526ece60d3a61f5528381b9e71a02a540753814582974e917005a94e798032e6

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 02:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cd5f6b3b69affcb6c93d3fe2afe362e0_NEIKI.exe
Size 416KB
Sample240509-ctjdeadc5v
SHA256 526ece60d3a61f5528381b9e71a02a540753814582974e917005a94e798032e6
MD5 cd5f6b3b69affcb6c93d3fe2afe362e0
SHA1 928096d98c0b03496d111ee71ff41050033660c4
SHA512 e4f59236f46a88eade0865c80907c8784b8c479a3cc2c695dfb27c6650cedeb1f063831231a3a3a7938710beed2ca18e9379e52b53c96d71b82fc717d2c67e2c
SSDEEP 12288:41TYJ07kE0KoFtw2gu9RxrBIUbPLwH96/I0lOZ0vbqFB:qTYJ07kE0KoFtw2gu9RxrBIUbPLwH96I
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

backdoor dropper persistence trojan

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 26 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mkepnjng.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqiogp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdkhapfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mkgmcjld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mnapdf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpaifalo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nkncdifl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	cd5f6b3b69affcb6c93d3fe2afe362e0_NEIKI.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnapdf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkepnjng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nqiogp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ncihikcg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcpebmkb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nkncdifl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nnolfdcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nklfoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mdkhapfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mcpebmkb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkgmcjld.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nklfoi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncihikcg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Majopeii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Majopeii.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	cd5f6b3b69affcb6c93d3fe2afe362e0_NEIKI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mpaifalo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnolfdcn.exe

Malware Dropper & Backdoor - Berbew 13 IoCs

Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.

backdoor trojan dropper

resource	yara_rule
behavioral2/files/0x00070000000232a4-6.dat	family_berbew
behavioral2/files/0x000800000002343d-14.dat	family_berbew
behavioral2/files/0x000700000002343f-22.dat	family_berbew
behavioral2/files/0x0007000000023443-33.dat	family_berbew
behavioral2/files/0x0007000000023445-47.dat	family_berbew
behavioral2/files/0x0007000000023447-55.dat	family_berbew
behavioral2/files/0x0007000000023441-31.dat	family_berbew
behavioral2/files/0x0007000000023449-62.dat	family_berbew
behavioral2/files/0x000700000002344b-70.dat	family_berbew
behavioral2/files/0x000700000002344d-78.dat	family_berbew
behavioral2/files/0x000700000002344f-86.dat	family_berbew
behavioral2/files/0x0007000000023451-94.dat	family_berbew
behavioral2/files/0x0007000000023453-102.dat	family_berbew

Executes dropped EXE 13 IoCs

pid	Process
1104	Majopeii.exe
3504	Mnapdf32.exe
4616	Mdkhapfj.exe
116	Mkepnjng.exe
804	Mpaifalo.exe
4268	Mcpebmkb.exe
3252	Mkgmcjld.exe
2584	Nklfoi32.exe
2784	Nqiogp32.exe
3280	Nkncdifl.exe
4748	Ncihikcg.exe
4788	Nnolfdcn.exe
1812	Nkcmohbg.exe

Drops file in System32 directory 39 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Hnibdpde.dll	Nnolfdcn.exe
File created	C:\Windows\SysWOW64\Lnohlokp.dll	cd5f6b3b69affcb6c93d3fe2afe362e0_NEIKI.exe
File opened for modification	C:\Windows\SysWOW64\Mpaifalo.exe	Mkepnjng.exe
File created	C:\Windows\SysWOW64\Ekipni32.dll	Mcpebmkb.exe
File created	C:\Windows\SysWOW64\Nnolfdcn.exe	Ncihikcg.exe
File created	C:\Windows\SysWOW64\Nqiogp32.exe	Nklfoi32.exe
File created	C:\Windows\SysWOW64\Pponmema.dll	Nklfoi32.exe
File created	C:\Windows\SysWOW64\Mdkhapfj.exe	Mnapdf32.exe
File created	C:\Windows\SysWOW64\Hhapkbgi.dll	Mpaifalo.exe
File opened for modification	C:\Windows\SysWOW64\Mkgmcjld.exe	Mcpebmkb.exe
File created	C:\Windows\SysWOW64\Fibjjh32.dll	Mkgmcjld.exe
File opened for modification	C:\Windows\SysWOW64\Nqiogp32.exe	Nklfoi32.exe
File created	C:\Windows\SysWOW64\Cknpkhch.dll	Ncihikcg.exe
File created	C:\Windows\SysWOW64\Majopeii.exe	cd5f6b3b69affcb6c93d3fe2afe362e0_NEIKI.exe
File created	C:\Windows\SysWOW64\Mnapdf32.exe	Majopeii.exe
File opened for modification	C:\Windows\SysWOW64\Mkepnjng.exe	Mdkhapfj.exe
File created	C:\Windows\SysWOW64\Nklfoi32.exe	Mkgmcjld.exe
File opened for modification	C:\Windows\SysWOW64\Mnapdf32.exe	Majopeii.exe
File created	C:\Windows\SysWOW64\Mkepnjng.exe	Mdkhapfj.exe
File opened for modification	C:\Windows\SysWOW64\Nkcmohbg.exe	Nnolfdcn.exe
File opened for modification	C:\Windows\SysWOW64\Nklfoi32.exe	Mkgmcjld.exe
File created	C:\Windows\SysWOW64\Nkncdifl.exe	Nqiogp32.exe
File opened for modification	C:\Windows\SysWOW64\Nkncdifl.exe	Nqiogp32.exe
File opened for modification	C:\Windows\SysWOW64\Mdkhapfj.exe	Mnapdf32.exe
File created	C:\Windows\SysWOW64\Mcpebmkb.exe	Mpaifalo.exe
File opened for modification	C:\Windows\SysWOW64\Mcpebmkb.exe	Mpaifalo.exe
File created	C:\Windows\SysWOW64\Mkgmcjld.exe	Mcpebmkb.exe
File created	C:\Windows\SysWOW64\Pdgdjjem.dll	Majopeii.exe
File created	C:\Windows\SysWOW64\Mpaifalo.exe	Mkepnjng.exe
File created	C:\Windows\SysWOW64\Ncihikcg.exe	Nkncdifl.exe
File opened for modification	C:\Windows\SysWOW64\Nnolfdcn.exe	Ncihikcg.exe
File created	C:\Windows\SysWOW64\Pkckjila.dll	Nkncdifl.exe
File created	C:\Windows\SysWOW64\Nkcmohbg.exe	Nnolfdcn.exe
File opened for modification	C:\Windows\SysWOW64\Majopeii.exe	cd5f6b3b69affcb6c93d3fe2afe362e0_NEIKI.exe
File created	C:\Windows\SysWOW64\Qcldhk32.dll	Mdkhapfj.exe
File created	C:\Windows\SysWOW64\Fnelfilp.dll	Mkepnjng.exe
File created	C:\Windows\SysWOW64\Jkeang32.dll	Nqiogp32.exe
File created	C:\Windows\SysWOW64\Njcqqgjb.dll	Mnapdf32.exe
File opened for modification	C:\Windows\SysWOW64\Ncihikcg.exe	Nkncdifl.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
404	1812	WerFault.exe	94

Modifies registry class 42 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nqiogp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jkeang32.dll"	Nqiogp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cknpkhch.dll"	Ncihikcg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}	cd5f6b3b69affcb6c93d3fe2afe362e0_NEIKI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fnelfilp.dll"	Mkepnjng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nklfoi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	cd5f6b3b69affcb6c93d3fe2afe362e0_NEIKI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pponmema.dll"	Nklfoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nkncdifl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ncihikcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lnohlokp.dll"	cd5f6b3b69affcb6c93d3fe2afe362e0_NEIKI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	cd5f6b3b69affcb6c93d3fe2afe362e0_NEIKI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekipni32.dll"	Mcpebmkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkckjila.dll"	Nkncdifl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ncihikcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qcldhk32.dll"	Mdkhapfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mdkhapfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fibjjh32.dll"	Mkgmcjld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mpaifalo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mcpebmkb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mdkhapfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mkepnjng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mpaifalo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mkepnjng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mkgmcjld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nnolfdcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nnolfdcn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mnapdf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Njcqqgjb.dll"	Mnapdf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mnapdf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	cd5f6b3b69affcb6c93d3fe2afe362e0_NEIKI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mcpebmkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnibdpde.dll"	Nnolfdcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Majopeii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hhapkbgi.dll"	Mpaifalo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mkgmcjld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nklfoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nqiogp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	cd5f6b3b69affcb6c93d3fe2afe362e0_NEIKI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Majopeii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdgdjjem.dll"	Majopeii.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nkncdifl.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 4200 wrote to memory of 1104	4200	cd5f6b3b69affcb6c93d3fe2afe362e0_NEIKI.exe	80
PID 4200 wrote to memory of 1104	4200	cd5f6b3b69affcb6c93d3fe2afe362e0_NEIKI.exe	80
PID 4200 wrote to memory of 1104	4200	cd5f6b3b69affcb6c93d3fe2afe362e0_NEIKI.exe	80
PID 1104 wrote to memory of 3504	1104	Majopeii.exe	82
PID 1104 wrote to memory of 3504	1104	Majopeii.exe	82
PID 1104 wrote to memory of 3504	1104	Majopeii.exe	82
PID 3504 wrote to memory of 4616	3504	Mnapdf32.exe	83
PID 3504 wrote to memory of 4616	3504	Mnapdf32.exe	83
PID 3504 wrote to memory of 4616	3504	Mnapdf32.exe	83
PID 4616 wrote to memory of 116	4616	Mdkhapfj.exe	84
PID 4616 wrote to memory of 116	4616	Mdkhapfj.exe	84
PID 4616 wrote to memory of 116	4616	Mdkhapfj.exe	84
PID 116 wrote to memory of 804	116	Mkepnjng.exe	85
PID 116 wrote to memory of 804	116	Mkepnjng.exe	85
PID 116 wrote to memory of 804	116	Mkepnjng.exe	85
PID 804 wrote to memory of 4268	804	Mpaifalo.exe	87
PID 804 wrote to memory of 4268	804	Mpaifalo.exe	87
PID 804 wrote to memory of 4268	804	Mpaifalo.exe	87
PID 4268 wrote to memory of 3252	4268	Mcpebmkb.exe	88
PID 4268 wrote to memory of 3252	4268	Mcpebmkb.exe	88
PID 4268 wrote to memory of 3252	4268	Mcpebmkb.exe	88
PID 3252 wrote to memory of 2584	3252	Mkgmcjld.exe	89
PID 3252 wrote to memory of 2584	3252	Mkgmcjld.exe	89
PID 3252 wrote to memory of 2584	3252	Mkgmcjld.exe	89
PID 2584 wrote to memory of 2784	2584	Nklfoi32.exe	90
PID 2584 wrote to memory of 2784	2584	Nklfoi32.exe	90
PID 2584 wrote to memory of 2784	2584	Nklfoi32.exe	90
PID 2784 wrote to memory of 3280	2784	Nqiogp32.exe	91
PID 2784 wrote to memory of 3280	2784	Nqiogp32.exe	91
PID 2784 wrote to memory of 3280	2784	Nqiogp32.exe	91
PID 3280 wrote to memory of 4748	3280	Nkncdifl.exe	92
PID 3280 wrote to memory of 4748	3280	Nkncdifl.exe	92
PID 3280 wrote to memory of 4748	3280	Nkncdifl.exe	92
PID 4748 wrote to memory of 4788	4748	Ncihikcg.exe	93
PID 4748 wrote to memory of 4788	4748	Ncihikcg.exe	93
PID 4748 wrote to memory of 4788	4748	Ncihikcg.exe	93
PID 4788 wrote to memory of 1812	4788	Nnolfdcn.exe	94
PID 4788 wrote to memory of 1812	4788	Nnolfdcn.exe	94
PID 4788 wrote to memory of 1812	4788	Nnolfdcn.exe	94

C:\Users\Admin\AppData\Local\Temp\cd5f6b3b69affcb6c93d3fe2afe362e0_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\cd5f6b3b69affcb6c93d3fe2afe362e0_NEIKI.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4200
- C:\Windows\SysWOW64\Majopeii.exe
  C:\Windows\system32\Majopeii.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1104
- - C:\Windows\SysWOW64\Mnapdf32.exe
    C:\Windows\system32\Mnapdf32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3504
  - - C:\Windows\SysWOW64\Mdkhapfj.exe
      C:\Windows\system32\Mdkhapfj.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4616
    - - C:\Windows\SysWOW64\Mkepnjng.exe
        
        C:\Windows\system32\Mkepnjng.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:116
      - C:\Windows\SysWOW64\Mpaifalo.exe
        
        C:\Windows\system32\Mpaifalo.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:804
        
        C:\Windows\SysWOW64\Mcpebmkb.exe
        
        C:\Windows\system32\Mcpebmkb.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4268
        
        C:\Windows\SysWOW64\Mkgmcjld.exe
        
        C:\Windows\system32\Mkgmcjld.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3252
        
        C:\Windows\SysWOW64\Nklfoi32.exe
        
        C:\Windows\system32\Nklfoi32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2584
        
        C:\Windows\SysWOW64\Nqiogp32.exe
        
        C:\Windows\system32\Nqiogp32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2784
        
        C:\Windows\SysWOW64\Nkncdifl.exe
        
        C:\Windows\system32\Nkncdifl.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3280
        
        C:\Windows\SysWOW64\Ncihikcg.exe
        
        C:\Windows\system32\Ncihikcg.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4748
        
        C:\Windows\SysWOW64\Nnolfdcn.exe
        
        C:\Windows\system32\Nnolfdcn.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4788
        
        C:\Windows\SysWOW64\Nkcmohbg.exe
        
        C:\Windows\system32\Nkcmohbg.exe
        14⤵
        Executes dropped EXE
        
        PID:1812
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1812 -s 412
        15⤵
        Program crash
        
        PID:404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1812 -ip 1812
1⤵
PID:556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Fnelfilp.dll

Path C:\Windows\SysWOW64\Fnelfilp.dll
Size 7KB
SHA256 90f97b111efcad5a445038938f987d5803e33d552e125deba5343a86b2ba2b81
MD5 5bdb0c1655e3efef4a63e6a648517ef7
SHA1 0736e4636c88f08e652333b28d9d374c49b9246c
SHA512 f657ee5c114ae628892ff4d07e5b1d7c3ec4ef6f9ddd46913c41cb8b72b91cea0a0d583931910f27eff744a1f3f5dd666102a32c2d04146d8c82c3e66f038d8f
SSDEEP 96:wb4VHccYJUC/aFbz/j0OvaPnd3cX5aXW:wUaJf/aFbP0OY2JaX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Majopeii.exe

Path C:\Windows\SysWOW64\Majopeii.exe
Size 416KB
SHA256 081dc602ed4e3a97d7b4627d4535e4f68e38471ef54515364671870939569a32
MD5 f70a5953fb9a90dae61d4d4ea00fa0da
SHA1 223ad5cc9d1d1a93b6801515166dc7f9ca61588e
SHA512 b6badb6d1f2a55d3e70152507c0fff69547882ccff4405386d982b5b00f619f15d31bc897e6f18e244c2c470519a50843acd5a3a003878715fb4486235228770
SSDEEP 12288:9AZWtYJ07kE0KoFtw2gu9RxrBIUbPLwH96/I0lOZ0vbqFB:uZ6YJ07kE0KoFtw2gu9RxrBIUbPLwH9n
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mcpebmkb.exe

Path C:\Windows\SysWOW64\Mcpebmkb.exe
Size 416KB
SHA256 9b5835e5e4cd44c38ae668e71476a82dff4ecde0333b1dbacd45eb3e91766ab4
MD5 12f77c4bda421647f82378a2c4ba620d
SHA1 2d834ff5e94e71dfa9e34e691c5cd6ec98dfebea
SHA512 68b2dc19f645ff63158ff99b835c1626537be9740a4990b4288402c20857f89d135e45c159a0a73aef97675c1e49c02dcacbad0ebf5f7ff2aed95d3e73d4b992
SSDEEP 12288:YxvOkYJ07kE0KoFtw2gu9RxrBIUbPLwH96/I0lOZ0vbqFB:YxWkYJ07kE0KoFtw2gu9RxrBIUbPLwHh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mdkhapfj.exe

Path C:\Windows\SysWOW64\Mdkhapfj.exe
Size 416KB
SHA256 ef835587a06d59a2a95e9bba3ae419e85af668c390164fd8597ba3eacc8ba147
MD5 423ebc0358b44d9a34f1bd5a50ddabda
SHA1 e1e0836fb2b9960a1781057ee9a6b0353b3b05b8
SHA512 065211c14631cad8fd35054809cfc0668e716304eee32d404635343fc21dc8d23dc3e28b631dbef6c12b1c006ec2d43eaa1afede3e0889935e3c58ae9821bbf2
SSDEEP 12288:rBLYJ07kE0KoFtw2gu9RxrBIUbPLwH96/I0lOZ0vbqFB:rBLYJ07kE0KoFtw2gu9RxrBIUbPLwH9n
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mkepnjng.exe

Path C:\Windows\SysWOW64\Mkepnjng.exe
Size 416KB
SHA256 b3615c3828e6e90377dc6cbfb71b94946ab731f314affeb48e46161fcae3c6b4
MD5 219fbb68f6ef0cd85b3df6c822bd593b
SHA1 d9eaccb3cbd781171f30c3bed4b06fe3b0abc329
SHA512 9c5d314130b292c1fc592a1796c27dceb973e94b7308e23b35cc2053337a47c65705fbe00b8a2569cdc98440d410dd92a5be706f9e3c55933c93d7e7f6eb3879
SSDEEP 12288:rCPYJ07kE0KoFtw2gu9RxrBIUbPLwH96/I0lOZ0vbqFB:aYJ07kE0KoFtw2gu9RxrBIUbPLwH96/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mkgmcjld.exe

Path C:\Windows\SysWOW64\Mkgmcjld.exe
Size 416KB
SHA256 3a5f543916c031603cc8d2f9dc48f99fbbd43da8f25d9e840027ac3a5d1e8bdc
MD5 18ed2319163c9326f0f8eb00dc2a3446
SHA1 9ae31b63d64fa732d9bb4054ba9e0195f9663966
SHA512 8041eaaadfa326a84082e8e90f63119f2c7bf856e109effd69d527cb0a93f8eb7216c641a757fe2839cf34b39bca810ea237ec91117640ceeab6e2e02338d7c1
SSDEEP 12288:hIv26DUgYJ07kE0KoFtw2gu9RxrBIUbPLwH96/I0lOZ0vbqFB:OuDgYJ07kE0KoFtw2gu9RxrBIUbPLwHh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mnapdf32.exe

Path C:\Windows\SysWOW64\Mnapdf32.exe
Size 416KB
SHA256 7be31175be0efd39d028a2d939d5d955bf777733def6d0d71304f5ed5808ec60
MD5 29f3a4bf56aa8cd69cf60ac76bf5888a
SHA1 920ad746d4d61f1879fb270d70db69bae586c9b0
SHA512 e6133c9ac243105d586d629d586e698c68c0c660bf423e391db58b2f3e20d764f8cfa13d4d1c73cc36e2d5bba0483f90d21770effbd70e6a1c6f70ae090e00aa
SSDEEP 12288:cjYJ07kE0KoFtw2gu9RxrBIUbPLwH96/I0lOZ0vbqFB:kYJ07kE0KoFtw2gu9RxrBIUbPLwH96/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mpaifalo.exe

Path C:\Windows\SysWOW64\Mpaifalo.exe
Size 416KB
SHA256 9241eed469dd761fa4967d800ed26ac52549410d1b564dbbde5177037ac53150
MD5 255471466fa6e17dbacfddccf30b9164
SHA1 f59cd0ab8afb5640a8e90febc1e290f37e82fad6
SHA512 10181fcf8eab8c04cc43c2099e25dd47e6333d053085b45c66be328296e70ae01233987692cb6b01998eba1460aedb092d8160a17543c32dece01d556713161c
SSDEEP 12288:uy1TT26YJ07kE0KoFtw2gu9RxrBIUbPLwH96/I0lOZ0vbqFB:zY6YJ07kE0KoFtw2gu9RxrBIUbPLwH9n
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ncihikcg.exe

Path C:\Windows\SysWOW64\Ncihikcg.exe
Size 416KB
SHA256 4c17685bed13078342d295924fbcf2b573fbd119c52d179fc42208ec070f0a02
MD5 51d20721c9ab7d7baa495bad87cd87ac
SHA1 2771069a60136a732c511ba8f7ff6fdbbc3b58a5
SHA512 18d609add30da6bb51bf02ec880eea482514bba45daa260d84fb2225ce466c20b4852538ebdba1a4c35b19e77109777a574e548ebf44435eda970ca29f14d592
SSDEEP 12288:yJ78JYYJ07kE0KoFtw2gu9RxrBIUbPLwH96/I0lOZ0vbqFB:yJwJYYJ07kE0KoFtw2gu9RxrBIUbPLwB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nkcmohbg.exe

Path C:\Windows\SysWOW64\Nkcmohbg.exe
Size 416KB
SHA256 ba08f40f8dc07121069322ea5e64f148d6ec199e67e21f4f01590a222f764461
MD5 ab2ef4f65c19ca1d67cd51b3f7a972f9
SHA1 fb4c6687d8e9447e6759cb7e886593c50606eac9
SHA512 65299384c483255fcba498483253f57bce22b13edcf53d4ec19b7de48e05d2adf62519370cefca9b4452091ea58576eb7c0387be3309c0ce359acc22ced0672e
SSDEEP 12288:MzYJ07kE0KoFtw2gu9RxrBIUbPLwH96/I0lOZ0vbqFB:SYJ07kE0KoFtw2gu9RxrBIUbPLwH96/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nklfoi32.exe

Path C:\Windows\SysWOW64\Nklfoi32.exe
Size 416KB
SHA256 bc7c6692432cdd64021e561c9cd3c880e46548c916d73b00ce2c8ea2a098e2fc
MD5 76b02c560d3a6142e94be9229d5d1cd2
SHA1 1b2bc89924c720d59b960b98427422224d865987
SHA512 635adc7618416daae57b8601a46286f7d04e11d37b6e85b710c3a695298ff350ce3cc690700ca1a43d1b23f22c16aa54991774434d0e9bd94fbdaab0a94078f0
SSDEEP 12288:GwIEcYJ07kE0KoFtw2gu9RxrBIUbPLwH96/I0lOZ0vbqFB:GRYJ07kE0KoFtw2gu9RxrBIUbPLwH96I
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nkncdifl.exe

Path C:\Windows\SysWOW64\Nkncdifl.exe
Size 416KB
SHA256 d217b382d3d10d73d81c31108df0e1b87672fb62af2f2fd3cfa5f441d567634b
MD5 f29491fd93cb486458b58b5d39bf5043
SHA1 0e8fef07e043fed5283a0cc4e6418bd79b914558
SHA512 4ef249be97ef55fac5805f77213947ae11aa5a55cd9131066ebd575f3168fc277c42078484c897ee99a10a72f199e9212734387598173704f2883c3ba0a5be60
SSDEEP 12288:tLJzHLYJ07kE0KoFtw2gu9RxrBIUbPLwH96/I0lOZ0vbqFB:7LLYJ07kE0KoFtw2gu9RxrBIUbPLwH9n
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nnolfdcn.exe

Path C:\Windows\SysWOW64\Nnolfdcn.exe
Size 416KB
SHA256 dc180e4c508df383f51fc706db616eeb88ee168eb5a2a3148ffc2da41321b090
MD5 e6c034dd801197099d11694c962ce50b
SHA1 e28bf78e4cc26117603c398273808cc088a46440
SHA512 e37865b9fdeb2b87ea92ade030c68ea63eb6e73d3d97deff80658df5d3963153aa3e740f165a34b654172d8f4f3c515cdacd30ecb5c3a7f5ed34186623ec4834
SSDEEP 12288:AZXsNYJ07kE0KoFtw2gu9RxrBIUbPLwH96/I0lOZ0vbqFB:AZXsNYJ07kE0KoFtw2gu9RxrBIUbPLwB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nqiogp32.exe

Path C:\Windows\SysWOW64\Nqiogp32.exe
Size 416KB
SHA256 b3d1e4aa8f11db2a83f645a8e4664d2cddd8d1c9506c7b838f17e114acfa4076
MD5 9362aa39c7fdf7a7620c099360fcc1bc
SHA1 ba89f69c78b74aa8a5dfcf00d534b24ec92bbcd6
SHA512 cf342a931071efd70f1d9516dd8834b06023ae0368f89ffed76f25973a28eb1e55fff38de48e814fff3b1578c4e1bb3b0d8d76a476dfd34735af924c9d1df1eb
SSDEEP 12288:hEh2oyhYJ07kE0KoFtw2gu9RxrBIUbPLwH96/I0lOZ0vbqFB:hEhBKYJ07kE0KoFtw2gu9RxrBIUbPLwB
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/116-32-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/116-113-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/804-44-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/804-112-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1104-8-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1104-116-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1812-106-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1812-104-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2584-110-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2584-63-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2784-71-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2784-109-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3252-56-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3252-111-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3280-108-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3280-79-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3504-16-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3504-115-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4200-117-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4200-0-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4268-52-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4616-114-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4616-27-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4748-107-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4748-88-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4788-95-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4788-105-0x0000000000400000-0x0000000000435000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads