d69fb199af4bf8665cc9562c6d3a418449982b3308d9b13cb3a6905dd0d7b49e

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 02:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d65a2ac89d531d36cc05b1f858765670_NEIKI.exe
Size 270KB
Sample240509-dedeaaef6z
SHA256 d69fb199af4bf8665cc9562c6d3a418449982b3308d9b13cb3a6905dd0d7b49e
MD5 d65a2ac89d531d36cc05b1f858765670
SHA1 b5cb9d562780d2086e6541803d888f3c8617528f
SHA512 7fca64167e281ce07307bc3d7c302b1275c54407e51a5e7c8823ec2e6f9d4cc051a2b6e958ebc815c739b7df2995e9029381cb9b5b76e22a45236ba97c9824a3
SSDEEP 6144:DX71C976hRNjpck4MetpS+f2uXLO+AGb+oPri2O3py69mNoRqzO5MnNYx:DhI6hb2XtpD2ub7A2Vri730697qy5oNK
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

backdoor dropper persistence trojan

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 36 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Maohkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Maohkd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdiklqhm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkepnjng.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mglack32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mglack32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mjjmog32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncgkcl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mdiklqhm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkbchk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njcpee32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjjmog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ncihikcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mkepnjng.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcbahlip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nnhfee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njogjfoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nafokcol.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncldnkae.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	d65a2ac89d531d36cc05b1f858765670_NEIKI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mkbchk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ncldnkae.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnhfee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njcpee32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnapdf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mcbahlip.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncihikcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mnapdf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nceonl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nceonl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ncgkcl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	d65a2ac89d531d36cc05b1f858765670_NEIKI.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnocof32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nafokcol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mnocof32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njogjfoj.exe

Malware Dropper & Backdoor - Berbew 18 IoCs

Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.

backdoor trojan dropper

resource	yara_rule
behavioral2/files/0x0008000000022f51-6.dat	family_berbew
behavioral2/files/0x00090000000233f6-14.dat	family_berbew
behavioral2/files/0x00070000000233fc-23.dat	family_berbew
behavioral2/files/0x00070000000233fe-30.dat	family_berbew
behavioral2/files/0x0007000000023400-38.dat	family_berbew
behavioral2/files/0x0007000000023402-46.dat	family_berbew
behavioral2/files/0x0007000000023404-54.dat	family_berbew
behavioral2/files/0x0007000000023406-62.dat	family_berbew
behavioral2/files/0x0007000000023408-70.dat	family_berbew
behavioral2/files/0x000700000002340a-78.dat	family_berbew
behavioral2/files/0x000700000002340c-86.dat	family_berbew
behavioral2/files/0x000700000002340e-94.dat	family_berbew
behavioral2/files/0x0007000000023410-102.dat	family_berbew
behavioral2/files/0x0007000000023412-111.dat	family_berbew
behavioral2/files/0x0007000000023414-118.dat	family_berbew
behavioral2/files/0x0007000000023416-126.dat	family_berbew
behavioral2/files/0x0007000000023418-134.dat	family_berbew
behavioral2/files/0x00090000000233ef-142.dat	family_berbew

Executes dropped EXE 18 IoCs

pid	Process
652	Mnocof32.exe
3192	Mdiklqhm.exe
752	Mkbchk32.exe
1484	Mnapdf32.exe
2636	Mkepnjng.exe
1112	Maohkd32.exe
4428	Mglack32.exe
1644	Mjjmog32.exe
912	Mcbahlip.exe
2180	Nnhfee32.exe
4968	Nceonl32.exe
3104	Njogjfoj.exe
1688	Nafokcol.exe
3740	Ncgkcl32.exe
1328	Ncihikcg.exe
2144	Njcpee32.exe
4612	Ncldnkae.exe
4908	Nkcmohbg.exe

Drops file in System32 directory 54 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Njogjfoj.exe	Nceonl32.exe
File created	C:\Windows\SysWOW64\Lfcbokki.dll	Nceonl32.exe
File created	C:\Windows\SysWOW64\Fcdjjo32.dll	Nnhfee32.exe
File created	C:\Windows\SysWOW64\Nafokcol.exe	Njogjfoj.exe
File created	C:\Windows\SysWOW64\Jcoegc32.dll	Njogjfoj.exe
File opened for modification	C:\Windows\SysWOW64\Ncldnkae.exe	Njcpee32.exe
File created	C:\Windows\SysWOW64\Dlddhggk.dll	Njcpee32.exe
File created	C:\Windows\SysWOW64\Ockcknah.dll	Mnocof32.exe
File created	C:\Windows\SysWOW64\Pdgdjjem.dll	Mkbchk32.exe
File created	C:\Windows\SysWOW64\Oedbld32.dll	d65a2ac89d531d36cc05b1f858765670_NEIKI.exe
File created	C:\Windows\SysWOW64\Nceonl32.exe	Nnhfee32.exe
File created	C:\Windows\SysWOW64\Hlmobp32.dll	Mcbahlip.exe
File created	C:\Windows\SysWOW64\Pipfna32.dll	Nafokcol.exe
File created	C:\Windows\SysWOW64\Mnapdf32.exe	Mkbchk32.exe
File opened for modification	C:\Windows\SysWOW64\Mcbahlip.exe	Mjjmog32.exe
File created	C:\Windows\SysWOW64\Hnibdpde.dll	Ncldnkae.exe
File created	C:\Windows\SysWOW64\Mdiklqhm.exe	Mnocof32.exe
File opened for modification	C:\Windows\SysWOW64\Mdiklqhm.exe	Mnocof32.exe
File created	C:\Windows\SysWOW64\Ncgkcl32.exe	Nafokcol.exe
File created	C:\Windows\SysWOW64\Ncldnkae.exe	Njcpee32.exe
File opened for modification	C:\Windows\SysWOW64\Mnocof32.exe	d65a2ac89d531d36cc05b1f858765670_NEIKI.exe
File created	C:\Windows\SysWOW64\Mkepnjng.exe	Mnapdf32.exe
File created	C:\Windows\SysWOW64\Geegicjl.dll	Mglack32.exe
File opened for modification	C:\Windows\SysWOW64\Nceonl32.exe	Nnhfee32.exe
File created	C:\Windows\SysWOW64\Pbcfgejn.dll	Mkepnjng.exe
File opened for modification	C:\Windows\SysWOW64\Mglack32.exe	Maohkd32.exe
File opened for modification	C:\Windows\SysWOW64\Mkepnjng.exe	Mnapdf32.exe
File created	C:\Windows\SysWOW64\Maohkd32.exe	Mkepnjng.exe
File opened for modification	C:\Windows\SysWOW64\Nafokcol.exe	Njogjfoj.exe
File opened for modification	C:\Windows\SysWOW64\Ncgkcl32.exe	Nafokcol.exe
File opened for modification	C:\Windows\SysWOW64\Ncihikcg.exe	Ncgkcl32.exe
File created	C:\Windows\SysWOW64\Nkcmohbg.exe	Ncldnkae.exe
File created	C:\Windows\SysWOW64\Mcbahlip.exe	Mjjmog32.exe
File opened for modification	C:\Windows\SysWOW64\Njogjfoj.exe	Nceonl32.exe
File opened for modification	C:\Windows\SysWOW64\Njcpee32.exe	Ncihikcg.exe
File created	C:\Windows\SysWOW64\Ddpfgd32.dll	Ncihikcg.exe
File created	C:\Windows\SysWOW64\Mkbchk32.exe	Mdiklqhm.exe
File created	C:\Windows\SysWOW64\Gqffnmfa.dll	Mdiklqhm.exe
File opened for modification	C:\Windows\SysWOW64\Mjjmog32.exe	Mglack32.exe
File created	C:\Windows\SysWOW64\Mjjmog32.exe	Mglack32.exe
File opened for modification	C:\Windows\SysWOW64\Nnhfee32.exe	Mcbahlip.exe
File created	C:\Windows\SysWOW64\Ncihikcg.exe	Ncgkcl32.exe
File created	C:\Windows\SysWOW64\Njcpee32.exe	Ncihikcg.exe
File created	C:\Windows\SysWOW64\Mnocof32.exe	d65a2ac89d531d36cc05b1f858765670_NEIKI.exe
File opened for modification	C:\Windows\SysWOW64\Mkbchk32.exe	Mdiklqhm.exe
File created	C:\Windows\SysWOW64\Lelgbkio.dll	Mjjmog32.exe
File opened for modification	C:\Windows\SysWOW64\Nkcmohbg.exe	Ncldnkae.exe
File created	C:\Windows\SysWOW64\Mglack32.exe	Maohkd32.exe
File created	C:\Windows\SysWOW64\Oaehlf32.dll	Maohkd32.exe
File opened for modification	C:\Windows\SysWOW64\Maohkd32.exe	Mkepnjng.exe
File created	C:\Windows\SysWOW64\Nnhfee32.exe	Mcbahlip.exe
File created	C:\Windows\SysWOW64\Pkckjila.dll	Ncgkcl32.exe
File opened for modification	C:\Windows\SysWOW64\Mnapdf32.exe	Mkbchk32.exe
File created	C:\Windows\SysWOW64\Qcldhk32.dll	Mnapdf32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2876	4908	WerFault.exe	99

Modifies registry class 57 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mdiklqhm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mdiklqhm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mkbchk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pbcfgejn.dll"	Mkepnjng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nnhfee32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	d65a2ac89d531d36cc05b1f858765670_NEIKI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlmobp32.dll"	Mcbahlip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ncihikcg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Njcpee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qcldhk32.dll"	Mnapdf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	d65a2ac89d531d36cc05b1f858765670_NEIKI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mglack32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nceonl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcoegc32.dll"	Njogjfoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ddpfgd32.dll"	Ncihikcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Njcpee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oedbld32.dll"	d65a2ac89d531d36cc05b1f858765670_NEIKI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mcbahlip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fcdjjo32.dll"	Nnhfee32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ncihikcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dlddhggk.dll"	Njcpee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mnapdf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Njogjfoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pipfna32.dll"	Nafokcol.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	d65a2ac89d531d36cc05b1f858765670_NEIKI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mnocof32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ncgkcl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	d65a2ac89d531d36cc05b1f858765670_NEIKI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mkbchk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mkepnjng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nafokcol.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mnocof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nnhfee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mkepnjng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oaehlf32.dll"	Maohkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdgdjjem.dll"	Mkbchk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mcbahlip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfcbokki.dll"	Nceonl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkckjila.dll"	Ncgkcl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnibdpde.dll"	Ncldnkae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Geegicjl.dll"	Mglack32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mjjmog32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nafokcol.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mglack32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nceonl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ncldnkae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	d65a2ac89d531d36cc05b1f858765670_NEIKI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mjjmog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ncgkcl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ncldnkae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Maohkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lelgbkio.dll"	Mjjmog32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Maohkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gqffnmfa.dll"	Mdiklqhm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mnapdf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Njogjfoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ockcknah.dll"	Mnocof32.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 1460 wrote to memory of 652	1460	d65a2ac89d531d36cc05b1f858765670_NEIKI.exe	79
PID 1460 wrote to memory of 652	1460	d65a2ac89d531d36cc05b1f858765670_NEIKI.exe	79
PID 1460 wrote to memory of 652	1460	d65a2ac89d531d36cc05b1f858765670_NEIKI.exe	79
PID 652 wrote to memory of 3192	652	Mnocof32.exe	80
PID 652 wrote to memory of 3192	652	Mnocof32.exe	80
PID 652 wrote to memory of 3192	652	Mnocof32.exe	80
PID 3192 wrote to memory of 752	3192	Mdiklqhm.exe	81
PID 3192 wrote to memory of 752	3192	Mdiklqhm.exe	81
PID 3192 wrote to memory of 752	3192	Mdiklqhm.exe	81
PID 752 wrote to memory of 1484	752	Mkbchk32.exe	82
PID 752 wrote to memory of 1484	752	Mkbchk32.exe	82
PID 752 wrote to memory of 1484	752	Mkbchk32.exe	82
PID 1484 wrote to memory of 2636	1484	Mnapdf32.exe	83
PID 1484 wrote to memory of 2636	1484	Mnapdf32.exe	83
PID 1484 wrote to memory of 2636	1484	Mnapdf32.exe	83
PID 2636 wrote to memory of 1112	2636	Mkepnjng.exe	85
PID 2636 wrote to memory of 1112	2636	Mkepnjng.exe	85
PID 2636 wrote to memory of 1112	2636	Mkepnjng.exe	85
PID 1112 wrote to memory of 4428	1112	Maohkd32.exe	86
PID 1112 wrote to memory of 4428	1112	Maohkd32.exe	86
PID 1112 wrote to memory of 4428	1112	Maohkd32.exe	86
PID 4428 wrote to memory of 1644	4428	Mglack32.exe	87
PID 4428 wrote to memory of 1644	4428	Mglack32.exe	87
PID 4428 wrote to memory of 1644	4428	Mglack32.exe	87
PID 1644 wrote to memory of 912	1644	Mjjmog32.exe	89
PID 1644 wrote to memory of 912	1644	Mjjmog32.exe	89
PID 1644 wrote to memory of 912	1644	Mjjmog32.exe	89
PID 912 wrote to memory of 2180	912	Mcbahlip.exe	90
PID 912 wrote to memory of 2180	912	Mcbahlip.exe	90
PID 912 wrote to memory of 2180	912	Mcbahlip.exe	90
PID 2180 wrote to memory of 4968	2180	Nnhfee32.exe	91
PID 2180 wrote to memory of 4968	2180	Nnhfee32.exe	91
PID 2180 wrote to memory of 4968	2180	Nnhfee32.exe	91
PID 4968 wrote to memory of 3104	4968	Nceonl32.exe	93
PID 4968 wrote to memory of 3104	4968	Nceonl32.exe	93
PID 4968 wrote to memory of 3104	4968	Nceonl32.exe	93
PID 3104 wrote to memory of 1688	3104	Njogjfoj.exe	94
PID 3104 wrote to memory of 1688	3104	Njogjfoj.exe	94
PID 3104 wrote to memory of 1688	3104	Njogjfoj.exe	94
PID 1688 wrote to memory of 3740	1688	Nafokcol.exe	95
PID 1688 wrote to memory of 3740	1688	Nafokcol.exe	95
PID 1688 wrote to memory of 3740	1688	Nafokcol.exe	95
PID 3740 wrote to memory of 1328	3740	Ncgkcl32.exe	96
PID 3740 wrote to memory of 1328	3740	Ncgkcl32.exe	96
PID 3740 wrote to memory of 1328	3740	Ncgkcl32.exe	96
PID 1328 wrote to memory of 2144	1328	Ncihikcg.exe	97
PID 1328 wrote to memory of 2144	1328	Ncihikcg.exe	97
PID 1328 wrote to memory of 2144	1328	Ncihikcg.exe	97
PID 2144 wrote to memory of 4612	2144	Njcpee32.exe	98
PID 2144 wrote to memory of 4612	2144	Njcpee32.exe	98
PID 2144 wrote to memory of 4612	2144	Njcpee32.exe	98
PID 4612 wrote to memory of 4908	4612	Ncldnkae.exe	99
PID 4612 wrote to memory of 4908	4612	Ncldnkae.exe	99
PID 4612 wrote to memory of 4908	4612	Ncldnkae.exe	99

C:\Users\Admin\AppData\Local\Temp\d65a2ac89d531d36cc05b1f858765670_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\d65a2ac89d531d36cc05b1f858765670_NEIKI.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1460
- C:\Windows\SysWOW64\Mnocof32.exe
  C:\Windows\system32\Mnocof32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:652
- - C:\Windows\SysWOW64\Mdiklqhm.exe
    C:\Windows\system32\Mdiklqhm.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3192
  - - C:\Windows\SysWOW64\Mkbchk32.exe
      C:\Windows\system32\Mkbchk32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:752
    - - C:\Windows\SysWOW64\Mnapdf32.exe
        
        C:\Windows\system32\Mnapdf32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1484
      - C:\Windows\SysWOW64\Mkepnjng.exe
        
        C:\Windows\system32\Mkepnjng.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2636
        
        C:\Windows\SysWOW64\Maohkd32.exe
        
        C:\Windows\system32\Maohkd32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1112
        
        C:\Windows\SysWOW64\Mglack32.exe
        
        C:\Windows\system32\Mglack32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4428
        
        C:\Windows\SysWOW64\Mjjmog32.exe
        
        C:\Windows\system32\Mjjmog32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1644
        
        C:\Windows\SysWOW64\Mcbahlip.exe
        
        C:\Windows\system32\Mcbahlip.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:912
        
        C:\Windows\SysWOW64\Nnhfee32.exe
        
        C:\Windows\system32\Nnhfee32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2180
        
        C:\Windows\SysWOW64\Nceonl32.exe
        
        C:\Windows\system32\Nceonl32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4968
        
        C:\Windows\SysWOW64\Njogjfoj.exe
        
        C:\Windows\system32\Njogjfoj.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3104
        
        C:\Windows\SysWOW64\Nafokcol.exe
        
        C:\Windows\system32\Nafokcol.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1688
        
        C:\Windows\SysWOW64\Ncgkcl32.exe
        
        C:\Windows\system32\Ncgkcl32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3740
        
        C:\Windows\SysWOW64\Ncihikcg.exe
        
        C:\Windows\system32\Ncihikcg.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1328
        
        C:\Windows\SysWOW64\Njcpee32.exe
        
        C:\Windows\system32\Njcpee32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2144
        
        C:\Windows\SysWOW64\Ncldnkae.exe
        
        C:\Windows\system32\Ncldnkae.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4612
        
        C:\Windows\SysWOW64\Nkcmohbg.exe
        
        C:\Windows\system32\Nkcmohbg.exe
        19⤵
        Executes dropped EXE
        
        PID:4908
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4908 -s 400
        20⤵
        Program crash
        
        PID:2876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4908 -ip 4908
1⤵
PID:1368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Maohkd32.exe

Path C:\Windows\SysWOW64\Maohkd32.exe
Size 270KB
SHA256 ba31f8bd053b77ee62e9479d85d8fe3533bfaa4ef0e4c3228909dcbef423196d
MD5 1581b50730c2cea1d77454928c210676
SHA1 200aa85b4575e21588fec03c93a1400456b9f354
SHA512 78eadf0771ce7c5f03727f3b63bea1423c43de341ddcaea803d72a6f5385df43b3d79b87c0234e168f0fdf2a8e3ba2111e2aa1928575afa3818be253a64a4e08
SSDEEP 6144:kV5i/Z6hRNjpck4MetpS+f2uXLO+AGb+oPri2O3py69mNoRqzO5MnNYx:1x6hb2XtpD2ub7A2Vri730697qy5oNK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mcbahlip.exe

Path C:\Windows\SysWOW64\Mcbahlip.exe
Size 270KB
SHA256 65970b67c28cf50e2e2c76615d14945f68865aff9af1471ed915eaa49cb20147
MD5 afbf302f758d8d9d28f1f3071785f793
SHA1 a6b6930787f94961bd3383355355f12d364f0dcd
SHA512 39aa081e407719f17759301a73e795dc68917ea7161919167ef75d738ae3cad5cb6d95361b247583c6d5859834ae7b39c1cf67a0a03eb7c9a8659beaf1e70ef3
SSDEEP 6144:4A2ug6hRNjpck4MetpS+f2uXLO+AGb+oPri2O3py69mNoRqzO5MnNYx:H2z6hb2XtpD2ub7A2Vri730697qy5oNK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mdiklqhm.exe

Path C:\Windows\SysWOW64\Mdiklqhm.exe
Size 270KB
SHA256 569c7cdfa7d73eb3ef208c4840b3732936f3335c251b789231a9644cfbaa8436
MD5 0f1cfda09560c34b0bf37964fab8b78b
SHA1 8855c6c3cdc055fdd4fd3e9981f599b4ffe5987d
SHA512 f4cd75fa3faa202d6679e1c2c12972b7a124bea3055911fd6e29baad57bc535cb85078361a3ec5b0b6a1d314b8eda00d20cca9dcab961a933d401918694901cc
SSDEEP 6144:DBfnEDtk6hRNjpck4MetpS+f2uXLO+AGb+oPri2O3py69mNoRqzO5MnNYx:DBfUy6hb2XtpD2ub7A2Vri730697qy5L
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mglack32.exe

Path C:\Windows\SysWOW64\Mglack32.exe
Size 270KB
SHA256 e0005704775025704dfa1ef377812a8e241b3f892318025146b6ff69ed3dcdc0
MD5 0203e5ab21bd5de22c06b6198163a061
SHA1 99218de15c0539f4d24aadb29be10d87ea6ee069
SHA512 4e62b69faabe7c883dd183a6f536fac5f28d08fcbf79d1f349eda8ff76558c470245b13630f9bd1b19a72710339312a240641b05778c8c72ea15b76005ef2227
SSDEEP 6144:1/mLjo1/y+Bb6hRNjpck4MetpS+f2uXLO+AGb+oPri2O3py69mNoRqzO5MnNYx:NIoNR6hb2XtpD2ub7A2Vri730697qy5L
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mjjmog32.exe

Path C:\Windows\SysWOW64\Mjjmog32.exe
Size 270KB
SHA256 70d908d53e6920943e654e2d1ab5970f1f0da499d347aad21310670e3bbeadbf
MD5 420957f0060716b3e138d405a9f7e1ae
SHA1 6fb8ee267bc3d3416e00eb3a60b067d81f690e1e
SHA512 db4234d800c2361f2208eaa34f89df890763f2d4d6a45eded92fd36ec11e3a39f1875c91270b5eeee53fd30d77c72febd893f522ebb271c14ae2b22111b499f3
SSDEEP 6144:p8AZGsd5Iwu6hRNjpck4MetpS+f2uXLO+AGb+oPri2O3py69mNoRqzO5MnNYx:p8AZGsna6hb2XtpD2ub7A2Vri730697n
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mkbchk32.exe

Path C:\Windows\SysWOW64\Mkbchk32.exe
Size 270KB
SHA256 3ed084e343b3e983aa00e37a812c773c156347d5467ec919dbd5b5c23745d65a
MD5 3cfe179cf74fc611b35c544a04e85422
SHA1 ac7852cb9fc474385be5f441da14a07ea503b1f3
SHA512 b87d2fb7e0ff872f814b51fcdfe008d1f2dcd4ea0820b2231918671f1e16bc289d0dd9b641f01c662bdc3d875a1ea96f8aa55e9bbb1b163e95ae8baadd83938f
SSDEEP 6144:MWMuLsu96hRNjpck4MetpS+f2uXLO+AGb+oPri2O3py69mNoRqzO5MnNYx:xLsm6hb2XtpD2ub7A2Vri730697qy5oA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mkepnjng.exe

Path C:\Windows\SysWOW64\Mkepnjng.exe
Size 270KB
SHA256 180b94bf3fc812656707c6cf60b626cc8abd875a972ff698097479355a32c5dc
MD5 90148fc4f8f0b628ab73e22f06aa39a6
SHA1 362c79ff5682bd900f5bd869e815bea14da4cba5
SHA512 4d02c1295738498ef346b16d35d2af02532f088facd7d4bba006479154446daafd9d3a08802a7b98cae9628366358c41d02861e06a7b156b4df13b0396fea40b
SSDEEP 6144:6R3VCOEUEvVgN6hRNjpck4MetpS+f2uXLO+AGb+oPri2O3py69mNoRqzO5MnNYx:6R3VjEpG6hb2XtpD2ub7A2Vri730697n
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mnapdf32.exe

Path C:\Windows\SysWOW64\Mnapdf32.exe
Size 270KB
SHA256 50f8f40d3c2c1823af6211735dc89c60c6ba2d79740bc4e920bfd20212d735fa
MD5 8a6de28fd02912807dd258cd81e1f3c5
SHA1 0b80baa87e81003f08330e4b07fa3349e75ec9c6
SHA512 ce41d6df8df85e181875734738d118827d8acd1f94543a327513597c99e0dd4bd7a2c939721cf107dd0864c9749bcbd53848424ba049836f6e8006fc86b9fea2
SSDEEP 6144:oJGygSt6hRNjpck4MetpS+f2uXLO+AGb+oPri2O3py69mNoRqzO5MnNYx:c6hb2XtpD2ub7A2Vri730697qy5oNK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mnocof32.exe

Path C:\Windows\SysWOW64\Mnocof32.exe
Size 270KB
SHA256 a53a5a36d92382b7e4d1fdb5e2b96c113cd90b1a828c9cc7f103bbb5233bfbd2
MD5 a8f7dc420765e62de895146f0add3586
SHA1 8285d7edc575a9d4394ba65f61af51dcd1164c7a
SHA512 2970c41177cd58c79628ed993b3831348655b30d75870f70468c001f7d1255f12d6508aa37fd52771862cc006f674937c98c5177ede0dadcc0996a61db2a8981
SSDEEP 6144:w1vw8EqaUXk6hRNjpck4MetpS+f2uXLO+AGb+oPri2O3py69mNoRqzO5MnNYx:Qvw1qg6hb2XtpD2ub7A2Vri730697qyB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nafokcol.exe

Path C:\Windows\SysWOW64\Nafokcol.exe
Size 270KB
SHA256 69c13712620c5b80d0ccc36c1506965b2e6b381d32a1b41730cb5bd20c6f8510
MD5 958b35349c053f61d114d33ad71eb453
SHA1 117fe888567e3c3ec2d75c302e61e34f44a43aaf
SHA512 097dbdeac8b5b085e6c13528012323f01a2ac52ebe72c2db3d4690ae13b17646d0434755b45bf11b734ec7ccfc8a3121dd8f664db57fc1c2c6e62c58496616e0
SSDEEP 6144:016Z8jQ6hRNjpck4MetpS+f2uXLO+AGb+oPri2O3py69mNoRqzO5MnNYx:M6+M6hb2XtpD2ub7A2Vri730697qy5oA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nceonl32.exe

Path C:\Windows\SysWOW64\Nceonl32.exe
Size 270KB
SHA256 1be13158416f18f26f671772038f667d0d535a29c33c7db7d5f2014d4a8f9658
MD5 af63b6bd4fbe2377de4e615a88c07b4d
SHA1 1ef0c150b336523f334b5a724f0b9b8155c3813f
SHA512 935367566fd56650b25f15bcec293419a46006d987a3930076d75a5f5d06d31d5103aba5ab2317ea6ea540777c533ab3afe97ff752e0fa7c5287cd611a6cb3b6
SSDEEP 6144:Te9hm6hRNjpck4MetpS+f2uXLO+AGb+oPri2O3py69mNoRqzO5MnNYx:Te9A6hb2XtpD2ub7A2Vri730697qy5oA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ncgkcl32.exe

Path C:\Windows\SysWOW64\Ncgkcl32.exe
Size 270KB
SHA256 04e87e931c0f949532732fe13757699075b6de7ea8783b0feca5291eac62318e
MD5 51a158c0c61f8acf263ca764a9725ca0
SHA1 8547fa6ac3a86f73b43aad3f447b11a72ab50c85
SHA512 b8985889c20b52310d5f210a292f578f4a44e080fe3f08bb8e1e9a668c8f633638394a64395102cd2bc57d8a11c4049f6aea24a5c988e44db257187d413ee0fb
SSDEEP 6144:Nm1tADZPCRQ6hRNjpck4MetpS+f2uXLO+AGb+oPri2O3py69mNoRqzO5MnNYx:01tAVF6hb2XtpD2ub7A2Vri730697qyB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ncihikcg.exe

Path C:\Windows\SysWOW64\Ncihikcg.exe
Size 270KB
SHA256 241341f447ffcbe97f67a64d06d127882ab76c5a7e3eaaad6caf31dfe4218d54
MD5 b295c9e523d2c87b31e083915e8d3b84
SHA1 2c88a495719de32ade79561936fdbfca5953b786
SHA512 3abd3d625cd6b6c8a2d6734081c0c896e6ba74ab90fe35afff189ed10d4b939a51b21d29c1127f1d338c2f9a52914ed474651e27211c063bb846ba662592aeb6
SSDEEP 6144:/hfs3UqQP4uj6hRNjpck4MetpS+f2uXLO+AGb+oPri2O3py69mNoRqzO5MnNYx:/16hb2XtpD2ub7A2Vri730697qy5oNK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ncldnkae.exe

Path C:\Windows\SysWOW64\Ncldnkae.exe
Size 270KB
SHA256 d8d9eac93eed3991766f03194be063b67aa707547c67288f025f397e7ed0aa5d
MD5 56fe248a1b6b7870af41522705068743
SHA1 20d4b337d2c737920a95de9cdb6d6626404a47fa
SHA512 131b455edc5e0ca84002547353ab2f9a232ed8e737921eb04fa50bf97be90521d9bfe2c02d277e8b474b081d930c1dc91b78dee6cb1b2c5fc7ad52974610d9dd
SSDEEP 6144:fQvSeXn0/46a66hRNjpck4MetpS+f2uXLO+AGb+oPri2O3py69mNoRqzO5MnNYx:4aeE/46J6hb2XtpD2ub7A2Vri730697n
MD5 SHA1 SHA512 SSDEEP

Submit Download

Njcpee32.exe

Path C:\Windows\SysWOW64\Njcpee32.exe
Size 270KB
SHA256 d426c8c075bcc8a61dfd11bc0c4fde469c2156a48c37623872d14a0a35eed092
MD5 ff02d754f8a8ee993dbcc144965d5a7f
SHA1 14d54ee96630c777d184126ef5e549a21c51763f
SHA512 e1c3399fd847feb1b9ed5bac4ccc433efa30d7f608f4e10aa5ac590624e9d96687bf836622bdc6e0c01a98f6f8d9bb5ea3c2fcd5fb919a152fc30844b9fbb7bf
SSDEEP 6144:uGTs6rCI6hRNjpck4MetpS+f2uXLO+AGb+oPri2O3py69mNoRqzO5MnNYx:k6rv6hb2XtpD2ub7A2Vri730697qy5oA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Njogjfoj.exe

Path C:\Windows\SysWOW64\Njogjfoj.exe
Size 270KB
SHA256 039e81a18de8d7a85c7116916f20a7059f53dca50d378b4d1fe28c956980090c
MD5 11dd51a2da0b4eca598152dd1fb0b078
SHA1 3580a539e4874e3cd4a7f737ffa888d5d72b93bd
SHA512 2449ebca2cdb307ac93e216223b6136e82a49701323f97d4140f9680bdd1832085fdfb9614ffc8354409cc460e06da4505552801284931c135953c2528999a0c
SSDEEP 6144:8i+6hRNjpck4MetpS+f2uXLO+AGb+oPri2O3py69mNoRqzO5MnNYx:8h6hb2XtpD2ub7A2Vri730697qy5oNK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nkcmohbg.exe

Path C:\Windows\SysWOW64\Nkcmohbg.exe
Size 270KB
SHA256 13cd852e8f07c24dce123ab86cddbfc7382adb9b93df718f2f4564a6d61a55db
MD5 0422b56fb9f3d2f920c62487af5b0c3d
SHA1 fc5f7414d4b5dae3b1a1bee69a5627dae4a27c70
SHA512 ff0e449b31b429ac1ab564d8dd43d2492cc03e11518440c087d43729a698a4a9bc58f0627d31d3cba75e69318ee9b6664e983ad95003c159dfeee558cca9537b
SSDEEP 6144:IIvh3k6hRNjpck4MetpS+f2uXLO+AGb+oPri2O3py69mNoRqzO5MnNYx:IIpU6hb2XtpD2ub7A2Vri730697qy5oA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nnhfee32.exe

Path C:\Windows\SysWOW64\Nnhfee32.exe
Size 270KB
SHA256 64e39e2784460360118ff57d1932901406b9becd9c71a96b3f4390d0960264ae
MD5 719cb436f3f296acffed25be1335e074
SHA1 88a7b8e75b4a91a103cf70ab758a06cb6ecdfd35
SHA512 669db25cddedd9d84184a8c1370df8604973c3687da9f5f87217ae59ba1ba85ea25a348e4f7eccf7b5da724ab3478a2a5c20abe87b1aad1999632be16760fe34
SSDEEP 6144:MEFJ2WId6hRNjpck4MetpS+f2uXLO+AGb+oPri2O3py69mNoRqzO5MnNYx:MEFa6hb2XtpD2ub7A2Vri730697qy5oA
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/652-7-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/652-161-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/752-24-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/752-159-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/912-71-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/912-153-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1112-48-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1112-156-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1328-148-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1328-119-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1460-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1460-162-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1484-32-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1484-158-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1644-64-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1644-154-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1688-149-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1688-104-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2144-128-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2144-147-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2180-152-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2180-79-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2636-39-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2636-157-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3104-100-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3192-15-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3192-160-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3740-150-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3740-112-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4428-155-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4428-56-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4612-136-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4612-146-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4908-144-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4908-145-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4968-151-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4968-87-0x0000000000400000-0x0000000000434000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads