7bd07859fb5e5c1be03fde08f04b5a7c78cddc32372f01d004c84a9f1e48b6c1

Analysis

max time kernel
137s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 12:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a30316e5962dca158a5bb0fc33216180_NEIKI.exe
Size

264KB
MD5

a30316e5962dca158a5bb0fc33216180
SHA1

f04604a2dfeff057faa36616a4b6a51a61a0ba31
SHA256

7bd07859fb5e5c1be03fde08f04b5a7c78cddc32372f01d004c84a9f1e48b6c1
SHA512

653303495a299aa4c6fd0d7bfe1a49463525969d267954022a2f387918ec42db0f1d6ac1e44cff0159f989d2f645fb32403f2cdc4c9342cf25ef19810434885f
SSDEEP

6144:XBtOXTqfpui6yYPaIGck72siBTQtpui6yYPaIGckv:xtOjUpV6yYPc2siBTspV6yYPo

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nqfbaq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lpocjdld.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqfbaq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqmhbpba.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lnepih32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lkiqbl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpfijcfl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lpfijcfl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpaifalo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mdpalp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lnepih32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpkbebbf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mcpebmkb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdpalp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nkqpjidj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kgdbkohf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ljnnch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lgbnmm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nafokcol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lpappc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnolfdcn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Laalifad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lphfpbdi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgidml32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	a30316e5962dca158a5bb0fc33216180_NEIKI.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kkbkamnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mpkbebbf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Majopeii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nnolfdcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kibnhjgj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lgkhlnbn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lkiqbl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcklgm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mnapdf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nqmhbpba.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpocjdld.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcdegnep.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lphfpbdi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjcgohig.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnapdf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Njacpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	a30316e5962dca158a5bb0fc33216180_NEIKI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kcifkp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lcdegnep.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgbnmm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njacpf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcmofolg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nkqpjidj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nbhkac32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kcifkp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ljnnch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mgidml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mncmjfmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mpaifalo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcpebmkb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nklfoi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kibnhjgj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kkbkamnl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgkhlnbn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lknjmkdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lknjmkdo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nafokcol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lcmofolg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Laalifad.exe

Executes dropped EXE 37 IoCs

pid	Process
3500	Kcifkp32.exe
4432	Kgdbkohf.exe
1432	Kibnhjgj.exe
2492	Kkbkamnl.exe
5104	Lpocjdld.exe
3392	Lcmofolg.exe
4908	Lpappc32.exe
4416	Lgkhlnbn.exe
1784	Lnepih32.exe
1636	Laalifad.exe
3228	Lkiqbl32.exe
1456	Lpfijcfl.exe
3168	Lcdegnep.exe
3492	Ljnnch32.exe
1448	Lphfpbdi.exe
644	Lgbnmm32.exe
4800	Lknjmkdo.exe
2948	Mpkbebbf.exe
4904	Mjcgohig.exe
624	Majopeii.exe
4124	Mcklgm32.exe
844	Mnapdf32.exe
1480	Mgidml32.exe
1764	Mncmjfmk.exe
2228	Mpaifalo.exe
4100	Mcpebmkb.exe
2904	Mdpalp32.exe
2580	Nkjjij32.exe
2996	Nqfbaq32.exe
2344	Nklfoi32.exe
1772	Nafokcol.exe
1712	Njacpf32.exe
4384	Nbhkac32.exe
4424	Nkqpjidj.exe
3732	Nnolfdcn.exe
3408	Nqmhbpba.exe
2296	Nkcmohbg.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Mcklgm32.exe	Majopeii.exe
File opened for modification	C:\Windows\SysWOW64\Njacpf32.exe	Nafokcol.exe
File created	C:\Windows\SysWOW64\Nkqpjidj.exe	Nbhkac32.exe
File opened for modification	C:\Windows\SysWOW64\Nbhkac32.exe	Njacpf32.exe
File created	C:\Windows\SysWOW64\Fogjfmfe.dll	Kcifkp32.exe
File created	C:\Windows\SysWOW64\Bpcbnd32.dll	Kgdbkohf.exe
File created	C:\Windows\SysWOW64\Mpkbebbf.exe	Lknjmkdo.exe
File created	C:\Windows\SysWOW64\Kibnhjgj.exe	Kgdbkohf.exe
File opened for modification	C:\Windows\SysWOW64\Kibnhjgj.exe	Kgdbkohf.exe
File created	C:\Windows\SysWOW64\Ogndib32.dll	Lcmofolg.exe
File created	C:\Windows\SysWOW64\Laalifad.exe	Lnepih32.exe
File created	C:\Windows\SysWOW64\Pdgdjjem.dll	Mcklgm32.exe
File created	C:\Windows\SysWOW64\Npckna32.dll	Nkjjij32.exe
File opened for modification	C:\Windows\SysWOW64\Lgkhlnbn.exe	Lpappc32.exe
File opened for modification	C:\Windows\SysWOW64\Lkiqbl32.exe	Laalifad.exe
File opened for modification	C:\Windows\SysWOW64\Nqmhbpba.exe	Nnolfdcn.exe
File opened for modification	C:\Windows\SysWOW64\Laalifad.exe	Lnepih32.exe
File opened for modification	C:\Windows\SysWOW64\Majopeii.exe	Mjcgohig.exe
File created	C:\Windows\SysWOW64\Cnacjn32.dll	Mnapdf32.exe
File created	C:\Windows\SysWOW64\Offdjb32.dll	Lpocjdld.exe
File opened for modification	C:\Windows\SysWOW64\Lcdegnep.exe	Lpfijcfl.exe
File opened for modification	C:\Windows\SysWOW64\Lphfpbdi.exe	Ljnnch32.exe
File created	C:\Windows\SysWOW64\Mglppmnd.dll	Ljnnch32.exe
File created	C:\Windows\SysWOW64\Kmdigkkd.dll	Lknjmkdo.exe
File opened for modification	C:\Windows\SysWOW64\Nkjjij32.exe	Mdpalp32.exe
File created	C:\Windows\SysWOW64\Fhpdhp32.dll	Mcpebmkb.exe
File created	C:\Windows\SysWOW64\Mgidml32.exe	Mnapdf32.exe
File opened for modification	C:\Windows\SysWOW64\Mncmjfmk.exe	Mgidml32.exe
File opened for modification	C:\Windows\SysWOW64\Mdpalp32.exe	Mcpebmkb.exe
File created	C:\Windows\SysWOW64\Cknpkhch.dll	Nkqpjidj.exe
File created	C:\Windows\SysWOW64\Nqmhbpba.exe	Nnolfdcn.exe
File opened for modification	C:\Windows\SysWOW64\Lpocjdld.exe	Kkbkamnl.exe
File opened for modification	C:\Windows\SysWOW64\Lcmofolg.exe	Lpocjdld.exe
File created	C:\Windows\SysWOW64\Lcdegnep.exe	Lpfijcfl.exe
File created	C:\Windows\SysWOW64\Nafokcol.exe	Nklfoi32.exe
File created	C:\Windows\SysWOW64\Lmbnpm32.dll	Nafokcol.exe
File created	C:\Windows\SysWOW64\Ndclfb32.dll	Lpappc32.exe
File opened for modification	C:\Windows\SysWOW64\Lpfijcfl.exe	Lkiqbl32.exe
File opened for modification	C:\Windows\SysWOW64\Lknjmkdo.exe	Lgbnmm32.exe
File created	C:\Windows\SysWOW64\Ghiqbiae.dll	a30316e5962dca158a5bb0fc33216180_NEIKI.exe
File created	C:\Windows\SysWOW64\Lnepih32.exe	Lgkhlnbn.exe
File opened for modification	C:\Windows\SysWOW64\Nafokcol.exe	Nklfoi32.exe
File opened for modification	C:\Windows\SysWOW64\Nkcmohbg.exe	Nqmhbpba.exe
File created	C:\Windows\SysWOW64\Gcdihi32.dll	Kibnhjgj.exe
File created	C:\Windows\SysWOW64\Mpaifalo.exe	Mncmjfmk.exe
File opened for modification	C:\Windows\SysWOW64\Nqfbaq32.exe	Nkjjij32.exe
File created	C:\Windows\SysWOW64\Jnngob32.dll	Lgbnmm32.exe
File opened for modification	C:\Windows\SysWOW64\Mcklgm32.exe	Majopeii.exe
File opened for modification	C:\Windows\SysWOW64\Mnapdf32.exe	Mcklgm32.exe
File created	C:\Windows\SysWOW64\Nkcmohbg.exe	Nqmhbpba.exe
File opened for modification	C:\Windows\SysWOW64\Kcifkp32.exe	a30316e5962dca158a5bb0fc33216180_NEIKI.exe
File created	C:\Windows\SysWOW64\Lpfijcfl.exe	Lkiqbl32.exe
File opened for modification	C:\Windows\SysWOW64\Lgbnmm32.exe	Lphfpbdi.exe
File created	C:\Windows\SysWOW64\Mecaoggc.dll	Lphfpbdi.exe
File created	C:\Windows\SysWOW64\Nklfoi32.exe	Nqfbaq32.exe
File opened for modification	C:\Windows\SysWOW64\Nklfoi32.exe	Nqfbaq32.exe
File created	C:\Windows\SysWOW64\Mbaohn32.dll	Lkiqbl32.exe
File opened for modification	C:\Windows\SysWOW64\Mpkbebbf.exe	Lknjmkdo.exe
File created	C:\Windows\SysWOW64\Lknjmkdo.exe	Lgbnmm32.exe
File created	C:\Windows\SysWOW64\Mcpebmkb.exe	Mpaifalo.exe
File created	C:\Windows\SysWOW64\Ogpnaafp.dll	Nbhkac32.exe
File created	C:\Windows\SysWOW64\Gefncbmc.dll	Lcdegnep.exe
File created	C:\Windows\SysWOW64\Lphfpbdi.exe	Ljnnch32.exe
File opened for modification	C:\Windows\SysWOW64\Ljnnch32.exe	Lcdegnep.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4204	2296	WerFault.exe	122

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hhapkbgi.dll"	Mpaifalo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mcpebmkb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nnolfdcn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Majopeii.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mncmjfmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mncmjfmk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mpaifalo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fhpdhp32.dll"	Mcpebmkb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lgbnmm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lphfpbdi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mjcgohig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mdpalp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nkqpjidj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kkbkamnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mbaohn32.dll"	Lkiqbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gefncbmc.dll"	Lcdegnep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nbhkac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mnapdf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mgidml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bghhihab.dll"	Nnolfdcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kcifkp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Lphfpbdi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lnohlokp.dll"	Mjcgohig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Majopeii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdgdjjem.dll"	Mcklgm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lpocjdld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Lcmofolg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Laalifad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Laalifad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mpkbebbf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nafokcol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nqmhbpba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gcdihi32.dll"	Kibnhjgj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lpfijcfl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ljnnch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mpaifalo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mcpebmkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ciiqgjgg.dll"	Mgidml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nklfoi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	a30316e5962dca158a5bb0fc33216180_NEIKI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kcifkp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lcdegnep.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mcklgm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nqfbaq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmdigkkd.dll"	Lknjmkdo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kgdbkohf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogndib32.dll"	Lcmofolg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nklfoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcoegc32.dll"	Nklfoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kkbkamnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ljnnch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Lgbnmm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lknjmkdo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mpkbebbf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kibnhjgj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Npckna32.dll"	Nkjjij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogpnaafp.dll"	Nbhkac32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lkiqbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Lkiqbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Njacpf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nqmhbpba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cnacjn32.dll"	Mnapdf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mdpalp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	a30316e5962dca158a5bb0fc33216180_NEIKI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 324 wrote to memory of 3500	324	a30316e5962dca158a5bb0fc33216180_NEIKI.exe	83
PID 324 wrote to memory of 3500	324	a30316e5962dca158a5bb0fc33216180_NEIKI.exe	83
PID 324 wrote to memory of 3500	324	a30316e5962dca158a5bb0fc33216180_NEIKI.exe	83
PID 3500 wrote to memory of 4432	3500	Kcifkp32.exe	84
PID 3500 wrote to memory of 4432	3500	Kcifkp32.exe	84
PID 3500 wrote to memory of 4432	3500	Kcifkp32.exe	84
PID 4432 wrote to memory of 1432	4432	Kgdbkohf.exe	85
PID 4432 wrote to memory of 1432	4432	Kgdbkohf.exe	85
PID 4432 wrote to memory of 1432	4432	Kgdbkohf.exe	85
PID 1432 wrote to memory of 2492	1432	Kibnhjgj.exe	86
PID 1432 wrote to memory of 2492	1432	Kibnhjgj.exe	86
PID 1432 wrote to memory of 2492	1432	Kibnhjgj.exe	86
PID 2492 wrote to memory of 5104	2492	Kkbkamnl.exe	87
PID 2492 wrote to memory of 5104	2492	Kkbkamnl.exe	87
PID 2492 wrote to memory of 5104	2492	Kkbkamnl.exe	87
PID 5104 wrote to memory of 3392	5104	Lpocjdld.exe	88
PID 5104 wrote to memory of 3392	5104	Lpocjdld.exe	88
PID 5104 wrote to memory of 3392	5104	Lpocjdld.exe	88
PID 3392 wrote to memory of 4908	3392	Lcmofolg.exe	89
PID 3392 wrote to memory of 4908	3392	Lcmofolg.exe	89
PID 3392 wrote to memory of 4908	3392	Lcmofolg.exe	89
PID 4908 wrote to memory of 4416	4908	Lpappc32.exe	90
PID 4908 wrote to memory of 4416	4908	Lpappc32.exe	90
PID 4908 wrote to memory of 4416	4908	Lpappc32.exe	90
PID 4416 wrote to memory of 1784	4416	Lgkhlnbn.exe	91
PID 4416 wrote to memory of 1784	4416	Lgkhlnbn.exe	91
PID 4416 wrote to memory of 1784	4416	Lgkhlnbn.exe	91
PID 1784 wrote to memory of 1636	1784	Lnepih32.exe	92
PID 1784 wrote to memory of 1636	1784	Lnepih32.exe	92
PID 1784 wrote to memory of 1636	1784	Lnepih32.exe	92
PID 1636 wrote to memory of 3228	1636	Laalifad.exe	93
PID 1636 wrote to memory of 3228	1636	Laalifad.exe	93
PID 1636 wrote to memory of 3228	1636	Laalifad.exe	93
PID 3228 wrote to memory of 1456	3228	Lkiqbl32.exe	94
PID 3228 wrote to memory of 1456	3228	Lkiqbl32.exe	94
PID 3228 wrote to memory of 1456	3228	Lkiqbl32.exe	94
PID 1456 wrote to memory of 3168	1456	Lpfijcfl.exe	95
PID 1456 wrote to memory of 3168	1456	Lpfijcfl.exe	95
PID 1456 wrote to memory of 3168	1456	Lpfijcfl.exe	95
PID 3168 wrote to memory of 3492	3168	Lcdegnep.exe	97
PID 3168 wrote to memory of 3492	3168	Lcdegnep.exe	97
PID 3168 wrote to memory of 3492	3168	Lcdegnep.exe	97
PID 3492 wrote to memory of 1448	3492	Ljnnch32.exe	98
PID 3492 wrote to memory of 1448	3492	Ljnnch32.exe	98
PID 3492 wrote to memory of 1448	3492	Ljnnch32.exe	98
PID 1448 wrote to memory of 644	1448	Lphfpbdi.exe	99
PID 1448 wrote to memory of 644	1448	Lphfpbdi.exe	99
PID 1448 wrote to memory of 644	1448	Lphfpbdi.exe	99
PID 644 wrote to memory of 4800	644	Lgbnmm32.exe	100
PID 644 wrote to memory of 4800	644	Lgbnmm32.exe	100
PID 644 wrote to memory of 4800	644	Lgbnmm32.exe	100
PID 4800 wrote to memory of 2948	4800	Lknjmkdo.exe	101
PID 4800 wrote to memory of 2948	4800	Lknjmkdo.exe	101
PID 4800 wrote to memory of 2948	4800	Lknjmkdo.exe	101
PID 2948 wrote to memory of 4904	2948	Mpkbebbf.exe	102
PID 2948 wrote to memory of 4904	2948	Mpkbebbf.exe	102
PID 2948 wrote to memory of 4904	2948	Mpkbebbf.exe	102
PID 4904 wrote to memory of 624	4904	Mjcgohig.exe	103
PID 4904 wrote to memory of 624	4904	Mjcgohig.exe	103
PID 4904 wrote to memory of 624	4904	Mjcgohig.exe	103
PID 624 wrote to memory of 4124	624	Majopeii.exe	104
PID 624 wrote to memory of 4124	624	Majopeii.exe	104
PID 624 wrote to memory of 4124	624	Majopeii.exe	104
PID 4124 wrote to memory of 844	4124	Mcklgm32.exe	105

C:\Users\Admin\AppData\Local\Temp\a30316e5962dca158a5bb0fc33216180_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\a30316e5962dca158a5bb0fc33216180_NEIKI.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:324
- C:\Windows\SysWOW64\Kcifkp32.exe
  C:\Windows\system32\Kcifkp32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3500
- - C:\Windows\SysWOW64\Kgdbkohf.exe
    C:\Windows\system32\Kgdbkohf.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4432
  - - C:\Windows\SysWOW64\Kibnhjgj.exe
      C:\Windows\system32\Kibnhjgj.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:1432
    - - C:\Windows\SysWOW64\Kkbkamnl.exe
        
        C:\Windows\system32\Kkbkamnl.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2492
      - C:\Windows\SysWOW64\Lpocjdld.exe
        
        C:\Windows\system32\Lpocjdld.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5104
        
        C:\Windows\SysWOW64\Lcmofolg.exe
        
        C:\Windows\system32\Lcmofolg.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3392
        
        C:\Windows\SysWOW64\Lpappc32.exe
        
        C:\Windows\system32\Lpappc32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4908
        
        C:\Windows\SysWOW64\Lgkhlnbn.exe
        
        C:\Windows\system32\Lgkhlnbn.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4416
        
        C:\Windows\SysWOW64\Lnepih32.exe
        
        C:\Windows\system32\Lnepih32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1784
        
        C:\Windows\SysWOW64\Laalifad.exe
        
        C:\Windows\system32\Laalifad.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1636
        
        C:\Windows\SysWOW64\Lkiqbl32.exe
        
        C:\Windows\system32\Lkiqbl32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3228
        
        C:\Windows\SysWOW64\Lpfijcfl.exe
        
        C:\Windows\system32\Lpfijcfl.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1456
        
        C:\Windows\SysWOW64\Lcdegnep.exe
        
        C:\Windows\system32\Lcdegnep.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3168
        
        C:\Windows\SysWOW64\Ljnnch32.exe
        
        C:\Windows\system32\Ljnnch32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3492
        
        C:\Windows\SysWOW64\Lphfpbdi.exe
        
        C:\Windows\system32\Lphfpbdi.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1448
        
        C:\Windows\SysWOW64\Lgbnmm32.exe
        
        C:\Windows\system32\Lgbnmm32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:644
        
        C:\Windows\SysWOW64\Lknjmkdo.exe
        
        C:\Windows\system32\Lknjmkdo.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4800
        
        C:\Windows\SysWOW64\Mpkbebbf.exe
        
        C:\Windows\system32\Mpkbebbf.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2948
        
        C:\Windows\SysWOW64\Mjcgohig.exe
        
        C:\Windows\system32\Mjcgohig.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4904
        
        C:\Windows\SysWOW64\Majopeii.exe
        
        C:\Windows\system32\Majopeii.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:624
        
        C:\Windows\SysWOW64\Mcklgm32.exe
        
        C:\Windows\system32\Mcklgm32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4124
        
        C:\Windows\SysWOW64\Mnapdf32.exe
        
        C:\Windows\system32\Mnapdf32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:844
        
        C:\Windows\SysWOW64\Mgidml32.exe
        
        C:\Windows\system32\Mgidml32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1480
        
        C:\Windows\SysWOW64\Mncmjfmk.exe
        
        C:\Windows\system32\Mncmjfmk.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1764
        
        C:\Windows\SysWOW64\Mpaifalo.exe
        
        C:\Windows\system32\Mpaifalo.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2228
        
        C:\Windows\SysWOW64\Mcpebmkb.exe
        
        C:\Windows\system32\Mcpebmkb.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4100
        
        C:\Windows\SysWOW64\Mdpalp32.exe
        
        C:\Windows\system32\Mdpalp32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2904
        
        C:\Windows\SysWOW64\Nkjjij32.exe
        
        C:\Windows\system32\Nkjjij32.exe
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2580
        
        C:\Windows\SysWOW64\Nqfbaq32.exe
        
        C:\Windows\system32\Nqfbaq32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2996
        
        C:\Windows\SysWOW64\Nklfoi32.exe
        
        C:\Windows\system32\Nklfoi32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2344
        
        C:\Windows\SysWOW64\Nafokcol.exe
        
        C:\Windows\system32\Nafokcol.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1772
        
        C:\Windows\SysWOW64\Njacpf32.exe
        
        C:\Windows\system32\Njacpf32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1712
        
        C:\Windows\SysWOW64\Nbhkac32.exe
        
        C:\Windows\system32\Nbhkac32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4384
        
        C:\Windows\SysWOW64\Nkqpjidj.exe
        
        C:\Windows\system32\Nkqpjidj.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4424
        
        C:\Windows\SysWOW64\Nnolfdcn.exe
        
        C:\Windows\system32\Nnolfdcn.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3732
        
        C:\Windows\SysWOW64\Nqmhbpba.exe
        
        C:\Windows\system32\Nqmhbpba.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3408
        
        C:\Windows\SysWOW64\Nkcmohbg.exe
        
        C:\Windows\system32\Nkcmohbg.exe
        38⤵
        Executes dropped EXE
        
        PID:2296
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2296 -s 412
        39⤵
        Program crash
        
        PID:4204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2296 -ip 2296
1⤵
PID:1360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Jchbak32.dll

Filesize
7KB

MD5
ee6c7b76d30d24fc31c65d823c7550d0

SHA1
52bb26ad3be54d0231508a657156e2f83a4e8e73

SHA256
7302fd1822a9b89611bc6826c41a2229ac42e29e608e1fcb5385d413b2c17fbd

SHA512
38053c18415fbf5828f60b3200ec0def87a23e3ee214ed749f36176e2a3a6ff35178ba25bf630ccf33c745e4e35cdb1a9532f539b6a676b17ab21b615b73aef9

Download Submit
C:\Windows\SysWOW64\Kcifkp32.exe

Filesize
264KB

MD5
94bb544116c1be0daa556ae94a457bba

SHA1
11df8b64d781edd8ce299518292968556470c5a7

SHA256
70cd9db3c1e853487024144a0711ea96d12dbbc5bf115807f906c297d41041df

SHA512
7bf37bbfd7a4cd31add118272c4a606a0b85f94b3f401b606e76ff30fb6a3b5a1f6de3db957baca7507af76e1bd4b3d2fe0f719b0fbefccd67a94353a7d1d0e6

Download Submit
C:\Windows\SysWOW64\Kgdbkohf.exe

Filesize
264KB

MD5
99252da39bb17c6befa448cf01a5dd4a

SHA1
f8ed8e067f3f07a31665ba484c49e0627024adc6

SHA256
ba78636595693e6e3d839660bf7292b7cff9dd61fc952df4fd0e072cefaadb69

SHA512
28e603d2a8fb247eee9636fe070ebb2a01904f43ddc281d255c8179e79f237d9fd4fa4a4794a0690b76ad6cb6cf69115646a70ffd0e581cb59e89ce8a5bf368c

Download Submit
C:\Windows\SysWOW64\Kibnhjgj.exe

Filesize
264KB

MD5
81598f4dcf56bcff9dec65e8941588c5

SHA1
de85b904b9550ba7239a459ff2c0e287aa6ade1d

SHA256
27206566867a2935c08c875a78b894945e30cc31dced3a22ea2a8a7bb8465835

SHA512
73dae4b9a664afe7cc975ff0f0956795fdedd66ebcc18927083193d9a51a9554bc1a0fae32dc74824c0ccf3e901998a64da0cec26dfe9e5bc0ca6eb7152f0e1a

Download Submit
C:\Windows\SysWOW64\Kkbkamnl.exe

Filesize
264KB

MD5
e34bed622a56c3b89c1cbd75d5ff70af

SHA1
de119a2fac10872d834dc86300c9a3eef64b6873

SHA256
649afa7951eff87f1d252207f76784fea56d7fd0dbadead7c8b8080c8a18f0a9

SHA512
c554e811b422e406b69b5fd3d0fed22ddd560b7026d907c2226a9ae9ac2db05d49b84cef617b386acf051dfb33d52fe78950c4737abc53e3ea69f55c6f182559

Download Submit
C:\Windows\SysWOW64\Laalifad.exe

Filesize
264KB

MD5
294b00100016be4f68ff1e27f75f9e84

SHA1
c7e09ce74d99f0ec19b9431986c284fc33242b0e

SHA256
84148dc8e0fa2e2a28c7d6aef8db65501f45ab4dd93470ba58ec7618f295e9ab

SHA512
ad5276cc6a43ba60297997380b7eca06bf8c7759b7bd03241329f3b1051fcba9c96ebfea50625934ddaa909ebf52217e33b8830c2f0babb9eb514792b5933f28

Download Submit
C:\Windows\SysWOW64\Lcdegnep.exe

Filesize
264KB

MD5
ccb8431f9e2a2dc51dc7fe71e2abb28a

SHA1
67e26ba65872e7b16435a3f27f49167bbb314bec

SHA256
2411f07c26a378bf95681ced8c95c8dc030c3751065a93d6367fdde9d1db24dc

SHA512
27ebdc3d163ed7f40a0ae7b405c4607eabc2d652dca2e34ce74bcf589639a2eed5f5930bef37731533010637aa5d17511b6bde32a74b5b5e8a8748bf267c7a9e

Download Submit
C:\Windows\SysWOW64\Lcmofolg.exe

Filesize
264KB

MD5
0ea1c94753ad3e2d9f66e17d44ce8cc6

SHA1
dc890da8a0989f4ac00ce57023f872f426dad089

SHA256
ac81a9f9a034c9b2b7a187e0a74ec1653b4c516c567a6ada7525dce1b6f8e0f0

SHA512
441a73f2377cdd8690244aded37a8769a3cc9dd52add2ce7af7d17ffcd6df61ee8afa4fb98952c5f735fec011fa14d5a12b6d970743d72c9fd4e6799037c9748

Download Submit
C:\Windows\SysWOW64\Lcmofolg.exe

Filesize
264KB

MD5
6e8fb613a87590a33f8c6581c3b52d80

SHA1
7efc9202f016aea449b30d965be9c9aa0de592cb

SHA256
779a1b4b5bd2c71116a6c9945047afb7391f3aee051e34c93968d531d47a9c08

SHA512
e79b5db42bc4c043e43e8330987a12051300b5b6144e0443e20a657502789cf148e623f61fc7cb8b87e7b66c8f6eef87988bb1e5cbbac2b32ec70f500684dbdf

Download Submit
C:\Windows\SysWOW64\Lgbnmm32.exe

Filesize
264KB

MD5
01300afc307a4ac1d7d21497f5811038

SHA1
91076a86ccfb38fa5076ae48aecdc9064ba29679

SHA256
34fe39a2cd3a9ebfc85c237427bb29827ab15acf27ea6d2f690e5796ae7f9d5d

SHA512
0c9c8e38f913bf4a7e71401deb4eb69a9371be51c21af5d1b6d8bc680805771bdbee1940f07d190b9ffd295a45707506262f5a3f928d5200eda1704f7ee43df9

Download Submit
C:\Windows\SysWOW64\Lgkhlnbn.exe

Filesize
264KB

MD5
bcac428cd41f4d33d8c2a6b336012307

SHA1
cbb88b4a8fd22c0207c8b161ec3a4751fb41799c

SHA256
300a9b87491bc8172816e21b1aead4b4f29ced72f5ac0120701a9f437c565c47

SHA512
223aa6cd271c3a44f61fc3e36bd6b21fc4e05cc31578c6db0ddd17777dcb63fd8edb5b542b6b9eb2ea164aef8466a08ac3f22708247d2d234e0148fd89e629cd

Download Submit
C:\Windows\SysWOW64\Ljnnch32.exe

Filesize
264KB

MD5
26faba43deecd365d48412806151a9d9

SHA1
326a6e73db4ec7834ca17277e009ece4d27ce963

SHA256
74991ea2e622219446f98dd192a605d51480b1b43b2c688f532b2a974094be62

SHA512
3eb81cdd2defad41287bea40d3cdcf3d5008379c7b77f3994bd050ecf5f6f4d8044eedc25f3eb5196853cbc651c27b1fff7a85450fb180f31400b59c38ef3f70

Download Submit
C:\Windows\SysWOW64\Lkiqbl32.exe

Filesize
264KB

MD5
f32def214811a3177e5c0e9388ba7452

SHA1
c842ef1ffabf167caa7c71d164df12bc88aa24c3

SHA256
a7dc0a3d5a817f5e280329bfc20a5da7b9297a1823ad837cee107d42b3bb0169

SHA512
7201436921a5639f5e2c56edd2635b540c7835aa7a191b87ccc6b5b73412e165934cda39f33bc19d4f868a5937f6db6d10247e335121312b9af34c849e9d869a

Download Submit
C:\Windows\SysWOW64\Lknjmkdo.exe

Filesize
264KB

MD5
b7cac42b93cfd3d775e3cd0cf061cd46

SHA1
f34d89b305187e85572f5e196808f41e83a650a8

SHA256
3de916d988659a4c21f3263bd2e9b402d0d81a6727ab62805973c853abb34f7f

SHA512
f5332f6aa7d7d330451968f6c5a85c7039992965e348ffa828281488629a7368ee9fccc1669b62279a55a9e213539bf1392a09e1c58b243824b3a9287f75fa8d

Download Submit
C:\Windows\SysWOW64\Lnepih32.exe

Filesize
264KB

MD5
c668b48c15198568a97fed39f3cc6ce4

SHA1
e88f7e91b75fa5ddaf8e2a2f2b2a0290e0f68686

SHA256
d297e987de682763e2dab885318a6707cdec0c6f067accb6eac156e69a3a9db3

SHA512
73d70710e431041bce78d80de6f2107f46f40915c5726032fc4694ba56ca277d4494ec617505d6d0af7243a1641628e487e830b3dd20e474c50d5cfc4ad8b934

Download Submit
C:\Windows\SysWOW64\Lpappc32.exe

Filesize
264KB

MD5
f41a3b6a6392e7c883539a2115ffb33c

SHA1
896c00c501d2750565db3e3a38e37b040311e65d

SHA256
704bd0013ad30630eb92590db452f05dfed8c6cbb0b238ad8c3aa9f2a6259f14

SHA512
7c0dccb1cd90dcfac2727ff8790610a43b45468242992d5f88d93f98b4fedebdf8e2b55c176fcd376993a77afe6332745f9c2aac393f17159a4cfb33fa7beb4b

Download Submit
C:\Windows\SysWOW64\Lpfijcfl.exe

Filesize
264KB

MD5
754207ae3d3974023e0e55d2d280a099

SHA1
b9072091762aa76bdb6696971def40c75a6e0aa4

SHA256
be822a99196f4b2ad3314e05df5bc873c7f0124028603005d9335fddfc2bdfad

SHA512
f3fb7ae08404d32e79e513b107cb3b21aee7abd9890a4936008d5bc624c47833dbd88ca60f59937440c5c8e5bca5a69c1c4dd373d8147b69c0a73b255f07c9d9

Download Submit
C:\Windows\SysWOW64\Lphfpbdi.exe

Filesize
264KB

MD5
cf8b7746112392f0c50b25252cbaee6f

SHA1
b1a85ed339e4bc3ea1dcf832e75d0cb697aaad70

SHA256
ec77bb5a45dfb77222ce82d90628190ae35bf5a853f60593adb8c833c6b76d06

SHA512
62a06a128b708ca877b6b5d385e109a082935f62a50e7fd6954bc3b26979ac1fb69b9a96e8cce9f361b3cde325d1639147d83e8cc4dfa0eb38ad36b18a6b0238

Download Submit
C:\Windows\SysWOW64\Majopeii.exe

Filesize
264KB

MD5
60ca52be923073d7faf900ecbdd2d4f3

SHA1
0052caa9651a3d24ee578d668ef6b71804aadf38

SHA256
26cecd05e8c4af6947074eef6342e455b2b84995a231401b9f19198e85d42448

SHA512
53119e40e707dff67cc4ad54c1dd997eff55b802d8075de684592ba160321ccfcf7da70e6341d067e558248e99e6b0848f926855314f9d03f9f3279a80ae0cd5

Download Submit
C:\Windows\SysWOW64\Mcklgm32.exe

Filesize
264KB

MD5
89bef5b6c9841dd281fe5eb529c669ed

SHA1
db2de6233e6342986bf790ed12dbcad38aa6214b

SHA256
579a14feb48e735a6e72969bb37a9546a016f1ec7fd4eb71558a4a42fff14c46

SHA512
2d05bb406bfe47c9539df9e26f2bd2937d363a9c4b9ed537c33508edb435b64778125957040af920cd785d2fb2fc1ea7ea343a0e8f3f6c1d906f3882155f859e

Download Submit
C:\Windows\SysWOW64\Mcpebmkb.exe

Filesize
264KB

MD5
e7c601282b68d5c829b11de03f652073

SHA1
4ef611e6576c4efb911181e73d3f9c3237df26ed

SHA256
aef0df6f86815d923b22b95a6f2acdecae23bb4408f5e23d200bf16d111ffb12

SHA512
5763c4b6f273da2e8dc08abe7a9adbc3abeec6436fb0a1bdccee6ba21b13a511ab46ba1c32fb9c4d273aa04a157e2e0a18b3427f8b22170a647b2fdcaf7e7ef2

Download Submit
C:\Windows\SysWOW64\Mdpalp32.exe

Filesize
264KB

MD5
f36e10a2dadab19249f71f61270b792d

SHA1
cfddd80ebce74222021755c4565bf7bdd5bcc4aa

SHA256
a5287048767c0203f66c490bd7a0af37f1a69257c996f5a62a21fb31218e02e3

SHA512
7ef190e4c403626ea10671e241b324cb7df3e260fc1f8e4e4685292e4b729a1288ea74cf3732fe8d17464ccabdbd09a2670bb81c197606a5e86330350e3f752f

Download Submit
C:\Windows\SysWOW64\Mgidml32.exe

Filesize
264KB

MD5
c4d73d8654fd7a078ab5aac7b33f984c

SHA1
1b5fc7b861f60abd825513a11fe8f476cb90d54c

SHA256
ca207006ca08d26746f562103107882ae3671ea4b6aa8e6022fec3de5a3ee4d7

SHA512
09f59affefa402db5785b1d8380b27c12f0d8c23b51123f4ec5f3cf127b9038eac6efe358c7b844fdb124c24e3da4fcd5b38de17b62ef50738f95c8c7b9ddba6

Download Submit
C:\Windows\SysWOW64\Mjcgohig.exe

Filesize
264KB

MD5
abd6bac518dfcf08554b2a07dfd70f5d

SHA1
a95eb0ffa5678823bd2102efe348d5417b65d03b

SHA256
9e2c7e9267ed3b0bc9c8ec9e7cae15f5338c940209926dd338170baf7f967369

SHA512
9ce6e68f15524680a55d824cdfe7cb6230230e9abb5acf0a38ede94bffd149d9758234da9c3ea4465053f1f8c54ae3d7a955703d869584a2f6a7160f2548c01c

Download Submit
C:\Windows\SysWOW64\Mnapdf32.exe

Filesize
264KB

MD5
dd09533e9cf86d7363cf44aa487046f3

SHA1
5f26c776d412ec2ec48554e90358497a214a258d

SHA256
8dbe48da29d9d7257d7b0bc2f290a57e59da6b6c71b448d15d64003f80afc403

SHA512
3f72a0cf495ba6d968f16041c951eb2b87eb35e5222d0a46486cdd0d89de091fa55a081327ab36ef25d42666daf9ad5e408a58268bebbf6ef394b66f8ce70f38

Download Submit
C:\Windows\SysWOW64\Mncmjfmk.exe

Filesize
264KB

MD5
92dcbe30d80ef6f42ef10d2597e47f1e

SHA1
2c4a7f2f1c252d87411338c67a3794a9f34bb4e6

SHA256
48f4482fce7c0ee636448aaa4196d11a6c7fa3892979623e637700e9aee17058

SHA512
b2e5f1c9705fd0f02d6020e25983cbf5b6814890edec3954081ac6a3b8bf51ee6f5d8b832361ec5fb4d38fe1bee2a161f4b87f3dcf3c2fb6c30d4419d7f963ee

Download Submit
C:\Windows\SysWOW64\Mpaifalo.exe

Filesize
264KB

MD5
e53a7216dc7e193d16f55d2ee49e9cd9

SHA1
3fd8dd025503331dc4c7a1e1bbfd36784bcbd38a

SHA256
9a6107d809aee00925ba30469d177187e7f3aee57fdc614ba572af0355719ae7

SHA512
4284974d3330db0d13d0c4d84704dc6a618e2d2e7f3c0f7a85bb7c0299baa5afa538d4fa2b714194a0d56e04e2dd2556ff6ac98534f3461b523ed9e05f766689

Download Submit
C:\Windows\SysWOW64\Mpkbebbf.exe

Filesize
264KB

MD5
990cbbf3a31bae9facc180fbc58d76b9

SHA1
92817c60938b8a3063ec9de00dc2f6c45da73696

SHA256
dd1fe88ae5a0a87e5d3f9a7cac2563b9aeff004d97fdf7bbfe3af7ba1f284902

SHA512
f62ca9d95bf8fb53093d134e578683470fdba51ee0524976e11e5c40190743c8a46cfd584a772fe7a947d1c4146aed8501efd5f35de0fc14654775ca71907747

Download Submit
C:\Windows\SysWOW64\Nafokcol.exe

Filesize
264KB

MD5
b88b25b7cf27340e3abb0088582ed1e9

SHA1
9f5098a493e6a8484d8920aba38bea2551632f8b

SHA256
8e38797a6dde83ba1d7ecc572d9ba6de53f88e0b3292ea29ef6142dbeb052015

SHA512
e6c18de16cfb639d7e3169eafc44a31a3121db0818b573a7d08a7157b922b27dcc3b8b33631f57756875324061b445132184bf8ee04ba0e826f1fd506458cc6a

Download Submit
C:\Windows\SysWOW64\Njacpf32.exe

Filesize
264KB

MD5
454069d31dee07e1f9cafab15ae80c48

SHA1
c560805f3e3ae432ff90cb5c62d006c153841d82

SHA256
e58af7174dfe8b6eef97b7750d37c4546a91389dc8d4f38dd66165700265b67e

SHA512
487dd5f8a72dbcdb8a2c2ca1bb0ce6220d22cfe5a29fb9b5f1d0afa67c7d75373047b9e061fa13eade7352d2bd11291935e07e48376d5d430cf6674b76b4f7b8

Download Submit
C:\Windows\SysWOW64\Nkcmohbg.exe

Filesize
264KB

MD5
c1ab1accda7d46d294b46cbb98c40e40

SHA1
6478c5c729eb36aed283f37d585c92f2f3d0671f

SHA256
f7c599faa3a678c861b5249d9e67bdee6d0d0290a102d8fd24234fb5b8f75b77

SHA512
cb24dee17f28749d685556cda69a51782a47e31ad2293b63d2a7d456bcfa1c5582ab70de2969bc0efe4b1d553611b52069a045c8560002449ca3654d13fa74fd

Download Submit
C:\Windows\SysWOW64\Nkjjij32.exe

Filesize
264KB

MD5
5f415b24aee3576f08d6f5c6412ee304

SHA1
2ed821c54180ec220d6877850417e92991be1ffe

SHA256
2ce91624be3e0d457f2ebe18d355abcf1acb0390bfa9bdafb3e07b68e3087de4

SHA512
1fef71de21be838415aa2dd8071a823242ca6d3b7068b0f32aeceba4ed28ab10edaaf4276b1ce955b8cb9a30338271ee69f2f548652e89a2016eeaba53abdb5d

Download Submit
C:\Windows\SysWOW64\Nklfoi32.exe

Filesize
264KB

MD5
c57379242389febc31c09a5bf599ba5e

SHA1
1bfd611197cbbdac63ec86ca5767339154c4c2ba

SHA256
2858e06aa0a838b981668425eb5bfa75d6a2b61fd26b1804af74c67e1bdebd3b

SHA512
a35d7cc892e7639884cd4d61507c827203a839a05c1fb3c15d82081a2f617b5a057e822378f642205a234f3910cfe4112abfaf9d1d7f3ae32fe91ad81031b8b4

Download Submit
C:\Windows\SysWOW64\Nqfbaq32.exe

Filesize
264KB

MD5
31c0a7740eb705262e622ef73964e0cd

SHA1
078ecf7fa684b409a0e1194ffbcae2302adc76ca

SHA256
f66a6ec6d817c6f54794555d0c3a91ff9cd01b3527f9b4d72195f2af8ae8407b

SHA512
07a3d1cc90c43df4c1b97a766c593ad6b567d98292b6987cf956547b057b7c20a0a5c122d7cd27e14ee52f1db863edb330ad664086ace021125500add870bff8

Download Submit
memory/324-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/324-358-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/624-319-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/624-160-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/644-128-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/644-327-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/844-316-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/844-176-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1432-24-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1432-352-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1448-329-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1448-120-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1456-96-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1456-335-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1480-184-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1480-314-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1636-339-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1636-80-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1712-256-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1712-297-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1764-196-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1772-247-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1772-299-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1784-77-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2228-311-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2228-200-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2296-288-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2296-286-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2344-301-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2344-240-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2492-32-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2492-350-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2580-305-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2580-224-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2904-307-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2904-216-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2948-323-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2948-144-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2996-303-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2996-231-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3168-104-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3168-333-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3228-87-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3228-337-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3392-346-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3392-48-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3408-290-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3408-280-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3492-331-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3492-112-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3500-356-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3500-7-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3732-278-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4100-309-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4100-208-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4124-172-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4384-295-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4384-262-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4416-342-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4416-64-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4424-268-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4424-293-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4432-16-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4432-354-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4800-325-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4800-136-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4904-321-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4904-153-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4908-344-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4908-55-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5104-41-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5104-348-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads