c49409c96322ab14978883bc3062e02164386ad23ccddb0bc9f0dfe6231c6355

Analysis

max time kernel
143s
max time network
108s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 03:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d9a8872bfd7d5b64c77540c88dbd98c0_NEIKI.exe
Size 768KB
Sample240509-dmtfgafb7y
SHA256 c49409c96322ab14978883bc3062e02164386ad23ccddb0bc9f0dfe6231c6355
MD5 d9a8872bfd7d5b64c77540c88dbd98c0
SHA1 6bb5d63e94b4abcba4ab1cfb8dd2504e882b9e9d
SHA512 e0b69837409eb177ea5330e6aaeb9b913c9eff057ee2a6e462782bbd9b6147794c6b86addeb5d566c45bbac50e7388f8e04b881f182cbc611c7a99780647cc6b
SSDEEP 12288:IMCiv36IveDVqvQ6IvYvc6IveDVqvQ6IvBaSHaMaZRBEYyqmaf2qwiHPKgRC4gvO:IXGq5h3q5htaSHFaZRBEYyqmaf2qwiHP
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

backdoor dropper persistence trojan

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nkjjij32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njogjfoj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnjbke32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lklnhlfb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgekbljc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mncmjfmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mkgmcjld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ndbnboqb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nddkgonp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ngcgcjnc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncihikcg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldaeka32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdiklqhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mncmjfmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nnhfee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njacpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ngedij32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndidbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mkbchk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdkhapfj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngpjnkpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njogjfoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nnjbke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ncihikcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njcpee32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnolfdcn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkbchk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mdkhapfj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpdelajl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mpdelajl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngedij32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	d9a8872bfd7d5b64c77540c88dbd98c0_NEIKI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mdiklqhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mcbahlip.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngcgcjnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mjqjih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mjjmog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nacbfdao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ngpjnkpf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqklmpdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nggqoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mnapdf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mcpebmkb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcbahlip.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nkjjij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lgneampk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nbhkac32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nbkhfc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgneampk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkgmcjld.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nafokcol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nnolfdcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Maaepd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nddkgonp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njacpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nbkhfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ldaeka32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndbnboqb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncgkcl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nggqoj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnapdf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcpebmkb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjjmog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ndidbn32.exe

Malware Dropper & Backdoor - Berbew 32 IoCs

Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.

backdoor trojan dropper

resource	yara_rule
behavioral2/files/0x000b000000023385-7.dat	family_berbew
behavioral2/files/0x0007000000023428-15.dat	family_berbew
behavioral2/files/0x000700000002342a-23.dat	family_berbew
behavioral2/files/0x000700000002342d-32.dat	family_berbew
behavioral2/files/0x000700000002342f-39.dat	family_berbew
behavioral2/files/0x0007000000023431-47.dat	family_berbew
behavioral2/files/0x0007000000023433-56.dat	family_berbew
behavioral2/files/0x0007000000023435-64.dat	family_berbew
behavioral2/files/0x0007000000023437-72.dat	family_berbew
behavioral2/files/0x0007000000023439-79.dat	family_berbew
behavioral2/files/0x000700000002343b-87.dat	family_berbew
behavioral2/files/0x000700000002343d-96.dat	family_berbew
behavioral2/files/0x0007000000023441-109.dat	family_berbew
behavioral2/files/0x0007000000023447-131.dat	family_berbew
behavioral2/files/0x0007000000023449-138.dat	family_berbew
behavioral2/files/0x000700000002344f-159.dat	family_berbew
behavioral2/files/0x0007000000023453-173.dat	family_berbew
behavioral2/files/0x0007000000023457-187.dat	family_berbew
behavioral2/files/0x0007000000023465-236.dat	family_berbew
behavioral2/files/0x0007000000023463-229.dat	family_berbew
behavioral2/files/0x0007000000023461-222.dat	family_berbew
behavioral2/files/0x000700000002345f-215.dat	family_berbew
behavioral2/files/0x000700000002345d-208.dat	family_berbew
behavioral2/files/0x000700000002345b-201.dat	family_berbew
behavioral2/files/0x0007000000023459-194.dat	family_berbew
behavioral2/files/0x0007000000023455-180.dat	family_berbew
behavioral2/files/0x0007000000023451-166.dat	family_berbew
behavioral2/files/0x000700000002344d-152.dat	family_berbew
behavioral2/files/0x000700000002344b-145.dat	family_berbew
behavioral2/files/0x0007000000023445-124.dat	family_berbew
behavioral2/files/0x0007000000023443-117.dat	family_berbew
behavioral2/files/0x000700000002343f-103.dat	family_berbew

Executes dropped EXE 38 IoCs

pid	Process
2420	Lgneampk.exe
1364	Ldaeka32.exe
3164	Lklnhlfb.exe
1760	Mjqjih32.exe
2108	Mgekbljc.exe
2320	Mdiklqhm.exe
2744	Mkbchk32.exe
448	Mnapdf32.exe
5064	Mdkhapfj.exe
4584	Mncmjfmk.exe
4040	Mcpebmkb.exe
1880	Mkgmcjld.exe
732	Mjjmog32.exe
668	Maaepd32.exe
3740	Mpdelajl.exe
3468	Mcbahlip.exe
5008	Nkjjij32.exe
944	Nnhfee32.exe
3864	Nacbfdao.exe
4960	Ndbnboqb.exe
1720	Ngpjnkpf.exe
3536	Njogjfoj.exe
1992	Nnjbke32.exe
2120	Nafokcol.exe
4752	Nddkgonp.exe
4340	Ncgkcl32.exe
2228	Ngcgcjnc.exe
4592	Njacpf32.exe
3256	Nbhkac32.exe
2536	Nqklmpdd.exe
1500	Ncihikcg.exe
2104	Ngedij32.exe
224	Njcpee32.exe
4048	Nnolfdcn.exe
4268	Nbkhfc32.exe
1132	Ndidbn32.exe
2860	Nggqoj32.exe
4212	Nkcmohbg.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Nacbfdao.exe	Nnhfee32.exe
File created	C:\Windows\SysWOW64\Nddkgonp.exe	Nafokcol.exe
File created	C:\Windows\SysWOW64\Pkckjila.dll	Nqklmpdd.exe
File created	C:\Windows\SysWOW64\Njogjfoj.exe	Ngpjnkpf.exe
File created	C:\Windows\SysWOW64\Pipfna32.dll	Nddkgonp.exe
File created	C:\Windows\SysWOW64\Opbnic32.dll	Nbkhfc32.exe
File opened for modification	C:\Windows\SysWOW64\Nddkgonp.exe	Nafokcol.exe
File created	C:\Windows\SysWOW64\Nqklmpdd.exe	Nbhkac32.exe
File created	C:\Windows\SysWOW64\Lklnhlfb.exe	Ldaeka32.exe
File opened for modification	C:\Windows\SysWOW64\Mdkhapfj.exe	Mnapdf32.exe
File created	C:\Windows\SysWOW64\Dihcoe32.dll	Nacbfdao.exe
File created	C:\Windows\SysWOW64\Njcpee32.exe	Ngedij32.exe
File created	C:\Windows\SysWOW64\Ldaeka32.exe	Lgneampk.exe
File created	C:\Windows\SysWOW64\Mncmjfmk.exe	Mdkhapfj.exe
File opened for modification	C:\Windows\SysWOW64\Mncmjfmk.exe	Mdkhapfj.exe
File created	C:\Windows\SysWOW64\Lkfbjdpq.dll	Nnolfdcn.exe
File created	C:\Windows\SysWOW64\Nnolfdcn.exe	Njcpee32.exe
File opened for modification	C:\Windows\SysWOW64\Lklnhlfb.exe	Ldaeka32.exe
File opened for modification	C:\Windows\SysWOW64\Mgekbljc.exe	Mjqjih32.exe
File created	C:\Windows\SysWOW64\Kpdobeck.dll	Mjqjih32.exe
File created	C:\Windows\SysWOW64\Njcqqgjb.dll	Mnapdf32.exe
File created	C:\Windows\SysWOW64\Lfcbokki.dll	Ngpjnkpf.exe
File created	C:\Windows\SysWOW64\Bheenp32.dll	Ldaeka32.exe
File created	C:\Windows\SysWOW64\Nbkhfc32.exe	Nnolfdcn.exe
File created	C:\Windows\SysWOW64\Mkbchk32.exe	Mdiklqhm.exe
File created	C:\Windows\SysWOW64\Ngpjnkpf.exe	Ndbnboqb.exe
File created	C:\Windows\SysWOW64\Njacpf32.exe	Ngcgcjnc.exe
File created	C:\Windows\SysWOW64\Lmbnpm32.dll	Ngcgcjnc.exe
File opened for modification	C:\Windows\SysWOW64\Njcpee32.exe	Ngedij32.exe
File created	C:\Windows\SysWOW64\Addjcmqn.dll	Ndidbn32.exe
File created	C:\Windows\SysWOW64\Mpdelajl.exe	Maaepd32.exe
File opened for modification	C:\Windows\SysWOW64\Njogjfoj.exe	Ngpjnkpf.exe
File created	C:\Windows\SysWOW64\Jlnpomfk.dll	Nafokcol.exe
File opened for modification	C:\Windows\SysWOW64\Ncgkcl32.exe	Nddkgonp.exe
File opened for modification	C:\Windows\SysWOW64\Ngcgcjnc.exe	Ncgkcl32.exe
File opened for modification	C:\Windows\SysWOW64\Nbhkac32.exe	Njacpf32.exe
File opened for modification	C:\Windows\SysWOW64\Ncihikcg.exe	Nqklmpdd.exe
File created	C:\Windows\SysWOW64\Ddpfgd32.dll	Ngedij32.exe
File created	C:\Windows\SysWOW64\Mgekbljc.exe	Mjqjih32.exe
File created	C:\Windows\SysWOW64\Gqffnmfa.dll	Mdiklqhm.exe
File created	C:\Windows\SysWOW64\Nafokcol.exe	Nnjbke32.exe
File opened for modification	C:\Windows\SysWOW64\Nnhfee32.exe	Nkjjij32.exe
File created	C:\Windows\SysWOW64\Jcoegc32.dll	Nnjbke32.exe
File created	C:\Windows\SysWOW64\Ljfemn32.dll	Nbhkac32.exe
File created	C:\Windows\SysWOW64\Lgneampk.exe	d9a8872bfd7d5b64c77540c88dbd98c0_NEIKI.exe
File created	C:\Windows\SysWOW64\Mkgmcjld.exe	Mcpebmkb.exe
File opened for modification	C:\Windows\SysWOW64\Mcbahlip.exe	Mpdelajl.exe
File created	C:\Windows\SysWOW64\Mdkhapfj.exe	Mnapdf32.exe
File opened for modification	C:\Windows\SysWOW64\Ndbnboqb.exe	Nacbfdao.exe
File created	C:\Windows\SysWOW64\Majknlkd.dll	Ncgkcl32.exe
File created	C:\Windows\SysWOW64\Mdiklqhm.exe	Mgekbljc.exe
File created	C:\Windows\SysWOW64\Egqcbapl.dll	Mcbahlip.exe
File created	C:\Windows\SysWOW64\Ipkobd32.dll	Njacpf32.exe
File opened for modification	C:\Windows\SysWOW64\Ndidbn32.exe	Nbkhfc32.exe
File created	C:\Windows\SysWOW64\Mjqjih32.exe	Lklnhlfb.exe
File created	C:\Windows\SysWOW64\Hhapkbgi.dll	Mncmjfmk.exe
File created	C:\Windows\SysWOW64\Bebboiqi.dll	Mjjmog32.exe
File opened for modification	C:\Windows\SysWOW64\Nggqoj32.exe	Ndidbn32.exe
File opened for modification	C:\Windows\SysWOW64\Mdiklqhm.exe	Mgekbljc.exe
File opened for modification	C:\Windows\SysWOW64\Ngpjnkpf.exe	Ndbnboqb.exe
File created	C:\Windows\SysWOW64\Ncihikcg.exe	Nqklmpdd.exe
File created	C:\Windows\SysWOW64\Ngedij32.exe	Ncihikcg.exe
File created	C:\Windows\SysWOW64\Paadnmaq.dll	Ncihikcg.exe
File created	C:\Windows\SysWOW64\Cknpkhch.dll	Njcpee32.exe

Program crash 1 IoCs

pid	pid_target	Process
4288	4212	WerFault.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lgneampk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ockcknah.dll"	Mgekbljc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mjjmog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcoegc32.dll"	Nnjbke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnibdpde.dll"	Nggqoj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ndidbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bheenp32.dll"	Ldaeka32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mkbchk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gbbkdl32.dll"	Maaepd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ngpjnkpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Njogjfoj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Njcpee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	d9a8872bfd7d5b64c77540c88dbd98c0_NEIKI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ngpjnkpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pipfna32.dll"	Nddkgonp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mpdelajl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nkjjij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ndbnboqb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlnpomfk.dll"	Nafokcol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Addjcmqn.dll"	Ndidbn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ldaeka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mcbahlip.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nddkgonp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cknpkhch.dll"	Njcpee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mpdelajl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdgdjjem.dll"	Mkbchk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mcbahlip.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nafokcol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nnolfdcn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nnjbke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Majknlkd.dll"	Ncgkcl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ngcgcjnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kpdobeck.dll"	Mjqjih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mcpebmkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dihcoe32.dll"	Nacbfdao.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nbhkac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nbhkac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nggqoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lmbnpm32.dll"	Ngcgcjnc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ngedij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Egqcbapl.dll"	Mcbahlip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Legdcg32.dll"	Nnhfee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mlhblb32.dll"	Ndbnboqb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gqffnmfa.dll"	Mdiklqhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nnhfee32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Njacpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ckegia32.dll"	Lgneampk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mjjmog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Paadnmaq.dll"	Ncihikcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ddpfgd32.dll"	Ngedij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bebboiqi.dll"	Mjjmog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lkfbjdpq.dll"	Nnolfdcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Njcqqgjb.dll"	Mnapdf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nacbfdao.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Njogjfoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hhapkbgi.dll"	Mncmjfmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekipni32.dll"	Mcpebmkb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Maaepd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlmobp32.dll"	Nkjjij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ljfemn32.dll"	Nbhkac32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nnolfdcn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	d9a8872bfd7d5b64c77540c88dbd98c0_NEIKI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lppbjjia.dll"	Lklnhlfb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Geegicjl.dll"	Mkgmcjld.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3588 wrote to memory of 2420	3588	d9a8872bfd7d5b64c77540c88dbd98c0_NEIKI.exe	83
PID 3588 wrote to memory of 2420	3588	d9a8872bfd7d5b64c77540c88dbd98c0_NEIKI.exe	83
PID 3588 wrote to memory of 2420	3588	d9a8872bfd7d5b64c77540c88dbd98c0_NEIKI.exe	83
PID 2420 wrote to memory of 1364	2420	Lgneampk.exe	84
PID 2420 wrote to memory of 1364	2420	Lgneampk.exe	84
PID 2420 wrote to memory of 1364	2420	Lgneampk.exe	84
PID 1364 wrote to memory of 3164	1364	Ldaeka32.exe	85
PID 1364 wrote to memory of 3164	1364	Ldaeka32.exe	85
PID 1364 wrote to memory of 3164	1364	Ldaeka32.exe	85
PID 3164 wrote to memory of 1760	3164	Lklnhlfb.exe	86
PID 3164 wrote to memory of 1760	3164	Lklnhlfb.exe	86
PID 3164 wrote to memory of 1760	3164	Lklnhlfb.exe	86
PID 1760 wrote to memory of 2108	1760	Mjqjih32.exe	87
PID 1760 wrote to memory of 2108	1760	Mjqjih32.exe	87
PID 1760 wrote to memory of 2108	1760	Mjqjih32.exe	87
PID 2108 wrote to memory of 2320	2108	Mgekbljc.exe	88
PID 2108 wrote to memory of 2320	2108	Mgekbljc.exe	88
PID 2108 wrote to memory of 2320	2108	Mgekbljc.exe	88
PID 2320 wrote to memory of 2744	2320	Mdiklqhm.exe	89
PID 2320 wrote to memory of 2744	2320	Mdiklqhm.exe	89
PID 2320 wrote to memory of 2744	2320	Mdiklqhm.exe	89
PID 2744 wrote to memory of 448	2744	Mkbchk32.exe	90
PID 2744 wrote to memory of 448	2744	Mkbchk32.exe	90
PID 2744 wrote to memory of 448	2744	Mkbchk32.exe	90
PID 448 wrote to memory of 5064	448	Mnapdf32.exe	91
PID 448 wrote to memory of 5064	448	Mnapdf32.exe	91
PID 448 wrote to memory of 5064	448	Mnapdf32.exe	91
PID 5064 wrote to memory of 4584	5064	Mdkhapfj.exe	92
PID 5064 wrote to memory of 4584	5064	Mdkhapfj.exe	92
PID 5064 wrote to memory of 4584	5064	Mdkhapfj.exe	92
PID 4584 wrote to memory of 4040	4584	Mncmjfmk.exe	94
PID 4584 wrote to memory of 4040	4584	Mncmjfmk.exe	94
PID 4584 wrote to memory of 4040	4584	Mncmjfmk.exe	94
PID 4040 wrote to memory of 1880	4040	Mcpebmkb.exe	95
PID 4040 wrote to memory of 1880	4040	Mcpebmkb.exe	95
PID 4040 wrote to memory of 1880	4040	Mcpebmkb.exe	95
PID 1880 wrote to memory of 732	1880	Mkgmcjld.exe	96
PID 1880 wrote to memory of 732	1880	Mkgmcjld.exe	96
PID 1880 wrote to memory of 732	1880	Mkgmcjld.exe	96
PID 732 wrote to memory of 668	732	Mjjmog32.exe	97
PID 732 wrote to memory of 668	732	Mjjmog32.exe	97
PID 732 wrote to memory of 668	732	Mjjmog32.exe	97
PID 668 wrote to memory of 3740	668	Maaepd32.exe	98
PID 668 wrote to memory of 3740	668	Maaepd32.exe	98
PID 668 wrote to memory of 3740	668	Maaepd32.exe	98
PID 3740 wrote to memory of 3468	3740	Mpdelajl.exe	99
PID 3740 wrote to memory of 3468	3740	Mpdelajl.exe	99
PID 3740 wrote to memory of 3468	3740	Mpdelajl.exe	99
PID 3468 wrote to memory of 5008	3468	Mcbahlip.exe	100
PID 3468 wrote to memory of 5008	3468	Mcbahlip.exe	100
PID 3468 wrote to memory of 5008	3468	Mcbahlip.exe	100
PID 5008 wrote to memory of 944	5008	Nkjjij32.exe	101
PID 5008 wrote to memory of 944	5008	Nkjjij32.exe	101
PID 5008 wrote to memory of 944	5008	Nkjjij32.exe	101
PID 944 wrote to memory of 3864	944	Nnhfee32.exe	102
PID 944 wrote to memory of 3864	944	Nnhfee32.exe	102
PID 944 wrote to memory of 3864	944	Nnhfee32.exe	102
PID 3864 wrote to memory of 4960	3864	Nacbfdao.exe	103
PID 3864 wrote to memory of 4960	3864	Nacbfdao.exe	103
PID 3864 wrote to memory of 4960	3864	Nacbfdao.exe	103
PID 4960 wrote to memory of 1720	4960	Ndbnboqb.exe	104
PID 4960 wrote to memory of 1720	4960	Ndbnboqb.exe	104
PID 4960 wrote to memory of 1720	4960	Ndbnboqb.exe	104
PID 1720 wrote to memory of 3536	1720	Ngpjnkpf.exe	105

C:\Users\Admin\AppData\Local\Temp\d9a8872bfd7d5b64c77540c88dbd98c0_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\d9a8872bfd7d5b64c77540c88dbd98c0_NEIKI.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3588
- C:\Windows\SysWOW64\Lgneampk.exe
  C:\Windows\system32\Lgneampk.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2420
- - C:\Windows\SysWOW64\Ldaeka32.exe
    C:\Windows\system32\Ldaeka32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1364
  - - C:\Windows\SysWOW64\Lklnhlfb.exe
      C:\Windows\system32\Lklnhlfb.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3164
    - - C:\Windows\SysWOW64\Mjqjih32.exe
        
        C:\Windows\system32\Mjqjih32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1760
      - C:\Windows\SysWOW64\Mgekbljc.exe
        
        C:\Windows\system32\Mgekbljc.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2108
        
        C:\Windows\SysWOW64\Mdiklqhm.exe
        
        C:\Windows\system32\Mdiklqhm.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2320
        
        C:\Windows\SysWOW64\Mkbchk32.exe
        
        C:\Windows\system32\Mkbchk32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2744
        
        C:\Windows\SysWOW64\Mnapdf32.exe
        
        C:\Windows\system32\Mnapdf32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:448
        
        C:\Windows\SysWOW64\Mdkhapfj.exe
        
        C:\Windows\system32\Mdkhapfj.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5064
        
        C:\Windows\SysWOW64\Mncmjfmk.exe
        
        C:\Windows\system32\Mncmjfmk.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4584
        
        C:\Windows\SysWOW64\Mcpebmkb.exe
        
        C:\Windows\system32\Mcpebmkb.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4040
        
        C:\Windows\SysWOW64\Mkgmcjld.exe
        
        C:\Windows\system32\Mkgmcjld.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1880
        
        C:\Windows\SysWOW64\Mjjmog32.exe
        
        C:\Windows\system32\Mjjmog32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:732
        
        C:\Windows\SysWOW64\Maaepd32.exe
        
        C:\Windows\system32\Maaepd32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:668
        
        C:\Windows\SysWOW64\Mpdelajl.exe
        
        C:\Windows\system32\Mpdelajl.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3740
        
        C:\Windows\SysWOW64\Mcbahlip.exe
        
        C:\Windows\system32\Mcbahlip.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3468
        
        C:\Windows\SysWOW64\Nkjjij32.exe
        
        C:\Windows\system32\Nkjjij32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5008
        
        C:\Windows\SysWOW64\Nnhfee32.exe
        
        C:\Windows\system32\Nnhfee32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:944
        
        C:\Windows\SysWOW64\Nacbfdao.exe
        
        C:\Windows\system32\Nacbfdao.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3864
        
        C:\Windows\SysWOW64\Ndbnboqb.exe
        
        C:\Windows\system32\Ndbnboqb.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4960
        
        C:\Windows\SysWOW64\Ngpjnkpf.exe
        
        C:\Windows\system32\Ngpjnkpf.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1720
        
        C:\Windows\SysWOW64\Njogjfoj.exe
        
        C:\Windows\system32\Njogjfoj.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3536
        
        C:\Windows\SysWOW64\Nnjbke32.exe
        
        C:\Windows\system32\Nnjbke32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1992
        
        C:\Windows\SysWOW64\Nafokcol.exe
        
        C:\Windows\system32\Nafokcol.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2120
        
        C:\Windows\SysWOW64\Nddkgonp.exe
        
        C:\Windows\system32\Nddkgonp.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4752
        
        C:\Windows\SysWOW64\Ncgkcl32.exe
        
        C:\Windows\system32\Ncgkcl32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4340
        
        C:\Windows\SysWOW64\Ngcgcjnc.exe
        
        C:\Windows\system32\Ngcgcjnc.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2228
        
        C:\Windows\SysWOW64\Njacpf32.exe
        
        C:\Windows\system32\Njacpf32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4592
        
        C:\Windows\SysWOW64\Nbhkac32.exe
        
        C:\Windows\system32\Nbhkac32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3256
        
        C:\Windows\SysWOW64\Nqklmpdd.exe
        
        C:\Windows\system32\Nqklmpdd.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2536
        
        C:\Windows\SysWOW64\Ncihikcg.exe
        
        C:\Windows\system32\Ncihikcg.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1500
        
        C:\Windows\SysWOW64\Ngedij32.exe
        
        C:\Windows\system32\Ngedij32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2104
        
        C:\Windows\SysWOW64\Njcpee32.exe
        
        C:\Windows\system32\Njcpee32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:224
        
        C:\Windows\SysWOW64\Nnolfdcn.exe
        
        C:\Windows\system32\Nnolfdcn.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4048
        
        C:\Windows\SysWOW64\Nbkhfc32.exe
        
        C:\Windows\system32\Nbkhfc32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4268
        
        C:\Windows\SysWOW64\Ndidbn32.exe
        
        C:\Windows\system32\Ndidbn32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1132
        
        C:\Windows\SysWOW64\Nggqoj32.exe
        
        C:\Windows\system32\Nggqoj32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2860
        
        C:\Windows\SysWOW64\Nkcmohbg.exe
        
        C:\Windows\system32\Nkcmohbg.exe
        39⤵
        Executes dropped EXE
        
        PID:4212
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4212 -s 400
        40⤵
        Program crash
        
        PID:4288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4212 -ip 4212
1⤵
PID:4784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Ldaeka32.exe

Path C:\Windows\SysWOW64\Ldaeka32.exe
Size 768KB
SHA256 ddb36630e017068515204c9876243d2ea209d3694fd553ecf8bbdf2419b24cf1
MD5 e6f56fcc11eb5f6147b019531556ea5d
SHA1 f355bcbb67890f2d5958778619f88fefe37d22b7
SHA512 2cc2da4b2c5269c8e71172be716236c2c0faacc67cfd15d645e5f89e2026ad16789003b45b1c55d39d1bddf0664181c74b54e77ab47d693eb1ed09ce50a19f7c
SSDEEP 12288:8rcAv16IveDVqvQ6IvYvc6IveDVqvQ6IvBaSHaMaZRBEYyqmaf2qwiHPKgRC4gvO:8rcaq5h3q5htaSHFaZRBEYyqmaf2qwiv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lgneampk.exe

Path C:\Windows\SysWOW64\Lgneampk.exe
Size 768KB
SHA256 f76bd4341aae5fba773fd78091179421652d3a155124adadc056e7d207b29310
MD5 84639fd1fd86f73b3727a60eeb27d2d5
SHA1 f3b668caea6c3f2a7a44b71b28b7b14de9094518
SHA512 47ef9bf77221e3bb3e16b5981c057ea509e0a84eda3ff8b5fea1833b10a6f22108ee5ce951ccec40e908b30c9978b0b4d65126c385e1f839528730c16d2fb861
SSDEEP 12288:bqStKvp6IveDVqvQ6IvYvc6IveDVqvQ6IvBaSHaMaZRBEYyqmaf2qwiHPKgRC4g2:bqxq5h3q5htaSHFaZRBEYyqmaf2qwiHP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lklnhlfb.exe

Path C:\Windows\SysWOW64\Lklnhlfb.exe
Size 768KB
SHA256 e33869a6eae0fe8f9db036c290d9a1d5b622afe39ba3851dd6c183b23c06444a
MD5 fde13c669ed7c5188c5bbb90a0578239
SHA1 e088a4fdda984956d7154245683d07f9b96acd36
SHA512 80612f08e3301876a9a77ea0532fc8a22b7a7bab72373cc9267fd80699b2feeb3b778b8a26b55e7fe27a53e8e2e575df7bf14eacfa8f6285a09a7c4b386da108
SSDEEP 12288:TYOGkvR6IveDVqvQ6IvYvc6IveDVqvQ6IvBaSHaMaZRBEYyqmaf2qwiHPKgRC4g2:DGiq5h3q5htaSHFaZRBEYyqmaf2qwiHP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Maaepd32.exe

Path C:\Windows\SysWOW64\Maaepd32.exe
Size 768KB
SHA256 83acca12db880fe7bb0c0b673c657961264b171d540e749d1eca9a80f8d5d168
MD5 abc6ec6a54a6795592456c4712088d3d
SHA1 7eee99725271498744e18778b0aac46917268eae
SHA512 90de0e383f172e92d45a145c475621fcfb2ad5d8257f929df0ff21660a56fa0b6f70acad26625a9bce5766304c1a79205edaca7e3b1b7a6cca41f815f9fb9e18
SSDEEP 12288:lfjvR6IveDVqvQ6IvYvc6IveDVqvQ6IvBaSHaMaZRBEYyqmaf2qwiHPKgRC4gvGJ:pdq5h3q5htaSHFaZRBEYyqmaf2qwiHPX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mcbahlip.exe

Path C:\Windows\SysWOW64\Mcbahlip.exe
Size 768KB
SHA256 1c71d3eae215e45b07c6450e75076998eb645b38f3091db0cf6060eb9bb03217
MD5 2ce8d697e287e25be2ae6ee8c82936ca
SHA1 e6901671917ae4c9bf4c25dd2fc8d1150be85c7a
SHA512 60509d99905a2f03f24aedefefc0a04dfaabfbd8ffe4a0e31cfedfeb5ce070c1a14f17e8681c431b8025c1d4beaee6bfe3040568ae3f7de77295f2ab15f2714b
SSDEEP 12288:ndvM6IveDVqvQ6IvYvc6IveDVqvQ6IvBaSHaMaZRBEYyqmaf2qwiHPKgRC4gvGZX:Wq5h3q5htaSHFaZRBEYyqmaf2qwiHPKu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mcpebmkb.exe

Path C:\Windows\SysWOW64\Mcpebmkb.exe
Size 768KB
SHA256 bad9b8ddecf588e3e7f7fc6bc52d28c41789bb6bfdac2c0b004221101e47a1f8
MD5 c8312c135a29009c4d59ccc0a7bad63d
SHA1 3005756ddbdb8d34c163e2ee045bde565b72056f
SHA512 492d6e11ff5bbb1bc901744daca8cd6045409d56fca99a9bd60a8fe7f9e67b5054f52421cde4d52bf43f906013050f4247542710627046cd773c82bd09b102b0
SSDEEP 12288:r/vd6IveDVqvQ6IvYvc6IveDVqvQ6IvBaSHaMaZRBEYyqmaf2qwiHPKgRC4gvGZX:rdq5h3q5htaSHFaZRBEYyqmaf2qwiHPX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mdiklqhm.exe

Path C:\Windows\SysWOW64\Mdiklqhm.exe
Size 768KB
SHA256 1cac0ad31c67d1a9f6db3e765a40606a42208ef57861feb42f46389deb53d8f2
MD5 adb89cd72cccae55fa8481c2494cddaa
SHA1 c170200cf75da83fd3f86fc9200f94454a3a5b50
SHA512 126d196a66b6d82796d012bac6e5cb6e2f07bef465303d43a777437b8c6da829cb1f856760463bde7616f9cf96a43dc23cef9bff53d56f4fe4e83c31a52f6bfb
SSDEEP 12288:zG2uxkkvP6IveDVqvQ6IvYvc6IveDVqvQ6IvBaSHaMaZRBEYyqmaf2qwiHPKgRCW:SDxZq5h3q5htaSHFaZRBEYyqmaf2qwiv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mdkhapfj.exe

Path C:\Windows\SysWOW64\Mdkhapfj.exe
Size 768KB
SHA256 79e3b30f1e91809927bda9fdd2a4ac5c35d10d9bf360080d0ce9aeaf72215ade
MD5 0591c67a74738900a54e7fd3f2555183
SHA1 cc3083995090e9df6ed88e4be5703a0aaa36e054
SHA512 2ea1ea39ac6a1a0e6cdfc80d8ee542276781580656c7d512a6426c0f104148a78c36a45a9be5c831f00fe6d6cb30cf168842f827cf52a2f21610db4070abd1cd
SSDEEP 12288:xNzcWvd6IveDVqvQ6IvYvc6IveDVqvQ6IvBaSHaMaZRBEYyqmaf2qwiHPKgRC4g2:xJRq5h3q5htaSHFaZRBEYyqmaf2qwiHP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mgekbljc.exe

Path C:\Windows\SysWOW64\Mgekbljc.exe
Size 768KB
SHA256 eea28b58da563ebd8d424f076bf01952aa5f31451e3cd43f08017fabc4e593b6
MD5 c61cb914472460de655970aac44000e5
SHA1 2a5efedda4782e5b5e1899fd43e68d21a1d8694b
SHA512 e04c8e92c7cc6e78c73c2d09251558b254969cb702160a9d196052faef319ca8f7e1e49e2593373a84fe56eb5f7cae125a07c46ec4b3b3c45b34b1a30b33599b
SSDEEP 12288:xBFAvw6IveDVqvQ6IvYvc6IveDVqvQ6IvBaSHaMaZRBEYyqmaf2qwiHPKgRC4gvO:xjbq5h3q5htaSHFaZRBEYyqmaf2qwiHP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mjjmog32.exe

Path C:\Windows\SysWOW64\Mjjmog32.exe
Size 768KB
SHA256 b1b0f82a20f0cf9e121cfa8ed9c56c79a6f192ef6a4032b3199d1a150516837c
MD5 3ea15cb410ee43ed92e9cae2a36d6b5f
SHA1 8bbe7aa5e459ad7cebee76b43c150cd132bbedde
SHA512 4d4f11a6638a4d5d48193145397b0a7ccdca3e1de58549cada5b14dc2321b7510fa37f44bf11c99e16aff8f1c0f09fb07b1527ad98735b7ea57c916f88c321e5
SSDEEP 12288:GPX3Nv06IveDVqvQ6IvYvc6IveDVqvQ6IvBaSHaMaZRBEYyqmaf2qwiHPKgRC4g2:oXCq5h3q5htaSHFaZRBEYyqmaf2qwiHP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mjqjih32.exe

Path C:\Windows\SysWOW64\Mjqjih32.exe
Size 768KB
SHA256 0487ed6865afb6f2aa02bcedf8c9dcc825e992a4de7024a8ff84dffde977b770
MD5 86170df29aeaeccce361df5e6a819a9b
SHA1 0874888d285f62c4c2933fbe5a7a9a7e7074c4fd
SHA512 3f8b30825c0104eb299843bd30805894d58390113a882fae7f6b8aa442306fdc1299dd81f91ec454469b91b61fd061d18e69bc34b2a6a0d4c1ee57657c5236d8
SSDEEP 12288:Lgxavb6IveDVqvQ6IvYvc6IveDVqvQ6IvBaSHaMaZRBEYyqmaf2qwiHPKgRC4gvO:LmWq5h3q5htaSHFaZRBEYyqmaf2qwiHP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mkbchk32.exe

Path C:\Windows\SysWOW64\Mkbchk32.exe
Size 768KB
SHA256 9a46351a49985b6fbeda6995b581c80ac112dc5bc5d1adf51026026c3fce8618
MD5 25fac1adb3a14ab14a14e344e0299186
SHA1 6d4d85f5f992ed399e80554210eb5a3b250b94a9
SHA512 0d49ed888c46b2066cf3ee2ddbe243886eb31cd053e746ccdd75122385bf643c55c9d7b90aed4e81e647da2b1835e208eccefe024bdcad51aa917872b951b863
SSDEEP 12288:aLsMv76IveDVqvQ6IvYvc6IveDVqvQ6IvBaSHaMaZRBEYyqmaf2qwiHPKgRC4gvO:o/q5h3q5htaSHFaZRBEYyqmaf2qwiHPX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mkgmcjld.exe

Path C:\Windows\SysWOW64\Mkgmcjld.exe
Size 768KB
SHA256 7140eca0010e19f3d84fce198be28d2162cc4f62a2094cc98af48e6a27f74e08
MD5 6a2fef95d287fd71535e9d0e0952acf7
SHA1 5423faab7691c9f8af3f127a48608636faee555f
SHA512 a182c85dddba5937e18a7348fbd8732dcf43d943565a9fa73bff78918c1e6d28620ddb423d90ef474dd77ebb347d9b4c75b503e516fb7304d1a366adccdf6c2a
SSDEEP 12288:RlCd9tvJ6IveDVqvQ6IvYvc6IveDVqvQ6IvBaSHaMaZRBEYyqmaf2qwiHPKgRC45:O9Lq5h3q5htaSHFaZRBEYyqmaf2qwiHP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mnapdf32.exe

Path C:\Windows\SysWOW64\Mnapdf32.exe
Size 768KB
SHA256 1a9d4cb99e2ecdcb2c70aed0a958b6f6575129131ae04033cd6910872f61dd14
MD5 abb5b3000cfc92f0a85e00c8ea9aa2fd
SHA1 11a4414797272d1d6e669c21b13c08fba865545d
SHA512 bb8a811652a1676bd3789fda3b837376f5619dd7261200effa31d0130da82dbaf9e50851dd50cc9b54685356658f5c0e106a6506a60e81f22f4acf3fabe3c8ee
SSDEEP 12288:jXmvT6IveDVqvQ6IvYvc6IveDVqvQ6IvBaSHaMaZRBEYyqmaf2qwiHPKgRC4gvGJ:7Kq5h3q5htaSHFaZRBEYyqmaf2qwiHPX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mncmjfmk.exe

Path C:\Windows\SysWOW64\Mncmjfmk.exe
Size 768KB
SHA256 e64838c2b18f9f1386df26d60bf22e082c69c1e7e588b985796c0909f4673d57
MD5 d7f5ea1259460f6e515f3db1cbf79209
SHA1 649d46afe2d727e5ad6677cf43b59e7d89383688
SHA512 a5c289d7252f2f3a8a173592c30ae74a166cc54970fb13ad57ef658fe970cba876f36a4ca65d9b41a757546be96b98cdf1804b1b949e3763f3e7d25ee82106c3
SSDEEP 12288:Bk/vU6IveDVqvQ6IvYvc6IveDVqvQ6IvBaSHaMaZRBEYyqmaf2qwiHPKgRC4gvGJ:BkUq5h3q5htaSHFaZRBEYyqmaf2qwiHP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mpdelajl.exe

Path C:\Windows\SysWOW64\Mpdelajl.exe
Size 768KB
SHA256 bb851d9f6e5f31690fb6b83fe583dafd28f252f06e0ee76d97de0ed1c7c14579
MD5 2be3e4f3ec6663679243b92ccff2a116
SHA1 2834f8d038b79347100d9e055f0d5eca006d4bdb
SHA512 61d7c4c6af3e26c8901dca6afd4c244a5b4062b6c987ada6a12430553654fed18fd3b5f672cda65c21f4bb02dfbc33ec96ec71d8988709f5b6d191392e5e2eab
SSDEEP 12288:ioP8Mv96IveDVqvQ6IvYvc6IveDVqvQ6IvBaSHaMaZRBEYyqmaf2qwiHPKgRC4g2:dU2q5h3q5htaSHFaZRBEYyqmaf2qwiHP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nacbfdao.exe

Path C:\Windows\SysWOW64\Nacbfdao.exe
Size 768KB
SHA256 73fd93f9d49c51283266750cdd5702953c9b3f71da1c60b6c12340b29319c4be
MD5 6c80300321e82c0b2124e0df7ab4026c
SHA1 66e1a24f61d4c15372a753b87cdaed02bafd89f1
SHA512 76b5c1eb47e0a768c971ab0ed079d9129dcfb8706a18b3dac510584075953cc3e1c540ddc7ee10483f6349432cfb6ad5e2ca9521c39bafaa9c79f5e10fe77f89
SSDEEP 12288:vI+vz6IveDVqvQ6IvYvc6IveDVqvQ6IvBaSHaMaZRBEYyqmaf2qwiHPKgRC4gvGJ:waq5h3q5htaSHFaZRBEYyqmaf2qwiHPX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nafokcol.exe

Path C:\Windows\SysWOW64\Nafokcol.exe
Size 768KB
SHA256 48ed774f4d37ef5a6f36ea761cc875911249a612c5a37a3b85d312c4b586326c
MD5 9fd84eabe36a69d955bfcdae28ddfc69
SHA1 facf65a6d075c11adbe9f47e68cf0e7720e8eb17
SHA512 17ad223c8604662b3a15432e92df803a48caab79c1199075925e85d6a8b6723a495d380651a5d8302e007abe6147933decea18a9db5018e5747da99a3b2c1073
SSDEEP 12288:na20veivE6IveDVqvQ6IvYvc6IveDVqvQ6IvBaSHaMaZRBEYyqmaf2qwiHPKgRCW:FXdq5h3q5htaSHFaZRBEYyqmaf2qwiHP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nbhkac32.exe

Path C:\Windows\SysWOW64\Nbhkac32.exe
Size 768KB
SHA256 ce87a27faf95c8cc4550e1f1fb93448a2ddd9c669ea74646973be3e115ae9773
MD5 5ec10eb706d68c0bcf4b6304b557827a
SHA1 2216bad878f7f0aa63a6bf80b49ab637c34e3060
SHA512 d8ee37e80336dfe2dfef43f806fea0ef00dd1b1ea54c7885574995bec2569042dcb391d0ff6d4fd7da9c334439756d982d5f6ce21740f0940ba1871d2ad093bc
SSDEEP 12288:8nYv96IveDVqvQ6IvYvc6IveDVqvQ6IvBaSHaMaZRBEYyqmaf2qwiHPKgRC4gvGJ:xq5h3q5htaSHFaZRBEYyqmaf2qwiHPKu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ncgkcl32.exe

Path C:\Windows\SysWOW64\Ncgkcl32.exe
Size 768KB
SHA256 1853bc3a1906a11e978e03a6e36ceec33776564d601f70ed442532d8efc8044e
MD5 327e3d68f82746338b245f739c964d8c
SHA1 a01b8faa564b679306398266684fbc92c0ac386d
SHA512 b19fc3ac52645aa053f9e8252d94d950820fe304b58e7f842bf3c9ca614b44596d64fc28aeb20ef8cae0e6030a06596ce0d24df5b0f57766ec7c19d7c4748cc9
SSDEEP 12288:rh7CHjvc6IveDVqvQ6IvYvc6IveDVqvQ6IvBaSHaMaZRBEYyqmaf2qwiHPKgRC45:xCgq5h3q5htaSHFaZRBEYyqmaf2qwiHP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ncihikcg.exe

Path C:\Windows\SysWOW64\Ncihikcg.exe
Size 768KB
SHA256 7a5c99d3a8fc39828fd250c90f2669cde203c48c00046f1963c8638b6378686c
MD5 d2ed704332a6a1e384411187897d6820
SHA1 0ea308acade7a9577787ac9d57433817b2ccbfdc
SHA512 623d119b9d67e18dadeecce85923fa052978907e50ad4e5cf1b358f25382f605d13d87750e154ca5d3f92d03bc90d6dd335b3f6d18dd7a5f54ef7fe903c19356
SSDEEP 12288:jaDvF6IveDVqvQ6IvYvc6IveDVqvQ6IvBaSHaMaZRBEYyqmaf2qwiHPKgRC4gvGJ:oq5h3q5htaSHFaZRBEYyqmaf2qwiHPKu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ndbnboqb.exe

Path C:\Windows\SysWOW64\Ndbnboqb.exe
Size 768KB
SHA256 69ecc270a13f83464dbad5cbbecff93e2c3fd7846947ef0954e060839525cff2
MD5 b71a213de3622250ca9ba2a3db6484d8
SHA1 73aac84d88d415d16d2c88b6801f52e80e88c253
SHA512 f4174c95e65496462f7123c70f5ef587b0e4db85be25b82025e52e9efdb0bcdf5e3fbd3f0465a554af89ee76c73a0428c0337e0207b8e146d8303b983fde966e
SSDEEP 12288:Hlxo0kCv96IveDVqvQ6IvYvc6IveDVqvQ6IvBaSHaMaZRBEYyqmaf2qwiHPKgRCW:fo0nq5h3q5htaSHFaZRBEYyqmaf2qwiv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nddkgonp.exe

Path C:\Windows\SysWOW64\Nddkgonp.exe
Size 768KB
SHA256 44ab36bd934326f170f1bfd8a13808d97fbd6e5955045f287c9e522d8c4b51d5
MD5 ac25e931f7052fbb2feac22630e3cf55
SHA1 9acf3f530c591dc9731336343c4d538cba5e51d1
SHA512 c80a18ed593c208f8c8d4834eebf2a6a5fa89488b37b175a16ef4e0fe7998df20a58341f03c24fa6be36e895bb0b7b181b5fa75a7e43311820c420da0caa5ddf
SSDEEP 12288:dnCCOvW6IveDVqvQ6IvYvc6IveDVqvQ6IvBaSHaMaZRBEYyqmaf2qwiHPKgRC4g2:dCqq5h3q5htaSHFaZRBEYyqmaf2qwiHP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ngcgcjnc.exe

Path C:\Windows\SysWOW64\Ngcgcjnc.exe
Size 768KB
SHA256 d9d6c818986f1f6ab46c1cb7d17c41ca446f30eb8089e07d8b4fdc7fed5c8e82
MD5 a2a4b622bded7d549ab800acef628e4e
SHA1 6aa2d19fac3e76226448c9ef89c5ce3010e6cd6f
SHA512 f1c282cd2af5c836718eded348cad217118cf50a750084eafdfec88fe0e1c6879c6ddf00cb29ced7ed86bebf6b699ff6c0b101a25de3b8fd3827b0e72389281a
SSDEEP 12288:Z0nt5ij0jJvi6IveDVqvQ6IvYvc6IveDVqvQ6IvBaSHaMaZRBEYyqmaf2qwiHPKu:Z0ntMjyUq5h3q5htaSHFaZRBEYyqmaff
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ngedij32.exe

Path C:\Windows\SysWOW64\Ngedij32.exe
Size 768KB
SHA256 810eb36846cf6b1529117476128143b2e67bcd0512be84c92b63e45a987fe1ee
MD5 ae3dbb7fa13a61bb23cc30c2fe83e9f7
SHA1 abdf68ea2586783ac87dab221c75b5ac01ead542
SHA512 af8dc47b6f1266e39c36ff5db2abfb1d0f89bc3e729318e7df8cf602813b0eca9b74fee12ec690fd73f75d40ec0f17da8eb4c46a15df2fc3ef44b73b84fd6669
SSDEEP 12288:hYVovp6IveDVqvQ6IvYvc6IveDVqvQ6IvBaSHaMaZRBEYyqmaf2qwiHPKgRC4gvO:hYMq5h3q5htaSHFaZRBEYyqmaf2qwiHP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ngpjnkpf.exe

Path C:\Windows\SysWOW64\Ngpjnkpf.exe
Size 768KB
SHA256 bf45b764bea1fae2a2e92eb335ea0e7332c657a88671872051dbc2881517e70a
MD5 994361684241d27fb4c69613e2b68cd3
SHA1 d6bf0c339d0d9031a040a3883f4d102563789480
SHA512 73d426bbf45c10380141ae151a62e0f5bdd5199a752745d6674b260a0a9606c462691854fdcdcfccf02b0feb60375051203a4e91d12eb1451647fe896de778f0
SSDEEP 12288:Xhs6PXvl6IveDVqvQ6IvYvc6IveDVqvQ6IvBaSHaMaZRBEYyqmaf2qwiHPKgRC45:XzNq5h3q5htaSHFaZRBEYyqmaf2qwiHP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Njacpf32.exe

Path C:\Windows\SysWOW64\Njacpf32.exe
Size 768KB
SHA256 554468dc7faa80d84f80e5266280a1617e96abf2626c0789a9ba4a772b9d663d
MD5 f16c42aad09c9986da2aab56c3bdf293
SHA1 437e80944c96ed6969834232957083375bb83548
SHA512 d5ab561f41f3f882b5b3e7710c21c277565635e5a88ca85d3f7880d8e75b462f2e0a73c77cfcdacf3ce8bc7c019323919013a4706cd0c7fc3d565c0b64b2ec51
SSDEEP 12288:HHyQfLCDIiuvk6IveDVqvQ6IvYvc6IveDVqvQ6IvBaSHaMaZRBEYyqmaf2qwiHPX:nCsiq5h3q5htaSHFaZRBEYyqmaf2qwiv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Njogjfoj.exe

Path C:\Windows\SysWOW64\Njogjfoj.exe
Size 768KB
SHA256 602a386d1d4057db148b55af6133288ab077febeb3269997804bfe9aac23df51
MD5 ac791bff041af1e0d9e3c37c2b8a85eb
SHA1 48af383b9f9d9f82d5a38ce59162a935dd059d74
SHA512 afa57013c0f97ac5598afaa237e8a531afb1a189523b66ea88203115c73334ca79c7dd6fe557ccaee0aa39a1ba0b1a073d8af11b4eed736ba998496ae013e2f1
SSDEEP 12288:8vu0ruvK6IveDVqvQ6IvYvc6IveDVqvQ6IvBaSHaMaZRBEYyqmaf2qwiHPKgRC45:8v5q5h3q5htaSHFaZRBEYyqmaf2qwiHP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nkjjij32.exe

Path C:\Windows\SysWOW64\Nkjjij32.exe
Size 768KB
SHA256 3ed6fc84010cf66aa67ed99c1897ee7d3291ca60a841c2ba6a54400b00faab52
MD5 25fb320c6380af7fa13c9f00533298be
SHA1 9bd106106051a268db2d73386c43902dc20158c5
SHA512 f0c7c5c1ad801aa0d1ecc2fe485ca3f015413f972d2db04bed2314c27808d81488ed214f7c491cb5d9ba8fd6c057807a9829dbf75cab6ac6f26d864b7571d47c
SSDEEP 12288:Fkbxtvq6IveDVqvQ6IvYvc6IveDVqvQ6IvBaSHaMaZRBEYyqmaf2qwiHPKgRC4g2:9q5h3q5htaSHFaZRBEYyqmaf2qwiHPKu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nnhfee32.exe

Path C:\Windows\SysWOW64\Nnhfee32.exe
Size 768KB
SHA256 6611a78e31e994e62354d248b05e1a07d592c445efa7378e3173161a0a38fcea
MD5 bf187ddf72dba4f09b04d9f1bbbb981a
SHA1 d38341f4cb654dd520e4fee80dd0533cc8d7e596
SHA512 6547c01f9b0764429d5d63e7aa0f466555e2eac30c85f631eed0b38d598edf9b8c43a4c57063e9d6c6d62712349ea5b6bf7e4456511ee9f4eb49619a46f4bff4
SSDEEP 12288:2avT6IveDVqvQ6IvYvc6IveDVqvQ6IvBaSHaMaZRBEYyqmaf2qwiHPKgRC4gvGZX:2+q5h3q5htaSHFaZRBEYyqmaf2qwiHPX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nnjbke32.exe

Path C:\Windows\SysWOW64\Nnjbke32.exe
Size 768KB
SHA256 86949dd0022e55047fb54d331c8717a2809fb76085f23e90bdf0f04c83085dac
MD5 3f6a423eb06a187e88836b75af4bf5f9
SHA1 aa9067e56a8bf3e16eab0be72ace8bfd296a2aa9
SHA512 8f07f049f9a1f3e1d9534aa6c93ab7bc92e568f40a343c63da5c8926a7e0a4a293e84eb8b87fc4472c07da7cf3822b072fb676afab3e9d37ec1311814cbe0b86
SSDEEP 12288:gppZvN6IveDVqvQ6IvYvc6IveDVqvQ6IvBaSHaMaZRBEYyqmaf2qwiHPKgRC4gvO:Mnq5h3q5htaSHFaZRBEYyqmaf2qwiHPX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nqklmpdd.exe

Path C:\Windows\SysWOW64\Nqklmpdd.exe
Size 768KB
SHA256 ce1ae2669ea539de201b5bd653f461f55ba9bbbf961c4b6a3b455ec3307f2d58
MD5 56aafe2d7712a7ea334382450ad8fcd5
SHA1 a4b22b7d11d751a98af0adc07ad48596dbd21963
SHA512 a056c3a1601e38f35bbd45d5d9b2c50eebd671c1ad5b40d2a76e9e66752d4e46573fd956ea951b548ca7fe0920355d2bf738b2e949df9f4458cde8852a49fb81
SSDEEP 12288:Gvk6IveDVqvQ6IvYvc6IveDVqvQ6IvBaSHaMaZRBEYyqmaf2qwiHPKgRC4gvGZ+A:xq5h3q5htaSHFaZRBEYyqmaf2qwiHPKu
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/224-278-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/448-65-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/448-326-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/668-316-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/732-318-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/944-308-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1132-272-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1364-21-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1500-282-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1720-302-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1760-334-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1760-33-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1880-320-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1992-298-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2104-280-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2108-332-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2108-41-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2120-296-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2228-290-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2320-330-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2320-49-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2420-339-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2420-9-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2536-284-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2744-57-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2744-328-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2860-270-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3164-25-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3164-336-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3256-286-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3468-312-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3536-300-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3588-0-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3588-1-0x0000000000431000-0x0000000000432000-memory.dmp

Download

memory/3588-341-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3740-314-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3864-306-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4040-93-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4048-276-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4212-268-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4268-274-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4340-292-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4584-323-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4584-81-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4592-288-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4752-294-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4960-304-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5008-310-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5064-77-0x0000000000400000-0x0000000000433000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads