njrat | 418299623cbf9de8d9df8459350869d26514343b4df72dee3ec9047d7438a775

Analysis

max time kernel
142s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 18:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0d472dca311025b009604ffe8e7986d0_NEIKI.exe
Size 337KB
Sample240508-xdny6sca83
SHA256 418299623cbf9de8d9df8459350869d26514343b4df72dee3ec9047d7438a775
MD5 0d472dca311025b009604ffe8e7986d0
SHA1 580a7d124bac0bda5a7b8dbe4e950414c4c2333b
SHA512 2502d8875c7c5505ccbd392656db248fe284eca66c096941e7830b6e589b66c654be326888b1d7382703478b12cd07f7f3e2d1ed840c57f175ebbb8714f6bc2b
SSDEEP 3072:L+bIx7sNepjLXF4RYm6/GgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:L+bEsNepXWYG1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

njrat persistence trojan

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 54 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hgeihiac.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ibdplaho.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fbdnne32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fcekfnkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gdgdeppb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iabglnco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lkiamp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lahbei32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hejjanpm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Infhebbh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ibdplaho.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fjjjgh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fjjjgh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iajmmm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lkiamp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkbgjo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jeaiij32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	0d472dca311025b009604ffe8e7986d0_NEIKI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gqbneq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hejjanpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iabglnco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kkgdhp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fbdnne32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fcekfnkb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fqikob32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fcpakn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Igjbci32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Infhebbh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lhpnlclc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hkmlnimb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lhpnlclc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lahbei32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hebcao32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jeaiij32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lhmafcnf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hkmlnimb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hgeihiac.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kkgdhp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lhmafcnf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dkbgjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fcpakn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Igjbci32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jhkljfok.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Klpjad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	0d472dca311025b009604ffe8e7986d0_NEIKI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fqikob32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gdgdeppb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gjficg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iajmmm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jhkljfok.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gjficg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gqbneq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hebcao32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Klpjad32.exe

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Executes dropped EXE 27 IoCs

pid	Process
2776	Dkbgjo32.exe
4028	Fcpakn32.exe
3312	Fjjjgh32.exe
4708	Fbdnne32.exe
5020	Fcekfnkb.exe
1552	Fqikob32.exe
4292	Gdgdeppb.exe
1468	Gjficg32.exe
1556	Gqbneq32.exe
1824	Hebcao32.exe
3628	Hkmlnimb.exe
2280	Hgeihiac.exe
1456	Hejjanpm.exe
4348	Igjbci32.exe
4728	Iabglnco.exe
3584	Infhebbh.exe
4460	Ibdplaho.exe
1964	Iajmmm32.exe
4668	Jhkljfok.exe
3828	Jeaiij32.exe
2788	Klpjad32.exe
4256	Kkgdhp32.exe
4932	Lkiamp32.exe
4300	Lhmafcnf.exe
5028	Lhpnlclc.exe
1392	Lahbei32.exe
3412	Ldikgdpe.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Gjficg32.exe	Gdgdeppb.exe
File created	C:\Windows\SysWOW64\Jopaaj32.dll	Hejjanpm.exe
File opened for modification	C:\Windows\SysWOW64\Lhmafcnf.exe	Lkiamp32.exe
File opened for modification	C:\Windows\SysWOW64\Gdgdeppb.exe	Fqikob32.exe
File created	C:\Windows\SysWOW64\Pceijm32.dll	Jhkljfok.exe
File created	C:\Windows\SysWOW64\Ibdplaho.exe	Infhebbh.exe
File opened for modification	C:\Windows\SysWOW64\Ldikgdpe.exe	Lahbei32.exe
File opened for modification	C:\Windows\SysWOW64\Fcekfnkb.exe	Fbdnne32.exe
File created	C:\Windows\SysWOW64\Fjjjgh32.exe	Fcpakn32.exe
File opened for modification	C:\Windows\SysWOW64\Fjjjgh32.exe	Fcpakn32.exe
File created	C:\Windows\SysWOW64\Fhgmqghl.dll	Fjjjgh32.exe
File created	C:\Windows\SysWOW64\Fachkklb.dll	Fbdnne32.exe
File created	C:\Windows\SysWOW64\Dbneceac.dll	Hebcao32.exe
File created	C:\Windows\SysWOW64\Bekdaogi.dll	Lahbei32.exe
File created	C:\Windows\SysWOW64\Fcpakn32.exe	Dkbgjo32.exe
File created	C:\Windows\SysWOW64\Gdgdeppb.exe	Fqikob32.exe
File created	C:\Windows\SysWOW64\Hebcao32.exe	Gqbneq32.exe
File created	C:\Windows\SysWOW64\Lcmgbngb.dll	Hkmlnimb.exe
File opened for modification	C:\Windows\SysWOW64\Kkgdhp32.exe	Klpjad32.exe
File created	C:\Windows\SysWOW64\Ebpmamlm.dll	Klpjad32.exe
File created	C:\Windows\SysWOW64\Fcnhog32.dll	Kkgdhp32.exe
File opened for modification	C:\Windows\SysWOW64\Fbdnne32.exe	Fjjjgh32.exe
File created	C:\Windows\SysWOW64\Jfqqddpi.dll	Dkbgjo32.exe
File created	C:\Windows\SysWOW64\Fbdnne32.exe	Fjjjgh32.exe
File created	C:\Windows\SysWOW64\Gqbneq32.exe	Gjficg32.exe
File opened for modification	C:\Windows\SysWOW64\Hgeihiac.exe	Hkmlnimb.exe
File created	C:\Windows\SysWOW64\Infhebbh.exe	Iabglnco.exe
File created	C:\Windows\SysWOW64\Iajmmm32.exe	Ibdplaho.exe
File opened for modification	C:\Windows\SysWOW64\Iajmmm32.exe	Ibdplaho.exe
File created	C:\Windows\SysWOW64\Dkbgjo32.exe	0d472dca311025b009604ffe8e7986d0_NEIKI.exe
File opened for modification	C:\Windows\SysWOW64\Klpjad32.exe	Jeaiij32.exe
File created	C:\Windows\SysWOW64\Lajbnn32.dll	Jeaiij32.exe
File opened for modification	C:\Windows\SysWOW64\Lhpnlclc.exe	Lhmafcnf.exe
File created	C:\Windows\SysWOW64\Jhkljfok.exe	Iajmmm32.exe
File opened for modification	C:\Windows\SysWOW64\Hebcao32.exe	Gqbneq32.exe
File created	C:\Windows\SysWOW64\Hejjanpm.exe	Hgeihiac.exe
File opened for modification	C:\Windows\SysWOW64\Fcpakn32.exe	Dkbgjo32.exe
File opened for modification	C:\Windows\SysWOW64\Iabglnco.exe	Igjbci32.exe
File created	C:\Windows\SysWOW64\Jeaiij32.exe	Jhkljfok.exe
File created	C:\Windows\SysWOW64\Klpjad32.exe	Jeaiij32.exe
File opened for modification	C:\Windows\SysWOW64\Hejjanpm.exe	Hgeihiac.exe
File opened for modification	C:\Windows\SysWOW64\Fqikob32.exe	Fcekfnkb.exe
File created	C:\Windows\SysWOW64\Lahbei32.exe	Lhpnlclc.exe
File opened for modification	C:\Windows\SysWOW64\Lahbei32.exe	Lhpnlclc.exe
File created	C:\Windows\SysWOW64\Lfeliqka.dll	Lhpnlclc.exe
File created	C:\Windows\SysWOW64\Fcekfnkb.exe	Fbdnne32.exe
File created	C:\Windows\SysWOW64\Dpchag32.dll	Ibdplaho.exe
File opened for modification	C:\Windows\SysWOW64\Infhebbh.exe	Iabglnco.exe
File created	C:\Windows\SysWOW64\Pjpjea32.dll	Igjbci32.exe
File created	C:\Windows\SysWOW64\Kkgdhp32.exe	Klpjad32.exe
File opened for modification	C:\Windows\SysWOW64\Dkbgjo32.exe	0d472dca311025b009604ffe8e7986d0_NEIKI.exe
File created	C:\Windows\SysWOW64\Bbjlpn32.dll	Fqikob32.exe
File created	C:\Windows\SysWOW64\Emjnfn32.dll	Gdgdeppb.exe
File opened for modification	C:\Windows\SysWOW64\Gqbneq32.exe	Gjficg32.exe
File created	C:\Windows\SysWOW64\Gmkock32.dll	Gjficg32.exe
File opened for modification	C:\Windows\SysWOW64\Hkmlnimb.exe	Hebcao32.exe
File created	C:\Windows\SysWOW64\Hgeihiac.exe	Hkmlnimb.exe
File created	C:\Windows\SysWOW64\Gcqpalio.dll	Hgeihiac.exe
File created	C:\Windows\SysWOW64\Fqikob32.exe	Fcekfnkb.exe
File created	C:\Windows\SysWOW64\Pinffi32.dll	Iabglnco.exe
File opened for modification	C:\Windows\SysWOW64\Ibdplaho.exe	Infhebbh.exe
File opened for modification	C:\Windows\SysWOW64\Jhkljfok.exe	Iajmmm32.exe
File opened for modification	C:\Windows\SysWOW64\Jeaiij32.exe	Jhkljfok.exe
File created	C:\Windows\SysWOW64\Ldikgdpe.exe	Lahbei32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4084	3412	WerFault.exe	117

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bbjlpn32.dll"	Fqikob32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gdgdeppb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gjficg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlbngnmk.dll"	Iajmmm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jeaiij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fcnhog32.dll"	Kkgdhp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lahbei32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fcpakn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fcpakn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hebcao32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbneceac.dll"	Hebcao32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hejjanpm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Infhebbh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eaeamb32.dll"	Infhebbh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dkbgjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gcqpalio.dll"	Hgeihiac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Infhebbh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kkgdhp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfeliqka.dll"	Lhpnlclc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dkbgjo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iajmmm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hgeihiac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Igjbci32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pinffi32.dll"	Iabglnco.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lhpnlclc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gdgdeppb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmkock32.dll"	Gjficg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hebcao32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lcmgbngb.dll"	Hkmlnimb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jopaaj32.dll"	Hejjanpm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lkiamp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fjjjgh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gjficg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hgeihiac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iajmmm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Klpjad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfqqddpi.dll"	Dkbgjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pceijm32.dll"	Jhkljfok.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fqikob32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fqikob32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Emjnfn32.dll"	Gdgdeppb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Klpjad32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	0d472dca311025b009604ffe8e7986d0_NEIKI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fcekfnkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hkmlnimb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Igjbci32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjpjea32.dll"	Igjbci32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lhpnlclc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	0d472dca311025b009604ffe8e7986d0_NEIKI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hdeeipfp.dll"	Fcpakn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fbdnne32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gqhomdeb.dll"	Lkiamp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lhmafcnf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fhgmqghl.dll"	Fjjjgh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gqbneq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dpchag32.dll"	Ibdplaho.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	0d472dca311025b009604ffe8e7986d0_NEIKI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohjckodg.dll"	0d472dca311025b009604ffe8e7986d0_NEIKI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fcekfnkb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gqbneq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jeaiij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lajbnn32.dll"	Jeaiij32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jhkljfok.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	0d472dca311025b009604ffe8e7986d0_NEIKI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 2776	4888	0d472dca311025b009604ffe8e7986d0_NEIKI.exe	91
PID 4888 wrote to memory of 2776	4888	0d472dca311025b009604ffe8e7986d0_NEIKI.exe	91
PID 4888 wrote to memory of 2776	4888	0d472dca311025b009604ffe8e7986d0_NEIKI.exe	91
PID 2776 wrote to memory of 4028	2776	Dkbgjo32.exe	92
PID 2776 wrote to memory of 4028	2776	Dkbgjo32.exe	92
PID 2776 wrote to memory of 4028	2776	Dkbgjo32.exe	92
PID 4028 wrote to memory of 3312	4028	Fcpakn32.exe	93
PID 4028 wrote to memory of 3312	4028	Fcpakn32.exe	93
PID 4028 wrote to memory of 3312	4028	Fcpakn32.exe	93
PID 3312 wrote to memory of 4708	3312	Fjjjgh32.exe	94
PID 3312 wrote to memory of 4708	3312	Fjjjgh32.exe	94
PID 3312 wrote to memory of 4708	3312	Fjjjgh32.exe	94
PID 4708 wrote to memory of 5020	4708	Fbdnne32.exe	95
PID 4708 wrote to memory of 5020	4708	Fbdnne32.exe	95
PID 4708 wrote to memory of 5020	4708	Fbdnne32.exe	95
PID 5020 wrote to memory of 1552	5020	Fcekfnkb.exe	96
PID 5020 wrote to memory of 1552	5020	Fcekfnkb.exe	96
PID 5020 wrote to memory of 1552	5020	Fcekfnkb.exe	96
PID 1552 wrote to memory of 4292	1552	Fqikob32.exe	97
PID 1552 wrote to memory of 4292	1552	Fqikob32.exe	97
PID 1552 wrote to memory of 4292	1552	Fqikob32.exe	97
PID 4292 wrote to memory of 1468	4292	Gdgdeppb.exe	98
PID 4292 wrote to memory of 1468	4292	Gdgdeppb.exe	98
PID 4292 wrote to memory of 1468	4292	Gdgdeppb.exe	98
PID 1468 wrote to memory of 1556	1468	Gjficg32.exe	99
PID 1468 wrote to memory of 1556	1468	Gjficg32.exe	99
PID 1468 wrote to memory of 1556	1468	Gjficg32.exe	99
PID 1556 wrote to memory of 1824	1556	Gqbneq32.exe	100
PID 1556 wrote to memory of 1824	1556	Gqbneq32.exe	100
PID 1556 wrote to memory of 1824	1556	Gqbneq32.exe	100
PID 1824 wrote to memory of 3628	1824	Hebcao32.exe	101
PID 1824 wrote to memory of 3628	1824	Hebcao32.exe	101
PID 1824 wrote to memory of 3628	1824	Hebcao32.exe	101
PID 3628 wrote to memory of 2280	3628	Hkmlnimb.exe	102
PID 3628 wrote to memory of 2280	3628	Hkmlnimb.exe	102
PID 3628 wrote to memory of 2280	3628	Hkmlnimb.exe	102
PID 2280 wrote to memory of 1456	2280	Hgeihiac.exe	103
PID 2280 wrote to memory of 1456	2280	Hgeihiac.exe	103
PID 2280 wrote to memory of 1456	2280	Hgeihiac.exe	103
PID 1456 wrote to memory of 4348	1456	Hejjanpm.exe	104
PID 1456 wrote to memory of 4348	1456	Hejjanpm.exe	104
PID 1456 wrote to memory of 4348	1456	Hejjanpm.exe	104
PID 4348 wrote to memory of 4728	4348	Igjbci32.exe	105
PID 4348 wrote to memory of 4728	4348	Igjbci32.exe	105
PID 4348 wrote to memory of 4728	4348	Igjbci32.exe	105
PID 4728 wrote to memory of 3584	4728	Iabglnco.exe	106
PID 4728 wrote to memory of 3584	4728	Iabglnco.exe	106
PID 4728 wrote to memory of 3584	4728	Iabglnco.exe	106
PID 3584 wrote to memory of 4460	3584	Infhebbh.exe	107
PID 3584 wrote to memory of 4460	3584	Infhebbh.exe	107
PID 3584 wrote to memory of 4460	3584	Infhebbh.exe	107
PID 4460 wrote to memory of 1964	4460	Ibdplaho.exe	108
PID 4460 wrote to memory of 1964	4460	Ibdplaho.exe	108
PID 4460 wrote to memory of 1964	4460	Ibdplaho.exe	108
PID 1964 wrote to memory of 4668	1964	Iajmmm32.exe	109
PID 1964 wrote to memory of 4668	1964	Iajmmm32.exe	109
PID 1964 wrote to memory of 4668	1964	Iajmmm32.exe	109
PID 4668 wrote to memory of 3828	4668	Jhkljfok.exe	110
PID 4668 wrote to memory of 3828	4668	Jhkljfok.exe	110
PID 4668 wrote to memory of 3828	4668	Jhkljfok.exe	110
PID 3828 wrote to memory of 2788	3828	Jeaiij32.exe	111
PID 3828 wrote to memory of 2788	3828	Jeaiij32.exe	111
PID 3828 wrote to memory of 2788	3828	Jeaiij32.exe	111
PID 2788 wrote to memory of 4256	2788	Klpjad32.exe	112

C:\Users\Admin\AppData\Local\Temp\0d472dca311025b009604ffe8e7986d0_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\0d472dca311025b009604ffe8e7986d0_NEIKI.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Windows\SysWOW64\Dkbgjo32.exe
  C:\Windows\system32\Dkbgjo32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2776
- - C:\Windows\SysWOW64\Fcpakn32.exe
    C:\Windows\system32\Fcpakn32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4028
  - - C:\Windows\SysWOW64\Fjjjgh32.exe
      C:\Windows\system32\Fjjjgh32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3312
    - - C:\Windows\SysWOW64\Fbdnne32.exe
        
        C:\Windows\system32\Fbdnne32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4708
      - C:\Windows\SysWOW64\Fcekfnkb.exe
        
        C:\Windows\system32\Fcekfnkb.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5020
        
        C:\Windows\SysWOW64\Fqikob32.exe
        
        C:\Windows\system32\Fqikob32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1552
        
        C:\Windows\SysWOW64\Gdgdeppb.exe
        
        C:\Windows\system32\Gdgdeppb.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4292
        
        C:\Windows\SysWOW64\Gjficg32.exe
        
        C:\Windows\system32\Gjficg32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1468
        
        C:\Windows\SysWOW64\Gqbneq32.exe
        
        C:\Windows\system32\Gqbneq32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1556
        
        C:\Windows\SysWOW64\Hebcao32.exe
        
        C:\Windows\system32\Hebcao32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1824
        
        C:\Windows\SysWOW64\Hkmlnimb.exe
        
        C:\Windows\system32\Hkmlnimb.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3628
        
        C:\Windows\SysWOW64\Hgeihiac.exe
        
        C:\Windows\system32\Hgeihiac.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2280
        
        C:\Windows\SysWOW64\Hejjanpm.exe
        
        C:\Windows\system32\Hejjanpm.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1456
        
        C:\Windows\SysWOW64\Igjbci32.exe
        
        C:\Windows\system32\Igjbci32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4348
        
        C:\Windows\SysWOW64\Iabglnco.exe
        
        C:\Windows\system32\Iabglnco.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4728
        
        C:\Windows\SysWOW64\Infhebbh.exe
        
        C:\Windows\system32\Infhebbh.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3584
        
        C:\Windows\SysWOW64\Ibdplaho.exe
        
        C:\Windows\system32\Ibdplaho.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4460
        
        C:\Windows\SysWOW64\Iajmmm32.exe
        
        C:\Windows\system32\Iajmmm32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1964
        
        C:\Windows\SysWOW64\Jhkljfok.exe
        
        C:\Windows\system32\Jhkljfok.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4668
        
        C:\Windows\SysWOW64\Jeaiij32.exe
        
        C:\Windows\system32\Jeaiij32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3828
        
        C:\Windows\SysWOW64\Klpjad32.exe
        
        C:\Windows\system32\Klpjad32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2788
        
        C:\Windows\SysWOW64\Kkgdhp32.exe
        
        C:\Windows\system32\Kkgdhp32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4256
        
        C:\Windows\SysWOW64\Lkiamp32.exe
        
        C:\Windows\system32\Lkiamp32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4932
        
        C:\Windows\SysWOW64\Lhmafcnf.exe
        
        C:\Windows\system32\Lhmafcnf.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4300
        
        C:\Windows\SysWOW64\Lhpnlclc.exe
        
        C:\Windows\system32\Lhpnlclc.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:5028
        
        C:\Windows\SysWOW64\Lahbei32.exe
        
        C:\Windows\system32\Lahbei32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1392
        
        C:\Windows\SysWOW64\Ldikgdpe.exe
        
        C:\Windows\system32\Ldikgdpe.exe
        28⤵
        Executes dropped EXE
        
        PID:3412
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3412 -s 408
        29⤵
        Program crash
        
        PID:4084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3412 -ip 3412
1⤵
PID:1192

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4332 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8
1⤵
PID:1868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Dkbgjo32.exe

Path C:\Windows\SysWOW64\Dkbgjo32.exe
Size 337KB
SHA256 d19cb93a52fa4180695d4f032b5aa8a3ac45c8062fd0a48904e3bda1b09d4e2c
MD5 d651155871697bfe248b0248ed31983f
SHA1 147788f317401074cf43cff0950049d8ec5565fe
SHA512 f95053bbdec54aabfd7b4c6668af4d1a357e88db0933249dd9110c8820c9ee7e57846c92681e21790163741f4ad8e622bf63c8faf978e761d74de66777942fe4
SSDEEP 3072:otCpfBpOJNXgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:otCpfBpgX1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fbdnne32.exe

Path C:\Windows\SysWOW64\Fbdnne32.exe
Size 337KB
SHA256 4e44d484b7750ba9c258d4a40dff8e732b44e64806cb13988fc2444f5a1f36cc
MD5 4eb0b8a20bec3c917f18d935495cfc47
SHA1 54da3b5639dcd05ce96d17e022b40bf8138ac9a4
SHA512 04259b402ede4030c821c83703fe38e285a3b81111895152ffdc4a64dafb3da049f6a08451fd253ce6f99aceca68ee99394f911f8eaddc4a2b05f5d91ea3f5dc
SSDEEP 3072:MTfEERlS65xRWep9gYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:Mjqpep91+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fcekfnkb.exe

Path C:\Windows\SysWOW64\Fcekfnkb.exe
Size 337KB
SHA256 f5fbd6043ce9c2f661e178d417047a5c0b5d19fb0195de19c5608bdb0a7ab1aa
MD5 e65d2774cc62498ea6be950954990c4c
SHA1 872b990c18632e20290f279a4dca17b8724db7c1
SHA512 b621e4117b4bb10207aec50ff1415910a72dbc0a6c21baed928ce9237323ab654df28f91b574be222395ed47999c00361500e84986d57f504d0310aec2c8a96a
SSDEEP 3072:tu007OCPm0pTVvtgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:tunlPmQvt1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fcpakn32.exe

Path C:\Windows\SysWOW64\Fcpakn32.exe
Size 337KB
SHA256 e802371b8e16f4444cd1ebb52687674d85b44d4eb2d057506515d3aa7cbe1875
MD5 c46d565cbd66f94540fde83d2ba4cd29
SHA1 1c11b5ea15fbf41f00cabf2108a3d6b90f59766b
SHA512 86f62a99475302d60ef9be67da5370337ec754875e61d96c47104f772e704eeb3ae022102af4148d9a84639a8fbb3c10c53a88c48755d011ecac7a4d1c2144d7
SSDEEP 3072:0b2KihuSsTFlbdadfgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:K2bhzGadf1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fjjjgh32.exe

Path C:\Windows\SysWOW64\Fjjjgh32.exe
Size 337KB
SHA256 c38a53dfbb294e740a47d3c210e4b82ab35406cfec87df95bd3dfe29bc5709d2
MD5 49174ef0d35e3fe0865d6d12b88c1210
SHA1 9f618985bb743004434be9a43511e04e68142401
SHA512 0c20cfb170ad972b1a3a7825f6a155ba043de4f2a0a7d1023ee5bcdf98907d034ca417d2ccbeb41032ef8b866b9bb14f6874e44ae19bcbe70c869ecd5bee4a3a
SSDEEP 3072:WaUaxMzqkMT8+WihA5UC/Ki3dgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:dUaxFkzZihxC/Kkd1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fqikob32.exe

Path C:\Windows\SysWOW64\Fqikob32.exe
Size 337KB
SHA256 ce75658ee0d22e7c8031f01b0bc2ae9fa7af0ac54751e889285778363d3b0a12
MD5 f52ea0cc5c0c1905bfda16faf63b3e60
SHA1 27b3aaf29d2a1aa013677b74fa3cf6609c96942b
SHA512 bcc56d5b11d7d105f9282a58497de5ad8aedf00818f3c2fa69e8778a24d3552f11ac8f7f68c1ef87028421d70e058933303b1307b6ef66913ca758e2655d12b2
SSDEEP 3072:pXiLU4VQa1XMGBM3YhgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:8LU4WaFh1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gdgdeppb.exe

Path C:\Windows\SysWOW64\Gdgdeppb.exe
Size 337KB
SHA256 fad4e35bb014f53808b06924e8794c4caecdabbf291668bcc56684b87ae6eced
MD5 bb85e534fcfdb658c45c51c4a6241650
SHA1 9fc0621c09074bebdba5c5116a9c661e8fee1efe
SHA512 38f442894e4c3fed1e8b0633609ef77f18ea0d6e8a2c8831d8c4cd4f0f4bdcb6de7647ebb5b5cfa87cac70a614969fc3770417988e01e1606c830eb2803072fd
SSDEEP 3072:xJ7C3Yf5tVI1QOZrgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:SoRnIi4r1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gjficg32.exe

Path C:\Windows\SysWOW64\Gjficg32.exe
Size 337KB
SHA256 bb055c79a5bfffa01ffa3636a0d0e0813611bee84ac07fb6ff66cb0dca376c54
MD5 03a6faf432e57b957978890e1371bae6
SHA1 bf9bdf1d032a03107be6fdac90b8c9966fe42317
SHA512 22a28e4464a89769730a3640f3f933ca77d636e47e59a643d3d4f2df88b6c652d876fd112bd5d00ff2379dadddecfeff765c21d893a4873c06fa2ef88b542fe1
SSDEEP 3072:jHEekiJZ3qFGa9GDgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:jxo9GD1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gqbneq32.exe

Path C:\Windows\SysWOW64\Gqbneq32.exe
Size 337KB
SHA256 c480dbea1d7d33a75233c8c3066c450d379a2eb7cee389ca8eede19fc7a3707a
MD5 d8c93ebb1f65d72da7df6d8b63a50faa
SHA1 3c09a43e841c0a75335271f9fde8a98564fed123
SHA512 d73b5c3296f50a88f648753f08651b6ebe6ae8ebb7cb70c32688824bfb08b02fbe75c64c5be44a65ca33d2200ae5ebc181183d39affb9a32d661298d7c2214ec
SSDEEP 3072:kDHROeFpAuHXgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:kDxOGpAuHX1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hebcao32.exe

Path C:\Windows\SysWOW64\Hebcao32.exe
Size 337KB
SHA256 9a045edfdf4e4d15fb01b89ea62142d552f928d73faee55f6f70f2118cedd174
MD5 d93749b3c123dec5202ff32e94dece97
SHA1 6bd75be37cb91cc011803bf730e19dd89ab184da
SHA512 d6b41341ded9ba41c9f713dbafa3a346771b61936ec23735ddcf1994d42a66cf0726fb9f65bd575edc8312dcf6cb7dc7b80aabfcd7c6c3d1f492fac455d7d1c1
SSDEEP 3072:XwbR5NUHysgF3JFgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:sNXsEZF1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hejjanpm.exe

Path C:\Windows\SysWOW64\Hejjanpm.exe
Size 337KB
SHA256 c2f601316df75213e27e4510b3b9383c513220110e042a6bdf38cb1cfc5fca30
MD5 c0250de7d2a69416268dd048f2f05e18
SHA1 1678726fe2f19f26cf0797673cb8f259e6b104e0
SHA512 705bda437180fdcda5aec90d387edd77c7f23aff25415443898ee3157d9144f449046fe7a38bb58bff4783afc3032f86f3806530c4b45b108415c7c539f8ab42
SSDEEP 3072:rTwYNfkxyV6k4aBgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:n6QTB1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hgeihiac.exe

Path C:\Windows\SysWOW64\Hgeihiac.exe
Size 337KB
SHA256 05d394eae7226dd4d30c36b4c539cb5b0e6dfa0cf6272b121c6fd634f7680e46
MD5 4a52d7e43a5851d6999f66bb16aa9e35
SHA1 fae080fd4c4b2768fb22cd36c8ed81d9e15c0100
SHA512 914f90285d30a6e0235b4407b975e4f30f3456bb8eeab7668e169e93a0d7e5c3bbb61b6c8924eef31ed8392134e3275de9788ac27eab00647b54ed862a613ec7
SSDEEP 3072:QCnmwzI9IqBvwYEqHtMpgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:Q+tzI9I8vwY7ep1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hkmlnimb.exe

Path C:\Windows\SysWOW64\Hkmlnimb.exe
Size 337KB
SHA256 8794017b98f7a6fbe291d705418e5b20a13da082a38b4a1c584d01e21d08b031
MD5 7e6b434cc79553083500ecbac45bbf1c
SHA1 888565c68f2df44ecc4df77d7c7483936e870bfa
SHA512 8dde372fb351e170b4377bb765a1156154f3a3c819c99001fe628d15dd3d1c87e297f984ca42549b6149b1731223e2fc8bb717b57ed9f1dc7a4664e326a0cd66
SSDEEP 3072:pJhGRjRNzygfDE/yAgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:03zygfDE/yA1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Iabglnco.exe

Path C:\Windows\SysWOW64\Iabglnco.exe
Size 337KB
SHA256 91063cb0be82d0c50df1a615b8e786faaeb9e4728ac03a08b0b10996a105c356
MD5 81111e3abc479b76a731bcb05a322c3c
SHA1 c6aa941703c4b821022798b052a70c770879c566
SHA512 855612a79a7d13b1d6099cd543cc16ea9a3d69bab659a5804aa90d55086b2f7b7b349ca90729f5ab496b16dbd10285ab7a5584a4ed793ca15a3d8ddd0f66f1de
SSDEEP 3072:LqZkQdqUsnvv7gztgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:33Ukct1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ibdplaho.exe

Path C:\Windows\SysWOW64\Ibdplaho.exe
Size 337KB
SHA256 a808a0a6fe86e85c3a4be7f9d52b4241397fd4869073906456feefd35f72c5d9
MD5 0ba2923c7891d8744a7bf32ad24f7ad5
SHA1 d30046662b2b97adc1077385db7482fd31e08ef3
SHA512 193943aa03abbce77bfa65d801f63c670a1cf2d5139ce06d11d941d067ab5c31f067f410075196b2b5b9411d3e317c3078af36e19829631fd204647f9ae0a79c
SSDEEP 3072:BTc+hAmHEF9gYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:XimHEF91+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Igjbci32.exe

Path C:\Windows\SysWOW64\Igjbci32.exe
Size 337KB
SHA256 87548e459139cc45b296154dc6867b30ffaa845ae1f8096df6057436e0ab2f92
MD5 4830979a167b18499df6e7fe4cfd386d
SHA1 572705336febf887c2d83dab7678accedebefd8f
SHA512 21a3aec6a38e1547609d395a6c85b4bd571cddb813bec91f8a714839616b31ea46a8938c276829804808a90af0605872ce26afd75a0f5eb7612c091f73cfbadd
SSDEEP 3072:X5QRjYWDFr0agYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:pQR0E0a1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Infhebbh.exe

Path C:\Windows\SysWOW64\Infhebbh.exe
Size 337KB
SHA256 dadaffcdc2a94651e87f8fd6ca5f9b3f55630143f89d65ea214e7211506ca6b0
MD5 a096ddffe6d159e5c969796989b75902
SHA1 d673a14d1e5846afffe84b42fed0468fb25424c0
SHA512 04efbea23b830d9aa57239211fc31b357de0cdee923c42e5aeab369b074b4b5ade16fa1dbe37487a78a48e730d5c337503b27771ab46e402e9dc54fc291a2653
SSDEEP 3072:vebYv4wtswWqicjgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:GbE4wjWqicj1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jeaiij32.exe

Path C:\Windows\SysWOW64\Jeaiij32.exe
Size 337KB
SHA256 b56274112a63d9f7d6dea617b3b6a89ac321a148651ca888a74fedefd08fa3b6
MD5 37529891b5a39eeb038c2e50d8a52891
SHA1 8038c59cec1d1445c4cd948624bf026e26f68a5e
SHA512 b4780d39363c07849a1e85cb5f56c5c7d7316c21f02c2c1da4f1e5716bbaab8432f9f362634d597bc1eaeaf10b7b8a8e057f9e53928c6eeb6beb9c5fc8e569db
SSDEEP 3072:HWYHTtBKDRYgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:HWIBBKDC1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jhkljfok.exe

Path C:\Windows\SysWOW64\Jhkljfok.exe
Size 337KB
SHA256 1a2ca4d69604a17f44fa8f36e7f797fafe07f5f2791c9829a6fb13a6c02f9f65
MD5 d6c0c59787a3cc4e01bb59b9e16139ba
SHA1 80e0454347527e664b26272510ded868ba58ff4c
SHA512 0cd6fb7a8c796560450d7bc0e8ea203140ab9a8a1271fc33c55b833805ab1c42f78b2a13a700f2320fdf76ef9837414d69904e95151a2fbe17c4889bfa09cbfd
SSDEEP 3072:pRqkf8TXg32xgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:pJUTwGx1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jhkljfok.exe

Path C:\Windows\SysWOW64\Jhkljfok.exe
Size 337KB
SHA256 00fe8479a2fde9a39440f9d8bda3ea6f7e811e5381ea7ac3c72242868a07393a
MD5 5eadddf41b3eedec6cb06759834eff4b
SHA1 987d0615f3c873874741ce4a838a68617cf2d714
SHA512 72ddd667c9d4bc4c0a0934e6d7fe5d024e924ce5facf8d074198fe4faa49afbc667db7097f814c77b96057ac2ee10c1436d144e7c9e9370405318ee5d0f1aff6
SSDEEP 3072:pip/1Yz+IuV7LZp2gYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:pipiiIUlp21+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kkgdhp32.exe

Path C:\Windows\SysWOW64\Kkgdhp32.exe
Size 337KB
SHA256 7e9872acda3f5faff44e8e2fb9dd24679874c959a79dd1ec706033262e533ab4
MD5 92853ffd2053f465f841ef7e76f5a95c
SHA1 68809f3285912d0746c9d4724b59b8136ce993f7
SHA512 28ab0a6012122226d7a4f143252c103024d2e187a9c0a42ab7fd177e7b574458b8f5e80d6e031e208341bc73fc49aa51aefd97365aaeb531f87bca13417c732a
SSDEEP 3072:qbIAuoGX6LQgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:q0ApLQ1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Klpjad32.exe

Path C:\Windows\SysWOW64\Klpjad32.exe
Size 337KB
SHA256 b77a1bda52610bca38d7ca328727ca802d1e88b600f4031e9dbe2293a77ee14a
MD5 935f47524cd3b410b67d6d623ca99f25
SHA1 529ff5e7dd326789ea9304fee0653af0803c791e
SHA512 7f07b6d62bffdd24fc5ac72c7507ea5e0756b7c070650b481f6c83b3515a7e19dadff0c8ab880f6ebb4f1b893a067f997f8defc60d0ece1df5541cb631509c5f
SSDEEP 3072:IdJQVvHPkcOPqrO6b+YTMdgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:BHPSC+Ywd1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lahbei32.exe

Path C:\Windows\SysWOW64\Lahbei32.exe
Size 337KB
SHA256 a32a1e63b82e39812ef518c45c805b914ee6e27bb3f1634c497c683b1450509d
MD5 5ca535eb334e947e4225027840212c56
SHA1 a9d10a92a208270cd7e72588f437a17e1206502d
SHA512 1d0ba1e9cb447ae17d2a4c70954cc468116b8c7913eb264fb28bea31873a3c08bcc466cf0ead43c9aa79f701b324de2889268bde4d92cd83f4cff221fa29ebe7
SSDEEP 3072:SUYKPvhEBefgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:Swaef1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ldikgdpe.exe

Path C:\Windows\SysWOW64\Ldikgdpe.exe
Size 337KB
SHA256 62c191d7a154a4e5d43d6c7ae20101772a4476f01290f8e1a0a5e00d9f6c95e0
MD5 4a63f429d3a63c71b45aac4decdcd2f1
SHA1 6a47213889961a6e08d45e3dfba028a90bb92ff7
SHA512 8eef1cfdbe2862c489e80f8e8f35951e112b93d7d64583aff1837b8365ec4ed96fccaa6d49647878335c2a75019e6f6501f33a0520825f3d07187c3871d083a4
SSDEEP 3072:kfov82R++V6H9gYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:Soxs+Vc91+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lhmafcnf.exe

Path C:\Windows\SysWOW64\Lhmafcnf.exe
Size 337KB
SHA256 5c89e0827b9b5c50c072ab318b864a5d08eb232888ab67525588e819a038a2f9
MD5 e407fb1ebea8294a60481628ed5f7c17
SHA1 c46162c5d9f89ee2f323ab57b90565e088edf007
SHA512 3250094a1e2db5dc4e8b290b24b409f5ebde6c6b9c70a6dce38e4ad1264f059f1a11df1ee3ca78c9177686e30cd1371ac64bcc1c0abf7eb9e860f62787e3baa7
SSDEEP 3072:iL5bV21o86cYjHgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:iP8ojH1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lhpnlclc.exe

Path C:\Windows\SysWOW64\Lhpnlclc.exe
Size 337KB
SHA256 d085b8413c1073bd719630ca0f5e44fa7bd290864e7037ad3920de6bcfac002d
MD5 0e40b5e7f5dc5a7ce4ef24d20d3f69fd
SHA1 4c2ff0c14ac9380bedef731860515a6ce8acc3fd
SHA512 ccd221bdb9430e8f9b166fc8fe579c42c76c7cdccf0817bbd8d6d604691e2115e4e563e37d394f76a6e095a5e23bf0948d5cd362195b784cd497dd044f19b01a
SSDEEP 3072:yWXW5SC7HPyMB7Yjc5QTsgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:RiyicjwUs1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lkiamp32.exe

Path C:\Windows\SysWOW64\Lkiamp32.exe
Size 337KB
SHA256 bb7559ae4f9746b53c87f10c54588155854782433246c2550b5415d0649c9b47
MD5 8f3857acbeaa58eb2ef2cdb1f2d11392
SHA1 dea6d8f5e715308ba08a7f699952a156f9ee18af
SHA512 5a55c0692236ad2024664e9f181a29c9eaf331f69f10d301872c35480719a8ebe6af8c410818e0f39d09aff3b22d449c76034bcf987336fe3ad735783d335288
SSDEEP 3072:AluJLPiJ+VBizfgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:AMJLPcmBizf1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1392-210-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1392-245-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1456-106-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1456-232-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1468-227-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1468-64-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1552-225-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1552-48-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1556-228-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1556-74-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1824-81-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1824-229-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1964-237-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1964-146-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2280-97-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2280-231-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2776-8-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2776-220-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2788-240-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2788-169-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3312-222-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3312-24-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3412-218-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3412-246-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3584-129-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3584-235-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3628-89-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3628-230-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3828-162-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3828-239-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4028-221-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4028-17-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4256-177-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4256-241-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4292-56-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4292-226-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4300-193-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4300-243-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4348-114-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4348-233-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4460-236-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4460-137-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4668-238-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4668-153-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4708-32-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4708-223-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4728-234-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4728-122-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4888-72-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4888-0-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4888-1-0x0000000000431000-0x0000000000432000-memory.dmp

Download

memory/4932-242-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4932-185-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5020-224-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5020-40-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5028-202-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5028-244-0x0000000000400000-0x0000000000433000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads