Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
09/05/2024, 03:40
Behavioral task
behavioral1
Sample
e246a89db78ff29e0188ed1624561060_NEIKI.exe
Resource
win7-20240508-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
e246a89db78ff29e0188ed1624561060_NEIKI.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target e246a89db78ff29e0188ed1624561060_NEIKI.exe
- Size 391KB
- Sample240509-d8cpvagf2w
- SHA256 25ccf1d2c3b7fce3f7467df49b3b5572cf816682dd025cb5842a005de23f9eb0
- MD5 e246a89db78ff29e0188ed1624561060
- SHA1 c392ce8d73000351004d3bc89a72896b746eabff
- SHA512 a1d5f665aeaea7bb93d1bc19e1f653b6daa49f3ac29ab96c648fa5c45c4619ef0e5f61488983c21d156ed3f485c14aeba2c3f52b6a0de0d5d09f1247e882f26f
- SSDEEP 12288:2BgT9XvEhdfJkKSkU3kHyuaRB5t6k0IJogZ+SZE:2S9XvEhdfJkKSkU3kHyuaRB5t6k0IJon
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 20 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nbkhfc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ndidbn32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nafokcol.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Nafokcol.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ndghmo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ngedij32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad e246a89db78ff29e0188ed1624561060_NEIKI.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ngcgcjnc.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Njacpf32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ngedij32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Nbhkac32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" e246a89db78ff29e0188ed1624561060_NEIKI.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ngcgcjnc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Njacpf32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nbhkac32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ndidbn32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nddkgonp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Nddkgonp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ndghmo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Nbkhfc32.exe - Malware Dropper & Backdoor - Berbew 11 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/files/0x0007000000023478-16.dat family_berbew behavioral2/files/0x000700000002347d-31.dat family_berbew behavioral2/files/0x0007000000023481-41.dat family_berbew behavioral2/files/0x0007000000023481-48.dat family_berbew behavioral2/files/0x0007000000023489-79.dat family_berbew behavioral2/files/0x0007000000023487-71.dat family_berbew behavioral2/files/0x0007000000023485-63.dat family_berbew behavioral2/files/0x0007000000023483-55.dat family_berbew behavioral2/files/0x000700000002347f-39.dat family_berbew behavioral2/files/0x000700000002347b-23.dat family_berbew behavioral2/files/0x0007000000023305-7.dat family_berbew - Executes dropped EXE 10 IoCs
pid Process 32 Nafokcol.exe 3972 Nddkgonp.exe 2596 Ngcgcjnc.exe 4496 Njacpf32.exe 1504 Nbhkac32.exe 3024 Ndghmo32.exe 4272 Ngedij32.exe 4548 Nbkhfc32.exe 376 Ndidbn32.exe 1532 Nkcmohbg.exe - Drops file in System32 directory 30 IoCs
description ioc Process File created C:\Windows\SysWOW64\Nddkgonp.exe Nafokcol.exe File created C:\Windows\SysWOW64\Njacpf32.exe Ngcgcjnc.exe File created C:\Windows\SysWOW64\Ngcgcjnc.exe Nddkgonp.exe File created C:\Windows\SysWOW64\Lmbnpm32.dll Ngcgcjnc.exe File created C:\Windows\SysWOW64\Nbkhfc32.exe Ngedij32.exe File opened for modification C:\Windows\SysWOW64\Nbkhfc32.exe Ngedij32.exe File created C:\Windows\SysWOW64\Jlnpomfk.dll Nafokcol.exe File opened for modification C:\Windows\SysWOW64\Ngcgcjnc.exe Nddkgonp.exe File opened for modification C:\Windows\SysWOW64\Ndidbn32.exe Nbkhfc32.exe File opened for modification C:\Windows\SysWOW64\Nafokcol.exe e246a89db78ff29e0188ed1624561060_NEIKI.exe File created C:\Windows\SysWOW64\Nbhkac32.exe Njacpf32.exe File opened for modification C:\Windows\SysWOW64\Ndghmo32.exe Nbhkac32.exe File created C:\Windows\SysWOW64\Ngedij32.exe Ndghmo32.exe File created C:\Windows\SysWOW64\Ndidbn32.exe Nbkhfc32.exe File opened for modification C:\Windows\SysWOW64\Nkcmohbg.exe Ndidbn32.exe File created C:\Windows\SysWOW64\Jcoegc32.dll e246a89db78ff29e0188ed1624561060_NEIKI.exe File opened for modification C:\Windows\SysWOW64\Nddkgonp.exe Nafokcol.exe File opened for modification C:\Windows\SysWOW64\Njacpf32.exe Ngcgcjnc.exe File opened for modification C:\Windows\SysWOW64\Nbhkac32.exe Njacpf32.exe File opened for modification C:\Windows\SysWOW64\Ngedij32.exe Ndghmo32.exe File created C:\Windows\SysWOW64\Ndghmo32.exe Nbhkac32.exe File created C:\Windows\SysWOW64\Hnibdpde.dll Ndidbn32.exe File created C:\Windows\SysWOW64\Nkcmohbg.exe Ndidbn32.exe File created C:\Windows\SysWOW64\Nafokcol.exe e246a89db78ff29e0188ed1624561060_NEIKI.exe File created C:\Windows\SysWOW64\Majknlkd.dll Nddkgonp.exe File created C:\Windows\SysWOW64\Ipkobd32.dll Njacpf32.exe File created C:\Windows\SysWOW64\Bdknoa32.dll Nbhkac32.exe File created C:\Windows\SysWOW64\Paadnmaq.dll Ndghmo32.exe File created C:\Windows\SysWOW64\Lkfbjdpq.dll Ngedij32.exe File created C:\Windows\SysWOW64\Opbnic32.dll Nbkhfc32.exe - Program crash 1 IoCs
pid pid_target Process procid_target 3048 1532 WerFault.exe 92 - Modifies registry class 33 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Nbhkac32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ngedij32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Nbkhfc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Majknlkd.dll" Nddkgonp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcoegc32.dll" e246a89db78ff29e0188ed1624561060_NEIKI.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Nddkgonp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Njacpf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID e246a89db78ff29e0188ed1624561060_NEIKI.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ngcgcjnc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ndghmo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlnpomfk.dll" Nafokcol.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Njacpf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bdknoa32.dll" Nbhkac32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Paadnmaq.dll" Ndghmo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ndghmo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Nafokcol.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ipkobd32.dll" Njacpf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Nbhkac32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ndidbn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Nddkgonp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node e246a89db78ff29e0188ed1624561060_NEIKI.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" e246a89db78ff29e0188ed1624561060_NEIKI.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Opbnic32.dll" Nbkhfc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 e246a89db78ff29e0188ed1624561060_NEIKI.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Nafokcol.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ngcgcjnc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Nbkhfc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ndidbn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831} e246a89db78ff29e0188ed1624561060_NEIKI.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lkfbjdpq.dll" Ngedij32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ngedij32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnibdpde.dll" Ndidbn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lmbnpm32.dll" Ngcgcjnc.exe - Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 2444 wrote to memory of 32 2444 e246a89db78ff29e0188ed1624561060_NEIKI.exe 83 PID 2444 wrote to memory of 32 2444 e246a89db78ff29e0188ed1624561060_NEIKI.exe 83 PID 2444 wrote to memory of 32 2444 e246a89db78ff29e0188ed1624561060_NEIKI.exe 83 PID 32 wrote to memory of 3972 32 Nafokcol.exe 84 PID 32 wrote to memory of 3972 32 Nafokcol.exe 84 PID 32 wrote to memory of 3972 32 Nafokcol.exe 84 PID 3972 wrote to memory of 2596 3972 Nddkgonp.exe 85 PID 3972 wrote to memory of 2596 3972 Nddkgonp.exe 85 PID 3972 wrote to memory of 2596 3972 Nddkgonp.exe 85 PID 2596 wrote to memory of 4496 2596 Ngcgcjnc.exe 86 PID 2596 wrote to memory of 4496 2596 Ngcgcjnc.exe 86 PID 2596 wrote to memory of 4496 2596 Ngcgcjnc.exe 86 PID 4496 wrote to memory of 1504 4496 Njacpf32.exe 87 PID 4496 wrote to memory of 1504 4496 Njacpf32.exe 87 PID 4496 wrote to memory of 1504 4496 Njacpf32.exe 87 PID 1504 wrote to memory of 3024 1504 Nbhkac32.exe 88 PID 1504 wrote to memory of 3024 1504 Nbhkac32.exe 88 PID 1504 wrote to memory of 3024 1504 Nbhkac32.exe 88 PID 3024 wrote to memory of 4272 3024 Ndghmo32.exe 89 PID 3024 wrote to memory of 4272 3024 Ndghmo32.exe 89 PID 3024 wrote to memory of 4272 3024 Ndghmo32.exe 89 PID 4272 wrote to memory of 4548 4272 Ngedij32.exe 90 PID 4272 wrote to memory of 4548 4272 Ngedij32.exe 90 PID 4272 wrote to memory of 4548 4272 Ngedij32.exe 90 PID 4548 wrote to memory of 376 4548 Nbkhfc32.exe 91 PID 4548 wrote to memory of 376 4548 Nbkhfc32.exe 91 PID 4548 wrote to memory of 376 4548 Nbkhfc32.exe 91 PID 376 wrote to memory of 1532 376 Ndidbn32.exe 92 PID 376 wrote to memory of 1532 376 Ndidbn32.exe 92 PID 376 wrote to memory of 1532 376 Ndidbn32.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\e246a89db78ff29e0188ed1624561060_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\e246a89db78ff29e0188ed1624561060_NEIKI.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Windows\SysWOW64\Nafokcol.exeC:\Windows\system32\Nafokcol.exe2⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:32 -
C:\Windows\SysWOW64\Nddkgonp.exeC:\Windows\system32\Nddkgonp.exe3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Windows\SysWOW64\Ngcgcjnc.exeC:\Windows\system32\Ngcgcjnc.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Windows\SysWOW64\Njacpf32.exeC:\Windows\system32\Njacpf32.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Windows\SysWOW64\Nbhkac32.exeC:\Windows\system32\Nbhkac32.exe6⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Windows\SysWOW64\Ndghmo32.exeC:\Windows\system32\Ndghmo32.exe7⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Windows\SysWOW64\Ngedij32.exeC:\Windows\system32\Ngedij32.exe8⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Windows\SysWOW64\Nbkhfc32.exeC:\Windows\system32\Nbkhfc32.exe9⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Windows\SysWOW64\Ndidbn32.exeC:\Windows\system32\Ndidbn32.exe10⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:376 -
C:\Windows\SysWOW64\Nkcmohbg.exeC:\Windows\system32\Nkcmohbg.exe11⤵
- Executes dropped EXE
PID:1532 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1532 -s 41212⤵
- Program crash
PID:3048
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1532 -ip 15321⤵PID:3580
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\Ipkobd32.dll
- Size 7KB
- SHA256 dc2e2b53847aa43b00eed8ba3a225137f5a3ccf978052c7a496d4ec2d2f988c2
- MD5 92d8c29761d60ad20281f89629784f4b
- SHA1 6140a32dad673f9d7ab925bba2ef0324673ceae2
- SHA512 01b0784e57b969cdd9da0b182aadbd484be2933a03dcfb91a6e7a51b61fe344bc6dde0605952dcf49c5167a4bf305f24cc9924ef409568951086b80a68d5f4d0
- SSDEEP 96:wb4VHccYJUC/aFbz/j0OvaPUd3cX5aXW:wUaJf/aFbP0OX2JaX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Nafokcol.exe
- Size 391KB
- SHA256 eb8f331d78eb61aeeb127cce78d023525784557405abff20b199f8497fa2e34a
- MD5 90fad81011fa8eca5aa295e75cd3a04b
- SHA1 d0577329d586bb1d6b49dd0ee5c46dd29e8f6655
- SHA512 235ceaa938cb01ea967fa727ef6c85b876d7ee49785be700dafaef6c7ae954f07deaae5ac1aef602e99145f9ce3707585a3814539de1d514ca4cdc599cb5f557
- SSDEEP 12288:wHbBT9XvEhdfJkKSkU3kHyuaRB5t6k0IJogZ+SZE:w7R9XvEhdfJkKSkU3kHyuaRB5t6k0IJm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Nbhkac32.exe
- Size 391KB
- SHA256 1ce7b6d6ce8f5234f39d6496d44df432d2c20fefb65d2f63cb49ed2d907acd30
- MD5 70049f9d690dd11562597dbfb9eb99d6
- SHA1 8d3d0e745a649e16904812a71427f1bcefbd66dd
- SHA512 1e34f0f1761b36940f498ca6f60b17e965623fe9141d396e13691aa562e18c849bd9ec0b8512f15e009948d29601ae4944edf01cb842932754e399e45ec3c42e
- SSDEEP 12288:QqVT9XvEhdfJkKSkU3kHyuaRB5t6k0IJogZ+SZE:Q+9XvEhdfJkKSkU3kHyuaRB5t6k0IJon
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Nbkhfc32.exe
- Size 391KB
- SHA256 087b2247702fbfc04fbceda278f25ff83a86ca0a9ac376cb6f7416ab6258f0f3
- MD5 44b5074ea5f81e4143d613119af2a4ce
- SHA1 80e5d15fecd464835fa99b9dcccde912e54a5e1d
- SHA512 fdaaf0f81b70f031b869b0dd7a8e779fe7f8cd357c653448987528db38e04414c7c672a6fcae7db570b2e6c802622a8d639149e90fc128077e431508f656d8b6
- SSDEEP 12288:eCZw6PiT9XvEhdfJkKSkU3kHyuaRB5t6k0IJogZ+SZE:HZc9XvEhdfJkKSkU3kHyuaRB5t6k0IJm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Nddkgonp.exe
- Size 391KB
- SHA256 8cdb035fdfac59942f1164aad4d246da90638326f3b2894a6fae0c2e64a35371
- MD5 c1019f5cb9637bf716edbcc0b48ef777
- SHA1 f68d22de73a5d64c4ebeab5b6d0753485f94af9f
- SHA512 fd48b40640f444b1c2bc173202e6e8fee898101087d4989d495321b378efc2832cdf0354d68d5a0e239c17b9966c9c75acac25e94bacc3b5f86fc6ca374fdd25
- SSDEEP 12288:HnUzT9XvEhdfJkKSkU3kHyuaRB5t6k0IJogZ+SZE:Hy9XvEhdfJkKSkU3kHyuaRB5t6k0IJon
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Ndghmo32.exe
- Size 391KB
- SHA256 5741576a1298f33e209995dcc87cd4240fecd5213345caa28aaf2d23c82ebc72
- MD5 5aaa59cfb309643ffe112872fd077b96
- SHA1 34cd328e45e03990f7b7c6036742cc3828d8c46e
- SHA512 61370a9d2f070f7e4ec0f182830c96d0c9d3d2cbb51e64846c44e800616461be8ae8709304f4e718860856ceb16a8366e5f431ae3eb0f3335953cef3022967d4
- SSDEEP 12288:QqbT9XvEhdfJkKSkU3kHyuaRB5t6k0IJogZ+SZE:Qc9XvEhdfJkKSkU3kHyuaRB5t6k0IJon
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Ndghmo32.exe
- Size 391KB
- SHA256 6c4855b59435dc456a33923e3d3e0526101bfdf5ccb00ab091b1b6d6e8a20e43
- MD5 af8b794eb6b9eae6c6649652459cc47a
- SHA1 83ddf446df8f4ab47f00d399a5a16a44d6da13ad
- SHA512 a2f48356fa6084645ecad391fc837034146b04a7cd72947ed2d39ee3ef62218808a7d0c8c470ee96ba4a57e2d2575c226c49bb0439d47a4a5b653da2399c333c
- SSDEEP 12288:cL8xJDT9XvEhdfJkKSkU3kHyuaRB5t6k0IJogZ+SZE:MKJH9XvEhdfJkKSkU3kHyuaRB5t6k0Io
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Ndidbn32.exe
- Size 391KB
- SHA256 0610b8295d528b02ee3d82ad98b91e75fc30fd46c7f50b4cd8bafd7b0a490d0b
- MD5 ab75bc5aa530871e902a996493dd9a01
- SHA1 e47f1fff19221fbf282dc6a7b0aa5c6edb72c0fb
- SHA512 aff3fe4561c88f029fcfb1b7909393ae7e17df4e4854c4b5360d4e4395518b7d7ea9685ce0e176f7402ef80069c4e55f0823b0a6fb64e77981cb289bd0cc7734
- SSDEEP 12288:QwOT9XvEhdfJkKSkU3kHyuaRB5t6k0IJogZ+SZE:Ni9XvEhdfJkKSkU3kHyuaRB5t6k0IJon
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Ngcgcjnc.exe
- Size 391KB
- SHA256 abbda7eb0e0e82680a15f475d2ea764a698820a9fecdee92b9905b3a85b0cad6
- MD5 38741f11ef55a2ff6138cbcedaf1d721
- SHA1 4319cee6678d52832037729060f7204b4a53b1fc
- SHA512 f41a02d7999b8024630763317460870bfaf8e9a40dbdf0ee2c510d1424c61ba3547890b3043c4220613517fc79e31ba2429b6609c91b741614972979480cf401
- SSDEEP 12288:bBskv4vut/RNT9XvEhdfJkKSkU3kHyuaRB5t6k0IJogZ+SZE:bBskv4vut/Rl9XvEhdfJkKSkU3kHyuai
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Ngedij32.exe
- Size 391KB
- SHA256 af86d01fd15aba317212696a8a382756eed7770a1a536e870568c39661855aab
- MD5 d569616bc168e9ff55c80c210e60afaf
- SHA1 8e43c510422c5b785e11fc7c7fd261b42066675d
- SHA512 725432cb011709829ef3dbbb2968b900b415dfd14b67f0a510ab766229e7e2fbc77f3a29be241f886edd6bdf71a3640539a9213d55686085bb7af0b835a54fb1
- SSDEEP 12288:3zWPWMT9XvEhdfJkKSkU3kHyuaRB5t6k0IJogZ+SZE:jeN9XvEhdfJkKSkU3kHyuaRB5t6k0IJm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Njacpf32.exe
- Size 391KB
- SHA256 62d37c8cbc729dd98f0824a2677c772ac25d358ad321e79dd6a9c3c9093220b1
- MD5 ebab69544147d8b2b3af0b1e9e00e428
- SHA1 f91962b4327227c98da56b387b3934668436cf1e
- SHA512 f06beb34f81f4a3d82534f02f20cc20d32798df2f99df4dfbd979fe619015f8df29b798fd17969bc352b8e7a9818679154381f28e764762cb3a6ccede288fce2
- SSDEEP 12288:riJ09NvT9XvEhdfJkKSkU3kHyuaRB5t6k0IJogZ+SZE:rd9XvEhdfJkKSkU3kHyuaRB5t6k0IJon
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Nkcmohbg.exe
- Size 391KB
- SHA256 7c991c36ea19fa7cfaba2955b0175a6b06f8405fbbf86b097439438ed644a582
- MD5 150c1c5d98a1fbd95eb6d7122e91ad91
- SHA1 f1b4f588c4c2060587fe4d39500e1968a51cdac9
- SHA512 4926bc7bced1759ac295020f1d1cb7da9dc49958184557119059abd110dc46ebc86960a23423891f10ce17a2aa97b444a815d38905a038179256c4caccfd55d2
- SSDEEP 12288:yhT9XvEhdfJkKSkU3kHyuaRB5t6k0IJogZ+SZE:29XvEhdfJkKSkU3kHyuaRB5t6k0IJogU
- MD5 SHA1 SHA512 SSDEEP