Analysis
- max time kernel
141s - max time network
158s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
09/05/2024, 04:01
Behavioral task
behavioral1
Sample
e7ffb347d16d2e603f0f3c1bbb42caf0_NEIKI.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
e7ffb347d16d2e603f0f3c1bbb42caf0_NEIKI.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target e7ffb347d16d2e603f0f3c1bbb42caf0_NEIKI.exe
- Size 143KB
- Sample240509-elfzeshf2t
- SHA256 70a53e8718f0fd6bb83f10c5692d861c435277d84e6019172f8753c9119afa0e
- MD5 e7ffb347d16d2e603f0f3c1bbb42caf0
- SHA1 9ebb83d95e64de011fb3b7269f23bfcc6c1174ca
- SHA512 1053a6c30372c6d7567923206c2085481d7473f047d89292419c4f9892ed644c721e146124bc1652233e5dd8d477f6a2dbe04b32b18323acdba3293b09a1b002
- SSDEEP 1536:biFqS16/B0Ik8cswx8haAIw5a82UQ5ziJE93isirBUBEVGBtVM2hZV03fca13y:szPsG8YArv23N93bsGfhv0vt3y
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ogpfko32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Egiohh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cediab32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dhndil32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cnokmkfh.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Blnoad32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fjfgealk.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cdebfago.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mhoind32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kbbhka32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Omdnbd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Loqjlg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fpmeimpn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kpnepk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jkcpia32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Knenffqf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Onaieifh.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Khfdlnab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fhbbmc32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cngnbfid.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kdmjmqjf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ipldpo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Liifnp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jpjqaldi.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Enlcahgh.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Obeikc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Aljefena.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Loqjlg32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mdlgmgdh.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mppdbb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ccigpbga.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Clldhljp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Elccpife.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Khhaanop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mginniij.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Olkqnjhd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dofgklcb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ehlakjig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lpapiipo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Alfcflfb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bldogjib.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cqmgigfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ekahhn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pelacg32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bpggbm32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Edaaccbj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Aidomjaf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Khhaanop.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pjahchpb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dqajjp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lnepbm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Odkaac32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bpaacblm.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cediab32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mcgbfcij.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kkabefqp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jknocljn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ifcpgiji.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kaemgn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kgbepdpf.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kpnepk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jgiiclkl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Eflhiolf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ifcpgiji.exe - Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/memory/4292-0-0x0000000000400000-0x0000000000440000-memory.dmp family_berbew behavioral2/files/0x000800000002323d-6.dat family_berbew behavioral2/memory/4500-8-0x0000000000400000-0x0000000000440000-memory.dmp family_berbew behavioral2/files/0x0008000000023241-14.dat family_berbew behavioral2/memory/1868-15-0x0000000000400000-0x0000000000440000-memory.dmp family_berbew behavioral2/files/0x0008000000023244-17.dat family_berbew behavioral2/memory/3900-23-0x0000000000400000-0x0000000000440000-memory.dmp family_berbew behavioral2/files/0x0007000000023246-30.dat family_berbew behavioral2/memory/4708-31-0x0000000000400000-0x0000000000440000-memory.dmp family_berbew behavioral2/files/0x0007000000023249-38.dat family_berbew behavioral2/memory/2588-39-0x0000000000400000-0x0000000000440000-memory.dmp family_berbew behavioral2/files/0x000700000002324b-46.dat family_berbew behavioral2/memory/1008-47-0x0000000000400000-0x0000000000440000-memory.dmp family_berbew behavioral2/files/0x000700000002324d-54.dat family_berbew behavioral2/memory/4952-55-0x0000000000400000-0x0000000000440000-memory.dmp family_berbew behavioral2/files/0x000700000002324f-62.dat family_berbew behavioral2/memory/5108-64-0x0000000000400000-0x0000000000440000-memory.dmp family_berbew behavioral2/files/0x0007000000023251-69.dat family_berbew behavioral2/memory/2012-72-0x0000000000400000-0x0000000000440000-memory.dmp family_berbew behavioral2/files/0x0007000000023253-78.dat family_berbew behavioral2/memory/3552-79-0x0000000000400000-0x0000000000440000-memory.dmp family_berbew behavioral2/files/0x0007000000023255-86.dat family_berbew behavioral2/memory/4908-87-0x0000000000400000-0x0000000000440000-memory.dmp family_berbew behavioral2/files/0x0007000000023257-94.dat family_berbew behavioral2/memory/4444-95-0x0000000000400000-0x0000000000440000-memory.dmp family_berbew behavioral2/files/0x0007000000023259-101.dat family_berbew behavioral2/memory/1484-103-0x0000000000400000-0x0000000000440000-memory.dmp family_berbew behavioral2/files/0x000700000002325b-110.dat family_berbew behavioral2/memory/3524-111-0x0000000000400000-0x0000000000440000-memory.dmp family_berbew behavioral2/files/0x000700000002325d-118.dat family_berbew behavioral2/memory/2072-119-0x0000000000400000-0x0000000000440000-memory.dmp family_berbew behavioral2/files/0x000700000002325f-126.dat family_berbew behavioral2/memory/3464-127-0x0000000000400000-0x0000000000440000-memory.dmp family_berbew behavioral2/files/0x0007000000023261-134.dat family_berbew behavioral2/memory/4920-135-0x0000000000400000-0x0000000000440000-memory.dmp family_berbew behavioral2/files/0x0007000000023263-142.dat family_berbew behavioral2/memory/4772-144-0x0000000000400000-0x0000000000440000-memory.dmp family_berbew behavioral2/files/0x0007000000023265-150.dat family_berbew behavioral2/memory/2876-152-0x0000000000400000-0x0000000000440000-memory.dmp family_berbew behavioral2/files/0x0007000000023267-158.dat family_berbew behavioral2/memory/4336-159-0x0000000000400000-0x0000000000440000-memory.dmp family_berbew behavioral2/files/0x0007000000023269-166.dat family_berbew behavioral2/memory/4872-167-0x0000000000400000-0x0000000000440000-memory.dmp family_berbew behavioral2/files/0x000700000002326b-174.dat family_berbew behavioral2/memory/5116-175-0x0000000000400000-0x0000000000440000-memory.dmp family_berbew behavioral2/files/0x000700000002326d-182.dat family_berbew behavioral2/memory/1716-183-0x0000000000400000-0x0000000000440000-memory.dmp family_berbew behavioral2/files/0x000700000002326f-190.dat family_berbew behavioral2/memory/4384-191-0x0000000000400000-0x0000000000440000-memory.dmp family_berbew behavioral2/files/0x0007000000023271-198.dat family_berbew behavioral2/memory/228-199-0x0000000000400000-0x0000000000440000-memory.dmp family_berbew behavioral2/files/0x0007000000023273-206.dat family_berbew behavioral2/memory/5060-208-0x0000000000400000-0x0000000000440000-memory.dmp family_berbew behavioral2/files/0x0007000000023275-214.dat family_berbew behavioral2/memory/2656-215-0x0000000000400000-0x0000000000440000-memory.dmp family_berbew behavioral2/files/0x0007000000023277-222.dat family_berbew behavioral2/memory/1968-224-0x0000000000400000-0x0000000000440000-memory.dmp family_berbew behavioral2/files/0x000700000002327b-231.dat family_berbew behavioral2/memory/2152-232-0x0000000000400000-0x0000000000440000-memory.dmp family_berbew behavioral2/files/0x000700000002327d-238.dat family_berbew behavioral2/memory/2224-240-0x0000000000400000-0x0000000000440000-memory.dmp family_berbew behavioral2/files/0x0007000000023280-246.dat family_berbew behavioral2/memory/1984-247-0x0000000000400000-0x0000000000440000-memory.dmp family_berbew behavioral2/files/0x0007000000023282-253.dat family_berbew - Executes dropped EXE 64 IoCs
pid Process 4500 Mlljnf32.exe 1868 Ojqcnhkl.exe 3900 Oikjkc32.exe 4708 Qclmck32.exe 2588 Apjdikqd.exe 1008 Bmidnm32.exe 4952 Cienon32.exe 5108 Cacmpj32.exe 2012 Ddfbgelh.exe 3552 Dcnlnaom.exe 4908 Enemaimp.exe 4444 Edaaccbj.exe 1484 Enlcahgh.exe 3524 Fqphic32.exe 2072 Fcpakn32.exe 3464 Fqfojblo.exe 4920 Ggccllai.exe 4772 Gjkbnfha.exe 2876 Hjmodffo.exe 4336 Hkmlnimb.exe 4872 Hjdedepg.exe 5116 Ilfodgeg.exe 1716 Iaedanal.exe 4384 Ihaidhgf.exe 228 Jaljbmkd.exe 5060 Jejbhk32.exe 2656 Jnedgq32.exe 1968 Klmnkdal.exe 2152 Kejloi32.exe 2224 Khkdad32.exe 1984 Llkjmb32.exe 4736 Lhbkac32.exe 2564 Lhgdmb32.exe 4364 Mdbnmbhj.exe 4516 Nakhaf32.exe 2304 Nfiagd32.exe 4312 Nhjjip32.exe 4592 Nhlfoodc.exe 624 Nfpghccm.exe 3092 Okmpqjad.exe 3352 Ookhfigk.exe 4340 Oflfdbip.exe 3164 Piaiqlak.exe 3188 Qpbgnecp.exe 1040 Acbmjcgd.exe 396 Aidomjaf.exe 1864 Bflham32.exe 4560 Cdebfago.exe 2124 Cekhihig.exe 3904 Cpqlfa32.exe 1440 Cepadh32.exe 3172 Dfonnk32.exe 2728 Dpjompqc.exe 1836 Dgfdojfm.exe 1980 Dmbiackg.exe 4752 Eepkkefp.exe 448 Eebgqe32.exe 4728 Edcgnmml.exe 2272 Fpmeimpn.exe 2080 Fjeibc32.exe 2692 Fgpplf32.exe 5040 Gqkajk32.exe 4604 Gdhjpjjd.exe 392 Gdmcki32.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Cdkcbfjm.dll Fokbbcmo.exe File opened for modification C:\Windows\SysWOW64\Gfcgpkhk.exe Gcdkdpih.exe File opened for modification C:\Windows\SysWOW64\Nnolojhk.exe Ngedbp32.exe File created C:\Windows\SysWOW64\Qclmck32.exe Oikjkc32.exe File opened for modification C:\Windows\SysWOW64\Qdipag32.exe Pklamb32.exe File created C:\Windows\SysWOW64\Miipencp.exe Mdlgmgdh.exe File created C:\Windows\SysWOW64\Ppblkffp.exe Obeikc32.exe File opened for modification C:\Windows\SysWOW64\Eaegqc32.exe Enfjdh32.exe File opened for modification C:\Windows\SysWOW64\Jognokdi.exe Jhmfba32.exe File opened for modification C:\Windows\SysWOW64\Hgnlmdcp.exe Gdmcki32.exe File opened for modification C:\Windows\SysWOW64\Apqhldjp.exe Amblpikl.exe File created C:\Windows\SysWOW64\Knojng32.dll Oflfdbip.exe File opened for modification C:\Windows\SysWOW64\Lijlii32.exe Lbqdmodg.exe File created C:\Windows\SysWOW64\Lfkich32.exe Loaafnah.exe File created C:\Windows\SysWOW64\Elepei32.exe Eflhiolf.exe File opened for modification C:\Windows\SysWOW64\Gfnnel32.exe Gcpaiq32.exe File opened for modification C:\Windows\SysWOW64\Acbmjcgd.exe Qpbgnecp.exe File created C:\Windows\SysWOW64\Bcngddao.exe Bldogjib.exe File opened for modification C:\Windows\SysWOW64\Iehkpmgl.exe Hdfapjbl.exe File opened for modification C:\Windows\SysWOW64\Gcpaiq32.exe Gmfilfep.exe File created C:\Windows\SysWOW64\Kdffiinp.exe Kmlmlo32.exe File opened for modification C:\Windows\SysWOW64\Dgqblp32.exe Dcqmpa32.exe File opened for modification C:\Windows\SysWOW64\Idpdfija.exe Iehkpmgl.exe File opened for modification C:\Windows\SysWOW64\Dedceddg.exe Dnkkij32.exe File opened for modification C:\Windows\SysWOW64\Ekahhn32.exe Eegpkcbd.exe File opened for modification C:\Windows\SysWOW64\Locnlmoe.exe Lmeapbpa.exe File created C:\Windows\SysWOW64\Qkphie32.dll Imdndbkn.exe File created C:\Windows\SysWOW64\Gmeadk32.dll Eepkkefp.exe File opened for modification C:\Windows\SysWOW64\Endnohdp.exe Eclmlpfl.exe File created C:\Windows\SysWOW64\Cmkehicj.exe Bqahmhpi.exe File created C:\Windows\SysWOW64\Fnofpqff.exe Fgencf32.exe File created C:\Windows\SysWOW64\Cojqdhid.exe Clldhljp.exe File created C:\Windows\SysWOW64\Ailghj32.dll Dadlmanj.exe File created C:\Windows\SysWOW64\Bpaacblm.exe Bekmei32.exe File opened for modification C:\Windows\SysWOW64\Odkaac32.exe Onaieifh.exe File created C:\Windows\SysWOW64\Kpnepk32.exe Kcgekjgp.exe File created C:\Windows\SysWOW64\Eimelg32.exe Eejcki32.exe File created C:\Windows\SysWOW64\Commjgga.exe Chbenm32.exe File opened for modification C:\Windows\SysWOW64\Eebgqe32.exe Eepkkefp.exe File opened for modification C:\Windows\SysWOW64\Ljmmcbdp.exe Lmiljn32.exe File opened for modification C:\Windows\SysWOW64\Pcfhlh32.exe Pllppnnm.exe File opened for modification C:\Windows\SysWOW64\Hddejjdo.exe Heohinog.exe File created C:\Windows\SysWOW64\Dhnebcph.dll Ipcakd32.exe File created C:\Windows\SysWOW64\Hdglka32.dll Hppedpkf.exe File opened for modification C:\Windows\SysWOW64\Pmpmnb32.exe Offeahhp.exe File created C:\Windows\SysWOW64\Dabeamma.dll Ccigpbga.exe File created C:\Windows\SysWOW64\Jiphebml.exe Jbfphh32.exe File created C:\Windows\SysWOW64\Inogbj32.dll Khhaanop.exe File created C:\Windows\SysWOW64\Jgibqj32.dll Dpglmjoj.exe File created C:\Windows\SysWOW64\Cjodhbii.dll Jobfdl32.exe File created C:\Windows\SysWOW64\Kmkpipaf.exe Jqbbno32.exe File created C:\Windows\SysWOW64\Pgpobmca.exe Ppdjpcng.exe File created C:\Windows\SysWOW64\Doankb32.dll Jknocljn.exe File created C:\Windows\SysWOW64\Iqdmghnp.exe Ijhhenhf.exe File opened for modification C:\Windows\SysWOW64\Clohhbli.exe Cfeplh32.exe File created C:\Windows\SysWOW64\Hifmhf32.exe Gfcgpkhk.exe File created C:\Windows\SysWOW64\Jobfdl32.exe Jmopmalc.exe File created C:\Windows\SysWOW64\Gmfpgmil.exe Fapobl32.exe File opened for modification C:\Windows\SysWOW64\Pneelmjo.exe Plfipakk.exe File created C:\Windows\SysWOW64\Dekobaki.exe Dpnfjjla.exe File opened for modification C:\Windows\SysWOW64\Ehekjk32.exe Ebkbmqhb.exe File created C:\Windows\SysWOW64\Ehlakjig.exe Efnennjc.exe File created C:\Windows\SysWOW64\Mpkbohhd.exe Mjqjbn32.exe File created C:\Windows\SysWOW64\Ogoibgad.dll Kabpan32.exe - Program crash 1 IoCs
pid pid_target Process procid_target 10064 7108 WerFault.exe 658 - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nhafcd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nlphmafm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ppphkq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gflapl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Anepki32.dll" Njacikbd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nkgoke32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bgkaip32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dnekcd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Giofggia.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nlphmafm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Almifk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bgfgpnpd.dll" Bjielh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mmdcde32.dll" Elaobdmm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Glompi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jflhqe32.dll" Gjmmfq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bmidnm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kgkfil32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fiimfo32.dll" Jjhonfjg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mlcieblm.dll" Ljmmcbdp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Locnlmoe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Amibqhed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hfmqapcl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jacnegep.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mdibplaf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kabpan32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ognginic.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dpjompqc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hoefgj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hhnkppbf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kfggbope.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Eoocfegl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Madbpi32.dll" Lgkhec32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nnolojhk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nakhaf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bbbcimhh.dll" Foonjd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jjefao32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pichac32.dll" Kpnepk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Knojng32.dll" Oflfdbip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cjejmk32.dll" Hadcce32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dcknnglh.dll" Iapbodql.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Embdofop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qcpcmogh.dll" Dpqcoj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jgekdq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ggdcpacl.dll" Idpdfija.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dhnebcph.dll" Ipcakd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Igmjhnej.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fbqiak32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Imdndbkn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID e7ffb347d16d2e603f0f3c1bbb42caf0_NEIKI.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nmbamdkm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cggpfa32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ldlmieaa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bgfpdmho.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jacnegep.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gahnae32.dll" Pneelmjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Eebgqe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cogbfgli.dll" Omdnbd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mohedncd.dll" Akkmocjl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ppphkq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Aemjjeek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ikcmmjkb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gfnnel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dnfgdc32.dll" Jkqccbkf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kpihpm32.dll" Ppphkq32.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4292 wrote to memory of 4500 4292 e7ffb347d16d2e603f0f3c1bbb42caf0_NEIKI.exe 90 PID 4292 wrote to memory of 4500 4292 e7ffb347d16d2e603f0f3c1bbb42caf0_NEIKI.exe 90 PID 4292 wrote to memory of 4500 4292 e7ffb347d16d2e603f0f3c1bbb42caf0_NEIKI.exe 90 PID 4500 wrote to memory of 1868 4500 Mlljnf32.exe 91 PID 4500 wrote to memory of 1868 4500 Mlljnf32.exe 91 PID 4500 wrote to memory of 1868 4500 Mlljnf32.exe 91 PID 1868 wrote to memory of 3900 1868 Ojqcnhkl.exe 92 PID 1868 wrote to memory of 3900 1868 Ojqcnhkl.exe 92 PID 1868 wrote to memory of 3900 1868 Ojqcnhkl.exe 92 PID 3900 wrote to memory of 4708 3900 Oikjkc32.exe 93 PID 3900 wrote to memory of 4708 3900 Oikjkc32.exe 93 PID 3900 wrote to memory of 4708 3900 Oikjkc32.exe 93 PID 4708 wrote to memory of 2588 4708 Qclmck32.exe 94 PID 4708 wrote to memory of 2588 4708 Qclmck32.exe 94 PID 4708 wrote to memory of 2588 4708 Qclmck32.exe 94 PID 2588 wrote to memory of 1008 2588 Apjdikqd.exe 95 PID 2588 wrote to memory of 1008 2588 Apjdikqd.exe 95 PID 2588 wrote to memory of 1008 2588 Apjdikqd.exe 95 PID 1008 wrote to memory of 4952 1008 Bmidnm32.exe 96 PID 1008 wrote to memory of 4952 1008 Bmidnm32.exe 96 PID 1008 wrote to memory of 4952 1008 Bmidnm32.exe 96 PID 4952 wrote to memory of 5108 4952 Cienon32.exe 97 PID 4952 wrote to memory of 5108 4952 Cienon32.exe 97 PID 4952 wrote to memory of 5108 4952 Cienon32.exe 97 PID 5108 wrote to memory of 2012 5108 Cacmpj32.exe 98 PID 5108 wrote to memory of 2012 5108 Cacmpj32.exe 98 PID 5108 wrote to memory of 2012 5108 Cacmpj32.exe 98 PID 2012 wrote to memory of 3552 2012 Ddfbgelh.exe 99 PID 2012 wrote to memory of 3552 2012 Ddfbgelh.exe 99 PID 2012 wrote to memory of 3552 2012 Ddfbgelh.exe 99 PID 3552 wrote to memory of 4908 3552 Dcnlnaom.exe 100 PID 3552 wrote to memory of 4908 3552 Dcnlnaom.exe 100 PID 3552 wrote to memory of 4908 3552 Dcnlnaom.exe 100 PID 4908 wrote to memory of 4444 4908 Enemaimp.exe 101 PID 4908 wrote to memory of 4444 4908 Enemaimp.exe 101 PID 4908 wrote to memory of 4444 4908 Enemaimp.exe 101 PID 4444 wrote to memory of 1484 4444 Edaaccbj.exe 102 PID 4444 wrote to memory of 1484 4444 Edaaccbj.exe 102 PID 4444 wrote to memory of 1484 4444 Edaaccbj.exe 102 PID 1484 wrote to memory of 3524 1484 Enlcahgh.exe 103 PID 1484 wrote to memory of 3524 1484 Enlcahgh.exe 103 PID 1484 wrote to memory of 3524 1484 Enlcahgh.exe 103 PID 3524 wrote to memory of 2072 3524 Fqphic32.exe 104 PID 3524 wrote to memory of 2072 3524 Fqphic32.exe 104 PID 3524 wrote to memory of 2072 3524 Fqphic32.exe 104 PID 2072 wrote to memory of 3464 2072 Fcpakn32.exe 105 PID 2072 wrote to memory of 3464 2072 Fcpakn32.exe 105 PID 2072 wrote to memory of 3464 2072 Fcpakn32.exe 105 PID 3464 wrote to memory of 4920 3464 Fqfojblo.exe 106 PID 3464 wrote to memory of 4920 3464 Fqfojblo.exe 106 PID 3464 wrote to memory of 4920 3464 Fqfojblo.exe 106 PID 4920 wrote to memory of 4772 4920 Ggccllai.exe 107 PID 4920 wrote to memory of 4772 4920 Ggccllai.exe 107 PID 4920 wrote to memory of 4772 4920 Ggccllai.exe 107 PID 4772 wrote to memory of 2876 4772 Gjkbnfha.exe 108 PID 4772 wrote to memory of 2876 4772 Gjkbnfha.exe 108 PID 4772 wrote to memory of 2876 4772 Gjkbnfha.exe 108 PID 2876 wrote to memory of 4336 2876 Hjmodffo.exe 109 PID 2876 wrote to memory of 4336 2876 Hjmodffo.exe 109 PID 2876 wrote to memory of 4336 2876 Hjmodffo.exe 109 PID 4336 wrote to memory of 4872 4336 Hkmlnimb.exe 110 PID 4336 wrote to memory of 4872 4336 Hkmlnimb.exe 110 PID 4336 wrote to memory of 4872 4336 Hkmlnimb.exe 110 PID 4872 wrote to memory of 5116 4872 Hjdedepg.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\e7ffb347d16d2e603f0f3c1bbb42caf0_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\e7ffb347d16d2e603f0f3c1bbb42caf0_NEIKI.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Windows\SysWOW64\Mlljnf32.exeC:\Windows\system32\Mlljnf32.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Windows\SysWOW64\Ojqcnhkl.exeC:\Windows\system32\Ojqcnhkl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Windows\SysWOW64\Oikjkc32.exeC:\Windows\system32\Oikjkc32.exe4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Windows\SysWOW64\Qclmck32.exeC:\Windows\system32\Qclmck32.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Windows\SysWOW64\Apjdikqd.exeC:\Windows\system32\Apjdikqd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Windows\SysWOW64\Bmidnm32.exeC:\Windows\system32\Bmidnm32.exe7⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Windows\SysWOW64\Cienon32.exeC:\Windows\system32\Cienon32.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Windows\SysWOW64\Cacmpj32.exeC:\Windows\system32\Cacmpj32.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Windows\SysWOW64\Ddfbgelh.exeC:\Windows\system32\Ddfbgelh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Windows\SysWOW64\Dcnlnaom.exeC:\Windows\system32\Dcnlnaom.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Windows\SysWOW64\Enemaimp.exeC:\Windows\system32\Enemaimp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Windows\SysWOW64\Edaaccbj.exeC:\Windows\system32\Edaaccbj.exe13⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Windows\SysWOW64\Enlcahgh.exeC:\Windows\system32\Enlcahgh.exe14⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Windows\SysWOW64\Fqphic32.exeC:\Windows\system32\Fqphic32.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\Windows\SysWOW64\Fcpakn32.exeC:\Windows\system32\Fcpakn32.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Windows\SysWOW64\Fqfojblo.exeC:\Windows\system32\Fqfojblo.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Windows\SysWOW64\Ggccllai.exeC:\Windows\system32\Ggccllai.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Windows\SysWOW64\Gjkbnfha.exeC:\Windows\system32\Gjkbnfha.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Windows\SysWOW64\Hjmodffo.exeC:\Windows\system32\Hjmodffo.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Windows\SysWOW64\Hkmlnimb.exeC:\Windows\system32\Hkmlnimb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Windows\SysWOW64\Hjdedepg.exeC:\Windows\system32\Hjdedepg.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Windows\SysWOW64\Ilfodgeg.exeC:\Windows\system32\Ilfodgeg.exe23⤵
- Executes dropped EXE
PID:5116 -
C:\Windows\SysWOW64\Iaedanal.exeC:\Windows\system32\Iaedanal.exe24⤵
- Executes dropped EXE
PID:1716 -
C:\Windows\SysWOW64\Ihaidhgf.exeC:\Windows\system32\Ihaidhgf.exe25⤵
- Executes dropped EXE
PID:4384 -
C:\Windows\SysWOW64\Jaljbmkd.exeC:\Windows\system32\Jaljbmkd.exe26⤵
- Executes dropped EXE
PID:228 -
C:\Windows\SysWOW64\Jejbhk32.exeC:\Windows\system32\Jejbhk32.exe27⤵
- Executes dropped EXE
PID:5060 -
C:\Windows\SysWOW64\Jnedgq32.exeC:\Windows\system32\Jnedgq32.exe28⤵
- Executes dropped EXE
PID:2656 -
C:\Windows\SysWOW64\Klmnkdal.exeC:\Windows\system32\Klmnkdal.exe29⤵
- Executes dropped EXE
PID:1968 -
C:\Windows\SysWOW64\Kejloi32.exeC:\Windows\system32\Kejloi32.exe30⤵
- Executes dropped EXE
PID:2152 -
C:\Windows\SysWOW64\Khkdad32.exeC:\Windows\system32\Khkdad32.exe31⤵
- Executes dropped EXE
PID:2224 -
C:\Windows\SysWOW64\Llkjmb32.exeC:\Windows\system32\Llkjmb32.exe32⤵
- Executes dropped EXE
PID:1984 -
C:\Windows\SysWOW64\Lhbkac32.exeC:\Windows\system32\Lhbkac32.exe33⤵
- Executes dropped EXE
PID:4736 -
C:\Windows\SysWOW64\Lhgdmb32.exeC:\Windows\system32\Lhgdmb32.exe34⤵
- Executes dropped EXE
PID:2564 -
C:\Windows\SysWOW64\Mdbnmbhj.exeC:\Windows\system32\Mdbnmbhj.exe35⤵
- Executes dropped EXE
PID:4364 -
C:\Windows\SysWOW64\Nakhaf32.exeC:\Windows\system32\Nakhaf32.exe36⤵
- Executes dropped EXE
- Modifies registry class
PID:4516 -
C:\Windows\SysWOW64\Nfiagd32.exeC:\Windows\system32\Nfiagd32.exe37⤵
- Executes dropped EXE
PID:2304 -
C:\Windows\SysWOW64\Nhjjip32.exeC:\Windows\system32\Nhjjip32.exe38⤵
- Executes dropped EXE
PID:4312 -
C:\Windows\SysWOW64\Nhlfoodc.exeC:\Windows\system32\Nhlfoodc.exe39⤵
- Executes dropped EXE
PID:4592 -
C:\Windows\SysWOW64\Nfpghccm.exeC:\Windows\system32\Nfpghccm.exe40⤵
- Executes dropped EXE
PID:624 -
C:\Windows\SysWOW64\Okmpqjad.exeC:\Windows\system32\Okmpqjad.exe41⤵
- Executes dropped EXE
PID:3092 -
C:\Windows\SysWOW64\Ookhfigk.exeC:\Windows\system32\Ookhfigk.exe42⤵
- Executes dropped EXE
PID:3352 -
C:\Windows\SysWOW64\Oloipmfd.exeC:\Windows\system32\Oloipmfd.exe43⤵PID:2368
-
C:\Windows\SysWOW64\Oflfdbip.exeC:\Windows\system32\Oflfdbip.exe44⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:4340 -
C:\Windows\SysWOW64\Piaiqlak.exeC:\Windows\system32\Piaiqlak.exe45⤵
- Executes dropped EXE
PID:3164 -
C:\Windows\SysWOW64\Qpbgnecp.exeC:\Windows\system32\Qpbgnecp.exe46⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3188 -
C:\Windows\SysWOW64\Acbmjcgd.exeC:\Windows\system32\Acbmjcgd.exe47⤵
- Executes dropped EXE
PID:1040 -
C:\Windows\SysWOW64\Aidomjaf.exeC:\Windows\system32\Aidomjaf.exe48⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:396 -
C:\Windows\SysWOW64\Bflham32.exeC:\Windows\system32\Bflham32.exe49⤵
- Executes dropped EXE
PID:1864 -
C:\Windows\SysWOW64\Cdebfago.exeC:\Windows\system32\Cdebfago.exe50⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:4560 -
C:\Windows\SysWOW64\Cekhihig.exeC:\Windows\system32\Cekhihig.exe51⤵
- Executes dropped EXE
PID:2124 -
C:\Windows\SysWOW64\Cpqlfa32.exeC:\Windows\system32\Cpqlfa32.exe52⤵
- Executes dropped EXE
PID:3904 -
C:\Windows\SysWOW64\Cepadh32.exeC:\Windows\system32\Cepadh32.exe53⤵
- Executes dropped EXE
PID:1440 -
C:\Windows\SysWOW64\Dfonnk32.exeC:\Windows\system32\Dfonnk32.exe54⤵
- Executes dropped EXE
PID:3172 -
C:\Windows\SysWOW64\Dpjompqc.exeC:\Windows\system32\Dpjompqc.exe55⤵
- Executes dropped EXE
- Modifies registry class
PID:2728 -
C:\Windows\SysWOW64\Dgfdojfm.exeC:\Windows\system32\Dgfdojfm.exe56⤵
- Executes dropped EXE
PID:1836 -
C:\Windows\SysWOW64\Dmbiackg.exeC:\Windows\system32\Dmbiackg.exe57⤵
- Executes dropped EXE
PID:1980 -
C:\Windows\SysWOW64\Eepkkefp.exeC:\Windows\system32\Eepkkefp.exe58⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4752 -
C:\Windows\SysWOW64\Eebgqe32.exeC:\Windows\system32\Eebgqe32.exe59⤵
- Executes dropped EXE
- Modifies registry class
PID:448 -
C:\Windows\SysWOW64\Edcgnmml.exeC:\Windows\system32\Edcgnmml.exe60⤵
- Executes dropped EXE
PID:4728 -
C:\Windows\SysWOW64\Fpmeimpn.exeC:\Windows\system32\Fpmeimpn.exe61⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2272 -
C:\Windows\SysWOW64\Fjeibc32.exeC:\Windows\system32\Fjeibc32.exe62⤵
- Executes dropped EXE
PID:2080 -
C:\Windows\SysWOW64\Fgpplf32.exeC:\Windows\system32\Fgpplf32.exe63⤵
- Executes dropped EXE
PID:2692 -
C:\Windows\SysWOW64\Gqkajk32.exeC:\Windows\system32\Gqkajk32.exe64⤵
- Executes dropped EXE
PID:5040 -
C:\Windows\SysWOW64\Gdhjpjjd.exeC:\Windows\system32\Gdhjpjjd.exe65⤵
- Executes dropped EXE
PID:4604 -
C:\Windows\SysWOW64\Gdmcki32.exeC:\Windows\system32\Gdmcki32.exe66⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:392 -
C:\Windows\SysWOW64\Hgnlmdcp.exeC:\Windows\system32\Hgnlmdcp.exe67⤵PID:4904
-
C:\Windows\SysWOW64\Ijhhenhf.exeC:\Windows\system32\Ijhhenhf.exe68⤵
- Drops file in System32 directory
PID:3616 -
C:\Windows\SysWOW64\Iqdmghnp.exeC:\Windows\system32\Iqdmghnp.exe69⤵PID:4420
-
C:\Windows\SysWOW64\Iebfmfdg.exeC:\Windows\system32\Iebfmfdg.exe70⤵PID:4196
-
C:\Windows\SysWOW64\Jgekdq32.exeC:\Windows\system32\Jgekdq32.exe71⤵
- Modifies registry class
PID:4168 -
C:\Windows\SysWOW64\Kmlgcf32.exeC:\Windows\system32\Kmlgcf32.exe72⤵PID:1808
-
C:\Windows\SysWOW64\Kaioidkh.exeC:\Windows\system32\Kaioidkh.exe73⤵PID:732
-
C:\Windows\SysWOW64\Khfdlnab.exeC:\Windows\system32\Khfdlnab.exe74⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1004 -
C:\Windows\SysWOW64\Kmbmdeoj.exeC:\Windows\system32\Kmbmdeoj.exe75⤵PID:1116
-
C:\Windows\SysWOW64\Khhaanop.exeC:\Windows\system32\Khhaanop.exe76⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:1368 -
C:\Windows\SysWOW64\Malefbkc.exeC:\Windows\system32\Malefbkc.exe77⤵PID:5136
-
C:\Windows\SysWOW64\Mginniij.exeC:\Windows\system32\Mginniij.exe78⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5176 -
C:\Windows\SysWOW64\Mkgfdgpq.exeC:\Windows\system32\Mkgfdgpq.exe79⤵PID:5216
-
C:\Windows\SysWOW64\Mgngih32.exeC:\Windows\system32\Mgngih32.exe80⤵PID:5256
-
C:\Windows\SysWOW64\Nhbmnj32.exeC:\Windows\system32\Nhbmnj32.exe81⤵PID:5296
-
C:\Windows\SysWOW64\Ndinck32.exeC:\Windows\system32\Ndinck32.exe82⤵PID:5336
-
C:\Windows\SysWOW64\Nonbqd32.exeC:\Windows\system32\Nonbqd32.exe83⤵PID:5384
-
C:\Windows\SysWOW64\Ngifef32.exeC:\Windows\system32\Ngifef32.exe84⤵PID:5428
-
C:\Windows\SysWOW64\Naokbokn.exeC:\Windows\system32\Naokbokn.exe85⤵PID:5472
-
C:\Windows\SysWOW64\Nkgoke32.exeC:\Windows\system32\Nkgoke32.exe86⤵
- Modifies registry class
PID:5516 -
C:\Windows\SysWOW64\Nemchn32.exeC:\Windows\system32\Nemchn32.exe87⤵PID:5560
-
C:\Windows\SysWOW64\Nkjlqd32.exeC:\Windows\system32\Nkjlqd32.exe88⤵PID:5604
-
C:\Windows\SysWOW64\Oeamcmmo.exeC:\Windows\system32\Oeamcmmo.exe89⤵PID:5648
-
C:\Windows\SysWOW64\Oeffnl32.exeC:\Windows\system32\Oeffnl32.exe90⤵PID:5692
-
C:\Windows\SysWOW64\Pnfdnnbo.exeC:\Windows\system32\Pnfdnnbo.exe91⤵PID:5740
-
C:\Windows\SysWOW64\Pklamb32.exeC:\Windows\system32\Pklamb32.exe92⤵
- Drops file in System32 directory
PID:5784 -
C:\Windows\SysWOW64\Qdipag32.exeC:\Windows\system32\Qdipag32.exe93⤵PID:5828
-
C:\Windows\SysWOW64\Akfdcq32.exeC:\Windows\system32\Akfdcq32.exe94⤵PID:5872
-
C:\Windows\SysWOW64\Abgcqjhp.exeC:\Windows\system32\Abgcqjhp.exe95⤵PID:5916
-
C:\Windows\SysWOW64\Bomppneg.exeC:\Windows\system32\Bomppneg.exe96⤵PID:5964
-
C:\Windows\SysWOW64\Bgkaip32.exeC:\Windows\system32\Bgkaip32.exe97⤵
- Modifies registry class
PID:6024 -
C:\Windows\SysWOW64\Cfbhhfbg.exeC:\Windows\system32\Cfbhhfbg.exe98⤵PID:6068
-
C:\Windows\SysWOW64\Cicqja32.exeC:\Windows\system32\Cicqja32.exe99⤵PID:6112
-
C:\Windows\SysWOW64\Dhmgfm32.exeC:\Windows\system32\Dhmgfm32.exe100⤵PID:5164
-
C:\Windows\SysWOW64\Dpglmjoj.exeC:\Windows\system32\Dpglmjoj.exe101⤵
- Drops file in System32 directory
PID:5232 -
C:\Windows\SysWOW64\Doqbifpl.exeC:\Windows\system32\Doqbifpl.exe102⤵PID:5304
-
C:\Windows\SysWOW64\Eflceb32.exeC:\Windows\system32\Eflceb32.exe103⤵PID:5416
-
C:\Windows\SysWOW64\Ehnpmkbg.exeC:\Windows\system32\Ehnpmkbg.exe104⤵PID:5440
-
C:\Windows\SysWOW64\Ebcdjc32.exeC:\Windows\system32\Ebcdjc32.exe105⤵PID:5488
-
C:\Windows\SysWOW64\Ehpmbj32.exeC:\Windows\system32\Ehpmbj32.exe106⤵PID:5632
-
C:\Windows\SysWOW64\Efampahd.exeC:\Windows\system32\Efampahd.exe107⤵PID:5728
-
C:\Windows\SysWOW64\Fefjanml.exeC:\Windows\system32\Fefjanml.exe108⤵PID:5792
-
C:\Windows\SysWOW64\Foonjd32.exeC:\Windows\system32\Foonjd32.exe109⤵
- Modifies registry class
PID:5864 -
C:\Windows\SysWOW64\Fekclnif.exeC:\Windows\system32\Fekclnif.exe110⤵PID:5924
-
C:\Windows\SysWOW64\Fofdkcmd.exeC:\Windows\system32\Fofdkcmd.exe111⤵PID:5996
-
C:\Windows\SysWOW64\Fpeaeedg.exeC:\Windows\system32\Fpeaeedg.exe112⤵PID:6064
-
C:\Windows\SysWOW64\Ginenk32.exeC:\Windows\system32\Ginenk32.exe113⤵PID:3004
-
C:\Windows\SysWOW64\Gojnfb32.exeC:\Windows\system32\Gojnfb32.exe114⤵PID:5200
-
C:\Windows\SysWOW64\Gipbck32.exeC:\Windows\system32\Gipbck32.exe115⤵PID:5368
-
C:\Windows\SysWOW64\Gpjjpe32.exeC:\Windows\system32\Gpjjpe32.exe116⤵PID:5504
-
C:\Windows\SysWOW64\Gegchl32.exeC:\Windows\system32\Gegchl32.exe117⤵PID:5616
-
C:\Windows\SysWOW64\Hfeoijbi.exeC:\Windows\system32\Hfeoijbi.exe118⤵PID:5836
-
C:\Windows\SysWOW64\Iqaiga32.exeC:\Windows\system32\Iqaiga32.exe119⤵PID:5912
-
C:\Windows\SysWOW64\Ijlkfg32.exeC:\Windows\system32\Ijlkfg32.exe120⤵PID:3128
-
C:\Windows\SysWOW64\Icdoolge.exeC:\Windows\system32\Icdoolge.exe121⤵PID:6104
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-