30
PID 1264 wrote to memory of 2636	1264	Nmpnhdfc.exe	30
PID 2636 wrote to memory of 2652	2636	Ngibaj32.exe	31
PID 2636 wrote to memory of 2652	2636	Ngibaj32.exe	31
PID 2636 wrote to memory of 2652	2636	Ngibaj32.exe	31
PID 2636 wrote to memory of 2652	2636	Ngibaj32.exe	31
PID 2652 wrote to memory of 2288	2652	Npagjpcd.exe	32
PID 2652 wrote to memory of 2288	2652	Npagjpcd.exe	32
PID 2652 wrote to memory of 2288	2652	Npagjpcd.exe	32
PID 2652 wrote to memory of 2288	2652	Npagjpcd.exe	32
PID 2288 wrote to memory of 2668	2288	Ngkogj32.exe	33
PID 2288 wrote to memory of 2668	2288	Ngkogj32.exe	33
PID 2288 wrote to memory of 2668	2288	Ngkogj32.exe	33
PID 2288 wrote to memory of 2668	2288	Ngkogj32.exe	33

C:\Users\Admin\AppData\Local\Temp\NEAS.91d478419bab7b6fbe7becf712618db6_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.91d478419bab7b6fbe7becf712618db6_JC.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Windows\SysWOW64\Naimccpo.exe
  C:\Windows\system32\Naimccpo.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2088
- - C:\Windows\SysWOW64\Nmpnhdfc.exe
    C:\Windows\system32\Nmpnhdfc.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1264
  - - C:\Windows\SysWOW64\Ngibaj32.exe
      C:\Windows\system32\Ngibaj32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2636
    - - C:\Windows\SysWOW64\Npagjpcd.exe
        
        C:\Windows\system32\Npagjpcd.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2652
      - C:\Windows\SysWOW64\Ngkogj32.exe
        
        C:\Windows\system32\Ngkogj32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2288
        
        C:\Windows\SysWOW64\Nlhgoqhh.exe
        
        C:\Windows\system32\Nlhgoqhh.exe
        7⤵
        Executes dropped EXE
        
        PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Naimccpo.exe

Filesize
77KB

MD5
d15dbeea8c5747963149e16e9fc74e7c

SHA1
2d9c954f389464bea369fe5c9d6b4c200a72d28d

SHA256
862f212d2ed332e2d02565836fe97ebeb7e31c2b69aac15a23a43589d25a4a36

SHA512
8aaebe0c1a49f2bc10cdf73c219899f737b917adbf46616627c80aedd00d57e05b6572945866af465be8ecf2f11f9d35944c42cfe23764cf084f0f5ae05f1319

Download Submit
C:\Windows\SysWOW64\Naimccpo.exe

Filesize
77KB

MD5
d15dbeea8c5747963149e16e9fc74e7c

SHA1
2d9c954f389464bea369fe5c9d6b4c200a72d28d

SHA256
862f212d2ed332e2d02565836fe97ebeb7e31c2b69aac15a23a43589d25a4a36

SHA512
8aaebe0c1a49f2bc10cdf73c219899f737b917adbf46616627c80aedd00d57e05b6572945866af465be8ecf2f11f9d35944c42cfe23764cf084f0f5ae05f1319

Download Submit
C:\Windows\SysWOW64\Naimccpo.exe

Filesize
77KB

MD5
d15dbeea8c5747963149e16e9fc74e7c

SHA1
2d9c954f389464bea369fe5c9d6b4c200a72d28d

SHA256
862f212d2ed332e2d02565836fe97ebeb7e31c2b69aac15a23a43589d25a4a36

SHA512
8aaebe0c1a49f2bc10cdf73c219899f737b917adbf46616627c80aedd00d57e05b6572945866af465be8ecf2f11f9d35944c42cfe23764cf084f0f5ae05f1319

Download Submit
C:\Windows\SysWOW64\Ngibaj32.exe

Filesize
77KB

MD5
103ca3b3e7b2b0d0c90dfdeee5c9a1b4

SHA1
8df940ca817233fe1976b49835297d3b351e3ded

SHA256
4d69a6da7a81598e6a379a385dfa0f1a18cdcf2bff80c0d5e8dd7389e5af4c8a

SHA512
b109b45c3865fda23006d13e7d8b4fb7f4e4d225b204c431eeed9fa0b33ee2720ac12429b59abdb374c73d55c2e5df13005941f4b8091a66dc470a13b4ccbcd3

Download Submit
C:\Windows\SysWOW64\Ngibaj32.exe

Filesize
77KB

MD5
103ca3b3e7b2b0d0c90dfdeee5c9a1b4

SHA1
8df940ca817233fe1976b49835297d3b351e3ded

SHA256
4d69a6da7a81598e6a379a385dfa0f1a18cdcf2bff80c0d5e8dd7389e5af4c8a

SHA512
b109b45c3865fda23006d13e7d8b4fb7f4e4d225b204c431eeed9fa0b33ee2720ac12429b59abdb374c73d55c2e5df13005941f4b8091a66dc470a13b4ccbcd3

Download Submit
C:\Windows\SysWOW64\Ngibaj32.exe

Filesize
77KB

MD5
103ca3b3e7b2b0d0c90dfdeee5c9a1b4

SHA1
8df940ca817233fe1976b49835297d3b351e3ded

SHA256
4d69a6da7a81598e6a379a385dfa0f1a18cdcf2bff80c0d5e8dd7389e5af4c8a

SHA512
b109b45c3865fda23006d13e7d8b4fb7f4e4d225b204c431eeed9fa0b33ee2720ac12429b59abdb374c73d55c2e5df13005941f4b8091a66dc470a13b4ccbcd3

Download Submit
C:\Windows\SysWOW64\Ngkogj32.exe

Filesize
77KB

MD5
3024ed24a87d05114ccaafabfdb1fffd

SHA1
4eb81da7cc50746f9ad8a48d011f39d17ad54053

SHA256
fd793f74ec9040708fd0c53763fde7213d58996c84a7f43bb2fd684ed17bb5fd

SHA512
638d215ada64610de57800e7922a7cbaeb7923fdf43b5b5cbc9f97852212e45cd02430b8d0e87a660566a4b599202b9e000b58bcd889ab87e24170a943b21070

Download Submit
C:\Windows\SysWOW64\Ngkogj32.exe

Filesize
77KB

MD5
3024ed24a87d05114ccaafabfdb1fffd

SHA1
4eb81da7cc50746f9ad8a48d011f39d17ad54053

SHA256
fd793f74ec9040708fd0c53763fde7213d58996c84a7f43bb2fd684ed17bb5fd

SHA512
638d215ada64610de57800e7922a7cbaeb7923fdf43b5b5cbc9f97852212e45cd02430b8d0e87a660566a4b599202b9e000b58bcd889ab87e24170a943b21070

Download Submit
C:\Windows\SysWOW64\Ngkogj32.exe

Filesize
77KB

MD5
3024ed24a87d05114ccaafabfdb1fffd

SHA1
4eb81da7cc50746f9ad8a48d011f39d17ad54053

SHA256
fd793f74ec9040708fd0c53763fde7213d58996c84a7f43bb2fd684ed17bb5fd

SHA512
638d215ada64610de57800e7922a7cbaeb7923fdf43b5b5cbc9f97852212e45cd02430b8d0e87a660566a4b599202b9e000b58bcd889ab87e24170a943b21070

Download Submit
C:\Windows\SysWOW64\Nlhgoqhh.exe

Filesize
77KB

MD5
8f92dd65ed8ee063a0b3986d4ef9ff00

SHA1
ca1689d0e5d26a793cf3c4b228a96ae0d1d0369c

SHA256
96ffb802d56b5510c0ed6f8a9e71bb6809b8a45c768e5de8e4e8c865f94a6501

SHA512
e292f29e9c66fbc42c6848b9c97a6151550a1456b0c61339228ce7f539790d05b82177930ed01f14308b3f4209108dcbe0b264217b023b2c1b5b8566dd77ea9f

Download Submit
C:\Windows\SysWOW64\Nlhgoqhh.exe

Filesize
77KB

MD5
8f92dd65ed8ee063a0b3986d4ef9ff00

SHA1
ca1689d0e5d26a793cf3c4b228a96ae0d1d0369c

SHA256
96ffb802d56b5510c0ed6f8a9e71bb6809b8a45c768e5de8e4e8c865f94a6501

SHA512
e292f29e9c66fbc42c6848b9c97a6151550a1456b0c61339228ce7f539790d05b82177930ed01f14308b3f4209108dcbe0b264217b023b2c1b5b8566dd77ea9f

Download Submit
C:\Windows\SysWOW64\Nmpnhdfc.exe

Filesize
77KB

MD5
646ac836392885b86e9e40891f924d2a

SHA1
35c8a903c691306072bc3ea2ae76bcddcc15ea19

SHA256
5314f6d6a0ad354525383f1f0620bd3455fc5d719988a414c46b0f687e8c52f1

SHA512
5bdf2d7a29a7dde5bb74f99a5466e06d27ee283b0416297b732ed32d7172334a2432d21d2f4f95846b29c6ca61755d6236dea4a77884284d021fdcc833601ff2

Download Submit
C:\Windows\SysWOW64\Nmpnhdfc.exe

Filesize
77KB

MD5
646ac836392885b86e9e40891f924d2a

SHA1
35c8a903c691306072bc3ea2ae76bcddcc15ea19

SHA256
5314f6d6a0ad354525383f1f0620bd3455fc5d719988a414c46b0f687e8c52f1

SHA512
5bdf2d7a29a7dde5bb74f99a5466e06d27ee283b0416297b732ed32d7172334a2432d21d2f4f95846b29c6ca61755d6236dea4a77884284d021fdcc833601ff2

Download Submit
C:\Windows\SysWOW64\Nmpnhdfc.exe

Filesize
77KB

MD5
646ac836392885b86e9e40891f924d2a

SHA1
35c8a903c691306072bc3ea2ae76bcddcc15ea19

SHA256
5314f6d6a0ad354525383f1f0620bd3455fc5d719988a414c46b0f687e8c52f1

SHA512
5bdf2d7a29a7dde5bb74f99a5466e06d27ee283b0416297b732ed32d7172334a2432d21d2f4f95846b29c6ca61755d6236dea4a77884284d021fdcc833601ff2

Download Submit
C:\Windows\SysWOW64\Npagjpcd.exe

Filesize
77KB

MD5
b1e9b939904fb1e50a016e75e27584bc

SHA1
35eafcd5355b80a7e93643674b9ae99d451e0ba5

SHA256
57652859286b323d1d4faf9e4ce1a45859129a234bcde4ee73048ec6ebbad2b4

SHA512
50c2de6451d1ac0a8f120f63e058b609384687903dac395147a7a4d941c8e47390a305889102248f6b5f08b83a4b81ecddc9426a831f65c979a6630ec9709a0c

Download Submit
C:\Windows\SysWOW64\Npagjpcd.exe

Filesize
77KB

MD5
b1e9b939904fb1e50a016e75e27584bc

SHA1
35eafcd5355b80a7e93643674b9ae99d451e0ba5

SHA256
57652859286b323d1d4faf9e4ce1a45859129a234bcde4ee73048ec6ebbad2b4

SHA512
50c2de6451d1ac0a8f120f63e058b609384687903dac395147a7a4d941c8e47390a305889102248f6b5f08b83a4b81ecddc9426a831f65c979a6630ec9709a0c

Download Submit
C:\Windows\SysWOW64\Npagjpcd.exe

Filesize
77KB

MD5
b1e9b939904fb1e50a016e75e27584bc

SHA1
35eafcd5355b80a7e93643674b9ae99d451e0ba5

SHA256
57652859286b323d1d4faf9e4ce1a45859129a234bcde4ee73048ec6ebbad2b4

SHA512
50c2de6451d1ac0a8f120f63e058b609384687903dac395147a7a4d941c8e47390a305889102248f6b5f08b83a4b81ecddc9426a831f65c979a6630ec9709a0c

Download Submit
\Windows\SysWOW64\Naimccpo.exe

Filesize
77KB

MD5
d15dbeea8c5747963149e16e9fc74e7c

SHA1
2d9c954f389464bea369fe5c9d6b4c200a72d28d

SHA256
862f212d2ed332e2d02565836fe97ebeb7e31c2b69aac15a23a43589d25a4a36

SHA512
8aaebe0c1a49f2bc10cdf73c219899f737b917adbf46616627c80aedd00d57e05b6572945866af465be8ecf2f11f9d35944c42cfe23764cf084f0f5ae05f1319

Download Submit
\Windows\SysWOW64\Naimccpo.exe

Filesize
77KB

MD5
d15dbeea8c5747963149e16e9fc74e7c

SHA1
2d9c954f389464bea369fe5c9d6b4c200a72d28d

SHA256
862f212d2ed332e2d02565836fe97ebeb7e31c2b69aac15a23a43589d25a4a36

SHA512
8aaebe0c1a49f2bc10cdf73c219899f737b917adbf46616627c80aedd00d57e05b6572945866af465be8ecf2f11f9d35944c42cfe23764cf084f0f5ae05f1319

Download Submit
\Windows\SysWOW64\Ngibaj32.exe

Filesize
77KB

MD5
103ca3b3e7b2b0d0c90dfdeee5c9a1b4

SHA1
8df940ca817233fe1976b49835297d3b351e3ded

SHA256
4d69a6da7a81598e6a379a385dfa0f1a18cdcf2bff80c0d5e8dd7389e5af4c8a

SHA512
b109b45c3865fda23006d13e7d8b4fb7f4e4d225b204c431eeed9fa0b33ee2720ac12429b59abdb374c73d55c2e5df13005941f4b8091a66dc470a13b4ccbcd3

Download Submit
\Windows\SysWOW64\Ngibaj32.exe

Filesize
77KB

MD5
103ca3b3e7b2b0d0c90dfdeee5c9a1b4

SHA1
8df940ca817233fe1976b49835297d3b351e3ded

SHA256
4d69a6da7a81598e6a379a385dfa0f1a18cdcf2bff80c0d5e8dd7389e5af4c8a

SHA512
b109b45c3865fda23006d13e7d8b4fb7f4e4d225b204c431eeed9fa0b33ee2720ac12429b59abdb374c73d55c2e5df13005941f4b8091a66dc470a13b4ccbcd3

Download Submit
\Windows\SysWOW64\Ngkogj32.exe

Filesize
77KB

MD5
3024ed24a87d05114ccaafabfdb1fffd

SHA1
4eb81da7cc50746f9ad8a48d011f39d17ad54053

SHA256
fd793f74ec9040708fd0c53763fde7213d58996c84a7f43bb2fd684ed17bb5fd

SHA512
638d215ada64610de57800e7922a7cbaeb7923fdf43b5b5cbc9f97852212e45cd02430b8d0e87a660566a4b599202b9e000b58bcd889ab87e24170a943b21070

Download Submit
\Windows\SysWOW64\Ngkogj32.exe

Filesize
77KB

MD5
3024ed24a87d05114ccaafabfdb1fffd

SHA1
4eb81da7cc50746f9ad8a48d011f39d17ad54053

SHA256
fd793f74ec9040708fd0c53763fde7213d58996c84a7f43bb2fd684ed17bb5fd

SHA512
638d215ada64610de57800e7922a7cbaeb7923fdf43b5b5cbc9f97852212e45cd02430b8d0e87a660566a4b599202b9e000b58bcd889ab87e24170a943b21070

Download Submit
\Windows\SysWOW64\Nlhgoqhh.exe

Filesize
77KB

MD5
8f92dd65ed8ee063a0b3986d4ef9ff00

SHA1
ca1689d0e5d26a793cf3c4b228a96ae0d1d0369c

SHA256
96ffb802d56b5510c0ed6f8a9e71bb6809b8a45c768e5de8e4e8c865f94a6501

SHA512
e292f29e9c66fbc42c6848b9c97a6151550a1456b0c61339228ce7f539790d05b82177930ed01f14308b3f4209108dcbe0b264217b023b2c1b5b8566dd77ea9f

Download Submit
\Windows\SysWOW64\Nlhgoqhh.exe

Filesize
77KB

MD5
8f92dd65ed8ee063a0b3986d4ef9ff00

SHA1
ca1689d0e5d26a793cf3c4b228a96ae0d1d0369c

SHA256
96ffb802d56b5510c0ed6f8a9e71bb6809b8a45c768e5de8e4e8c865f94a6501

SHA512
e292f29e9c66fbc42c6848b9c97a6151550a1456b0c61339228ce7f539790d05b82177930ed01f14308b3f4209108dcbe0b264217b023b2c1b5b8566dd77ea9f

Download Submit
\Windows\SysWOW64\Nmpnhdfc.exe

Filesize
77KB

MD5
646ac836392885b86e9e40891f924d2a

SHA1
35c8a903c691306072bc3ea2ae76bcddcc15ea19

SHA256
5314f6d6a0ad354525383f1f0620bd3455fc5d719988a414c46b0f687e8c52f1

SHA512
5bdf2d7a29a7dde5bb74f99a5466e06d27ee283b0416297b732ed32d7172334a2432d21d2f4f95846b29c6ca61755d6236dea4a77884284d021fdcc833601ff2

Download Submit
\Windows\SysWOW64\Nmpnhdfc.exe

Filesize
77KB

MD5
646ac836392885b86e9e40891f924d2a

SHA1
35c8a903c691306072bc3ea2ae76bcddcc15ea19

SHA256
5314f6d6a0ad354525383f1f0620bd3455fc5d719988a414c46b0f687e8c52f1

SHA512
5bdf2d7a29a7dde5bb74f99a5466e06d27ee283b0416297b732ed32d7172334a2432d21d2f4f95846b29c6ca61755d6236dea4a77884284d021fdcc833601ff2

Download Submit
\Windows\SysWOW64\Npagjpcd.exe

Filesize
77KB

MD5
b1e9b939904fb1e50a016e75e27584bc

SHA1
35eafcd5355b80a7e93643674b9ae99d451e0ba5

SHA256
57652859286b323d1d4faf9e4ce1a45859129a234bcde4ee73048ec6ebbad2b4

SHA512
50c2de6451d1ac0a8f120f63e058b609384687903dac395147a7a4d941c8e47390a305889102248f6b5f08b83a4b81ecddc9426a831f65c979a6630ec9709a0c

Download Submit
\Windows\SysWOW64\Npagjpcd.exe

Filesize
77KB

MD5
b1e9b939904fb1e50a016e75e27584bc

SHA1
35eafcd5355b80a7e93643674b9ae99d451e0ba5

SHA256
57652859286b323d1d4faf9e4ce1a45859129a234bcde4ee73048ec6ebbad2b4

SHA512
50c2de6451d1ac0a8f120f63e058b609384687903dac395147a7a4d941c8e47390a305889102248f6b5f08b83a4b81ecddc9426a831f65c979a6630ec9709a0c

Download Submit
memory/1264-27-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1264-86-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2088-21-0x0000000000220000-0x0000000000260000-memory.dmp

Filesize
256KB

Download
memory/2088-84-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2088-18-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2288-82-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2288-72-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2288-75-0x0000000000220000-0x0000000000260000-memory.dmp

Filesize
256KB

Download
memory/2636-40-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2636-87-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2652-83-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2652-53-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2652-65-0x0000000000220000-0x0000000000260000-memory.dmp

Filesize
256KB

Download
memory/2668-81-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2944-6-0x00000000001B0000-0x00000000001F0000-memory.dmp

Filesize
256KB

Download
memory/2944-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2944-85-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads