6dcf145c12785f74f0a048cc39efeb33099db5d16c24f63c5a439116e9517011

Analysis

max time kernel
93s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 02:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cbbb9ab244c092dd6eee1c19d057a470_NEIKI.exe
Size 113KB
Sample240509-cqaxvsfg28
SHA256 6dcf145c12785f74f0a048cc39efeb33099db5d16c24f63c5a439116e9517011
MD5 cbbb9ab244c092dd6eee1c19d057a470
SHA1 986baa1aa7f5e88dc2e8eef9cb32855b0affa2d7
SHA512 c8a979debf401263043c8e5a824b3426042286767a9091f5b8c7a6c21d75b68071eb706852b30e59a2f0c236913677e2445560f377b3b4f249b884b27139b812
SSDEEP 3072:gdx7VN+dzX6PezrWB8TBtCqhgEUcugCe8uvQa7gRj9/S2Kn:g0zlPUcISMRNF
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

backdoor dropper persistence trojan

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nnhfee32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nkncdifl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nbhkac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ngedij32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncldnkae.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	cbbb9ab244c092dd6eee1c19d057a470_NEIKI.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndbnboqb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqiogp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nbhkac32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndghmo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ndghmo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nbkhfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ncldnkae.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnhfee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nkjjij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ndbnboqb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njogjfoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nqiogp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nkncdifl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngedij32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nkjjij32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njogjfoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nbkhfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	cbbb9ab244c092dd6eee1c19d057a470_NEIKI.exe

Malware Dropper & Backdoor - Berbew 12 IoCs

Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.

backdoor trojan dropper

resource	yara_rule
behavioral2/files/0x0009000000023289-8.dat	family_berbew
behavioral2/files/0x0008000000023412-15.dat	family_berbew
behavioral2/files/0x0007000000023414-23.dat	family_berbew
behavioral2/files/0x0007000000023416-31.dat	family_berbew
behavioral2/files/0x0007000000023418-34.dat	family_berbew
behavioral2/files/0x000700000002341a-47.dat	family_berbew
behavioral2/files/0x000700000002341c-55.dat	family_berbew
behavioral2/files/0x000700000002341e-64.dat	family_berbew
behavioral2/files/0x0007000000023420-72.dat	family_berbew
behavioral2/files/0x0007000000023422-79.dat	family_berbew
behavioral2/files/0x0007000000023424-87.dat	family_berbew
behavioral2/files/0x0007000000023426-95.dat	family_berbew

Executes dropped EXE 12 IoCs

pid	Process
3400	Nkjjij32.exe
2376	Nnhfee32.exe
2216	Ndbnboqb.exe
3884	Njogjfoj.exe
3100	Nqiogp32.exe
4672	Nkncdifl.exe
3116	Nbhkac32.exe
4076	Ndghmo32.exe
3648	Ngedij32.exe
2484	Nbkhfc32.exe
2100	Ncldnkae.exe
2040	Nkcmohbg.exe

Drops file in System32 directory 36 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Bdknoa32.dll	Nbhkac32.exe
File created	C:\Windows\SysWOW64\Paadnmaq.dll	Ndghmo32.exe
File created	C:\Windows\SysWOW64\Nbkhfc32.exe	Ngedij32.exe
File created	C:\Windows\SysWOW64\Nkcmohbg.exe	Ncldnkae.exe
File created	C:\Windows\SysWOW64\Hnibdpde.dll	Ncldnkae.exe
File opened for modification	C:\Windows\SysWOW64\Nkncdifl.exe	Nqiogp32.exe
File created	C:\Windows\SysWOW64\Dihcoe32.dll	Nnhfee32.exe
File opened for modification	C:\Windows\SysWOW64\Nbhkac32.exe	Nkncdifl.exe
File created	C:\Windows\SysWOW64\Ipkobd32.dll	Nkncdifl.exe
File created	C:\Windows\SysWOW64\Nkjjij32.exe	cbbb9ab244c092dd6eee1c19d057a470_NEIKI.exe
File opened for modification	C:\Windows\SysWOW64\Njogjfoj.exe	Ndbnboqb.exe
File created	C:\Windows\SysWOW64\Nkncdifl.exe	Nqiogp32.exe
File created	C:\Windows\SysWOW64\Jkeang32.dll	Nqiogp32.exe
File created	C:\Windows\SysWOW64\Ndghmo32.exe	Nbhkac32.exe
File created	C:\Windows\SysWOW64\Ngedij32.exe	Ndghmo32.exe
File opened for modification	C:\Windows\SysWOW64\Ncldnkae.exe	Nbkhfc32.exe
File opened for modification	C:\Windows\SysWOW64\Nkjjij32.exe	cbbb9ab244c092dd6eee1c19d057a470_NEIKI.exe
File created	C:\Windows\SysWOW64\Ncldnkae.exe	Nbkhfc32.exe
File opened for modification	C:\Windows\SysWOW64\Nkcmohbg.exe	Ncldnkae.exe
File created	C:\Windows\SysWOW64\Njogjfoj.exe	Ndbnboqb.exe
File created	C:\Windows\SysWOW64\Dlddhggk.dll	Nbkhfc32.exe
File created	C:\Windows\SysWOW64\Pponmema.dll	Njogjfoj.exe
File created	C:\Windows\SysWOW64\Ndbnboqb.exe	Nnhfee32.exe
File created	C:\Windows\SysWOW64\Lfcbokki.dll	Ndbnboqb.exe
File created	C:\Windows\SysWOW64\Nqiogp32.exe	Njogjfoj.exe
File opened for modification	C:\Windows\SysWOW64\Nqiogp32.exe	Njogjfoj.exe
File created	C:\Windows\SysWOW64\Nbhkac32.exe	Nkncdifl.exe
File created	C:\Windows\SysWOW64\Egqcbapl.dll	cbbb9ab244c092dd6eee1c19d057a470_NEIKI.exe
File created	C:\Windows\SysWOW64\Hlmobp32.dll	Nkjjij32.exe
File opened for modification	C:\Windows\SysWOW64\Ndbnboqb.exe	Nnhfee32.exe
File opened for modification	C:\Windows\SysWOW64\Ngedij32.exe	Ndghmo32.exe
File created	C:\Windows\SysWOW64\Lkfbjdpq.dll	Ngedij32.exe
File created	C:\Windows\SysWOW64\Nnhfee32.exe	Nkjjij32.exe
File opened for modification	C:\Windows\SysWOW64\Ndghmo32.exe	Nbhkac32.exe
File opened for modification	C:\Windows\SysWOW64\Nbkhfc32.exe	Ngedij32.exe
File opened for modification	C:\Windows\SysWOW64\Nnhfee32.exe	Nkjjij32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2948	2040	WerFault.exe	92

Modifies registry class 39 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Egqcbapl.dll"	cbbb9ab244c092dd6eee1c19d057a470_NEIKI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nkjjij32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ndbnboqb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Njogjfoj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nqiogp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Paadnmaq.dll"	Ndghmo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	cbbb9ab244c092dd6eee1c19d057a470_NEIKI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	cbbb9ab244c092dd6eee1c19d057a470_NEIKI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nbkhfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ipkobd32.dll"	Nkncdifl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ndghmo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ngedij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nbkhfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfcbokki.dll"	Ndbnboqb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ndbnboqb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ngedij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ncldnkae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pponmema.dll"	Njogjfoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Njogjfoj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nkncdifl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nkncdifl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ndghmo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lkfbjdpq.dll"	Ngedij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dlddhggk.dll"	Nbkhfc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nnhfee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dihcoe32.dll"	Nnhfee32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ncldnkae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlmobp32.dll"	Nkjjij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nbhkac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nqiogp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nbhkac32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	cbbb9ab244c092dd6eee1c19d057a470_NEIKI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jkeang32.dll"	Nqiogp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nkjjij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nnhfee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bdknoa32.dll"	Nbhkac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnibdpde.dll"	Ncldnkae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	cbbb9ab244c092dd6eee1c19d057a470_NEIKI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	cbbb9ab244c092dd6eee1c19d057a470_NEIKI.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 3120 wrote to memory of 3400	3120	cbbb9ab244c092dd6eee1c19d057a470_NEIKI.exe	79
PID 3120 wrote to memory of 3400	3120	cbbb9ab244c092dd6eee1c19d057a470_NEIKI.exe	79
PID 3120 wrote to memory of 3400	3120	cbbb9ab244c092dd6eee1c19d057a470_NEIKI.exe	79
PID 3400 wrote to memory of 2376	3400	Nkjjij32.exe	80
PID 3400 wrote to memory of 2376	3400	Nkjjij32.exe	80
PID 3400 wrote to memory of 2376	3400	Nkjjij32.exe	80
PID 2376 wrote to memory of 2216	2376	Nnhfee32.exe	81
PID 2376 wrote to memory of 2216	2376	Nnhfee32.exe	81
PID 2376 wrote to memory of 2216	2376	Nnhfee32.exe	81
PID 2216 wrote to memory of 3884	2216	Ndbnboqb.exe	82
PID 2216 wrote to memory of 3884	2216	Ndbnboqb.exe	82
PID 2216 wrote to memory of 3884	2216	Ndbnboqb.exe	82
PID 3884 wrote to memory of 3100	3884	Njogjfoj.exe	83
PID 3884 wrote to memory of 3100	3884	Njogjfoj.exe	83
PID 3884 wrote to memory of 3100	3884	Njogjfoj.exe	83
PID 3100 wrote to memory of 4672	3100	Nqiogp32.exe	85
PID 3100 wrote to memory of 4672	3100	Nqiogp32.exe	85
PID 3100 wrote to memory of 4672	3100	Nqiogp32.exe	85
PID 4672 wrote to memory of 3116	4672	Nkncdifl.exe	87
PID 4672 wrote to memory of 3116	4672	Nkncdifl.exe	87
PID 4672 wrote to memory of 3116	4672	Nkncdifl.exe	87
PID 3116 wrote to memory of 4076	3116	Nbhkac32.exe	88
PID 3116 wrote to memory of 4076	3116	Nbhkac32.exe	88
PID 3116 wrote to memory of 4076	3116	Nbhkac32.exe	88
PID 4076 wrote to memory of 3648	4076	Ndghmo32.exe	89
PID 4076 wrote to memory of 3648	4076	Ndghmo32.exe	89
PID 4076 wrote to memory of 3648	4076	Ndghmo32.exe	89
PID 3648 wrote to memory of 2484	3648	Ngedij32.exe	90
PID 3648 wrote to memory of 2484	3648	Ngedij32.exe	90
PID 3648 wrote to memory of 2484	3648	Ngedij32.exe	90
PID 2484 wrote to memory of 2100	2484	Nbkhfc32.exe	91
PID 2484 wrote to memory of 2100	2484	Nbkhfc32.exe	91
PID 2484 wrote to memory of 2100	2484	Nbkhfc32.exe	91
PID 2100 wrote to memory of 2040	2100	Ncldnkae.exe	92
PID 2100 wrote to memory of 2040	2100	Ncldnkae.exe	92
PID 2100 wrote to memory of 2040	2100	Ncldnkae.exe	92

C:\Users\Admin\AppData\Local\Temp\cbbb9ab244c092dd6eee1c19d057a470_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\cbbb9ab244c092dd6eee1c19d057a470_NEIKI.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3120
- C:\Windows\SysWOW64\Nkjjij32.exe
  C:\Windows\system32\Nkjjij32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3400
- - C:\Windows\SysWOW64\Nnhfee32.exe
    C:\Windows\system32\Nnhfee32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2376
  - - C:\Windows\SysWOW64\Ndbnboqb.exe
      C:\Windows\system32\Ndbnboqb.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2216
    - - C:\Windows\SysWOW64\Njogjfoj.exe
        
        C:\Windows\system32\Njogjfoj.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3884
      - C:\Windows\SysWOW64\Nqiogp32.exe
        
        C:\Windows\system32\Nqiogp32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3100
        
        C:\Windows\SysWOW64\Nkncdifl.exe
        
        C:\Windows\system32\Nkncdifl.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4672
        
        C:\Windows\SysWOW64\Nbhkac32.exe
        
        C:\Windows\system32\Nbhkac32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3116
        
        C:\Windows\SysWOW64\Ndghmo32.exe
        
        C:\Windows\system32\Ndghmo32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4076
        
        C:\Windows\SysWOW64\Ngedij32.exe
        
        C:\Windows\system32\Ngedij32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3648
        
        C:\Windows\SysWOW64\Nbkhfc32.exe
        
        C:\Windows\system32\Nbkhfc32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2484
        
        C:\Windows\SysWOW64\Ncldnkae.exe
        
        C:\Windows\system32\Ncldnkae.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2100
        
        C:\Windows\SysWOW64\Nkcmohbg.exe
        
        C:\Windows\system32\Nkcmohbg.exe
        13⤵
        Executes dropped EXE
        
        PID:2040
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 400
        14⤵
        Program crash
        
        PID:2948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2040 -ip 2040
1⤵
PID:1220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Nbhkac32.exe

Path C:\Windows\SysWOW64\Nbhkac32.exe
Size 113KB
SHA256 2bd377cf6d056e2c0c0386f888fc9c2aee41226b3c09c311e6ac9968453216c5
MD5 86aef8d8d96acc24ac69a573570c453e
SHA1 175b05b1e1c622916e0b462825f60786f9ad72a4
SHA512 1df8391fee7565f979b235e3469d5ea5af0027ad4c70566277bc70ae89fab1cc8224c135bb69a0a5dd0e58080e1da6dd3886d9f8a1ef187688aeef62b5018055
SSDEEP 3072:FRtwoV+FphnugCk6HxugCe8uvQa7gRj9/S2Kn:jlI5kk6HxISMRNF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nbkhfc32.exe

Path C:\Windows\SysWOW64\Nbkhfc32.exe
Size 113KB
SHA256 5604c18f9a8b0cf47108e4c6dab3666e8ec3cde05a4d840c07fa68e97f701e63
MD5 f92053d590f381541882b0be88b3b5e5
SHA1 169661b47a53f42f39984918c177bcabdaa352a8
SHA512 acb4f50bfc793a763aef06874998880fbc72c1cb729a21b99730d6755e2ebd5f72bff9c31642c8d85e74d75c1d1464bcd519f500864651b8035ee260d936dcbc
SSDEEP 3072:cmCjUAmwryJkb3PGp4GugCe8uvQa7gRj9/S2Kn:CUAmw/b3+p4GISMRNF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ncldnkae.exe

Path C:\Windows\SysWOW64\Ncldnkae.exe
Size 113KB
SHA256 91c0a9d3f6e9189623a79fef8679365f401ba81aed2742cf0ff9c157bff5462d
MD5 9ff339f091ab33463029a75e79c1be74
SHA1 3cf6665c87041691a1c5070130a444ba1f39d244
SHA512 b2b7029bee5a5dc36717893e25608509b165634ecdc923b6a1396954c73b8c7b59463b870fad869c1df699c521f4aaa0b335efae8cedd91a20d470af95a29249
SSDEEP 3072:jSL9le6c3MAUcWLb8AGm5Ms1XugCe8uvQa7gRj9/S2Kn:jS2z3MAib8zU1XISMRNF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ndbnboqb.exe

Path C:\Windows\SysWOW64\Ndbnboqb.exe
Size 113KB
SHA256 242fd5199bf06613b5e6060084eb0005ee83e6d00c5cc67f235ddc20563764e9
MD5 e9effe85daacc1bc9648457f77ba645b
SHA1 89b0f6d261715778ab6136bf083cd459ee7a3e08
SHA512 1025a6d184a2fb65f83a38a4e03e43d31d7207c0c86d159bebe5931ee5803a34162681d086ec2ebd8c92411e5d2e6e5ceeb7fc4a1bbfec7bb6adbf34dcdde68f
SSDEEP 3072:sQAtuaZZeqecu5wEwzugCe8uvQa7gRj9/S2Kn:slqncrEiISMRNF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ndghmo32.exe

Path C:\Windows\SysWOW64\Ndghmo32.exe
Size 113KB
SHA256 bb4e49f3c9f9f44dc998d83c171296c6f13bc953902984896c644a357d6aa08b
MD5 1cbd39a18d4225c16cc94762e7d71900
SHA1 7447b834bb83a5f829f777d21c9ccd6b8f84da5c
SHA512 98c2ece51f82762a2a804a3b70534781c397e38eee43b9277b8ee154acd345f9d3294e06cf57ad46ee1eb341e291da1baf4fab08da85b4ad8e0dd4194b48ceeb
SSDEEP 1536:nfM+l2lVXxvt/log8BZjJXSKQQQQW17Ab1cgCe8uvQGYQzlVZg2lKVTP96YS2bM7:EPmgAYXUbugCe8uvQa7gRj9/S2Kn
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ngedij32.exe

Path C:\Windows\SysWOW64\Ngedij32.exe
Size 113KB
SHA256 01f08b38bb7532570540779676d0ff18cb28a5cf7ef1c8dca6f378665ce4c1b0
MD5 9ba9839033816db4c840daeb4f8dae29
SHA1 0d4adbc273f38a540c435308415ac70e58060a9d
SHA512 549b49923b86a3707d8290b3b040180d31f3ca94fecb1cd557b6757e20b2c06782a042b35694ab4d8faa06b70ac31ac9100b419fd0be28d4c35f2aea1aa3bafe
SSDEEP 3072:IF8Gi2hJyb00ndZvugCe8uvQa7gRj9/S2Kn:+Lyb00ndZvISMRNF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Njogjfoj.exe

Path C:\Windows\SysWOW64\Njogjfoj.exe
Size 113KB
SHA256 9a882cb84b8cab72c794d1f7455eca0cc0c93999e70f62211a12130a73ad72c7
MD5 0a1d7436d71e277efb920cd13211bd25
SHA1 3a289e1ef163d18e0f333d4b885ffc2f839e415b
SHA512 327adb21336f426ad5eb5a0b142708d71b434760fe49671c408ec40802eccb796a2c3e0af0eed27cec7d0cab1f337efdef5050723545be246335601bdb222ab6
SSDEEP 3072:2B81qvZz/5nLKKugCe8uvQa7gRj9/S2Kn:2BWwz/5nLKKISMRNF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nkcmohbg.exe

Path C:\Windows\SysWOW64\Nkcmohbg.exe
Size 113KB
SHA256 9369734b68a7932bf4b24adbf3b1d1761471c08b309b01222afd7fc66d9220ee
MD5 9fcf90d4a4f604093d6f08b194e5c705
SHA1 041fcd897c4327d6d24f69d4366e201ac985c23a
SHA512 b94c68ba6c4ca4252a3d0e8d2a307cce7fedcbba4f7a1d314489a9382831b02b06897981e5b9a64e68bcbab7732c1a0b9b52cbb5a750f563d860f51cfcccde12
SSDEEP 1536:nhXqfczyik2ShPIJRIoQQff51cgCe8uvQGYQzlVZg2lKVTP96YS2bMJVn:hXWczRVzpD5ugCe8uvQa7gRj9/S2Kn
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nkjjij32.exe

Path C:\Windows\SysWOW64\Nkjjij32.exe
Size 113KB
SHA256 124cc72c05e65a5a5e63c860d1b28e34392fd51b2fcd93edf650ade7e0f3f518
MD5 9b49dd6a47f5fd65d22f6726945f9f6f
SHA1 6343985730d30347f3dafa57ed076ba3a7a96c63
SHA512 03c917196ffbd7cb6ae5d30bbbee213f6dcd5e7284b3f5b1b4d8b181498be6c836f44ffce11a7333a48eda907066b9aaa0434e965dfaf799910475622a02a565
SSDEEP 3072:IXdxUOk6WNNRU5K+Z3GbxacugCe8uvQa7gRj9/S2Kn:IxB8NRU5K+Z3GbxacISMRNF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nkncdifl.exe

Path C:\Windows\SysWOW64\Nkncdifl.exe
Size 113KB
SHA256 861fda458cb8ae4d45e6367895321e2f2c7dfd24c09599bb83d17824521e13a9
MD5 5620e14c4be2cfa02e65f20a9f22c8da
SHA1 06cdad856d7933fc30f6b6184e3abca2f9a5cb62
SHA512 e408a02e5ee4699416c0b26d162793636db10236fb0cd1fe3d34fd03f485b0204e5c9f9a92b863a972e5a4455ef7924058bd7132d9958dfe4dd3f590af18131f
SSDEEP 3072:H95ILEJqRzvQJAeLWtk+QugCe8uvQa7gRj9/S2Kn:HvILEJqZQJjGfQISMRNF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nnhfee32.exe

Path C:\Windows\SysWOW64\Nnhfee32.exe
Size 113KB
SHA256 2c3b3892b7012ff9d5b35d33f319825680c78ea3d7a5d323843ea62913e84ff9
MD5 bfc06795c85e6f5e9e85b149324ab868
SHA1 3e28470b1bc295fe46c9c92cafc479514903631e
SHA512 a5dcfc213d0f0471b20164971a01b4df2f327ed1590c76b95396bed4f5f8c9c6439693b94db56954cea4fba3a202e0d525ada83642aafa9993e790461fd6ccad
SSDEEP 3072:bsF5oHZGMR1WixL345H5YPJ5KGu3Tl6TugCe8uvQa7gRj9/S2Kn:bUiHZS356TISMRNF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nqiogp32.exe

Path C:\Windows\SysWOW64\Nqiogp32.exe
Size 113KB
SHA256 35ceda8d00ea21b61ccd735393bca26e6a89acd9de32e6e86b4d58e34af253b3
MD5 f25facf575e78eaee2deed83933a0ed6
SHA1 6482dd704f48ce911b485f20c468c4cb7dca2259
SHA512 585cf81269f69d07971cb0d1b5ef3ac034037ce8ba00a312696034cf9699ce076b4aaf69895f1e29d9c1ad42f4ba128bf4b205e1f266376f67ce1bfdda55943b
SSDEEP 3072:wZDDtqk/Xoshy0BugCe8uvQa7gRj9/S2Kn:engk/BXBISMRNF
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2040-98-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/2040-97-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/2100-99-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/2100-89-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/2216-28-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/2216-106-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/2376-21-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/2484-100-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/2484-80-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/3100-41-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/3100-104-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/3116-62-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/3120-0-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/3120-108-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/3120-5-0x0000000000432000-0x0000000000433000-memory.dmp

Download

memory/3400-13-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/3400-107-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/3648-73-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/3648-101-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/3884-105-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/3884-33-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/4076-102-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/4076-65-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/4672-103-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/4672-53-0x0000000000400000-0x000000000043C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads