njrat | b5e7ec62583d2fdd1cc3d37e9fc9b183442ccc958e8c10dea0ccce6c5d8a3dfe

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 22:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2199f5511b57192f27f94d15c2646f30_NeikiAnalytics.exe
Size 337KB
Sample240510-2tbe8shb28
SHA256 b5e7ec62583d2fdd1cc3d37e9fc9b183442ccc958e8c10dea0ccce6c5d8a3dfe
MD5 2199f5511b57192f27f94d15c2646f30
SHA1 3e258e123e10096130df1d6808862e41daa7b922
SHA512 bd05807a876a374a33cee528045447da28b08a01e6907cfdb3d849dd4fa8cedb5197c5c1154e68757a2fcec3ec4ca5a5456c7afc518715b458f500b1222aae77
SSDEEP 3072:6CQ9zlwTXsd7wHZVXgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:6CQ9NiZVX1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

njrat persistence trojan

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kkpnlm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mnfipekh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ndbnboqb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nbkhfc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmccchkn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lnjjdgee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mkpgck32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngcgcjnc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njacpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jaimbj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jfkoeppq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpfijcfl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nbkhfc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jaimbj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jjbako32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lmccchkn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncihikcg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdkhapfj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnfipekh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njacpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jjbako32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lnepih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lnjjdgee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ngcgcjnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lpappc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lcbiao32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nafokcol.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jdhine32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kgbefoji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kgbefoji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kipabjil.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kibnhjgj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kibnhjgj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcbiao32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lknjmkdo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	2199f5511b57192f27f94d15c2646f30_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kbapjafe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kbdmpqcb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kkpnlm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkbchk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdffocib.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkpgck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mkbchk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jfkoeppq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lknjmkdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mpaifalo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kbapjafe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lnepih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lpfijcfl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcbahlip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mcbahlip.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kacphh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kbdmpqcb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdffocib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mdkhapfj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpappc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpaifalo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	2199f5511b57192f27f94d15c2646f30_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jidbflcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jidbflcj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kipabjil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ncihikcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jdhine32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kacphh32.exe

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Executes dropped EXE 33 IoCs

pid	Process
964	Jaimbj32.exe
4160	Jdhine32.exe
3576	Jjbako32.exe
2948	Jidbflcj.exe
1032	Jfkoeppq.exe
4668	Kbapjafe.exe
4444	Kacphh32.exe
1460	Kbdmpqcb.exe
4312	Kgbefoji.exe
4500	Kipabjil.exe
1568	Kdffocib.exe
1020	Kkpnlm32.exe
3160	Kibnhjgj.exe
3108	Lmccchkn.exe
4524	Lpappc32.exe
2260	Lnepih32.exe
4672	Lcbiao32.exe
440	Lpfijcfl.exe
4804	Lnjjdgee.exe
2676	Lknjmkdo.exe
2788	Mkpgck32.exe
2292	Mkbchk32.exe
3228	Mdkhapfj.exe
3380	Mpaifalo.exe
3508	Mnfipekh.exe
1864	Mcbahlip.exe
864	Ndbnboqb.exe
1144	Nafokcol.exe
2096	Ngcgcjnc.exe
3600	Njacpf32.exe
4428	Ncihikcg.exe
4480	Nbkhfc32.exe
4776	Nkcmohbg.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Njacpf32.exe	Ngcgcjnc.exe
File opened for modification	C:\Windows\SysWOW64\Kbdmpqcb.exe	Kacphh32.exe
File created	C:\Windows\SysWOW64\Lnjjdgee.exe	Lpfijcfl.exe
File created	C:\Windows\SysWOW64\Jnngob32.dll	Lnjjdgee.exe
File opened for modification	C:\Windows\SysWOW64\Mkpgck32.exe	Lknjmkdo.exe
File created	C:\Windows\SysWOW64\Mkbchk32.exe	Mkpgck32.exe
File created	C:\Windows\SysWOW64\Gqffnmfa.dll	Mkpgck32.exe
File created	C:\Windows\SysWOW64\Fldggfbc.dll	Lpfijcfl.exe
File created	C:\Windows\SysWOW64\Dihcoe32.dll	Mcbahlip.exe
File created	C:\Windows\SysWOW64\Jaimbj32.exe	2199f5511b57192f27f94d15c2646f30_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\Kbmfdgkm.dll	Kgbefoji.exe
File opened for modification	C:\Windows\SysWOW64\Jaimbj32.exe	2199f5511b57192f27f94d15c2646f30_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\Ghmfdf32.dll	Jaimbj32.exe
File opened for modification	C:\Windows\SysWOW64\Nafokcol.exe	Ndbnboqb.exe
File created	C:\Windows\SysWOW64\Lpfijcfl.exe	Lcbiao32.exe
File opened for modification	C:\Windows\SysWOW64\Jdhine32.exe	Jaimbj32.exe
File opened for modification	C:\Windows\SysWOW64\Jjbako32.exe	Jdhine32.exe
File opened for modification	C:\Windows\SysWOW64\Jfkoeppq.exe	Jidbflcj.exe
File created	C:\Windows\SysWOW64\Akihmf32.dll	Kipabjil.exe
File created	C:\Windows\SysWOW64\Lcbiao32.exe	Lnepih32.exe
File created	C:\Windows\SysWOW64\Mdkhapfj.exe	Mkbchk32.exe
File opened for modification	C:\Windows\SysWOW64\Ndbnboqb.exe	Mcbahlip.exe
File opened for modification	C:\Windows\SysWOW64\Nbkhfc32.exe	Ncihikcg.exe
File created	C:\Windows\SysWOW64\Kdffocib.exe	Kipabjil.exe
File created	C:\Windows\SysWOW64\Lnepih32.exe	Lpappc32.exe
File created	C:\Windows\SysWOW64\Mcbahlip.exe	Mnfipekh.exe
File created	C:\Windows\SysWOW64\Nbkhfc32.exe	Ncihikcg.exe
File created	C:\Windows\SysWOW64\Leqcod32.dll	2199f5511b57192f27f94d15c2646f30_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\Kgbefoji.exe	Kbdmpqcb.exe
File created	C:\Windows\SysWOW64\Kkpnlm32.exe	Kdffocib.exe
File created	C:\Windows\SysWOW64\Codhke32.dll	Mpaifalo.exe
File created	C:\Windows\SysWOW64\Kbdmpqcb.exe	Kacphh32.exe
File created	C:\Windows\SysWOW64\Ojmmkpmf.dll	Kacphh32.exe
File opened for modification	C:\Windows\SysWOW64\Lmccchkn.exe	Kibnhjgj.exe
File opened for modification	C:\Windows\SysWOW64\Mkbchk32.exe	Mkpgck32.exe
File created	C:\Windows\SysWOW64\Lelgbkio.dll	Mnfipekh.exe
File opened for modification	C:\Windows\SysWOW64\Ncihikcg.exe	Njacpf32.exe
File created	C:\Windows\SysWOW64\Kibnhjgj.exe	Kkpnlm32.exe
File created	C:\Windows\SysWOW64\Lidmdfdo.dll	Lnepih32.exe
File opened for modification	C:\Windows\SysWOW64\Njacpf32.exe	Ngcgcjnc.exe
File created	C:\Windows\SysWOW64\Lmbnpm32.dll	Ngcgcjnc.exe
File opened for modification	C:\Windows\SysWOW64\Lknjmkdo.exe	Lnjjdgee.exe
File created	C:\Windows\SysWOW64\Mnfipekh.exe	Mpaifalo.exe
File created	C:\Windows\SysWOW64\Jdhine32.exe	Jaimbj32.exe
File created	C:\Windows\SysWOW64\Hnibdpde.dll	Nbkhfc32.exe
File created	C:\Windows\SysWOW64\Mfpoqooh.dll	Jidbflcj.exe
File opened for modification	C:\Windows\SysWOW64\Kacphh32.exe	Kbapjafe.exe
File created	C:\Windows\SysWOW64\Milgab32.dll	Kbdmpqcb.exe
File opened for modification	C:\Windows\SysWOW64\Kkpnlm32.exe	Kdffocib.exe
File created	C:\Windows\SysWOW64\Ogndib32.dll	Lmccchkn.exe
File opened for modification	C:\Windows\SysWOW64\Lnepih32.exe	Lpappc32.exe
File created	C:\Windows\SysWOW64\Feambf32.dll	Jdhine32.exe
File created	C:\Windows\SysWOW64\Kacphh32.exe	Kbapjafe.exe
File created	C:\Windows\SysWOW64\Eeecjqkd.dll	Kdffocib.exe
File created	C:\Windows\SysWOW64\Lmccchkn.exe	Kibnhjgj.exe
File created	C:\Windows\SysWOW64\Mbaohn32.dll	Lcbiao32.exe
File opened for modification	C:\Windows\SysWOW64\Mpaifalo.exe	Mdkhapfj.exe
File opened for modification	C:\Windows\SysWOW64\Jidbflcj.exe	Jjbako32.exe
File created	C:\Windows\SysWOW64\Kbapjafe.exe	Jfkoeppq.exe
File created	C:\Windows\SysWOW64\Majknlkd.dll	Nafokcol.exe
File opened for modification	C:\Windows\SysWOW64\Kipabjil.exe	Kgbefoji.exe
File opened for modification	C:\Windows\SysWOW64\Lpappc32.exe	Lmccchkn.exe
File opened for modification	C:\Windows\SysWOW64\Mnfipekh.exe	Mpaifalo.exe
File created	C:\Windows\SysWOW64\Nafokcol.exe	Ndbnboqb.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
512	4776	WerFault.exe	118

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfbhfihj.dll"	Lknjmkdo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lknjmkdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dihcoe32.dll"	Mcbahlip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jidbflcj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kacphh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lcbiao32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ngcgcjnc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jidbflcj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lpappc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mdkhapfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jfkoeppq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lmccchkn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kkpnlm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogndib32.dll"	Lmccchkn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lnepih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mcbahlip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcoegc32.dll"	Ndbnboqb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ndbnboqb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kipabjil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jnngob32.dll"	Lnjjdgee.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nbkhfc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lmccchkn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mbaohn32.dll"	Lcbiao32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mpaifalo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nafokcol.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kbapjafe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lnjjdgee.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	2199f5511b57192f27f94d15c2646f30_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jjbako32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kacphh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghmfdf32.dll"	Jaimbj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkckjila.dll"	Njacpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	2199f5511b57192f27f94d15c2646f30_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kipabjil.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kdffocib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mkbchk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lelgbkio.dll"	Mnfipekh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nafokcol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lknjmkdo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jfkoeppq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Milgab32.dll"	Kbdmpqcb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kkpnlm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kibnhjgj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	2199f5511b57192f27f94d15c2646f30_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Feambf32.dll"	Jdhine32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ojmmkpmf.dll"	Kacphh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lidmdfdo.dll"	Lnepih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mnfipekh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mkbchk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	2199f5511b57192f27f94d15c2646f30_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jaimbj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kibnhjgj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mdkhapfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mpaifalo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kbmfdgkm.dll"	Kgbefoji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eeecjqkd.dll"	Kdffocib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lpfijcfl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jjbako32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kbdmpqcb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bpcbnd32.dll"	Kkpnlm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jdhine32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Honcnp32.dll"	Jjbako32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mfpoqooh.dll"	Jidbflcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjblgaie.dll"	Kbapjafe.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 932 wrote to memory of 964	932	2199f5511b57192f27f94d15c2646f30_NeikiAnalytics.exe	82
PID 932 wrote to memory of 964	932	2199f5511b57192f27f94d15c2646f30_NeikiAnalytics.exe	82
PID 932 wrote to memory of 964	932	2199f5511b57192f27f94d15c2646f30_NeikiAnalytics.exe	82
PID 964 wrote to memory of 4160	964	Jaimbj32.exe	83
PID 964 wrote to memory of 4160	964	Jaimbj32.exe	83
PID 964 wrote to memory of 4160	964	Jaimbj32.exe	83
PID 4160 wrote to memory of 3576	4160	Jdhine32.exe	84
PID 4160 wrote to memory of 3576	4160	Jdhine32.exe	84
PID 4160 wrote to memory of 3576	4160	Jdhine32.exe	84
PID 3576 wrote to memory of 2948	3576	Jjbako32.exe	85
PID 3576 wrote to memory of 2948	3576	Jjbako32.exe	85
PID 3576 wrote to memory of 2948	3576	Jjbako32.exe	85
PID 2948 wrote to memory of 1032	2948	Jidbflcj.exe	86
PID 2948 wrote to memory of 1032	2948	Jidbflcj.exe	86
PID 2948 wrote to memory of 1032	2948	Jidbflcj.exe	86
PID 1032 wrote to memory of 4668	1032	Jfkoeppq.exe	88
PID 1032 wrote to memory of 4668	1032	Jfkoeppq.exe	88
PID 1032 wrote to memory of 4668	1032	Jfkoeppq.exe	88
PID 4668 wrote to memory of 4444	4668	Kbapjafe.exe	90
PID 4668 wrote to memory of 4444	4668	Kbapjafe.exe	90
PID 4668 wrote to memory of 4444	4668	Kbapjafe.exe	90
PID 4444 wrote to memory of 1460	4444	Kacphh32.exe	91
PID 4444 wrote to memory of 1460	4444	Kacphh32.exe	91
PID 4444 wrote to memory of 1460	4444	Kacphh32.exe	91
PID 1460 wrote to memory of 4312	1460	Kbdmpqcb.exe	93
PID 1460 wrote to memory of 4312	1460	Kbdmpqcb.exe	93
PID 1460 wrote to memory of 4312	1460	Kbdmpqcb.exe	93
PID 4312 wrote to memory of 4500	4312	Kgbefoji.exe	94
PID 4312 wrote to memory of 4500	4312	Kgbefoji.exe	94
PID 4312 wrote to memory of 4500	4312	Kgbefoji.exe	94
PID 4500 wrote to memory of 1568	4500	Kipabjil.exe	95
PID 4500 wrote to memory of 1568	4500	Kipabjil.exe	95
PID 4500 wrote to memory of 1568	4500	Kipabjil.exe	95
PID 1568 wrote to memory of 1020	1568	Kdffocib.exe	96
PID 1568 wrote to memory of 1020	1568	Kdffocib.exe	96
PID 1568 wrote to memory of 1020	1568	Kdffocib.exe	96
PID 1020 wrote to memory of 3160	1020	Kkpnlm32.exe	97
PID 1020 wrote to memory of 3160	1020	Kkpnlm32.exe	97
PID 1020 wrote to memory of 3160	1020	Kkpnlm32.exe	97
PID 3160 wrote to memory of 3108	3160	Kibnhjgj.exe	98
PID 3160 wrote to memory of 3108	3160	Kibnhjgj.exe	98
PID 3160 wrote to memory of 3108	3160	Kibnhjgj.exe	98
PID 3108 wrote to memory of 4524	3108	Lmccchkn.exe	99
PID 3108 wrote to memory of 4524	3108	Lmccchkn.exe	99
PID 3108 wrote to memory of 4524	3108	Lmccchkn.exe	99
PID 4524 wrote to memory of 2260	4524	Lpappc32.exe	100
PID 4524 wrote to memory of 2260	4524	Lpappc32.exe	100
PID 4524 wrote to memory of 2260	4524	Lpappc32.exe	100
PID 2260 wrote to memory of 4672	2260	Lnepih32.exe	101
PID 2260 wrote to memory of 4672	2260	Lnepih32.exe	101
PID 2260 wrote to memory of 4672	2260	Lnepih32.exe	101
PID 4672 wrote to memory of 440	4672	Lcbiao32.exe	102
PID 4672 wrote to memory of 440	4672	Lcbiao32.exe	102
PID 4672 wrote to memory of 440	4672	Lcbiao32.exe	102
PID 440 wrote to memory of 4804	440	Lpfijcfl.exe	103
PID 440 wrote to memory of 4804	440	Lpfijcfl.exe	103
PID 440 wrote to memory of 4804	440	Lpfijcfl.exe	103
PID 4804 wrote to memory of 2676	4804	Lnjjdgee.exe	104
PID 4804 wrote to memory of 2676	4804	Lnjjdgee.exe	104
PID 4804 wrote to memory of 2676	4804	Lnjjdgee.exe	104
PID 2676 wrote to memory of 2788	2676	Lknjmkdo.exe	105
PID 2676 wrote to memory of 2788	2676	Lknjmkdo.exe	105
PID 2676 wrote to memory of 2788	2676	Lknjmkdo.exe	105
PID 2788 wrote to memory of 2292	2788	Mkpgck32.exe	106

C:\Users\Admin\AppData\Local\Temp\2199f5511b57192f27f94d15c2646f30_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2199f5511b57192f27f94d15c2646f30_NeikiAnalytics.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:932
- C:\Windows\SysWOW64\Jaimbj32.exe
  C:\Windows\system32\Jaimbj32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:964
- - C:\Windows\SysWOW64\Jdhine32.exe
    C:\Windows\system32\Jdhine32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4160
  - - C:\Windows\SysWOW64\Jjbako32.exe
      C:\Windows\system32\Jjbako32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3576
    - - C:\Windows\SysWOW64\Jidbflcj.exe
        
        C:\Windows\system32\Jidbflcj.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2948
      - C:\Windows\SysWOW64\Jfkoeppq.exe
        
        C:\Windows\system32\Jfkoeppq.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1032
        
        C:\Windows\SysWOW64\Kbapjafe.exe
        
        C:\Windows\system32\Kbapjafe.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4668
        
        C:\Windows\SysWOW64\Kacphh32.exe
        
        C:\Windows\system32\Kacphh32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4444
        
        C:\Windows\SysWOW64\Kbdmpqcb.exe
        
        C:\Windows\system32\Kbdmpqcb.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1460
        
        C:\Windows\SysWOW64\Kgbefoji.exe
        
        C:\Windows\system32\Kgbefoji.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4312
        
        C:\Windows\SysWOW64\Kipabjil.exe
        
        C:\Windows\system32\Kipabjil.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4500
        
        C:\Windows\SysWOW64\Kdffocib.exe
        
        C:\Windows\system32\Kdffocib.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1568
        
        C:\Windows\SysWOW64\Kkpnlm32.exe
        
        C:\Windows\system32\Kkpnlm32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1020
        
        C:\Windows\SysWOW64\Kibnhjgj.exe
        
        C:\Windows\system32\Kibnhjgj.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3160
        
        C:\Windows\SysWOW64\Lmccchkn.exe
        
        C:\Windows\system32\Lmccchkn.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3108
        
        C:\Windows\SysWOW64\Lpappc32.exe
        
        C:\Windows\system32\Lpappc32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4524
        
        C:\Windows\SysWOW64\Lnepih32.exe
        
        C:\Windows\system32\Lnepih32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2260
        
        C:\Windows\SysWOW64\Lcbiao32.exe
        
        C:\Windows\system32\Lcbiao32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4672
        
        C:\Windows\SysWOW64\Lpfijcfl.exe
        
        C:\Windows\system32\Lpfijcfl.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:440
        
        C:\Windows\SysWOW64\Lnjjdgee.exe
        
        C:\Windows\system32\Lnjjdgee.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4804
        
        C:\Windows\SysWOW64\Lknjmkdo.exe
        
        C:\Windows\system32\Lknjmkdo.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2676
        
        C:\Windows\SysWOW64\Mkpgck32.exe
        
        C:\Windows\system32\Mkpgck32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2788
        
        C:\Windows\SysWOW64\Mkbchk32.exe
        
        C:\Windows\system32\Mkbchk32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2292
        
        C:\Windows\SysWOW64\Mdkhapfj.exe
        
        C:\Windows\system32\Mdkhapfj.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3228
        
        C:\Windows\SysWOW64\Mpaifalo.exe
        
        C:\Windows\system32\Mpaifalo.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3380
        
        C:\Windows\SysWOW64\Mnfipekh.exe
        
        C:\Windows\system32\Mnfipekh.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3508
        
        C:\Windows\SysWOW64\Mcbahlip.exe
        
        C:\Windows\system32\Mcbahlip.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1864
        
        C:\Windows\SysWOW64\Ndbnboqb.exe
        
        C:\Windows\system32\Ndbnboqb.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:864
        
        C:\Windows\SysWOW64\Nafokcol.exe
        
        C:\Windows\system32\Nafokcol.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1144
        
        C:\Windows\SysWOW64\Ngcgcjnc.exe
        
        C:\Windows\system32\Ngcgcjnc.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2096
        
        C:\Windows\SysWOW64\Njacpf32.exe
        
        C:\Windows\system32\Njacpf32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3600
        
        C:\Windows\SysWOW64\Ncihikcg.exe
        
        C:\Windows\system32\Ncihikcg.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4428
        
        C:\Windows\SysWOW64\Nbkhfc32.exe
        
        C:\Windows\system32\Nbkhfc32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4480
        
        C:\Windows\SysWOW64\Nkcmohbg.exe
        
        C:\Windows\system32\Nkcmohbg.exe
        34⤵
        Executes dropped EXE
        
        PID:4776
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4776 -s 400
        35⤵
        Program crash
        
        PID:512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4776 -ip 4776
1⤵
PID:4304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Jaimbj32.exe

Path C:\Windows\SysWOW64\Jaimbj32.exe
Size 337KB
SHA256 104e96ce9849d9bdb8341cdebc30a6e08d751b253577cb0ae06bc037f5ef23aa
MD5 519d057da75e3eabc27364945989a3da
SHA1 fd81661766186cf11a97a2475c64c732e56ec61a
SHA512 243a3dc24e8945bdb89ae49da280fafb5ce97fb12fc8a4574e7ed67a624db5229c1fd9b246be914c11c8cdb47758fa0351f1957f21741036cfacfaaed88410f0
SSDEEP 3072:Qt6WuXWOO6xzShjgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:Qt6co4hj1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jdhine32.exe

Path C:\Windows\SysWOW64\Jdhine32.exe
Size 337KB
SHA256 15732cbfda86ac0eac3fe8337e265759f76579a1c4e381ae570c2a7ef6ab8f17
MD5 00ab4e07701a8af24bc37b192bd68528
SHA1 1f467ebc19cace5374875333e79b0000b5ac7892
SHA512 666cc9594b8480d988f453750fbdd996a576800812b2757664242f9b7c2d70d63cd0e69e70d09140d610ee9fce173997f7c27e5d1d0e7db35975789f8c3ec5d5
SSDEEP 3072:I+SWho82so+NQbdagYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:I+SMvFo+NQbda1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jfkoeppq.exe

Path C:\Windows\SysWOW64\Jfkoeppq.exe
Size 337KB
SHA256 b87045012554fd82956b67347cb9c9200a3be65cf2d0f5955360dab6de7d048b
MD5 a20987c8ff7ac7cda14cf0c363f62292
SHA1 2bc4365948008e71d44815a70d4d9de375626491
SHA512 fac20f0f740f53b1b4a463c1176db1b5cebe9bd7a1c6ce326c28b53b232b8395684402c0d465fc43ee9eb19c6eafe120a76cd154236050e1f50bc735ca59a81e
SSDEEP 3072:YCosRReD74HLgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:YCosWsHL1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jidbflcj.exe

Path C:\Windows\SysWOW64\Jidbflcj.exe
Size 337KB
SHA256 d270ceb08ee2e13ef951fe6f1077f5a29c4be18dac20b84beadb03f858d4efd6
MD5 1603bf6bff8ca1762bf3e988a47fa2f7
SHA1 696fc7e8ad0765321e4aa557f3c4060c06cf8c74
SHA512 a7f53de19aff7044f3532cb4eee2a6772efbfc36b0bf86a7d5c902086e538a6eebc71717c4a0cf5adfa7afa9c341f212ddb47766b285b1ad9b5693099193511c
SSDEEP 3072:sHfEFTCsn9Ws91A5egYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:sMFms4c1Ee1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jjbako32.exe

Path C:\Windows\SysWOW64\Jjbako32.exe
Size 337KB
SHA256 a34a9314312a7289e8e6a4309a0f3ecc1af876964188cb9503b587f942a75f33
MD5 78660ce968d75f61b44dd3d3300f9111
SHA1 e479f05d3dde577a26e0ed3c269c5cded555dc5f
SHA512 68801c2641d98260fc845e6c5524a3abefe8b99b9fd749a15fb9c7b014f43ee6736b90b0c6ae77dbbb73913f1621c6df5e3515152e9163606b5f295cc842ddb5
SSDEEP 6144:3TQEgQg3HHDAzcrNzA51+fIyG5jZkCwi8r:3TVbQpiZkCwiY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kacphh32.exe

Path C:\Windows\SysWOW64\Kacphh32.exe
Size 337KB
SHA256 c482e1df72435cd4ecd100767db87b87777480b3c951208ec23cc4010999647c
MD5 9699be1ed0e08d1c600863270952a43c
SHA1 77ded6abba01d9ed0057e1b1a0ba12e35ba1dbe5
SHA512 e66b56863c42009252102275e3c5d27d85ff310c85b731d6a0c7fcf877dd933ac5ab2525237dd91649974cde10475f93afec5f0348e393a42f112ad704183362
SSDEEP 3072:+WFvo8lofHjDtFgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:tbobBF1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kbapjafe.exe

Path C:\Windows\SysWOW64\Kbapjafe.exe
Size 337KB
SHA256 c5fc760e8f2e2646ec337e29dfa5b0db950a8325295d50fb321b56b28986d5f2
MD5 172c988d40cd4e3c67aa299714d2f447
SHA1 7e412407863adb394fee5114e15aaead03188d80
SHA512 b4db1822525a6a90e7d62bf296ccae0853fbb46b03a71784e55b8fe5c41677d9b2813443da96208ade4a266a0a730d121b09be79b7aa5c37a3c98e8d028b5e03
SSDEEP 3072:Gqglzn9ooFBOWKpeEGlJTbTtDgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:ClLhBKgEGlJ/TtD1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kbdmpqcb.exe

Path C:\Windows\SysWOW64\Kbdmpqcb.exe
Size 337KB
SHA256 3376faf05023c3381cd8b5b9ea26d4f05d6b6bd68c02a06d80da846a40e6f074
MD5 bb96a518dada7400bc777d2ffc1ce9df
SHA1 00215a72024765990229488082ceae37b5d586ad
SHA512 97332a67fb157c83e92f4b028c272830d8a9086036df027ab7f4db39f40eb6f17b2249035888ad673d59b5b7a789effb4845ab6d3bb3cbbc50e711d3c3eadd42
SSDEEP 3072:cRFLtid4sbwgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:cRFLtidRw1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kdffocib.exe

Path C:\Windows\SysWOW64\Kdffocib.exe
Size 337KB
SHA256 121707a23c4d8cb6735e40dc3ee72c28316ae8f019655ca924dafe57ad303fb5
MD5 d55a79c8294b9d57c0ed005fe18b04e2
SHA1 1874126b9272b1dccbc12bd11f6afc7ea981a035
SHA512 23014cbb0ddff748be9a17f8da9b1f64f780cc1900cc86daaea7a80c6ff815114c711c07ce893b0d7db7c6505aa2ffe8fdaefc8f1e72513ad7271d9655023b32
SSDEEP 3072:0evtBMb1lbOXTpuUoYDbzOx4yX3JIugYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc8:rVSxgoYDbCku1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kgbefoji.exe

Path C:\Windows\SysWOW64\Kgbefoji.exe
Size 337KB
SHA256 684eb01bb6eed2bc612062ec1aeed0412e467a098b356fa4d37bf3a8d2c74e40
MD5 f85cc969f90f52debbb66c314c2df5af
SHA1 e5a358f91789d7b6dfadd5ab2679124803f4d3b9
SHA512 6d5f3159da4f2ed427251c1eb5382f20581cb96848392b4bbeeec4bfac2691e2e5c9c0a6c6c806c4baae098bc40f8accea8e18bef67ed0f2bc36bfea99f0a403
SSDEEP 3072:tLOBqw1Xtlx69WmVKPNSgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:ltiHxlmVK1S1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kibnhjgj.exe

Path C:\Windows\SysWOW64\Kibnhjgj.exe
Size 337KB
SHA256 7130a07c61501ecb673e2562d966f79746d747ae3b796834bdb34c7909d26e84
MD5 4ece851a2594ca76ff8ace44c34a6f55
SHA1 d5f31bd4a37184eab4ff6333202cef9d8ac63093
SHA512 fb2cc02be972d6b87f67084855b1d2c0dfe6f047114a8c204a52c54ae7c7fa759e77d70ee0b92c81d98822862fc240d5d4d8a7b9941549bd5de8eb6f5f539fab
SSDEEP 3072:xRt1axwZ8be/QHFP/6gYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:xRtQq86o961+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kipabjil.exe

Path C:\Windows\SysWOW64\Kipabjil.exe
Size 337KB
SHA256 33ef0b9d2c41848a4c7322f3c50d90555d3c14d803d71789cead2e8c6d15995d
MD5 14cec704d666294b440777771b6a4ac0
SHA1 5ae8668893d79ef47fe6497e59cb3ec343e06b9a
SHA512 32a5d123232fbb6b1902f485f785a1c68a7816e8bf5a893b9d7b13b53df1634656f1ea62813461050f7e9b1685051fb26954c45d9d696b75fccf36575a61df90
SSDEEP 3072:G5uPdjg5xgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:AQUx1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kkpnlm32.exe

Path C:\Windows\SysWOW64\Kkpnlm32.exe
Size 337KB
SHA256 cf6229029e807d6b54cda43c34cb7305fad9fabcf6b9d087d3a0a78b97bf6608
MD5 503dbd35946fdd95e42c75c6175df91a
SHA1 4e7b67fd298c15a6783c9fae6a03f740daa8d3f8
SHA512 49262e04954e50dcf754af24ada0cfdcb647707f7d9c496486637e05c26559d0abc9b41b8a6eede9f33bd87a95fd47f36f870563794492ae29798991839094a0
SSDEEP 3072:98KHfTGZR33hispNNygYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:SKKXhVNNy1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lcbiao32.exe

Path C:\Windows\SysWOW64\Lcbiao32.exe
Size 337KB
SHA256 a411ba71323d7cf1451adaed7387c5ae2057c25f097f5d70fef4dfb46242bac9
MD5 fb69142ea190347e630f27a6c9d84471
SHA1 27bb8bca01067fd792bb69bb7e2652602ed32be4
SHA512 113d0e315b84592c4d2cd735ee38dc48f75eae5d45e934f1a4c36a4f2a376d4ec126813314f482a044acc4d74536401a06cac977422dd0ccb2ca8739a8bc450f
SSDEEP 3072:FGtLqDd/wEGNnTgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:FGkQT1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lknjmkdo.exe

Path C:\Windows\SysWOW64\Lknjmkdo.exe
Size 337KB
SHA256 80ac68832bedf3260492260bc0221a24e7e8346cce94633abfb602484b3f8017
MD5 839e2d87329d36c74ddb7b8f86c587f6
SHA1 7398dc814552e9be83e077099c70ca8dfc266720
SHA512 14688dd8de5fdd8a2c0da3ee76e44ef2278e6cab8afd9f7d86fa4a31ca19502fde9fd7e52253aea97c8556c73cca79620cd572eb6e24e96ee5257725bcae8f2c
SSDEEP 3072:mDtYqGIrh7PUUgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:mDWqXhTUU1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lmccchkn.exe

Path C:\Windows\SysWOW64\Lmccchkn.exe
Size 337KB
SHA256 a462d31123473f1e07e7ab722493ba15b0a657f4a666920077e02f8c6f3b34eb
MD5 7a15e2095394617b6a8c2596dcf7c358
SHA1 4713cde3d938e22ee6eaea351a36492f424da5ec
SHA512 6e195ec64505d719663342e9749bbf25f5c5045cb152ed4855ae469a7453850bbc05e87b3342ad6751c5cf8d96f709fb337c7be138601a6528473df74e6d1490
SSDEEP 3072:FSu6hAJ33tJlJ4uD8T2wbDgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:B6pbD1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lnepih32.exe

Path C:\Windows\SysWOW64\Lnepih32.exe
Size 337KB
SHA256 c2afbfb50744cef78d912f659adaced37d5613406773681ea683a7ea89cb5a24
MD5 d0706a080e4ffdb2525d35a01f4fa2b3
SHA1 61264607d4ed093c0b2e57b0c7fa622d35dab7d3
SHA512 16980fcb84efe3a63ff9d353c6aa53a137ffd8fb5f78e27a534e9fe76aaa4d88d9b4069d39cd1a39d2edf9e56452728e57731af33d1fb6b6166890fafb94d0f2
SSDEEP 3072:9lcGJgP3sGXzR/gYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:/eP3bR/1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lnjjdgee.exe

Path C:\Windows\SysWOW64\Lnjjdgee.exe
Size 337KB
SHA256 161544a06e8a35f8bcf431a4ff0d29ac6765272213403caa4c7b356d3a41e8e9
MD5 d5dc54e0181b62cbb8d870a34460fbe8
SHA1 141bb87eb7bbaca2e6513bde035ecf9303db9a28
SHA512 1cc687820e835a5d5063498b33780627e64a1ca4f80cfc7511124a8d7488e02f0a204cddd729035af8652c08966d15f4b4de54501b9efe0823a4a26c07f0311f
SSDEEP 3072:yrgVA+K9kUvzvVgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:yYxaV1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lpappc32.exe

Path C:\Windows\SysWOW64\Lpappc32.exe
Size 337KB
SHA256 007aaac38e3eb93c6b2ea5351cb30b447dacea3f6169d6efefe5d82e6cb1c28f
MD5 2f5d607922a12f3f77d11b178f4b59ab
SHA1 7e535fb6ab385c01796dd8055f930e521dc37510
SHA512 39bcda522229ed49f0bf4b04e0400fd37687b7d64b4b2d8e2339e79ae7ff284a3713a28ead69c63b8b9183c07e1eadf8cc19aabc7bd6d0593a7abe812a62f86e
SSDEEP 3072:PR5EhuyqlFgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:PXPyqlF1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lpfijcfl.exe

Path C:\Windows\SysWOW64\Lpfijcfl.exe
Size 337KB
SHA256 5e9d98c81d5322e52592b41c546835620db39883b0da1aca2dcb253e457847ad
MD5 078f39b96855b4eb158fe107095d790f
SHA1 85ee7304d55b2da52ac6ecac85228f7e61a8532e
SHA512 55b343b2fa788745e4ff4126355c84b6e05bfaa5dacf5f55d19d92394d312b95a41ba1538f2725384a62a5f5b3f903c7a522180884584379183531a6e3fbe61b
SSDEEP 3072:fGynPdHhtS2dz2b+PKgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:fjPdjS2dz2b+PK1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mcbahlip.exe

Path C:\Windows\SysWOW64\Mcbahlip.exe
Size 337KB
SHA256 d83cd70a6adbc48bf14d7f2c9cd088c4ab26fb73a924538d1c2f4e7c3f895f53
MD5 1487e3725922b25715d32660ed286bc9
SHA1 c822c10ba19bf273187b97365b5e9397e63072dc
SHA512 a8efd960cee1113bd44c1d08a9231b043b66249edbc5847f58db99de0db144ff69041f390e71f35b941aee4b3cbad991c0107385bb9af9f1f56e9d7f6058aa17
SSDEEP 3072:eKAG7eGDgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:RLxD1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mdkhapfj.exe

Path C:\Windows\SysWOW64\Mdkhapfj.exe
Size 337KB
SHA256 e07f6722a9419e667d5643e107ecfb1a5685b5368db662e67ba804e9b1487e3f
MD5 b180e4f6e109649f56dc53cf57442641
SHA1 86cf93bf6cd4e16228fdc6cf1e4f54730a1d40e9
SHA512 63d098b743d1c47408a570ccf385f0b80f8e349a9f8a6050400ad2a60d865d8f362fa260da4e144b7fb53228f5bc571f0e730441dc734115705a6460c812f7cb
SSDEEP 3072:XRXr4LZyYotgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:R4LEYot1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mkbchk32.exe

Path C:\Windows\SysWOW64\Mkbchk32.exe
Size 337KB
SHA256 0c8a42700b07528fc90f894a71214d960efdd8e074f398fb68519b2f1c9df995
MD5 9247582e1ec6aa0523c995359cf0edee
SHA1 e86541ed2c4b168a0d8f2b9fcebdbc68e53fb75b
SHA512 cf952c5c269f41ad15fd503688a270949aac426fbf256833b3ac65190551d060f0808d2b61469a2e9bc68effaf9620840a7aeac47afe08dbcfd397758fa17ee7
SSDEEP 3072:LjW6tCJPKE9CgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:LjW6GKAC1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mkpgck32.exe

Path C:\Windows\SysWOW64\Mkpgck32.exe
Size 337KB
SHA256 1522ef4047a472b43a7a438c15a33c5ff238a00b699918fcd82e780402849d1b
MD5 0bdbbe763a746a1ccab99307ec342838
SHA1 50c7e3f27df5ff128bf7e64ecd47a08cb5446cfc
SHA512 917f809a18eeec23ef45b48b56e72beacf13607c96daabc09c8eb7b6e61c1c216d7866498a37b2d968c016b55b138b1c1b155e3ae720b04c9814f1831285afa7
SSDEEP 3072:j/ODd1rhUzbD451PUvgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:z0Bsv1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mnfipekh.exe

Path C:\Windows\SysWOW64\Mnfipekh.exe
Size 337KB
SHA256 d2c4052b84f67f1959d45288c518b378dfa8ff34e4ea5dc4b939d5439ffd5c62
MD5 8a9e6d7688aaf19a5ace2051f22d380d
SHA1 2b8ba3c48f39c45e47ead2845dcc382fe8b90b38
SHA512 6c6b81ea6e9448edccf1c8a79ef33503cdaecc49ef4c62cae85e0d24abb7b3baa45c6106dc052c572b7396eb77932cf461019877d8c5365139788779f6053c82
SSDEEP 3072:IFMLlyuABXrwG6wMgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:IFMLQuCVRM1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mpaifalo.exe

Path C:\Windows\SysWOW64\Mpaifalo.exe
Size 337KB
SHA256 df84cdfc5a0e712dc9066cc63d8ceab5e9ec5c444c2b456bc90c9e72cfd4f5f8
MD5 b00b0caecb8fc2bd282b9d96602bc089
SHA1 834d6671f383203ba561f102a26385df554088fe
SHA512 2d4ebbb9eb1c5c9a568eeb116fd8d6ba7345f04f28066fb107726a51d89dbf9a2d4b7afd6ca2744a0d0ece56bc7628a054225dd31bdca59b0b0c81dde08ef58b
SSDEEP 3072:1wcNjSeqHILmWq/HfQRgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:1wcN2HMlR1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nafokcol.exe

Path C:\Windows\SysWOW64\Nafokcol.exe
Size 337KB
SHA256 2cdbc552976529f7f6988e8f948b2aff3f97bf8fb1982dd66d3ed29d51431a95
MD5 c6bd074c7f10963457d8241560f90c8e
SHA1 7fe3eb0e27b7da6cc863a78a5955cc348d305c2e
SHA512 1886c812012583dbbee47f47cb3f7339ccd34efb078bd0d73f4a5af4058188b32c6c3585222a0ca6236fc334d2f78b7c74d76648ed258169879ad6b430fe0023
SSDEEP 3072:J2SZ4/fY2Fx+gYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:J2a4/NFx+1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nbkhfc32.exe

Path C:\Windows\SysWOW64\Nbkhfc32.exe
Size 337KB
SHA256 7566bd68ba0c1adb66939311e875aca2773518f047b02fbc120803a93a6048b5
MD5 9eb430111ee8df12b491b5ce5b1dd961
SHA1 341b5b55f3db68bc189c7c31fc8a607023274a93
SHA512 4c3a15ed1f978b6cb02785ab3076ff41c678b177a498bbff25a25dba4893a610bd450cc2fc434c735e910d71e1189717b978c2602481589573d37305a0d62ed5
SSDEEP 3072:ID82IJEB/bail17xgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:Io23bDl17x1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ncihikcg.exe

Path C:\Windows\SysWOW64\Ncihikcg.exe
Size 337KB
SHA256 1b0da128fd5e1e558828fa3d6baecf1732b597f75f04b834cdd5b99289226578
MD5 65163c9cc288e23458f52b0606ac5222
SHA1 ed5463ac10684c58aa957b715f42023121115b14
SHA512 0b79fc6b7142f0e669a0f881d7f6bfa453191ead81d890e5c2ad661ac12923af336dd6336200c6001c863976600f8e2d85987120cd4bba74efd7931ccc676335
SSDEEP 3072:XGczr+IESdkHgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:XGczrQSdkH1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ndbnboqb.exe

Path C:\Windows\SysWOW64\Ndbnboqb.exe
Size 337KB
SHA256 11e7fd454d4dbfc8f03b4d10cfdec6b3878bf177bb028fcb870e75ca1dad7e39
MD5 cbff7bfa7067e703406bb8d0ca6c58c3
SHA1 9c97f76d5449f1a4d838db88f628fcf84d7a1f19
SHA512 d91ba0dc345d34ab8df919e1fb30eab24715a036d82994456ce2ab21a0aefd0046c01b37c648ddd9530b61c353c83de719a26791c258ac4c75b9ff49553accef
SSDEEP 3072:FUNK3kQn+5gYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:FUEkQne1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ngcgcjnc.exe

Path C:\Windows\SysWOW64\Ngcgcjnc.exe
Size 337KB
SHA256 6e9ae34ddeba50a501e281e74decfde27a011b4c5e833cf3c95497f89064c8ef
MD5 7e5c716c31e38ffd69b565f8a115ea93
SHA1 ffa6f49ee716228eddfafeaacc95971dc103801c
SHA512 40877947542be0e860584be9965b0fae4c806d0763248cfe2877339424d25cf825f371fffdaca98da7ac7097eeaf581b14e603a792e33abf0d0bd5a3d3fb0740
SSDEEP 3072:d8bC9FLrbR7Zu73kgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:dcC/7u73k1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Njacpf32.exe

Path C:\Windows\SysWOW64\Njacpf32.exe
Size 337KB
SHA256 c868e6fbd808c03d16a3f17b6c3a594dc859ec09af06583bd1412baa2a0973b6
MD5 df83f05678ffd6d3f7bb070cc7d6966d
SHA1 02281a935ef00d59ae404203a5ec8087e24e6092
SHA512 5d75505ab0be02068509e42d35a3fef6d7ea0627a83f294765952c37bba66e777924721c6b4f52a8805d078708b6fe659b5addf3012bb988d1057a2edd9038b5
SSDEEP 3072:HTYIoR+yit8eMvMCNRzBuwdIMgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:z7osyxvhRzIiIM1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/440-292-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/440-144-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/864-216-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/864-275-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/932-0-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/932-323-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/932-5-0x0000000000431000-0x0000000000432000-memory.dmp

Download

memory/964-321-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/964-9-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1020-108-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1032-41-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1032-315-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1144-224-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1144-273-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1460-309-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1460-65-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1568-89-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1568-304-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1864-277-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1864-208-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2096-233-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2096-271-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2260-296-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2260-129-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2292-176-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2292-285-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2676-160-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2676-289-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2788-287-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2788-168-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2948-33-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2948-317-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3108-300-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3108-113-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3160-109-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3228-283-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3228-185-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3380-193-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3380-281-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3508-201-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3508-279-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3576-29-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3600-245-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4160-21-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4312-78-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4428-248-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4428-268-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4444-311-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4444-57-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4480-266-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4480-257-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4500-85-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4500-306-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4524-120-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4524-298-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4668-313-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4668-48-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4672-137-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4672-294-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4776-263-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4776-264-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4804-157-0x0000000000400000-0x0000000000433000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads