Analysis
- max time kernel
159s - max time network
168s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
09/05/2024, 12:38
Behavioral task
behavioral1
Sample
d4ae787422ae5693b83874189a6a202d_NEIKI.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
d4ae787422ae5693b83874189a6a202d_NEIKI.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target d4ae787422ae5693b83874189a6a202d_NEIKI.exe
- Size 320KB
- Sample240509-pvkn3scg86
- SHA256 ba6f31b8801d1de73b665fafa6a8168426c4582003daec69f7c022432b4782ca
- MD5 d4ae787422ae5693b83874189a6a202d
- SHA1 3b1cc1d62eec93774062854b75710166d1883d45
- SHA512 f73728df401233195f4d9b3f916e9ce034406a42f655fbe004fff85f95409050e74d7221437a7a58b7b70c9466cd3a2b3847db260b0ce190a299e64ded7daad5
- SSDEEP 6144:Pg2FtSe2yeLcKTCndOGeKTame6UK+42GTQMJSZO5f7M0rx7/hP66qve6UK+42GTx:RFt4yQedOGeKTaPkY660fIaDZkY66+
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fnjhccnd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Phpkgc32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Podcnh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fieacc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Hfmqapcl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Hkhkdjkl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kaehepeg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Pklkmo32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lokdgpqe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Mapgfk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jnmbjnlm.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jefbomoe.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ajcdhj32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iemdep32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fcjimnjl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Gmkibl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Peonhg32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cjindm32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dannbogl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Laqhao32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Mglfibmh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Pnlcdg32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kpdjbapj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aqijdk32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jnqbmadp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ndaboafl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Enigek32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kjnbhkqp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lmodqdpo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Djmbbk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Meiabh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jefbomoe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Pdkolm32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gmdcpoid.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lngkjhmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Lcbmlbig.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mglhgg32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nggnjjoo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Qnhabp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Fldeie32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bcebadof.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Magnbnea.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oejbpb32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pahiebeq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Akipdg32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jnmbjnlm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Andghd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Hmhmko32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Hhojqcil.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ihagfb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Dobnpm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Iajkohmj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jgbccm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jbilnkjc.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bogcqpdd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Piphaf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Cbnknpqj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Komhkn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Alnfiifd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Mjeaph32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Anogbohj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Legjgn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Cleeafbi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jinloboo.exe - Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/memory/1384-0-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew behavioral2/files/0x0008000000023241-6.dat family_berbew behavioral2/memory/1284-7-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew behavioral2/files/0x0008000000023245-14.dat family_berbew behavioral2/memory/2448-15-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew behavioral2/files/0x0007000000023247-22.dat family_berbew behavioral2/memory/4180-23-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew behavioral2/files/0x0007000000023249-25.dat family_berbew behavioral2/memory/3828-31-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew behavioral2/files/0x000700000002324b-34.dat family_berbew behavioral2/files/0x000700000002324b-38.dat family_berbew behavioral2/memory/1784-40-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew behavioral2/files/0x000700000002324d-46.dat family_berbew behavioral2/memory/1272-47-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew behavioral2/files/0x000700000002324f-54.dat family_berbew behavioral2/memory/2892-55-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew behavioral2/files/0x0007000000023251-62.dat family_berbew behavioral2/memory/3260-63-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew behavioral2/files/0x0007000000023253-70.dat family_berbew behavioral2/memory/1020-71-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew behavioral2/files/0x0007000000023255-73.dat family_berbew behavioral2/files/0x0007000000023255-78.dat family_berbew behavioral2/memory/2240-80-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew behavioral2/files/0x0007000000023257-86.dat family_berbew behavioral2/memory/3888-88-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew behavioral2/files/0x0007000000023259-94.dat family_berbew behavioral2/memory/3576-95-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew behavioral2/files/0x000700000002325b-102.dat family_berbew behavioral2/memory/3644-104-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew behavioral2/files/0x000700000002325d-109.dat family_berbew behavioral2/memory/568-111-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew behavioral2/files/0x000700000002325f-118.dat family_berbew behavioral2/memory/2256-119-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew behavioral2/files/0x0007000000023261-126.dat family_berbew behavioral2/memory/3176-127-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew behavioral2/files/0x0007000000023263-129.dat family_berbew behavioral2/memory/4540-136-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew behavioral2/files/0x0007000000023265-142.dat family_berbew behavioral2/memory/4760-143-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew behavioral2/files/0x0007000000023267-150.dat family_berbew behavioral2/memory/2988-151-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew behavioral2/files/0x0007000000023269-158.dat family_berbew behavioral2/memory/3732-159-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew behavioral2/files/0x000700000002326b-166.dat family_berbew behavioral2/memory/1976-168-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew behavioral2/files/0x000700000002326d-174.dat family_berbew behavioral2/memory/4368-176-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew behavioral2/files/0x0007000000023270-182.dat family_berbew behavioral2/memory/2520-184-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew behavioral2/files/0x0007000000023272-190.dat family_berbew behavioral2/memory/4384-192-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew behavioral2/files/0x0007000000023274-198.dat family_berbew behavioral2/memory/3656-200-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew behavioral2/files/0x0007000000023278-206.dat family_berbew behavioral2/memory/3984-209-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew behavioral2/files/0x000700000002327a-214.dat family_berbew behavioral2/memory/1776-216-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew behavioral2/files/0x000700000002327d-222.dat family_berbew behavioral2/memory/644-223-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew behavioral2/files/0x000700000002327f-230.dat family_berbew behavioral2/memory/4680-236-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew behavioral2/files/0x0007000000023281-238.dat family_berbew behavioral2/memory/2364-240-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew behavioral2/files/0x0007000000023284-246.dat family_berbew - Executes dropped EXE 64 IoCs
pid Process 1284 Afcmfe32.exe 2448 Ddmhhd32.exe 4180 Ephbhd32.exe 3828 Fggdpnkf.exe 1784 Fqdbdbna.exe 1272 Ggepalof.exe 2892 Gbpnjdkg.exe 3260 Hbiapb32.exe 1020 Hannao32.exe 2240 Ilfodgeg.exe 3888 Infhebbh.exe 3576 Jnnnfalp.exe 3644 Jlidpe32.exe 568 Klbgfc32.exe 2256 Mhiabbdi.exe 3176 Nlnpio32.exe 4540 Napameoi.exe 4760 Odgqopeb.exe 2988 Pmjhlklg.exe 3732 Aflpkpjm.exe 1976 Ammnhilb.exe 4368 Cemeoh32.exe 2520 Ddekmo32.exe 4384 Ecoaijio.exe 3656 Eegqldqg.exe 3984 Fpandm32.exe 1776 Ffpcbchm.exe 644 Gqkajk32.exe 4680 Hfnpca32.exe 2364 Hjcojo32.exe 2792 Kaioidkh.exe 3916 Leqkeajd.exe 2392 Lmqiec32.exe 4456 Nkpijfgf.exe 1596 Nhdicjfp.exe 2216 Odbpij32.exe 4636 Oggbfdog.exe 3924 Okeklcen.exe 4800 Pnhacn32.exe 3036 Qbmpjkqk.exe 4324 Abdfkj32.exe 3052 Agaoca32.exe 1360 Bpdfpmoo.exe 3308 Cbihmg32.exe 2548 Cnpibh32.exe 3096 Cldjkl32.exe 1232 Clffalkf.exe 4812 Dhmgfm32.exe 2324 Dlkplk32.exe 4028 Dhbqalle.exe 4024 Eemgkpef.exe 4508 Ijgakgej.exe 4008 Jfjakgpa.exe 3328 Kqdodo32.exe 4820 Kfjjbd32.exe 2808 Lpelqj32.exe 4908 Mmpbkm32.exe 3804 Mpqklh32.exe 2452 Mapgfk32.exe 4500 Nmnnlk32.exe 3700 Nhcbidcd.exe 3768 Oacmchcl.exe 1432 Odhppclh.exe 4436 Pdklebje.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Ffpjihee.exe Fkjfloeo.exe File created C:\Windows\SysWOW64\Cpihmmdo.exe Cpglgmfa.exe File opened for modification C:\Windows\SysWOW64\Ikijenab.exe Idpbhc32.exe File created C:\Windows\SysWOW64\Fpddngad.dll Igpkjo32.exe File opened for modification C:\Windows\SysWOW64\Hdaajd32.exe Hfmqapcl.exe File created C:\Windows\SysWOW64\Eplckh32.exe Echbad32.exe File opened for modification C:\Windows\SysWOW64\Gempqo32.exe Gnckjbfj.exe File opened for modification C:\Windows\SysWOW64\Kbbodj32.exe Kldmmp32.exe File created C:\Windows\SysWOW64\Bmbdbcgk.dll Kqpoja32.exe File created C:\Windows\SysWOW64\Lbkigk32.dll Mnknkbdk.exe File opened for modification C:\Windows\SysWOW64\Nahgik32.exe Nimbdi32.exe File created C:\Windows\SysWOW64\Dafccj32.dll Jgbccm32.exe File opened for modification C:\Windows\SysWOW64\Cagolf32.exe Cjindm32.exe File opened for modification C:\Windows\SysWOW64\Gmpqof32.exe Gplpfb32.exe File created C:\Windows\SysWOW64\Gicndaep.exe Gefencoj.exe File created C:\Windows\SysWOW64\Ighfkpji.dll Ebiffc32.exe File created C:\Windows\SysWOW64\Ghfpll32.dll Ihagfb32.exe File created C:\Windows\SysWOW64\Iakajagl.exe Icgqqmib.exe File created C:\Windows\SysWOW64\Akdameeh.dll Kpepmkjl.exe File created C:\Windows\SysWOW64\Onceji32.exe Odkaac32.exe File created C:\Windows\SysWOW64\Gempqo32.exe Gnckjbfj.exe File created C:\Windows\SysWOW64\Mdpmkhmc.dll Bpniaool.exe File opened for modification C:\Windows\SysWOW64\Jnnnfalp.exe Infhebbh.exe File created C:\Windows\SysWOW64\Mpadpm32.dll Gbmaog32.exe File created C:\Windows\SysWOW64\Gghdkg32.exe Gnppbapl.exe File created C:\Windows\SysWOW64\Debalegc.dll Hjcojo32.exe File opened for modification C:\Windows\SysWOW64\Djmbbk32.exe Dgnffp32.exe File created C:\Windows\SysWOW64\Okcccdkp.exe Nnpcjplf.exe File created C:\Windows\SysWOW64\Ndokko32.exe Nlefebfg.exe File opened for modification C:\Windows\SysWOW64\Gpcmagpo.exe Gkgeipah.exe File created C:\Windows\SysWOW64\Haoighmd.exe Hdkimdnk.exe File created C:\Windows\SysWOW64\Mojffn32.dll Baldmiom.exe File created C:\Windows\SysWOW64\Ddekmo32.exe Cemeoh32.exe File created C:\Windows\SysWOW64\Kenmbb32.dll Mgjicb32.exe File created C:\Windows\SysWOW64\Bhipiihc.exe Boqlqd32.exe File created C:\Windows\SysWOW64\Pnjbbemd.dll Oolgbpei.exe File created C:\Windows\SysWOW64\Cbccbiml.dll Cemeoh32.exe File opened for modification C:\Windows\SysWOW64\Clffalkf.exe Cldjkl32.exe File created C:\Windows\SysWOW64\Llmbqdfb.exe Lcbmlbig.exe File created C:\Windows\SysWOW64\Mppdbb32.exe Mcicma32.exe File created C:\Windows\SysWOW64\Nmmqgo32.exe Neaokboj.exe File created C:\Windows\SysWOW64\Ehfljn32.dll Idjdqc32.exe File created C:\Windows\SysWOW64\Kqpoja32.exe Kkcfbj32.exe File created C:\Windows\SysWOW64\Odgqopeb.exe Napameoi.exe File created C:\Windows\SysWOW64\Bcinie32.exe Acdeneij.exe File opened for modification C:\Windows\SysWOW64\Ngaihcli.exe Nllekk32.exe File opened for modification C:\Windows\SysWOW64\Nljgfn32.exe Ndaboafl.exe File created C:\Windows\SysWOW64\Akccje32.exe Alnfiifd.exe File created C:\Windows\SysWOW64\Iheaqolo.exe Hccomh32.exe File created C:\Windows\SysWOW64\Bgdjha32.dll Bjicnbba.exe File opened for modification C:\Windows\SysWOW64\Alnfiifd.exe Aahblp32.exe File opened for modification C:\Windows\SysWOW64\Cleeafbi.exe Ckeigc32.exe File created C:\Windows\SysWOW64\Pmdpok32.exe Opgloh32.exe File created C:\Windows\SysWOW64\Glkien32.dll Plpjhk32.exe File created C:\Windows\SysWOW64\Daehjein.dll Ibnlbm32.exe File opened for modification C:\Windows\SysWOW64\Dmnkdfce.exe Dcegkamd.exe File opened for modification C:\Windows\SysWOW64\Gfomfo32.exe Gempqo32.exe File created C:\Windows\SysWOW64\Liecmlno.exe Lbkkpb32.exe File opened for modification C:\Windows\SysWOW64\Pcmeek32.exe Plpqba32.exe File opened for modification C:\Windows\SysWOW64\Pogpcghp.exe Pdalfo32.exe File created C:\Windows\SysWOW64\Mngfkf32.dll Qbmpjkqk.exe File created C:\Windows\SysWOW64\Gamjea32.exe Fkqebg32.exe File created C:\Windows\SysWOW64\Ncjmob32.exe Mglfibmh.exe File created C:\Windows\SysWOW64\Nngoddkg.exe Ndokko32.exe - Program crash 1 IoCs
pid pid_target Process procid_target 6752 8120 WerFault.exe 850 - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Edngdafi.dll" Gmhogppb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Aqijdk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Lmaafcml.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Iacbbh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Inombh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cmiikpek.dll" Ammnhilb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfkdjn32.dll" Jdembk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Fnmeic32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Icalij32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Aldeap32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ijolhg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Eeagnc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Klhglj32.dll" Aehghn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Napameoi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Andghd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hkhhknoh.dll" Mccofn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Bngdndfn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Bcebadof.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Lbghpinc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mdpmkhmc.dll" Bpniaool.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kkjlmn32.dll" Jkggfl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Dhbqalle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gjjfdp32.dll" Qbeaba32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifjgobkn.dll" Mdaedgdb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cmhckmlc.dll" Mglfibmh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Fbbhla32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Fagjolao.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Plpqba32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Jcoapami.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Foaeccgp.dll" Dehgejep.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Pmdpok32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Dannbogl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cmkjoj32.dll" Jnnnfalp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Jdembk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Kjccna32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Apjppniq.dll" Cbnknpqj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Qmkfoj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Fkajoiok.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Macmhjgo.dll" Liecmlno.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Imbpam32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ngoighje.dll" Hingefqa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akpbae32.dll" Kpoaed32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Pnlcdg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Femndhgh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Boabkj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfbphcke.dll" Aahblp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gefipm32.dll" Iamoon32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Lepnli32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kaabkj32.dll" Haefqjeo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Lpkiim32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Epndddnk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cojpmaqp.dll" Bafnmnjn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Hmmffnai.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Lmaafcml.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ngikpjml.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Nffljjfc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehbpho32.dll" Opdiobod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Imonol32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Cbkncd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpflqjhe.dll" Cnahmo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Mpbaga32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Bfhhho32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Linmlm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmfdpm32.dll" Mqfpma32.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1384 wrote to memory of 1284 1384 d4ae787422ae5693b83874189a6a202d_NEIKI.exe 90 PID 1384 wrote to memory of 1284 1384 d4ae787422ae5693b83874189a6a202d_NEIKI.exe 90 PID 1384 wrote to memory of 1284 1384 d4ae787422ae5693b83874189a6a202d_NEIKI.exe 90 PID 1284 wrote to memory of 2448 1284 Afcmfe32.exe 91 PID 1284 wrote to memory of 2448 1284 Afcmfe32.exe 91 PID 1284 wrote to memory of 2448 1284 Afcmfe32.exe 91 PID 2448 wrote to memory of 4180 2448 Ddmhhd32.exe 92 PID 2448 wrote to memory of 4180 2448 Ddmhhd32.exe 92 PID 2448 wrote to memory of 4180 2448 Ddmhhd32.exe 92 PID 4180 wrote to memory of 3828 4180 Ephbhd32.exe 93 PID 4180 wrote to memory of 3828 4180 Ephbhd32.exe 93 PID 4180 wrote to memory of 3828 4180 Ephbhd32.exe 93 PID 3828 wrote to memory of 1784 3828 Fggdpnkf.exe 94 PID 3828 wrote to memory of 1784 3828 Fggdpnkf.exe 94 PID 3828 wrote to memory of 1784 3828 Fggdpnkf.exe 94 PID 1784 wrote to memory of 1272 1784 Fqdbdbna.exe 95 PID 1784 wrote to memory of 1272 1784 Fqdbdbna.exe 95 PID 1784 wrote to memory of 1272 1784 Fqdbdbna.exe 95 PID 1272 wrote to memory of 2892 1272 Ggepalof.exe 96 PID 1272 wrote to memory of 2892 1272 Ggepalof.exe 96 PID 1272 wrote to memory of 2892 1272 Ggepalof.exe 96 PID 2892 wrote to memory of 3260 2892 Gbpnjdkg.exe 97 PID 2892 wrote to memory of 3260 2892 Gbpnjdkg.exe 97 PID 2892 wrote to memory of 3260 2892 Gbpnjdkg.exe 97 PID 3260 wrote to memory of 1020 3260 Hbiapb32.exe 98 PID 3260 wrote to memory of 1020 3260 Hbiapb32.exe 98 PID 3260 wrote to memory of 1020 3260 Hbiapb32.exe 98 PID 1020 wrote to memory of 2240 1020 Hannao32.exe 99 PID 1020 wrote to memory of 2240 1020 Hannao32.exe 99 PID 1020 wrote to memory of 2240 1020 Hannao32.exe 99 PID 2240 wrote to memory of 3888 2240 Ilfodgeg.exe 100 PID 2240 wrote to memory of 3888 2240 Ilfodgeg.exe 100 PID 2240 wrote to memory of 3888 2240 Ilfodgeg.exe 100 PID 3888 wrote to memory of 3576 3888 Infhebbh.exe 101 PID 3888 wrote to memory of 3576 3888 Infhebbh.exe 101 PID 3888 wrote to memory of 3576 3888 Infhebbh.exe 101 PID 3576 wrote to memory of 3644 3576 Jnnnfalp.exe 102 PID 3576 wrote to memory of 3644 3576 Jnnnfalp.exe 102 PID 3576 wrote to memory of 3644 3576 Jnnnfalp.exe 102 PID 3644 wrote to memory of 568 3644 Jlidpe32.exe 103 PID 3644 wrote to memory of 568 3644 Jlidpe32.exe 103 PID 3644 wrote to memory of 568 3644 Jlidpe32.exe 103 PID 568 wrote to memory of 2256 568 Klbgfc32.exe 104 PID 568 wrote to memory of 2256 568 Klbgfc32.exe 104 PID 568 wrote to memory of 2256 568 Klbgfc32.exe 104 PID 2256 wrote to memory of 3176 2256 Mhiabbdi.exe 105 PID 2256 wrote to memory of 3176 2256 Mhiabbdi.exe 105 PID 2256 wrote to memory of 3176 2256 Mhiabbdi.exe 105 PID 3176 wrote to memory of 4540 3176 Nlnpio32.exe 106 PID 3176 wrote to memory of 4540 3176 Nlnpio32.exe 106 PID 3176 wrote to memory of 4540 3176 Nlnpio32.exe 106 PID 4540 wrote to memory of 4760 4540 Napameoi.exe 107 PID 4540 wrote to memory of 4760 4540 Napameoi.exe 107 PID 4540 wrote to memory of 4760 4540 Napameoi.exe 107 PID 4760 wrote to memory of 2988 4760 Odgqopeb.exe 108 PID 4760 wrote to memory of 2988 4760 Odgqopeb.exe 108 PID 4760 wrote to memory of 2988 4760 Odgqopeb.exe 108 PID 2988 wrote to memory of 3732 2988 Pmjhlklg.exe 109 PID 2988 wrote to memory of 3732 2988 Pmjhlklg.exe 109 PID 2988 wrote to memory of 3732 2988 Pmjhlklg.exe 109 PID 3732 wrote to memory of 1976 3732 Aflpkpjm.exe 110 PID 3732 wrote to memory of 1976 3732 Aflpkpjm.exe 110 PID 3732 wrote to memory of 1976 3732 Aflpkpjm.exe 110 PID 1976 wrote to memory of 4368 1976 Ammnhilb.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\d4ae787422ae5693b83874189a6a202d_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\d4ae787422ae5693b83874189a6a202d_NEIKI.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Windows\SysWOW64\Afcmfe32.exeC:\Windows\system32\Afcmfe32.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Windows\SysWOW64\Ddmhhd32.exeC:\Windows\system32\Ddmhhd32.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Windows\SysWOW64\Ephbhd32.exeC:\Windows\system32\Ephbhd32.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Windows\SysWOW64\Fggdpnkf.exeC:\Windows\system32\Fggdpnkf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Windows\SysWOW64\Fqdbdbna.exeC:\Windows\system32\Fqdbdbna.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Windows\SysWOW64\Ggepalof.exeC:\Windows\system32\Ggepalof.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Windows\SysWOW64\Gbpnjdkg.exeC:\Windows\system32\Gbpnjdkg.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Windows\SysWOW64\Hbiapb32.exeC:\Windows\system32\Hbiapb32.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Windows\SysWOW64\Hannao32.exeC:\Windows\system32\Hannao32.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Windows\SysWOW64\Ilfodgeg.exeC:\Windows\system32\Ilfodgeg.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Windows\SysWOW64\Infhebbh.exeC:\Windows\system32\Infhebbh.exe12⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Windows\SysWOW64\Jnnnfalp.exeC:\Windows\system32\Jnnnfalp.exe13⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Windows\SysWOW64\Jlidpe32.exeC:\Windows\system32\Jlidpe32.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Windows\SysWOW64\Klbgfc32.exeC:\Windows\system32\Klbgfc32.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:568 -
C:\Windows\SysWOW64\Mhiabbdi.exeC:\Windows\system32\Mhiabbdi.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Windows\SysWOW64\Nlnpio32.exeC:\Windows\system32\Nlnpio32.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Windows\SysWOW64\Napameoi.exeC:\Windows\system32\Napameoi.exe18⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Windows\SysWOW64\Odgqopeb.exeC:\Windows\system32\Odgqopeb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Windows\SysWOW64\Pmjhlklg.exeC:\Windows\system32\Pmjhlklg.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Windows\SysWOW64\Aflpkpjm.exeC:\Windows\system32\Aflpkpjm.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Windows\SysWOW64\Ammnhilb.exeC:\Windows\system32\Ammnhilb.exe22⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\SysWOW64\Cemeoh32.exeC:\Windows\system32\Cemeoh32.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4368 -
C:\Windows\SysWOW64\Ddekmo32.exeC:\Windows\system32\Ddekmo32.exe24⤵
- Executes dropped EXE
PID:2520 -
C:\Windows\SysWOW64\Ecoaijio.exeC:\Windows\system32\Ecoaijio.exe25⤵
- Executes dropped EXE
PID:4384 -
C:\Windows\SysWOW64\Eegqldqg.exeC:\Windows\system32\Eegqldqg.exe26⤵
- Executes dropped EXE
PID:3656 -
C:\Windows\SysWOW64\Fpandm32.exeC:\Windows\system32\Fpandm32.exe27⤵
- Executes dropped EXE
PID:3984 -
C:\Windows\SysWOW64\Ffpcbchm.exeC:\Windows\system32\Ffpcbchm.exe28⤵
- Executes dropped EXE
PID:1776 -
C:\Windows\SysWOW64\Gqkajk32.exeC:\Windows\system32\Gqkajk32.exe29⤵
- Executes dropped EXE
PID:644 -
C:\Windows\SysWOW64\Hfnpca32.exeC:\Windows\system32\Hfnpca32.exe30⤵
- Executes dropped EXE
PID:4680 -
C:\Windows\SysWOW64\Hjcojo32.exeC:\Windows\system32\Hjcojo32.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2364 -
C:\Windows\SysWOW64\Kaioidkh.exeC:\Windows\system32\Kaioidkh.exe32⤵
- Executes dropped EXE
PID:2792 -
C:\Windows\SysWOW64\Leqkeajd.exeC:\Windows\system32\Leqkeajd.exe33⤵
- Executes dropped EXE
PID:3916 -
C:\Windows\SysWOW64\Lmqiec32.exeC:\Windows\system32\Lmqiec32.exe34⤵
- Executes dropped EXE
PID:2392 -
C:\Windows\SysWOW64\Nkpijfgf.exeC:\Windows\system32\Nkpijfgf.exe35⤵
- Executes dropped EXE
PID:4456 -
C:\Windows\SysWOW64\Nhdicjfp.exeC:\Windows\system32\Nhdicjfp.exe36⤵
- Executes dropped EXE
PID:1596 -
C:\Windows\SysWOW64\Odbpij32.exeC:\Windows\system32\Odbpij32.exe37⤵
- Executes dropped EXE
PID:2216 -
C:\Windows\SysWOW64\Oggbfdog.exeC:\Windows\system32\Oggbfdog.exe38⤵
- Executes dropped EXE
PID:4636 -
C:\Windows\SysWOW64\Okeklcen.exeC:\Windows\system32\Okeklcen.exe39⤵
- Executes dropped EXE
PID:3924 -
C:\Windows\SysWOW64\Pnhacn32.exeC:\Windows\system32\Pnhacn32.exe40⤵
- Executes dropped EXE
PID:4800 -
C:\Windows\SysWOW64\Qbmpjkqk.exeC:\Windows\system32\Qbmpjkqk.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3036 -
C:\Windows\SysWOW64\Abdfkj32.exeC:\Windows\system32\Abdfkj32.exe42⤵
- Executes dropped EXE
PID:4324 -
C:\Windows\SysWOW64\Agaoca32.exeC:\Windows\system32\Agaoca32.exe43⤵
- Executes dropped EXE
PID:3052 -
C:\Windows\SysWOW64\Bpdfpmoo.exeC:\Windows\system32\Bpdfpmoo.exe44⤵
- Executes dropped EXE
PID:1360 -
C:\Windows\SysWOW64\Cbihmg32.exeC:\Windows\system32\Cbihmg32.exe45⤵
- Executes dropped EXE
PID:3308 -
C:\Windows\SysWOW64\Cnpibh32.exeC:\Windows\system32\Cnpibh32.exe46⤵
- Executes dropped EXE
PID:2548 -
C:\Windows\SysWOW64\Cldjkl32.exeC:\Windows\system32\Cldjkl32.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3096 -
C:\Windows\SysWOW64\Clffalkf.exeC:\Windows\system32\Clffalkf.exe48⤵
- Executes dropped EXE
PID:1232 -
C:\Windows\SysWOW64\Dhmgfm32.exeC:\Windows\system32\Dhmgfm32.exe49⤵
- Executes dropped EXE
PID:4812 -
C:\Windows\SysWOW64\Dlkplk32.exeC:\Windows\system32\Dlkplk32.exe50⤵
- Executes dropped EXE
PID:2324 -
C:\Windows\SysWOW64\Dhbqalle.exeC:\Windows\system32\Dhbqalle.exe51⤵
- Executes dropped EXE
- Modifies registry class
PID:4028 -
C:\Windows\SysWOW64\Eemgkpef.exeC:\Windows\system32\Eemgkpef.exe52⤵
- Executes dropped EXE
PID:4024 -
C:\Windows\SysWOW64\Ijgakgej.exeC:\Windows\system32\Ijgakgej.exe53⤵
- Executes dropped EXE
PID:4508 -
C:\Windows\SysWOW64\Jfjakgpa.exeC:\Windows\system32\Jfjakgpa.exe54⤵
- Executes dropped EXE
PID:4008 -
C:\Windows\SysWOW64\Kqdodo32.exeC:\Windows\system32\Kqdodo32.exe55⤵
- Executes dropped EXE
PID:3328 -
C:\Windows\SysWOW64\Kfjjbd32.exeC:\Windows\system32\Kfjjbd32.exe56⤵
- Executes dropped EXE
PID:4820 -
C:\Windows\SysWOW64\Lpelqj32.exeC:\Windows\system32\Lpelqj32.exe57⤵
- Executes dropped EXE
PID:2808 -
C:\Windows\SysWOW64\Mmpbkm32.exeC:\Windows\system32\Mmpbkm32.exe58⤵
- Executes dropped EXE
PID:4908 -
C:\Windows\SysWOW64\Mpqklh32.exeC:\Windows\system32\Mpqklh32.exe59⤵
- Executes dropped EXE
PID:3804 -
C:\Windows\SysWOW64\Mapgfk32.exeC:\Windows\system32\Mapgfk32.exe60⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2452 -
C:\Windows\SysWOW64\Nmnnlk32.exeC:\Windows\system32\Nmnnlk32.exe61⤵
- Executes dropped EXE
PID:4500 -
C:\Windows\SysWOW64\Nhcbidcd.exeC:\Windows\system32\Nhcbidcd.exe62⤵
- Executes dropped EXE
PID:3700 -
C:\Windows\SysWOW64\Oacmchcl.exeC:\Windows\system32\Oacmchcl.exe63⤵
- Executes dropped EXE
PID:3768 -
C:\Windows\SysWOW64\Odhppclh.exeC:\Windows\system32\Odhppclh.exe64⤵
- Executes dropped EXE
PID:1432 -
C:\Windows\SysWOW64\Pdklebje.exeC:\Windows\system32\Pdklebje.exe65⤵
- Executes dropped EXE
PID:4436 -
C:\Windows\SysWOW64\Pnlcdg32.exeC:\Windows\system32\Pnlcdg32.exe66⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:4396 -
C:\Windows\SysWOW64\Qnopjfgi.exeC:\Windows\system32\Qnopjfgi.exe67⤵PID:2568
-
C:\Windows\SysWOW64\Aamipe32.exeC:\Windows\system32\Aamipe32.exe68⤵PID:1812
-
C:\Windows\SysWOW64\Ajhndgjj.exeC:\Windows\system32\Ajhndgjj.exe69⤵PID:928
-
C:\Windows\SysWOW64\Bjcmpepm.exeC:\Windows\system32\Bjcmpepm.exe70⤵PID:4580
-
C:\Windows\SysWOW64\Cqiehnml.exeC:\Windows\system32\Cqiehnml.exe71⤵PID:4348
-
C:\Windows\SysWOW64\Cbnknpqj.exeC:\Windows\system32\Cbnknpqj.exe72⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:1960 -
C:\Windows\SysWOW64\Dehgejep.exeC:\Windows\system32\Dehgejep.exe73⤵
- Modifies registry class
PID:3456 -
C:\Windows\SysWOW64\Eangjkkd.exeC:\Windows\system32\Eangjkkd.exe74⤵PID:1740
-
C:\Windows\SysWOW64\Ehklmd32.exeC:\Windows\system32\Ehklmd32.exe75⤵PID:680
-
C:\Windows\SysWOW64\Eliecc32.exeC:\Windows\system32\Eliecc32.exe76⤵PID:3836
-
C:\Windows\SysWOW64\Fefcgh32.exeC:\Windows\system32\Fefcgh32.exe77⤵PID:4836
-
C:\Windows\SysWOW64\Fbnmkk32.exeC:\Windows\system32\Fbnmkk32.exe78⤵PID:3632
-
C:\Windows\SysWOW64\Geabbfoc.exeC:\Windows\system32\Geabbfoc.exe79⤵PID:2704
-
C:\Windows\SysWOW64\Geflne32.exeC:\Windows\system32\Geflne32.exe80⤵PID:3880
-
C:\Windows\SysWOW64\Hhiaepfl.exeC:\Windows\system32\Hhiaepfl.exe81⤵PID:3280
-
C:\Windows\SysWOW64\Hembndee.exeC:\Windows\system32\Hembndee.exe82⤵PID:4180
-
C:\Windows\SysWOW64\Hccomh32.exeC:\Windows\system32\Hccomh32.exe83⤵
- Drops file in System32 directory
PID:4336 -
C:\Windows\SysWOW64\Iheaqolo.exeC:\Windows\system32\Iheaqolo.exe84⤵PID:2200
-
C:\Windows\SysWOW64\Ioafchai.exeC:\Windows\system32\Ioafchai.exe85⤵PID:4964
-
C:\Windows\SysWOW64\Jokiig32.exeC:\Windows\system32\Jokiig32.exe86⤵PID:3480
-
C:\Windows\SysWOW64\Jbkbkbfo.exeC:\Windows\system32\Jbkbkbfo.exe87⤵PID:2868
-
C:\Windows\SysWOW64\Jcmkjeko.exeC:\Windows\system32\Jcmkjeko.exe88⤵PID:1696
-
C:\Windows\SysWOW64\Kbbhka32.exeC:\Windows\system32\Kbbhka32.exe89⤵PID:3524
-
C:\Windows\SysWOW64\Kmmedi32.exeC:\Windows\system32\Kmmedi32.exe90⤵PID:776
-
C:\Windows\SysWOW64\Kjqfmn32.exeC:\Windows\system32\Kjqfmn32.exe91⤵PID:2312
-
C:\Windows\SysWOW64\Lcndab32.exeC:\Windows\system32\Lcndab32.exe92⤵PID:3000
-
C:\Windows\SysWOW64\Lpdefc32.exeC:\Windows\system32\Lpdefc32.exe93⤵PID:3888
-
C:\Windows\SysWOW64\Lcbmlbig.exeC:\Windows\system32\Lcbmlbig.exe94⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:1968 -
C:\Windows\SysWOW64\Llmbqdfb.exeC:\Windows\system32\Llmbqdfb.exe95⤵PID:4604
-
C:\Windows\SysWOW64\Ljoboloa.exeC:\Windows\system32\Ljoboloa.exe96⤵PID:4572
-
C:\Windows\SysWOW64\Mcicma32.exeC:\Windows\system32\Mcicma32.exe97⤵
- Drops file in System32 directory
PID:2892 -
C:\Windows\SysWOW64\Mppdbb32.exeC:\Windows\system32\Mppdbb32.exe98⤵PID:3592
-
C:\Windows\SysWOW64\Mpbaga32.exeC:\Windows\system32\Mpbaga32.exe99⤵
- Modifies registry class
PID:852 -
C:\Windows\SysWOW64\Mjheejff.exeC:\Windows\system32\Mjheejff.exe100⤵PID:5168
-
C:\Windows\SysWOW64\Mfofjk32.exeC:\Windows\system32\Mfofjk32.exe101⤵PID:5212
-
C:\Windows\SysWOW64\Nffljjfc.exeC:\Windows\system32\Nffljjfc.exe102⤵
- Modifies registry class
PID:5256 -
C:\Windows\SysWOW64\Nfhipj32.exeC:\Windows\system32\Nfhipj32.exe103⤵PID:5300
-
C:\Windows\SysWOW64\Ndliin32.exeC:\Windows\system32\Ndliin32.exe104⤵PID:5344
-
C:\Windows\SysWOW64\Omdnbd32.exeC:\Windows\system32\Omdnbd32.exe105⤵PID:5388
-
C:\Windows\SysWOW64\Ojmgggdo.exeC:\Windows\system32\Ojmgggdo.exe106⤵PID:5432
-
C:\Windows\SysWOW64\Ofdhlh32.exeC:\Windows\system32\Ofdhlh32.exe107⤵PID:5480
-
C:\Windows\SysWOW64\Pkkdhe32.exeC:\Windows\system32\Pkkdhe32.exe108⤵PID:5524
-
C:\Windows\SysWOW64\Pdchakoo.exeC:\Windows\system32\Pdchakoo.exe109⤵PID:5564
-
C:\Windows\SysWOW64\Qlomemlj.exeC:\Windows\system32\Qlomemlj.exe110⤵PID:5616
-
C:\Windows\SysWOW64\Acdeneij.exeC:\Windows\system32\Acdeneij.exe111⤵
- Drops file in System32 directory
PID:5656 -
C:\Windows\SysWOW64\Bcinie32.exeC:\Windows\system32\Bcinie32.exe112⤵PID:5700
-
C:\Windows\SysWOW64\Bnobfn32.exeC:\Windows\system32\Bnobfn32.exe113⤵PID:5744
-
C:\Windows\SysWOW64\Ccbaoc32.exeC:\Windows\system32\Ccbaoc32.exe114⤵PID:5788
-
C:\Windows\SysWOW64\Cdbmifdl.exeC:\Windows\system32\Cdbmifdl.exe115⤵PID:5832
-
C:\Windows\SysWOW64\Cmmbmiag.exeC:\Windows\system32\Cmmbmiag.exe116⤵PID:5880
-
C:\Windows\SysWOW64\Dqdnjfpc.exeC:\Windows\system32\Dqdnjfpc.exe117⤵PID:5916
-
C:\Windows\SysWOW64\Dgnffp32.exeC:\Windows\system32\Dgnffp32.exe118⤵
- Drops file in System32 directory
PID:5964 -
C:\Windows\SysWOW64\Djmbbk32.exeC:\Windows\system32\Djmbbk32.exe119⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6012 -
C:\Windows\SysWOW64\Dcegkamd.exeC:\Windows\system32\Dcegkamd.exe120⤵
- Drops file in System32 directory
PID:6056 -
C:\Windows\SysWOW64\Dmnkdfce.exeC:\Windows\system32\Dmnkdfce.exe121⤵PID:6100
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-