c2dc581f63db97c6fcdc64c3c753a2e5f48016ef524a2816841716d4e1ae94b1

Analysis

max time kernel
94s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 23:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a1ed2f3a5cce1b68a6544ec3b831a980_NEIKI.exe
Size

368KB
MD5

a1ed2f3a5cce1b68a6544ec3b831a980
SHA1

51caa55a23c18fe1703a668ed62b3e185eb3311d
SHA256

c2dc581f63db97c6fcdc64c3c753a2e5f48016ef524a2816841716d4e1ae94b1
SHA512

740f3f2805a2b619bb8079bf5a05379a7be87f11bd7c85e9727f84056d6557351f8eb50240b055f4ddd71471a883f54dfc31f35f34b19b70945a933ebe3a7f0a
SSDEEP

6144:tmG//IYbgBE4f9FIUpOVw86CmOJfTo9FIUIhrcflDMxy9FIUpOVw86CmOJfTo9Fv:f3IUtaAD6RrI1+lDMEAD6Rr2NWL

Score

10^/10

backdoor dropper persistence trojan

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nkjjij32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqiogp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nnolfdcn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kpjjod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lphfpbdi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mgghhlhq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mcpebmkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lilanioo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mpmokb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kcifkp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kajfig32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpcmec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	a1ed2f3a5cce1b68a6544ec3b831a980_NEIKI.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ljnnch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nqiogp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpkbebbf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mciobn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mnapdf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mcnhmm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ngpjnkpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kmjqmi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kkbkamnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ljnnch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nkncdifl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ndghmo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngpjnkpf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnolfdcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mncmjfmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mnfipekh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lpcmec32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lphfpbdi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnapdf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	a1ed2f3a5cce1b68a6544ec3b831a980_NEIKI.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lkdggmlj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kmjqmi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldaeka32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mncmjfmk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldmlpbbj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpmokb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndghmo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mciobn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcpebmkb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kipabjil.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lilanioo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ldaeka32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kcifkp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mdpalp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kpjjod32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kajfig32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kkbkamnl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nkncdifl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngedij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lkdggmlj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Laciofpa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgghhlhq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnfipekh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdpalp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nkjjij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kipabjil.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Laciofpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mpkbebbf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ldmlpbbj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcnhmm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ngedij32.exe

Malware Dropper & Backdoor - Berbew 32 IoCs

Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.

backdoor trojan dropper

resource	yara_rule
behavioral2/files/0x000700000002328e-6.dat	family_berbew
behavioral2/files/0x00080000000233f2-14.dat	family_berbew
behavioral2/files/0x00070000000233f4-22.dat	family_berbew
behavioral2/files/0x00070000000233f6-30.dat	family_berbew
behavioral2/files/0x00070000000233f8-33.dat	family_berbew
behavioral2/files/0x00070000000233fa-46.dat	family_berbew
behavioral2/files/0x00070000000233fc-54.dat	family_berbew
behavioral2/files/0x00070000000233fe-62.dat	family_berbew
behavioral2/files/0x0007000000023400-70.dat	family_berbew
behavioral2/files/0x0007000000023402-78.dat	family_berbew
behavioral2/files/0x0007000000023404-86.dat	family_berbew
behavioral2/files/0x0007000000023406-94.dat	family_berbew
behavioral2/files/0x0008000000023408-102.dat	family_berbew
behavioral2/files/0x000700000002340b-110.dat	family_berbew
behavioral2/files/0x000700000002340d-118.dat	family_berbew
behavioral2/files/0x000700000002340e-126.dat	family_berbew
behavioral2/files/0x0007000000023410-134.dat	family_berbew
behavioral2/files/0x0007000000023412-142.dat	family_berbew
behavioral2/files/0x0007000000023414-150.dat	family_berbew
behavioral2/files/0x0007000000023416-158.dat	family_berbew
behavioral2/files/0x0009000000023365-166.dat	family_berbew
behavioral2/files/0x0007000000023419-174.dat	family_berbew
behavioral2/files/0x000700000002341b-182.dat	family_berbew
behavioral2/files/0x000700000002341d-190.dat	family_berbew
behavioral2/files/0x000700000002341f-198.dat	family_berbew
behavioral2/files/0x0007000000023421-206.dat	family_berbew
behavioral2/files/0x0007000000023423-214.dat	family_berbew
behavioral2/files/0x0008000000023425-222.dat	family_berbew
behavioral2/files/0x0007000000023428-225.dat	family_berbew
behavioral2/files/0x000700000002342a-238.dat	family_berbew
behavioral2/files/0x000700000002342c-247.dat	family_berbew
behavioral2/files/0x000700000002342e-249.dat	family_berbew

Executes dropped EXE 32 IoCs

pid	Process
3324	Kmjqmi32.exe
4008	Kipabjil.exe
4768	Kpjjod32.exe
1508	Kcifkp32.exe
4492	Kajfig32.exe
4044	Kkbkamnl.exe
3772	Lkdggmlj.exe
3092	Ldmlpbbj.exe
840	Lpcmec32.exe
2340	Lilanioo.exe
1340	Laciofpa.exe
396	Ldaeka32.exe
3136	Ljnnch32.exe
4232	Lphfpbdi.exe
3184	Mpkbebbf.exe
1560	Mciobn32.exe
1884	Mpmokb32.exe
392	Mgghhlhq.exe
5044	Mnapdf32.exe
1252	Mcnhmm32.exe
4524	Mncmjfmk.exe
4576	Mcpebmkb.exe
3500	Mnfipekh.exe
2456	Mdpalp32.exe
1788	Nkjjij32.exe
4836	Ngpjnkpf.exe
2296	Nqiogp32.exe
3016	Nkncdifl.exe
3452	Ndghmo32.exe
232	Ngedij32.exe
2584	Nnolfdcn.exe
4972	Nkcmohbg.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Mdpalp32.exe	Mnfipekh.exe
File created	C:\Windows\SysWOW64\Nkjjij32.exe	Mdpalp32.exe
File opened for modification	C:\Windows\SysWOW64\Nkjjij32.exe	Mdpalp32.exe
File created	C:\Windows\SysWOW64\Lkdggmlj.exe	Kkbkamnl.exe
File opened for modification	C:\Windows\SysWOW64\Ljnnch32.exe	Ldaeka32.exe
File opened for modification	C:\Windows\SysWOW64\Lphfpbdi.exe	Ljnnch32.exe
File created	C:\Windows\SysWOW64\Lifenaok.dll	Mpkbebbf.exe
File opened for modification	C:\Windows\SysWOW64\Mpmokb32.exe	Mciobn32.exe
File created	C:\Windows\SysWOW64\Mlhblb32.dll	Nkjjij32.exe
File created	C:\Windows\SysWOW64\Pponmema.dll	Ngpjnkpf.exe
File opened for modification	C:\Windows\SysWOW64\Kkbkamnl.exe	Kajfig32.exe
File created	C:\Windows\SysWOW64\Gcdihi32.dll	Kajfig32.exe
File created	C:\Windows\SysWOW64\Mglppmnd.dll	Ljnnch32.exe
File created	C:\Windows\SysWOW64\Agbnmibj.dll	Mpmokb32.exe
File created	C:\Windows\SysWOW64\Mcnhmm32.exe	Mnapdf32.exe
File created	C:\Windows\SysWOW64\Ngpjnkpf.exe	Nkjjij32.exe
File opened for modification	C:\Windows\SysWOW64\Nkncdifl.exe	Nqiogp32.exe
File opened for modification	C:\Windows\SysWOW64\Kmjqmi32.exe	a1ed2f3a5cce1b68a6544ec3b831a980_NEIKI.exe
File created	C:\Windows\SysWOW64\Lbhnnj32.dll	Kcifkp32.exe
File created	C:\Windows\SysWOW64\Kmdigkkd.dll	Lphfpbdi.exe
File created	C:\Windows\SysWOW64\Mnapdf32.exe	Mgghhlhq.exe
File created	C:\Windows\SysWOW64\Codhke32.dll	Mcpebmkb.exe
File created	C:\Windows\SysWOW64\Hhapkbgi.dll	Mncmjfmk.exe
File created	C:\Windows\SysWOW64\Ghiqbiae.dll	Kpjjod32.exe
File created	C:\Windows\SysWOW64\Kkbkamnl.exe	Kajfig32.exe
File opened for modification	C:\Windows\SysWOW64\Lpcmec32.exe	Ldmlpbbj.exe
File opened for modification	C:\Windows\SysWOW64\Mgghhlhq.exe	Mpmokb32.exe
File opened for modification	C:\Windows\SysWOW64\Mnapdf32.exe	Mgghhlhq.exe
File created	C:\Windows\SysWOW64\Gefncbmc.dll	Ldaeka32.exe
File opened for modification	C:\Windows\SysWOW64\Nkcmohbg.exe	Nnolfdcn.exe
File created	C:\Windows\SysWOW64\Nkncdifl.exe	Nqiogp32.exe
File created	C:\Windows\SysWOW64\Kipabjil.exe	Kmjqmi32.exe
File opened for modification	C:\Windows\SysWOW64\Kipabjil.exe	Kmjqmi32.exe
File created	C:\Windows\SysWOW64\Qgejif32.dll	Kkbkamnl.exe
File created	C:\Windows\SysWOW64\Mciobn32.exe	Mpkbebbf.exe
File created	C:\Windows\SysWOW64\Mgghhlhq.exe	Mpmokb32.exe
File created	C:\Windows\SysWOW64\Kbmfdgkm.dll	Kmjqmi32.exe
File created	C:\Windows\SysWOW64\Nqiogp32.exe	Ngpjnkpf.exe
File created	C:\Windows\SysWOW64\Paadnmaq.dll	Ndghmo32.exe
File opened for modification	C:\Windows\SysWOW64\Mpkbebbf.exe	Lphfpbdi.exe
File opened for modification	C:\Windows\SysWOW64\Mcpebmkb.exe	Mncmjfmk.exe
File opened for modification	C:\Windows\SysWOW64\Mnfipekh.exe	Mcpebmkb.exe
File created	C:\Windows\SysWOW64\Kpjjod32.exe	Kipabjil.exe
File created	C:\Windows\SysWOW64\Kcifkp32.exe	Kpjjod32.exe
File created	C:\Windows\SysWOW64\Baefid32.dll	Ldmlpbbj.exe
File created	C:\Windows\SysWOW64\Lilanioo.exe	Lpcmec32.exe
File created	C:\Windows\SysWOW64\Ldaeka32.exe	Laciofpa.exe
File opened for modification	C:\Windows\SysWOW64\Mdpalp32.exe	Mnfipekh.exe
File created	C:\Windows\SysWOW64\Ndghmo32.exe	Nkncdifl.exe
File created	C:\Windows\SysWOW64\Hnibdpde.dll	Nnolfdcn.exe
File created	C:\Windows\SysWOW64\Cknpkhch.dll	Ngedij32.exe
File opened for modification	C:\Windows\SysWOW64\Kpjjod32.exe	Kipabjil.exe
File opened for modification	C:\Windows\SysWOW64\Kcifkp32.exe	Kpjjod32.exe
File created	C:\Windows\SysWOW64\Lphfpbdi.exe	Ljnnch32.exe
File created	C:\Windows\SysWOW64\Egqcbapl.dll	Mdpalp32.exe
File created	C:\Windows\SysWOW64\Jkeang32.dll	Nqiogp32.exe
File created	C:\Windows\SysWOW64\Lpcmec32.exe	Ldmlpbbj.exe
File created	C:\Windows\SysWOW64\Bkankc32.dll	Mciobn32.exe
File created	C:\Windows\SysWOW64\Mnfipekh.exe	Mcpebmkb.exe
File opened for modification	C:\Windows\SysWOW64\Nnolfdcn.exe	Ngedij32.exe
File created	C:\Windows\SysWOW64\Nnolfdcn.exe	Ngedij32.exe
File created	C:\Windows\SysWOW64\Ldmlpbbj.exe	Lkdggmlj.exe
File opened for modification	C:\Windows\SysWOW64\Ldmlpbbj.exe	Lkdggmlj.exe
File created	C:\Windows\SysWOW64\Kgkocp32.dll	Lpcmec32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2304	4972	WerFault.exe	113

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mgghhlhq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nqiogp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mnapdf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ngedij32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kpjjod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mpkbebbf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mciobn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Agbnmibj.dll"	Mpmokb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kajfig32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ldmlpbbj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ldaeka32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mnfipekh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Khehmdgi.dll"	Lilanioo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Lkdggmlj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mncmjfmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nnolfdcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ajgblndm.dll"	a1ed2f3a5cce1b68a6544ec3b831a980_NEIKI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kajfig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ldaeka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ljnnch32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kipabjil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mglppmnd.dll"	Ljnnch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mcnhmm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hhapkbgi.dll"	Mncmjfmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mnfipekh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghiqbiae.dll"	Kpjjod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mpmokb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qgejif32.dll"	Kkbkamnl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lkdggmlj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Baefid32.dll"	Ldmlpbbj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nnolfdcn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mdpalp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nkncdifl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nqiogp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kcifkp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cknpkhch.dll"	Ngedij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mcpebmkb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kmjqmi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kpjjod32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ljnnch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Lphfpbdi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ciiqgjgg.dll"	Mcnhmm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mcpebmkb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	a1ed2f3a5cce1b68a6544ec3b831a980_NEIKI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Joamagmq.dll"	Kipabjil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ngpjnkpf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ngpjnkpf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kcifkp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ldmlpbbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Lpcmec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Laciofpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kipabjil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eqbmje32.dll"	Lkdggmlj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mnapdf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kkbkamnl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mncmjfmk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lilanioo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmdigkkd.dll"	Lphfpbdi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mgghhlhq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Laciofpa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lphfpbdi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dgcifj32.dll"	Mnapdf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bdknoa32.dll"	Nkncdifl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kbmfdgkm.dll"	Kmjqmi32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4196 wrote to memory of 3324	4196	a1ed2f3a5cce1b68a6544ec3b831a980_NEIKI.exe	80
PID 4196 wrote to memory of 3324	4196	a1ed2f3a5cce1b68a6544ec3b831a980_NEIKI.exe	80
PID 4196 wrote to memory of 3324	4196	a1ed2f3a5cce1b68a6544ec3b831a980_NEIKI.exe	80
PID 3324 wrote to memory of 4008	3324	Kmjqmi32.exe	81
PID 3324 wrote to memory of 4008	3324	Kmjqmi32.exe	81
PID 3324 wrote to memory of 4008	3324	Kmjqmi32.exe	81
PID 4008 wrote to memory of 4768	4008	Kipabjil.exe	82
PID 4008 wrote to memory of 4768	4008	Kipabjil.exe	82
PID 4008 wrote to memory of 4768	4008	Kipabjil.exe	82
PID 4768 wrote to memory of 1508	4768	Kpjjod32.exe	83
PID 4768 wrote to memory of 1508	4768	Kpjjod32.exe	83
PID 4768 wrote to memory of 1508	4768	Kpjjod32.exe	83
PID 1508 wrote to memory of 4492	1508	Kcifkp32.exe	85
PID 1508 wrote to memory of 4492	1508	Kcifkp32.exe	85
PID 1508 wrote to memory of 4492	1508	Kcifkp32.exe	85
PID 4492 wrote to memory of 4044	4492	Kajfig32.exe	86
PID 4492 wrote to memory of 4044	4492	Kajfig32.exe	86
PID 4492 wrote to memory of 4044	4492	Kajfig32.exe	86
PID 4044 wrote to memory of 3772	4044	Kkbkamnl.exe	87
PID 4044 wrote to memory of 3772	4044	Kkbkamnl.exe	87
PID 4044 wrote to memory of 3772	4044	Kkbkamnl.exe	87
PID 3772 wrote to memory of 3092	3772	Lkdggmlj.exe	89
PID 3772 wrote to memory of 3092	3772	Lkdggmlj.exe	89
PID 3772 wrote to memory of 3092	3772	Lkdggmlj.exe	89
PID 3092 wrote to memory of 840	3092	Ldmlpbbj.exe	90
PID 3092 wrote to memory of 840	3092	Ldmlpbbj.exe	90
PID 3092 wrote to memory of 840	3092	Ldmlpbbj.exe	90
PID 840 wrote to memory of 2340	840	Lpcmec32.exe	91
PID 840 wrote to memory of 2340	840	Lpcmec32.exe	91
PID 840 wrote to memory of 2340	840	Lpcmec32.exe	91
PID 2340 wrote to memory of 1340	2340	Lilanioo.exe	92
PID 2340 wrote to memory of 1340	2340	Lilanioo.exe	92
PID 2340 wrote to memory of 1340	2340	Lilanioo.exe	92
PID 1340 wrote to memory of 396	1340	Laciofpa.exe	93
PID 1340 wrote to memory of 396	1340	Laciofpa.exe	93
PID 1340 wrote to memory of 396	1340	Laciofpa.exe	93
PID 396 wrote to memory of 3136	396	Ldaeka32.exe	94
PID 396 wrote to memory of 3136	396	Ldaeka32.exe	94
PID 396 wrote to memory of 3136	396	Ldaeka32.exe	94
PID 3136 wrote to memory of 4232	3136	Ljnnch32.exe	95
PID 3136 wrote to memory of 4232	3136	Ljnnch32.exe	95
PID 3136 wrote to memory of 4232	3136	Ljnnch32.exe	95
PID 4232 wrote to memory of 3184	4232	Lphfpbdi.exe	96
PID 4232 wrote to memory of 3184	4232	Lphfpbdi.exe	96
PID 4232 wrote to memory of 3184	4232	Lphfpbdi.exe	96
PID 3184 wrote to memory of 1560	3184	Mpkbebbf.exe	97
PID 3184 wrote to memory of 1560	3184	Mpkbebbf.exe	97
PID 3184 wrote to memory of 1560	3184	Mpkbebbf.exe	97
PID 1560 wrote to memory of 1884	1560	Mciobn32.exe	98
PID 1560 wrote to memory of 1884	1560	Mciobn32.exe	98
PID 1560 wrote to memory of 1884	1560	Mciobn32.exe	98
PID 1884 wrote to memory of 392	1884	Mpmokb32.exe	99
PID 1884 wrote to memory of 392	1884	Mpmokb32.exe	99
PID 1884 wrote to memory of 392	1884	Mpmokb32.exe	99
PID 392 wrote to memory of 5044	392	Mgghhlhq.exe	100
PID 392 wrote to memory of 5044	392	Mgghhlhq.exe	100
PID 392 wrote to memory of 5044	392	Mgghhlhq.exe	100
PID 5044 wrote to memory of 1252	5044	Mnapdf32.exe	101
PID 5044 wrote to memory of 1252	5044	Mnapdf32.exe	101
PID 5044 wrote to memory of 1252	5044	Mnapdf32.exe	101
PID 1252 wrote to memory of 4524	1252	Mcnhmm32.exe	102
PID 1252 wrote to memory of 4524	1252	Mcnhmm32.exe	102
PID 1252 wrote to memory of 4524	1252	Mcnhmm32.exe	102
PID 4524 wrote to memory of 4576	4524	Mncmjfmk.exe	103

C:\Users\Admin\AppData\Local\Temp\a1ed2f3a5cce1b68a6544ec3b831a980_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\a1ed2f3a5cce1b68a6544ec3b831a980_NEIKI.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4196
- C:\Windows\SysWOW64\Kmjqmi32.exe
  C:\Windows\system32\Kmjqmi32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3324
- - C:\Windows\SysWOW64\Kipabjil.exe
    C:\Windows\system32\Kipabjil.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4008
  - - C:\Windows\SysWOW64\Kpjjod32.exe
      C:\Windows\system32\Kpjjod32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4768
    - - C:\Windows\SysWOW64\Kcifkp32.exe
        
        C:\Windows\system32\Kcifkp32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1508
      - C:\Windows\SysWOW64\Kajfig32.exe
        
        C:\Windows\system32\Kajfig32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4492
        
        C:\Windows\SysWOW64\Kkbkamnl.exe
        
        C:\Windows\system32\Kkbkamnl.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4044
        
        C:\Windows\SysWOW64\Lkdggmlj.exe
        
        C:\Windows\system32\Lkdggmlj.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3772
        
        C:\Windows\SysWOW64\Ldmlpbbj.exe
        
        C:\Windows\system32\Ldmlpbbj.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3092
        
        C:\Windows\SysWOW64\Lpcmec32.exe
        
        C:\Windows\system32\Lpcmec32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:840
        
        C:\Windows\SysWOW64\Lilanioo.exe
        
        C:\Windows\system32\Lilanioo.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2340
        
        C:\Windows\SysWOW64\Laciofpa.exe
        
        C:\Windows\system32\Laciofpa.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1340
        
        C:\Windows\SysWOW64\Ldaeka32.exe
        
        C:\Windows\system32\Ldaeka32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:396
        
        C:\Windows\SysWOW64\Ljnnch32.exe
        
        C:\Windows\system32\Ljnnch32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3136
        
        C:\Windows\SysWOW64\Lphfpbdi.exe
        
        C:\Windows\system32\Lphfpbdi.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4232
        
        C:\Windows\SysWOW64\Mpkbebbf.exe
        
        C:\Windows\system32\Mpkbebbf.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3184
        
        C:\Windows\SysWOW64\Mciobn32.exe
        
        C:\Windows\system32\Mciobn32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1560
        
        C:\Windows\SysWOW64\Mpmokb32.exe
        
        C:\Windows\system32\Mpmokb32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1884
        
        C:\Windows\SysWOW64\Mgghhlhq.exe
        
        C:\Windows\system32\Mgghhlhq.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:392
        
        C:\Windows\SysWOW64\Mnapdf32.exe
        
        C:\Windows\system32\Mnapdf32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5044
        
        C:\Windows\SysWOW64\Mcnhmm32.exe
        
        C:\Windows\system32\Mcnhmm32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1252
        
        C:\Windows\SysWOW64\Mncmjfmk.exe
        
        C:\Windows\system32\Mncmjfmk.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4524
        
        C:\Windows\SysWOW64\Mcpebmkb.exe
        
        C:\Windows\system32\Mcpebmkb.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4576
        
        C:\Windows\SysWOW64\Mnfipekh.exe
        
        C:\Windows\system32\Mnfipekh.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3500
        
        C:\Windows\SysWOW64\Mdpalp32.exe
        
        C:\Windows\system32\Mdpalp32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2456
        
        C:\Windows\SysWOW64\Nkjjij32.exe
        
        C:\Windows\system32\Nkjjij32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1788
        
        C:\Windows\SysWOW64\Ngpjnkpf.exe
        
        C:\Windows\system32\Ngpjnkpf.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4836
        
        C:\Windows\SysWOW64\Nqiogp32.exe
        
        C:\Windows\system32\Nqiogp32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2296
        
        C:\Windows\SysWOW64\Nkncdifl.exe
        
        C:\Windows\system32\Nkncdifl.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3016
        
        C:\Windows\SysWOW64\Ndghmo32.exe
        
        C:\Windows\system32\Ndghmo32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3452
        
        C:\Windows\SysWOW64\Ngedij32.exe
        
        C:\Windows\system32\Ngedij32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:232
        
        C:\Windows\SysWOW64\Nnolfdcn.exe
        
        C:\Windows\system32\Nnolfdcn.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2584
        
        C:\Windows\SysWOW64\Nkcmohbg.exe
        
        C:\Windows\system32\Nkcmohbg.exe
        33⤵
        Executes dropped EXE
        
        PID:4972
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4972 -s 420
        34⤵
        Program crash
        
        PID:2304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4972 -ip 4972
1⤵
PID:4732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Kajfig32.exe

Filesize
368KB

MD5
ec61206f040a71db1fff8eab4db720ab

SHA1
65615f82f221125c18a354251f11a9c4a8535b65

SHA256
ad3897f37bf00a301c4fd7bfdb0bf0f63e27e5dfd1a95bab6db2a4b7446bf2f5

SHA512
ab3428108a04e34765bde586bd69c17c53a6e68a318d97f82f8fb6d0c4e9de31c924d6979b9426d4a35a1c2165fb637137ff03d04dcc7884b0661ed8d56cee77

Download Submit
C:\Windows\SysWOW64\Kcifkp32.exe

Filesize
368KB

MD5
07bbba5ea47e7f4bd3eda75dfbbd1c22

SHA1
a0db56050b11ae6dcf93c69c41254d79edd408e5

SHA256
f1d10e7c072b9edbe74d0fcc0ba1b7271d8648a54b356afe37914f5a00c12880

SHA512
4427a7832f084c2e26a58dfdfcd4b8496486b2722e3748da8e18468738ff440000600bc2ffda1c84e80767aab8b8e3a926070dfe638af53411a3d8f298d139b1

Download Submit
C:\Windows\SysWOW64\Kipabjil.exe

Filesize
368KB

MD5
fbffb47ea95a944b5640e22197072b1e

SHA1
7bcfc49b981f529e1c09edb2909ae22f6bf9c986

SHA256
7289cf6abd3bcbf4f8f859a1d9e5929c7cd18d36373ea9f07b1fb20188b4d6fe

SHA512
9edb1a541dae8b9d5fb14909dfbbee2b78c2efd8ce456a6055d6934cd666bff27d5710095e3c30cc721d66647a6f3d8568e61931da1ad0995a774114e09d53f9

Download Submit
C:\Windows\SysWOW64\Kkbkamnl.exe

Filesize
368KB

MD5
3ee933a653687d8e21e8d718f91419aa

SHA1
df07b3ec36f06494fc95d0422f14ba4a9ab2d908

SHA256
bf3999feaeea4a758ffc529b4990969718d61d7e3f443601cdbc92c98cc1baa8

SHA512
f25b8fdfa35b02dc0e3474bbc74ea7b02c802fc58c6b0ac215bd678c5f5f7cbebccd08ee4fa298b6d80225338d2bcd2d47edf6508b91a49dd462088acb72e08f

Download Submit
C:\Windows\SysWOW64\Kmjqmi32.exe

Filesize
368KB

MD5
c04223b5cea81db0ac00843551e4f731

SHA1
5c6486b8a877a68a99af77123f28067755fff96d

SHA256
70697551f3d289b235395af18c21c5515127fe6e8f815619ca6feb2c73ea8277

SHA512
d4e67affc8efaba858c8a1804f1e372b9b5b66bc20783805960862ec1079b1ee8bd116defc96a5fd57122127a3fe00dd9fcef967d54d2978202dc367bea77b63

Download Submit
C:\Windows\SysWOW64\Kpjjod32.exe

Filesize
368KB

MD5
f74d3db18b5f56c15c6945129a49f2a4

SHA1
dc6575ab5d0c730d1127144a8d8c1ecebed8344b

SHA256
d83568c68fb61720a84248c19a739e1f8894a93af5adb06ab55215ac2001bfe6

SHA512
d2feef373de85bdacc553ab6433297cde20e7576d49cf04b0929439b003f3c50d056c2ca03dda5f4349f5d2b5fa0f885ce0ba0bf293beca2fae356407de6445b

Download Submit
C:\Windows\SysWOW64\Laciofpa.exe

Filesize
368KB

MD5
098feba5140e0f15535fccf46718de5f

SHA1
852a34c8dab6a44b739cb4faec24dab032b9d965

SHA256
f0279ee66724db1aed462a7aa271cc6ceb54be2e4f6c9d9c759759b86da67714

SHA512
5c61b32a58ba6abf3586c65601933ca1bb50f339bb1d14580e052ca029dd22a79df189c715433b637fd2469184a92e4561f52f873a27c3ceb76155e0f8dbec72

Download Submit
C:\Windows\SysWOW64\Lbhnnj32.dll

Filesize
7KB

MD5
3ad657b28133b3d059664d9d82a33bf2

SHA1
a3890c5896b15ecda701b8d7f344fc91a37c7ab3

SHA256
0dd5f692525cc289c92415478425006915960e1b87e5868930fb45b5e287b213

SHA512
d5638cfd3ee4460dda652929d2bf8c3d3e151682d02eea7c05770814c7a192c2e6d0f8050e8499f745c3d602e4d173025118aa4632999f8909eeb822fae8eaa8

Download Submit
C:\Windows\SysWOW64\Ldaeka32.exe

Filesize
368KB

MD5
4e1a19c84642941243aa87942ee741c0

SHA1
63d3027801ccf5941fc13dbae291a06505b41638

SHA256
f8ee3fd5067b850feb48999a71d60841caa9d1b250fbfd654e01dd84e5bb1dc4

SHA512
254ff41891981118890bac0b9923cb3e6dbff47e36d1942fbf4a7730b7cdf8e781d3c860a29a721e1adff3cf7505973987d20c1f9c50d63c93beb819f9ee2403

Download Submit
C:\Windows\SysWOW64\Ldmlpbbj.exe

Filesize
368KB

MD5
e05ab761ca169868f3d617b96bbb3e31

SHA1
504b53fc623c75b2dc5cde70b6da7ac33579981a

SHA256
b86faade9c3f37c81210aba0526c03d878cdc2d5c009c9c876d1cf14ae14f931

SHA512
6b6ebc8f9882fd3fc1d7c64c77ee34c002314b25ca57af147473a248e7bc122703ee1bf0c1f69fd2f2c139521ea58af6ba057cb1e35981f14f27aa27c6f19393

Download Submit
C:\Windows\SysWOW64\Lilanioo.exe

Filesize
368KB

MD5
5e263a907fd26d82f2963cf45ad3dd7d

SHA1
da725b37f0046fc24731d4210eef6d0662b0157b

SHA256
a518162f91217e9ecf4fb14a37ac7de85c309fccd7da888cd10e1e2b6c97a1e5

SHA512
8b40f72fe5929df241872ec7994288cfe69aae85dc661099c1d085d0d305d6ffbf8bf1e2b9db6bbba35c4d1d70827b41e23486856e45856ef2a14799c98108cd

Download Submit
C:\Windows\SysWOW64\Ljnnch32.exe

Filesize
368KB

MD5
99f5ba858d73e7e14d0735ee30a218de

SHA1
f30646d646e2ce7ab688ba1db316eb29ed57069b

SHA256
894acdffeb815ae36adc9a917eb6acc8df84e330f0214e1a38e6e16c33da338f

SHA512
769f38dea468da43622a2ca0f8a1bedd4d07bb4f1b600eba9ec8e22d49030a085bbf8fc9696ed6e7069c0d24b408c34cef7476dcea7e67cede68e2efaf5967b8

Download Submit
C:\Windows\SysWOW64\Lkdggmlj.exe

Filesize
368KB

MD5
0d399b344ec855a152c914f25f89e9ef

SHA1
c11ac3b83535750f3626957d09d20b32e69d03b9

SHA256
6be3f521e7047ab2294233e126362d847388e748a45f0a89e6f015abbbf71fa1

SHA512
af3068b2b627dad8315b36330b170456f8866c115ac257841654f79fe9f50ec635f0baf6029a22d45202bde1dd29390385303ed2eaee8de2ddbae5c57199103d

Download Submit
C:\Windows\SysWOW64\Lpcmec32.exe

Filesize
368KB

MD5
36873d819332008e8a7a732e9e132dfa

SHA1
c4709d6fb3ff2efad5f1764c319308902627169c

SHA256
a35129d6ee6247b75f37d3ca436f0b1a3684f3e362cbf3d73942b9607e86da18

SHA512
26b2905cbc080ad13b291a3e5e7ed56234b48fd3842370ec1ea083110fd24939fa6cefb0932be5fcc43c6407981acce3aab671c7ff989276f8bdaf9c1d65b3fa

Download Submit
C:\Windows\SysWOW64\Lphfpbdi.exe

Filesize
368KB

MD5
51512d7de3e28147a9d78329738e1b4d

SHA1
6e955850c0be680722577e33e2ffbf94ad285d4a

SHA256
1b5d24a88d55f76c59a94ad6ba5d02c0a16aa67ce9f1c88703f0a04faa3a4271

SHA512
67abd5d6e80d516ba213c99278a65dd10ce8ff6b814779735b8f46c8d9e89814cf1109c38f243000f0845b645d9c4cdf1e3224e95adab71f38c49e1bff483ce4

Download Submit
C:\Windows\SysWOW64\Mciobn32.exe

Filesize
368KB

MD5
448caebec3cc38ac6f0e1d4eb37db1d6

SHA1
77d02fca8a90fe120c8fc2a63cd755737e01fca5

SHA256
6f83b09725e753e3853d2287e68b2dd056d51ba8d57fbfabbfbedf4d492397c5

SHA512
cbbf2587631142617d9baf48d159fe2f9131427a40c8531723b314cfac3d7fafc77808a39857c8db64fba01ade7a7a93ab3135e2332529eb4cd99d76cdc8d7f1

Download Submit
C:\Windows\SysWOW64\Mcnhmm32.exe

Filesize
368KB

MD5
ec30527af2592b69f7fa80e8bc32b224

SHA1
c9216534ebcbf3b2b8fe0d646221434ea7cb2b99

SHA256
b547f6656e61d1d5455ffbb81bd1ebe45d6bf45b27d94901c64a55a381a03ead

SHA512
3f2e5fb6d2f87be6d0e18537b8aa000b7530adf27d1d2bd486d1891680af5518ca15f60eafc6c4972727668c8d781f00b761fd83c0320f1cbfb0fd2aa628c761

Download Submit
C:\Windows\SysWOW64\Mcpebmkb.exe

Filesize
368KB

MD5
cd895a2c9b5e470f8435cc92f9fdc342

SHA1
57d77d159f63ba3258b785b7ac9dd85109401386

SHA256
11b29b4fb326af0ec01c18036a78ef2259d9adbc15eb8ba185f59db431523d8c

SHA512
48ab420a820ff4121ad0f38ec9e236922951455df693f9cb416572bea8082bdc8782044155519baf5c02d8f7a5129445c7843a8e72a4da10b444f9d01a0449c0

Download Submit
C:\Windows\SysWOW64\Mdpalp32.exe

Filesize
368KB

MD5
d4b7ccbfeb241c7687119e5db7c307d4

SHA1
654a9a223cd95d82b757b9a09d20f4ec04b1ba24

SHA256
c5fee42b3238d451536a0b32e9a5e889e8b1ca7828b8a9cda65528baf0c8b0b8

SHA512
31fbc8a89d2c22968c1d1227b2b33e38aba49f494df9adb0dab89cfe0e88904c9faf206dcdf5af4608a0ff4b7271374ba2b3ac14712d207980a5123436aabe56

Download Submit
C:\Windows\SysWOW64\Mgghhlhq.exe

Filesize
368KB

MD5
267a62d1dda8eba17348ef60dfe11163

SHA1
376e269a351e42774f273af41ba1a31381549432

SHA256
d4ba11c70359e9e5f2f7e7ae37c0eea2159b55b54cc544f1186a8d65e4d50905

SHA512
acdf89e86dbfe45cb19b88e08c8bf276bbfb7521bf1cd45a50d998ac29996c1e4ef19e521b999e60959073186f056f4074d645fe3e7f141b04e04da77237a7ea

Download Submit
C:\Windows\SysWOW64\Mnapdf32.exe

Filesize
368KB

MD5
865049d8634d52c5564e707c13c6c5b0

SHA1
b859ca47913e34e3ecb8a9452900bf6ff739da46

SHA256
05e5f273ff6c5a070c9e24246037f253bb137c499a1f89f6ba503c804bb222fd

SHA512
4a0f254d03e60f88950c8c9e97439b2a17fd36e3299790dcfc183897d50cfdb4e98a6523d9d624ffd1cdd01970830e6b3a18c2ad0ab05e8126b211580e2abf09

Download Submit
C:\Windows\SysWOW64\Mncmjfmk.exe

Filesize
368KB

MD5
0d5089449c9119b60577396e25b466c0

SHA1
988651bd07630bdb98a9e6bda43846c6b59bc8fd

SHA256
cafa347e0966215c12c8ef2a66cbf7bcc858d9f1df7b0377ad1b589a46a40c71

SHA512
6a7e79bdd2170bd100a54bd583171f1692a235b5ea3d8a9e02ce8d494499b602d1245e708996fe7dbd612f621ca2d98fdcc2e6401f99ba2514015a5d96a87942

Download Submit
C:\Windows\SysWOW64\Mnfipekh.exe

Filesize
368KB

MD5
3a6442e0eef073bdc64c345da643b4e7

SHA1
4b6a8b2636a95bb212b275afff0f74b29ee8b4b3

SHA256
53da90e681c96b79a345fe2431f0eda113bf7ddd78d1e4f445902ecc22ec360c

SHA512
acae71e78bb763aeaaa08b020534251be61dc67296d2256eb43d224ae61fd5c421db66d81dcc4b688b15e380f5f66de641be1956eeadffdd19a710bb0384b439

Download Submit
C:\Windows\SysWOW64\Mpkbebbf.exe

Filesize
368KB

MD5
f9b4c8a22549bded0c2f269229157d2a

SHA1
0740ff544f2171fde8471b7a99a09d87d2e40791

SHA256
d43a7ebe9c0490902972fa5e97a650f8289728dce47a68bee31703e9acd98bcd

SHA512
2d80110725c5eb9774299401e37ff82489e8188fddeb9d5d04c5aaa773b6b766d015b8d8985146d7f8a8649f1e4decd3f84fd0c3287f113586e36aa0d8d43949

Download Submit
C:\Windows\SysWOW64\Mpmokb32.exe

Filesize
368KB

MD5
9b27d703c603faa58af665f2405f9d67

SHA1
c2306a4079eada0b38611a8c934ef66ec87ee35b

SHA256
989ab4790e602023b58a03c6fe66444caf740b586e88bc52420d609c5485848a

SHA512
3c80d9916f67ed11b7b01dac2da3adce3bdc4d540c156a1fa9fc3e50d432f1056336b220e10e6cc4f494c5099c643b24efa53d8e27e35d612c6e5f4d9dc6a508

Download Submit
C:\Windows\SysWOW64\Ndghmo32.exe

Filesize
368KB

MD5
4b252bef06f5dd0df96038ad9b1978da

SHA1
fa5a8adf4df5ea406405169528341ff62e77347a

SHA256
0de2cd65024491b4816f8fd4808ad38fc1ed5a338249118a3cdee6b2ce869c07

SHA512
3df4aa5120d981b327f259a48889d8db3ef9a55daeaa4c5dda0de9d68e5a7b4746d9e19432ecd2dbc941c02b64457069991f47a35531f6f9c2cfa4142ac76ef9

Download Submit
C:\Windows\SysWOW64\Ngedij32.exe

Filesize
368KB

MD5
06948d4f55ee64098efd110bea6511a8

SHA1
27a28158217b1bb77193c8ad3918a41cf057c086

SHA256
7e627a2ac367e68b44824498f325904cedc9c1bebe51ce927cdf9e7f3dbbaad0

SHA512
559fe050191d0c4da90791bdc08c4d1edac5e5c1eee36c06804db73a4ecc2d62c6a007f416193017483810046500b290f02fc0223abed13e26a11172d8258eb2

Download Submit
C:\Windows\SysWOW64\Ngpjnkpf.exe

Filesize
368KB

MD5
01e0090e060ed5601370ee3643370881

SHA1
9f507d5a63317dd65851ca8722e739bcf1f70871

SHA256
9bbccead6ee5af685cf45708815b8fe465482456935892c35665dd1245bac7ef

SHA512
0c224afa5caf04fc0e4d73aed576d651fc0c082c2b2df87680625f1649dde0eb7426527f1edff5d4c47ad843c004e7582e19913f4c9f4f8befb513b20e9b105a

Download Submit
C:\Windows\SysWOW64\Nkcmohbg.exe

Filesize
368KB

MD5
64ca029b7902c131bf688fa7b93aed86

SHA1
cf51f67c5b913bca7eaece936487eae1b5e0a9ad

SHA256
ae2b6c6b771a373561c9b88f39a32b775f52e602778be89286c762b9e4a1c3fc

SHA512
37460a40090387935a930d65311246184f065c12197a92ef7aead727ff5429d2a9125c9aabdfd4862a331a8f8a8c83b0a86ce2fdce90d8ee18315ee9d3c18571

Download Submit
C:\Windows\SysWOW64\Nkjjij32.exe

Filesize
368KB

MD5
3647dc601c1676a26affc3abb39c48e3

SHA1
9478e2feffd024e873654c2cdac26212e06727bb

SHA256
cfab788e3f081e46a69636678638d4091c8c03640dca981c544b3eca138e2916

SHA512
2d8ab1b2dcd15077e3ee8975851bd89d7e7cbb66b39b52953b84f4a5936d07239996a91d8e84aa6fd3423e19302752438f9e092e3dc8ef241a1eeb58274da40c

Download Submit
C:\Windows\SysWOW64\Nkncdifl.exe

Filesize
368KB

MD5
25d0d10ea7b270244ccfb623d221abb3

SHA1
d1b4f0565f1b346f377d4f9e1801152bf476a425

SHA256
e2ca3bcb2562be9451d318b103b863995fb5f99bab4205927a8d130190de848c

SHA512
a61ac8c2b9299cc00738d3b9ae39aa19e13a426e2fb9d0980f8ec0b179ad94778bf31a373fcba39496fb75a2bb5a0f76c2abd223ca8925d25796d40f3891da09

Download Submit
C:\Windows\SysWOW64\Nnolfdcn.exe

Filesize
368KB

MD5
4c3b927a16db445ae12bc406eade60d1

SHA1
f9228bbc0600c1d62864aca432eca7db46c493e6

SHA256
8050709d908285e3846214219fa581a1a7375ed5ac34f515a7f66ceb0a407473

SHA512
82ed900b998023594659a4fbca8e8df54f849f734b83de5aa24d876a00abb9517ab05d6c3dfa60f41799814e977eb63e6ac8007785d318a5217a0e5e24b30943

Download Submit
C:\Windows\SysWOW64\Nqiogp32.exe

Filesize
368KB

MD5
39c64e596ce01974f90bba66f1afc8ae

SHA1
abded55dd7802ffc2b1e6c9b34da94e01ed2bd5b

SHA256
601d139dd09a8870e6afb057cd0ea64c0f5ec80c51d54a52c210a12c087850b9

SHA512
6b9a35dfe38e221f05d9d6eada8dfae6b0008612f5d960643a1fbee2bfa677acb511435c3ebbe7e5fde13415a9eb2f23c3f0914f80c20308e721a60a5c4fcef2

Download Submit
memory/232-240-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/232-259-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/392-148-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/396-95-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/396-276-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/840-72-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/840-278-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1252-269-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1252-160-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1340-277-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1340-88-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1508-31-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1508-283-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1560-127-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1560-272-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1788-264-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1788-200-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1884-271-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1884-136-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2296-262-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2296-215-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2340-84-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2456-192-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2456-265-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2584-258-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2584-248-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3016-224-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3016-261-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3092-64-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3092-279-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3136-275-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3136-111-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3184-273-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3184-120-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3324-8-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3324-285-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3452-260-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3452-232-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3500-266-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3500-184-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3772-280-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3772-55-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4008-15-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4008-284-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4044-48-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4044-281-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4196-286-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4196-0-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4232-274-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4232-112-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4492-282-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4492-40-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4524-168-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4524-268-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4576-175-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4576-267-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4768-28-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4836-208-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4836-263-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4972-257-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4972-256-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/5044-270-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/5044-151-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads