Analysis
- max time kernel
139s - max time network
164s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
11/05/2024, 02:04
Behavioral task
behavioral1
Sample
54ac5895295e52e5e6e6709effd18360_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
54ac5895295e52e5e6e6709effd18360_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 54ac5895295e52e5e6e6709effd18360_NeikiAnalytics.exe
- Size 226KB
- Sample240511-chabcshh35
- SHA256 cfc2bec800cd8301fb47855d259e4e8e07227107a6d34f4dbbf24e69242a318c
- MD5 54ac5895295e52e5e6e6709effd18360
- SHA1 4f38fc9978e08e53e67753dd22dee102855f7ed7
- SHA512 84ae5368119384feacc5e7d27eeed42bdf95f688f3e332bc50ed90dbfce5d4c5337b8e4a7c7a15c47e9ec6192997da8c7105b91a771c6a763a5cdfe515b140bd
- SSDEEP 6144:AozA7a6EG/cXfxqySSKpRmSKeTk7eT5ABrnL8MdYg:AAA+6g5IKrEAlnLAg
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Fekclnif.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pfenga32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bocjdiol.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Pcgdcome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Qkcackeb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gedohfmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Eahjqicj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jjefao32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jmnheggo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kahpgcch.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bhppap32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kgkooeen.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bbcignbo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Hcfcmnce.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Lckbje32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jfjakgpa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Qimfoe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jmijnfgd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Nmlhaa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Lofjam32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ndpafe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Pklkbl32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kbkdgj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Dlkiaece.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Flmonbbp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bkbcpb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Olnmdi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ldiiio32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Efikco32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Lajokiaa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Aijlgkjq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ndpafe32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ipldpo32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mkkmaalo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bjjmfn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Cimhlakl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Llngbabj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Iabodcnj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ahgamo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bajqpe32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jmkdeaee.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kpccgk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Cdlhgpag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Dhjknljl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jabgkpad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jbkjcgaj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lndaaj32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mojmbf32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Piepnfnj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cikkga32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dlckik32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Iabglnco.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Opdpih32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Agcdnjcl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kjcccm32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Djgbmffn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jmnheggo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jopaejlo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Pehghhgc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Fpckjlje.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Opmcod32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gjapfjnb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ionbcb32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Knhbflbp.exe - Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/files/0x0008000000023254-6.dat family_berbew behavioral2/files/0x0007000000023256-14.dat family_berbew behavioral2/files/0x0007000000023258-17.dat family_berbew behavioral2/files/0x000700000002325a-30.dat family_berbew behavioral2/files/0x000700000002325c-38.dat family_berbew behavioral2/files/0x000700000002325e-46.dat family_berbew behavioral2/files/0x0007000000023260-54.dat family_berbew behavioral2/files/0x0007000000023262-57.dat family_berbew behavioral2/files/0x0007000000023264-70.dat family_berbew behavioral2/files/0x0007000000023266-80.dat family_berbew behavioral2/files/0x0007000000023268-86.dat family_berbew behavioral2/files/0x000700000002326a-96.dat family_berbew behavioral2/files/0x000700000002326c-103.dat family_berbew behavioral2/files/0x0007000000023270-120.dat family_berbew behavioral2/files/0x000700000002326e-111.dat family_berbew behavioral2/files/0x0007000000023272-126.dat family_berbew behavioral2/files/0x0007000000023274-134.dat family_berbew behavioral2/files/0x0007000000023276-142.dat family_berbew behavioral2/files/0x0007000000023278-150.dat family_berbew behavioral2/files/0x000700000002327a-154.dat family_berbew behavioral2/files/0x000700000002327c-167.dat family_berbew behavioral2/files/0x000700000002327e-169.dat family_berbew behavioral2/files/0x000700000002327e-176.dat family_berbew behavioral2/files/0x0007000000023280-182.dat family_berbew behavioral2/files/0x0007000000023282-192.dat family_berbew behavioral2/files/0x0007000000023284-198.dat family_berbew behavioral2/files/0x0007000000023286-207.dat family_berbew behavioral2/files/0x000700000002328a-218.dat family_berbew behavioral2/files/0x0007000000023288-215.dat family_berbew behavioral2/files/0x000700000002328c-230.dat family_berbew behavioral2/files/0x000700000002328e-233.dat family_berbew behavioral2/files/0x000700000002328e-240.dat family_berbew behavioral2/files/0x0007000000023290-246.dat family_berbew behavioral2/files/0x0007000000023292-255.dat family_berbew behavioral2/files/0x0007000000023294-257.dat family_berbew behavioral2/files/0x0007000000023298-270.dat family_berbew behavioral2/files/0x00070000000232a6-312.dat family_berbew behavioral2/files/0x00070000000232ae-335.dat family_berbew behavioral2/files/0x00070000000232c0-383.dat family_berbew behavioral2/files/0x00070000000232ce-414.dat family_berbew behavioral2/files/0x00070000000232df-462.dat family_berbew behavioral2/files/0x00070000000232e3-474.dat family_berbew behavioral2/files/0x00070000000232f4-523.dat family_berbew behavioral2/files/0x000700000002332c-702.dat family_berbew behavioral2/files/0x0007000000023336-737.dat family_berbew behavioral2/files/0x0007000000023344-786.dat family_berbew behavioral2/files/0x000700000002334a-808.dat family_berbew behavioral2/files/0x000700000002334e-822.dat family_berbew behavioral2/files/0x0007000000023354-842.dat family_berbew behavioral2/files/0x0007000000023356-850.dat family_berbew behavioral2/files/0x0007000000023370-939.dat family_berbew behavioral2/files/0x0007000000023384-1008.dat family_berbew behavioral2/files/0x0007000000023388-1021.dat family_berbew behavioral2/files/0x0007000000023392-1054.dat family_berbew behavioral2/files/0x0007000000023396-1068.dat family_berbew behavioral2/files/0x00070000000233a2-1108.dat family_berbew behavioral2/files/0x00070000000233a4-1116.dat family_berbew behavioral2/files/0x00070000000233a8-1128.dat family_berbew behavioral2/files/0x00070000000233b2-1162.dat family_berbew behavioral2/files/0x00070000000233b6-1176.dat family_berbew behavioral2/files/0x00070000000233bd-1197.dat family_berbew behavioral2/files/0x00070000000233c4-1222.dat family_berbew behavioral2/files/0x00070000000233c6-1230.dat family_berbew behavioral2/files/0x00070000000233d3-1269.dat family_berbew - Executes dropped EXE 64 IoCs
pid Process 4984 Hebcao32.exe 3356 Hbknebqi.exe 464 Iabglnco.exe 3028 Ihaidhgf.exe 3852 Jbijgp32.exe 2132 Jejbhk32.exe 1624 Jhmhpfmi.exe 2584 Jaemilci.exe 3592 Koimbpbc.exe 3528 Kkpnga32.exe 2116 Kbjbnnfg.exe 984 Kaaldjil.exe 3752 Llngbabj.exe 3620 Lajokiaa.exe 3948 Lhdggb32.exe 1980 Loopdmpk.exe 4536 Mafofggd.exe 1536 Mahklf32.exe 2664 Nkeipk32.exe 4300 Nlgbon32.exe 3968 Oljoen32.exe 4888 Ohqpjo32.exe 4712 Odgqopeb.exe 5020 Oooaah32.exe 4036 Ofijnbkb.exe 4644 Pijcpmhc.exe 2520 Pkklbh32.exe 2800 Pfbmdabh.exe 2680 Piceflpi.exe 4556 Qkdohg32.exe 3680 Aijlgkjq.exe 4548 Aioebj32.exe 2600 Afeban32.exe 3632 Bifkcioc.exe 764 Bflham32.exe 4384 Bbcignbo.exe 4744 Bcbeqaia.exe 1576 Clpgkcdj.exe 1540 Cidgdg32.exe 560 Cdlhgpag.exe 4496 Clijablo.exe 4988 Dllffa32.exe 2400 Dbhlikpf.exe 1228 Digmqe32.exe 4896 Edakimoo.exe 732 Egdqph32.exe 1128 Fdhail32.exe 1016 Fgkfqgce.exe 4636 Fpckjlje.exe 5060 Ffcpgcfj.exe 4996 Gfjfhbpb.exe 5028 Gnckooob.exe 4404 Hnehdo32.exe 3324 Hgnlmdcp.exe 4348 Hmmakk32.exe 2016 Hgbfhc32.exe 1560 Iepihf32.exe 4416 Jegohe32.exe 4488 Jnapgjdo.exe 2796 Jglaepim.exe 3544 Jmijnfgd.exe 2532 Knifging.exe 8 Kfdklllb.exe 1708 Knpmhh32.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Eldafjjc.dll Bcbeqaia.exe File created C:\Windows\SysWOW64\Ffpadn32.exe Fofigd32.exe File created C:\Windows\SysWOW64\Mpenmadn.exe Mjheejff.exe File opened for modification C:\Windows\SysWOW64\Apobakpn.exe Agfnhf32.exe File opened for modification C:\Windows\SysWOW64\Odfcjc32.exe Oiqomj32.exe File created C:\Windows\SysWOW64\Opmcod32.exe Odfcjc32.exe File created C:\Windows\SysWOW64\Kdaocnnj.dll Hkaqgjme.exe File created C:\Windows\SysWOW64\Hofmaq32.exe Hfniikha.exe File opened for modification C:\Windows\SysWOW64\Ijjnpg32.exe Icpecm32.exe File created C:\Windows\SysWOW64\Adeimibe.dll Npjnbg32.exe File opened for modification C:\Windows\SysWOW64\Jhfihp32.exe Jmqekg32.exe File created C:\Windows\SysWOW64\Bhbbnlco.dll Hpnhoqmi.exe File created C:\Windows\SysWOW64\Kialcj32.dll Pfbmdabh.exe File created C:\Windows\SysWOW64\Epiflfbm.dll Pbfjjlgc.exe File created C:\Windows\SysWOW64\Kkjoha32.dll Ajggjq32.exe File opened for modification C:\Windows\SysWOW64\Clhbhc32.exe Benjkijd.exe File opened for modification C:\Windows\SysWOW64\Djnaco32.exe Dcdifdem.exe File created C:\Windows\SysWOW64\Jbfphh32.exe Jaddpppa.exe File created C:\Windows\SysWOW64\Eiijfg32.dll Lcmopeae.exe File opened for modification C:\Windows\SysWOW64\Knpmhh32.exe Kfdklllb.exe File created C:\Windows\SysWOW64\Jlilhlel.dll Mcggga32.exe File created C:\Windows\SysWOW64\Pfjgbapo.exe Pppoeg32.exe File created C:\Windows\SysWOW64\Gnfmapqo.exe Gcqhcgqi.exe File opened for modification C:\Windows\SysWOW64\Jinloboo.exe Jbccbi32.exe File created C:\Windows\SysWOW64\Decnea32.dll Cmkehicj.exe File created C:\Windows\SysWOW64\Cdqgcnml.dll Fcepbooa.exe File created C:\Windows\SysWOW64\Ppffec32.exe Phkaqqoi.exe File created C:\Windows\SysWOW64\Midoph32.exe Mcggga32.exe File created C:\Windows\SysWOW64\Fbinda32.dll Oiagcg32.exe File created C:\Windows\SysWOW64\Jnapgjdo.exe Jegohe32.exe File created C:\Windows\SysWOW64\Pgihanii.exe Opmcod32.exe File opened for modification C:\Windows\SysWOW64\Gnkflo32.exe Ghanoeel.exe File opened for modification C:\Windows\SysWOW64\Lgqhki32.exe Ldblon32.exe File created C:\Windows\SysWOW64\Pbndgl32.exe Ppphkq32.exe File created C:\Windows\SysWOW64\Hidgpjoi.dll Apdkmn32.exe File opened for modification C:\Windows\SysWOW64\Liekgo32.exe Lckbje32.exe File created C:\Windows\SysWOW64\Nccmog32.dll Nfaijand.exe File created C:\Windows\SysWOW64\Mjheejff.exe Mldhacpj.exe File created C:\Windows\SysWOW64\Okndkohj.dll Igpkok32.exe File opened for modification C:\Windows\SysWOW64\Lofjam32.exe Lilbdcfe.exe File opened for modification C:\Windows\SysWOW64\Ofooqinh.exe Oljkcpnb.exe File created C:\Windows\SysWOW64\Ojhmipdl.dll Nqgiel32.exe File created C:\Windows\SysWOW64\Chlomnfl.exe Caagpdop.exe File created C:\Windows\SysWOW64\Haapme32.dll Abdoqd32.exe File opened for modification C:\Windows\SysWOW64\Dajnol32.exe Dgaiffii.exe File opened for modification C:\Windows\SysWOW64\Elilmi32.exe Ebagdddp.exe File created C:\Windows\SysWOW64\Dqdnjfpc.exe Dkgeao32.exe File created C:\Windows\SysWOW64\Ndphpk32.exe Nnfpcada.exe File created C:\Windows\SysWOW64\Fcqlqnpo.dll Clpppmqn.exe File created C:\Windows\SysWOW64\Mooqfmpj.dll Cnpbgajc.exe File opened for modification C:\Windows\SysWOW64\Enlqdc32.exe Dcglfjgf.exe File opened for modification C:\Windows\SysWOW64\Kkofofbb.exe Kjnihnmd.exe File created C:\Windows\SysWOW64\Khcjhnoh.dll Pmfldkei.exe File created C:\Windows\SysWOW64\Lniphngj.dll Nifele32.exe File created C:\Windows\SysWOW64\Hfacai32.exe Hcbgen32.exe File opened for modification C:\Windows\SysWOW64\Cgmfel32.exe Clhbhc32.exe File created C:\Windows\SysWOW64\Mfhimdmi.dll Dcmcfeke.exe File opened for modification C:\Windows\SysWOW64\Kgnbol32.exe Kpdjbapj.exe File created C:\Windows\SysWOW64\Bajqpe32.exe Bpidhmoi.exe File created C:\Windows\SysWOW64\Efikco32.exe Eomfae32.exe File opened for modification C:\Windows\SysWOW64\Nqklfe32.exe Nbfoeiei.exe File created C:\Windows\SysWOW64\Pdooddpo.dll Hakidd32.exe File created C:\Windows\SysWOW64\Mqbpjmeg.exe Moacbe32.exe File opened for modification C:\Windows\SysWOW64\Jkhpogij.exe Jflgfpkc.exe - Program crash 2 IoCs
pid pid_target Process procid_target 7664 7480 WerFault.exe 746 11108 7480 WerFault.exe 746 - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gilkbqmk.dll" Fpckjlje.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ihgnfnjl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Imdjadgk.dll" Dqdnjfpc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Mjcljk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Oljkcpnb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Lofjam32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Chbenm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Iepihf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Cnmebblf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Emikpeig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Afhaeflb.dll" Ofcaab32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogimlm32.dll" Ikbphn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Kagimmol.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Jaemilci.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Efjgpc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oflcnqal.dll" Gedohfmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Egfolf32.dll" Lcpqgbkj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Lilbdcfe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Pohilc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jgmhaapa.dll" Fdhail32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cjejmk32.dll" Hadcce32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ndanne32.dll" Ccgjjc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Hhojqcil.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cbpppcid.dll" Kiaqnagj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Mabdlk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aehbkica.dll" Libnapmg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Hjcllilo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Liekgo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Agkgceeh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Egelgoah.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Jehcfj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ngcngfgl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ookmnk32.dll" Pneelmjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmdknbko.dll" Docckfai.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ofnhfbjl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fnlnac32.dll" Impeib32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhfnch32.dll" Mdaedgdb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Epgdch32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Kbkdgj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Deaeii32.dll" Enajobbf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Blmjdmok.dll" Bhennm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Inoeep32.dll" Fmndkd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Hgpbhmna.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kiiigchq.dll" Jmdjha32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Nifele32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Knhbflbp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Fofigd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Gaoihfoo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Pihdnloc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Knjhae32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dlmbgm32.dll" Moacbe32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Lcpqgbkj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Deiblamk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehqabj32.dll" Ebifha32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Iiibdc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Fdhail32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Mginniij.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ndhgie32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hicgcm32.dll" Lkcaeige.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Iandjg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gbnhdihe.dll" Iiblcdil.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Okqbac32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fgmeobin.dll" Iqfcbahb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Fdmfcn32.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1668 wrote to memory of 4984 1668 54ac5895295e52e5e6e6709effd18360_NeikiAnalytics.exe 92 PID 1668 wrote to memory of 4984 1668 54ac5895295e52e5e6e6709effd18360_NeikiAnalytics.exe 92 PID 1668 wrote to memory of 4984 1668 54ac5895295e52e5e6e6709effd18360_NeikiAnalytics.exe 92 PID 4984 wrote to memory of 3356 4984 Hebcao32.exe 93 PID 4984 wrote to memory of 3356 4984 Hebcao32.exe 93 PID 4984 wrote to memory of 3356 4984 Hebcao32.exe 93 PID 3356 wrote to memory of 464 3356 Hbknebqi.exe 94 PID 3356 wrote to memory of 464 3356 Hbknebqi.exe 94 PID 3356 wrote to memory of 464 3356 Hbknebqi.exe 94 PID 464 wrote to memory of 3028 464 Iabglnco.exe 95 PID 464 wrote to memory of 3028 464 Iabglnco.exe 95 PID 464 wrote to memory of 3028 464 Iabglnco.exe 95 PID 3028 wrote to memory of 3852 3028 Ihaidhgf.exe 96 PID 3028 wrote to memory of 3852 3028 Ihaidhgf.exe 96 PID 3028 wrote to memory of 3852 3028 Ihaidhgf.exe 96 PID 3852 wrote to memory of 2132 3852 Jbijgp32.exe 97 PID 3852 wrote to memory of 2132 3852 Jbijgp32.exe 97 PID 3852 wrote to memory of 2132 3852 Jbijgp32.exe 97 PID 2132 wrote to memory of 1624 2132 Jejbhk32.exe 98 PID 2132 wrote to memory of 1624 2132 Jejbhk32.exe 98 PID 2132 wrote to memory of 1624 2132 Jejbhk32.exe 98 PID 1624 wrote to memory of 2584 1624 Jhmhpfmi.exe 99 PID 1624 wrote to memory of 2584 1624 Jhmhpfmi.exe 99 PID 1624 wrote to memory of 2584 1624 Jhmhpfmi.exe 99 PID 2584 wrote to memory of 3592 2584 Jaemilci.exe 100 PID 2584 wrote to memory of 3592 2584 Jaemilci.exe 100 PID 2584 wrote to memory of 3592 2584 Jaemilci.exe 100 PID 3592 wrote to memory of 3528 3592 Koimbpbc.exe 101 PID 3592 wrote to memory of 3528 3592 Koimbpbc.exe 101 PID 3592 wrote to memory of 3528 3592 Koimbpbc.exe 101 PID 3528 wrote to memory of 2116 3528 Kkpnga32.exe 102 PID 3528 wrote to memory of 2116 3528 Kkpnga32.exe 102 PID 3528 wrote to memory of 2116 3528 Kkpnga32.exe 102 PID 2116 wrote to memory of 984 2116 Kbjbnnfg.exe 103 PID 2116 wrote to memory of 984 2116 Kbjbnnfg.exe 103 PID 2116 wrote to memory of 984 2116 Kbjbnnfg.exe 103 PID 984 wrote to memory of 3752 984 Kaaldjil.exe 104 PID 984 wrote to memory of 3752 984 Kaaldjil.exe 104 PID 984 wrote to memory of 3752 984 Kaaldjil.exe 104 PID 3752 wrote to memory of 3620 3752 Llngbabj.exe 105 PID 3752 wrote to memory of 3620 3752 Llngbabj.exe 105 PID 3752 wrote to memory of 3620 3752 Llngbabj.exe 105 PID 3620 wrote to memory of 3948 3620 Lajokiaa.exe 106 PID 3620 wrote to memory of 3948 3620 Lajokiaa.exe 106 PID 3620 wrote to memory of 3948 3620 Lajokiaa.exe 106 PID 3948 wrote to memory of 1980 3948 Lhdggb32.exe 107 PID 3948 wrote to memory of 1980 3948 Lhdggb32.exe 107 PID 3948 wrote to memory of 1980 3948 Lhdggb32.exe 107 PID 1980 wrote to memory of 4536 1980 Loopdmpk.exe 108 PID 1980 wrote to memory of 4536 1980 Loopdmpk.exe 108 PID 1980 wrote to memory of 4536 1980 Loopdmpk.exe 108 PID 4536 wrote to memory of 1536 4536 Mafofggd.exe 109 PID 4536 wrote to memory of 1536 4536 Mafofggd.exe 109 PID 4536 wrote to memory of 1536 4536 Mafofggd.exe 109 PID 1536 wrote to memory of 2664 1536 Mahklf32.exe 110 PID 1536 wrote to memory of 2664 1536 Mahklf32.exe 110 PID 1536 wrote to memory of 2664 1536 Mahklf32.exe 110 PID 2664 wrote to memory of 4300 2664 Nkeipk32.exe 111 PID 2664 wrote to memory of 4300 2664 Nkeipk32.exe 111 PID 2664 wrote to memory of 4300 2664 Nkeipk32.exe 111 PID 4300 wrote to memory of 3968 4300 Nlgbon32.exe 112 PID 4300 wrote to memory of 3968 4300 Nlgbon32.exe 112 PID 4300 wrote to memory of 3968 4300 Nlgbon32.exe 112 PID 3968 wrote to memory of 4888 3968 Oljoen32.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\54ac5895295e52e5e6e6709effd18360_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\54ac5895295e52e5e6e6709effd18360_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Windows\SysWOW64\Hebcao32.exeC:\Windows\system32\Hebcao32.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Windows\SysWOW64\Hbknebqi.exeC:\Windows\system32\Hbknebqi.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Windows\SysWOW64\Iabglnco.exeC:\Windows\system32\Iabglnco.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Windows\SysWOW64\Ihaidhgf.exeC:\Windows\system32\Ihaidhgf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Windows\SysWOW64\Jbijgp32.exeC:\Windows\system32\Jbijgp32.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Windows\SysWOW64\Jejbhk32.exeC:\Windows\system32\Jejbhk32.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Windows\SysWOW64\Jhmhpfmi.exeC:\Windows\system32\Jhmhpfmi.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Windows\SysWOW64\Jaemilci.exeC:\Windows\system32\Jaemilci.exe9⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Windows\SysWOW64\Koimbpbc.exeC:\Windows\system32\Koimbpbc.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Windows\SysWOW64\Kkpnga32.exeC:\Windows\system32\Kkpnga32.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Windows\SysWOW64\Kbjbnnfg.exeC:\Windows\system32\Kbjbnnfg.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Windows\SysWOW64\Kaaldjil.exeC:\Windows\system32\Kaaldjil.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:984 -
C:\Windows\SysWOW64\Llngbabj.exeC:\Windows\system32\Llngbabj.exe14⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Windows\SysWOW64\Lajokiaa.exeC:\Windows\system32\Lajokiaa.exe15⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Windows\SysWOW64\Lhdggb32.exeC:\Windows\system32\Lhdggb32.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Windows\SysWOW64\Loopdmpk.exeC:\Windows\system32\Loopdmpk.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\SysWOW64\Mafofggd.exeC:\Windows\system32\Mafofggd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Windows\SysWOW64\Mahklf32.exeC:\Windows\system32\Mahklf32.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Windows\SysWOW64\Nkeipk32.exeC:\Windows\system32\Nkeipk32.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Windows\SysWOW64\Nlgbon32.exeC:\Windows\system32\Nlgbon32.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Windows\SysWOW64\Oljoen32.exeC:\Windows\system32\Oljoen32.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Windows\SysWOW64\Ohqpjo32.exeC:\Windows\system32\Ohqpjo32.exe23⤵
- Executes dropped EXE
PID:4888 -
C:\Windows\SysWOW64\Odgqopeb.exeC:\Windows\system32\Odgqopeb.exe24⤵
- Executes dropped EXE
PID:4712 -
C:\Windows\SysWOW64\Oooaah32.exeC:\Windows\system32\Oooaah32.exe25⤵
- Executes dropped EXE
PID:5020 -
C:\Windows\SysWOW64\Ofijnbkb.exeC:\Windows\system32\Ofijnbkb.exe26⤵
- Executes dropped EXE
PID:4036 -
C:\Windows\SysWOW64\Pijcpmhc.exeC:\Windows\system32\Pijcpmhc.exe27⤵
- Executes dropped EXE
PID:4644 -
C:\Windows\SysWOW64\Pkklbh32.exeC:\Windows\system32\Pkklbh32.exe28⤵
- Executes dropped EXE
PID:2520 -
C:\Windows\SysWOW64\Pfbmdabh.exeC:\Windows\system32\Pfbmdabh.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2800 -
C:\Windows\SysWOW64\Piceflpi.exeC:\Windows\system32\Piceflpi.exe30⤵
- Executes dropped EXE
PID:2680 -
C:\Windows\SysWOW64\Qkdohg32.exeC:\Windows\system32\Qkdohg32.exe31⤵
- Executes dropped EXE
PID:4556 -
C:\Windows\SysWOW64\Aijlgkjq.exeC:\Windows\system32\Aijlgkjq.exe32⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:3680 -
C:\Windows\SysWOW64\Aioebj32.exeC:\Windows\system32\Aioebj32.exe33⤵
- Executes dropped EXE
PID:4548 -
C:\Windows\SysWOW64\Afeban32.exeC:\Windows\system32\Afeban32.exe34⤵
- Executes dropped EXE
PID:2600 -
C:\Windows\SysWOW64\Bifkcioc.exeC:\Windows\system32\Bifkcioc.exe35⤵
- Executes dropped EXE
PID:3632 -
C:\Windows\SysWOW64\Bflham32.exeC:\Windows\system32\Bflham32.exe36⤵
- Executes dropped EXE
PID:764 -
C:\Windows\SysWOW64\Bbcignbo.exeC:\Windows\system32\Bbcignbo.exe37⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:4384 -
C:\Windows\SysWOW64\Bcbeqaia.exeC:\Windows\system32\Bcbeqaia.exe38⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4744 -
C:\Windows\SysWOW64\Clpgkcdj.exeC:\Windows\system32\Clpgkcdj.exe39⤵
- Executes dropped EXE
PID:1576 -
C:\Windows\SysWOW64\Cidgdg32.exeC:\Windows\system32\Cidgdg32.exe40⤵
- Executes dropped EXE
PID:1540 -
C:\Windows\SysWOW64\Cdlhgpag.exeC:\Windows\system32\Cdlhgpag.exe41⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:560 -
C:\Windows\SysWOW64\Clijablo.exeC:\Windows\system32\Clijablo.exe42⤵
- Executes dropped EXE
PID:4496 -
C:\Windows\SysWOW64\Dllffa32.exeC:\Windows\system32\Dllffa32.exe43⤵
- Executes dropped EXE
PID:4988 -
C:\Windows\SysWOW64\Dbhlikpf.exeC:\Windows\system32\Dbhlikpf.exe44⤵
- Executes dropped EXE
PID:2400 -
C:\Windows\SysWOW64\Digmqe32.exeC:\Windows\system32\Digmqe32.exe45⤵
- Executes dropped EXE
PID:1228 -
C:\Windows\SysWOW64\Edakimoo.exeC:\Windows\system32\Edakimoo.exe46⤵
- Executes dropped EXE
PID:4896 -
C:\Windows\SysWOW64\Egdqph32.exeC:\Windows\system32\Egdqph32.exe47⤵
- Executes dropped EXE
PID:732 -
C:\Windows\SysWOW64\Fdhail32.exeC:\Windows\system32\Fdhail32.exe48⤵
- Executes dropped EXE
- Modifies registry class
PID:1128 -
C:\Windows\SysWOW64\Fgkfqgce.exeC:\Windows\system32\Fgkfqgce.exe49⤵
- Executes dropped EXE
PID:1016 -
C:\Windows\SysWOW64\Fpckjlje.exeC:\Windows\system32\Fpckjlje.exe50⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:4636 -
C:\Windows\SysWOW64\Ffcpgcfj.exeC:\Windows\system32\Ffcpgcfj.exe51⤵
- Executes dropped EXE
PID:5060 -
C:\Windows\SysWOW64\Gfjfhbpb.exeC:\Windows\system32\Gfjfhbpb.exe52⤵
- Executes dropped EXE
PID:4996 -
C:\Windows\SysWOW64\Gnckooob.exeC:\Windows\system32\Gnckooob.exe53⤵
- Executes dropped EXE
PID:5028 -
C:\Windows\SysWOW64\Hnehdo32.exeC:\Windows\system32\Hnehdo32.exe54⤵
- Executes dropped EXE
PID:4404 -
C:\Windows\SysWOW64\Hgnlmdcp.exeC:\Windows\system32\Hgnlmdcp.exe55⤵
- Executes dropped EXE
PID:3324 -
C:\Windows\SysWOW64\Hmmakk32.exeC:\Windows\system32\Hmmakk32.exe56⤵
- Executes dropped EXE
PID:4348 -
C:\Windows\SysWOW64\Hgbfhc32.exeC:\Windows\system32\Hgbfhc32.exe57⤵
- Executes dropped EXE
PID:2016 -
C:\Windows\SysWOW64\Infqklol.exeC:\Windows\system32\Infqklol.exe58⤵PID:1176
-
C:\Windows\SysWOW64\Iepihf32.exeC:\Windows\system32\Iepihf32.exe59⤵
- Executes dropped EXE
- Modifies registry class
PID:1560 -
C:\Windows\SysWOW64\Jegohe32.exeC:\Windows\system32\Jegohe32.exe60⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4416 -
C:\Windows\SysWOW64\Jnapgjdo.exeC:\Windows\system32\Jnapgjdo.exe61⤵
- Executes dropped EXE
PID:4488 -
C:\Windows\SysWOW64\Jglaepim.exeC:\Windows\system32\Jglaepim.exe62⤵
- Executes dropped EXE
PID:2796 -
C:\Windows\SysWOW64\Jmijnfgd.exeC:\Windows\system32\Jmijnfgd.exe63⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:3544 -
C:\Windows\SysWOW64\Knifging.exeC:\Windows\system32\Knifging.exe64⤵
- Executes dropped EXE
PID:2532 -
C:\Windows\SysWOW64\Kfdklllb.exeC:\Windows\system32\Kfdklllb.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:8 -
C:\Windows\SysWOW64\Knpmhh32.exeC:\Windows\system32\Knpmhh32.exe66⤵
- Executes dropped EXE
PID:1708 -
C:\Windows\SysWOW64\Kaqejcep.exeC:\Windows\system32\Kaqejcep.exe67⤵PID:648
-
C:\Windows\SysWOW64\Lmgfod32.exeC:\Windows\system32\Lmgfod32.exe68⤵PID:884
-
C:\Windows\SysWOW64\Lhadgmge.exeC:\Windows\system32\Lhadgmge.exe69⤵PID:4908
-
C:\Windows\SysWOW64\Mginniij.exeC:\Windows\system32\Mginniij.exe70⤵
- Modifies registry class
PID:1492 -
C:\Windows\SysWOW64\Mdmngm32.exeC:\Windows\system32\Mdmngm32.exe71⤵PID:3224
-
C:\Windows\SysWOW64\Mkicjgnn.exeC:\Windows\system32\Mkicjgnn.exe72⤵PID:1448
-
C:\Windows\SysWOW64\Mmjlkb32.exeC:\Windows\system32\Mmjlkb32.exe73⤵PID:5064
-
C:\Windows\SysWOW64\Nmlhaa32.exeC:\Windows\system32\Nmlhaa32.exe74⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2644 -
C:\Windows\SysWOW64\Naokbokn.exeC:\Windows\system32\Naokbokn.exe75⤵PID:5132
-
C:\Windows\SysWOW64\Noehac32.exeC:\Windows\system32\Noehac32.exe76⤵PID:5172
-
C:\Windows\SysWOW64\Odbpij32.exeC:\Windows\system32\Odbpij32.exe77⤵PID:5212
-
C:\Windows\SysWOW64\Okneldkf.exeC:\Windows\system32\Okneldkf.exe78⤵PID:5260
-
C:\Windows\SysWOW64\Okqbac32.exeC:\Windows\system32\Okqbac32.exe79⤵
- Modifies registry class
PID:5300 -
C:\Windows\SysWOW64\Pfkpiled.exeC:\Windows\system32\Pfkpiled.exe80⤵PID:5336
-
C:\Windows\SysWOW64\Pkhhbbck.exeC:\Windows\system32\Pkhhbbck.exe81⤵PID:5384
-
C:\Windows\SysWOW64\Pgaelcgm.exeC:\Windows\system32\Pgaelcgm.exe82⤵PID:5420
-
C:\Windows\SysWOW64\Pbfjjlgc.exeC:\Windows\system32\Pbfjjlgc.exe83⤵
- Drops file in System32 directory
PID:5468 -
C:\Windows\SysWOW64\Pfdbpjmi.exeC:\Windows\system32\Pfdbpjmi.exe84⤵PID:5512
-
C:\Windows\SysWOW64\Qhghge32.exeC:\Windows\system32\Qhghge32.exe85⤵PID:5556
-
C:\Windows\SysWOW64\Aoapcood.exeC:\Windows\system32\Aoapcood.exe86⤵PID:5592
-
C:\Windows\SysWOW64\Agmehamp.exeC:\Windows\system32\Agmehamp.exe87⤵PID:5644
-
C:\Windows\SysWOW64\Aiqkmd32.exeC:\Windows\system32\Aiqkmd32.exe88⤵PID:5680
-
C:\Windows\SysWOW64\Afdkfh32.exeC:\Windows\system32\Afdkfh32.exe89⤵PID:5740
-
C:\Windows\SysWOW64\Bfieagka.exeC:\Windows\system32\Bfieagka.exe90⤵PID:5800
-
C:\Windows\SysWOW64\Bndjfjhl.exeC:\Windows\system32\Bndjfjhl.exe91⤵PID:5844
-
C:\Windows\SysWOW64\Beobcdoi.exeC:\Windows\system32\Beobcdoi.exe92⤵PID:5888
-
C:\Windows\SysWOW64\Cgagjo32.exeC:\Windows\system32\Cgagjo32.exe93⤵PID:5932
-
C:\Windows\SysWOW64\Cfbhhfbg.exeC:\Windows\system32\Cfbhhfbg.exe94⤵PID:5980
-
C:\Windows\SysWOW64\Clpppmqn.exeC:\Windows\system32\Clpppmqn.exe95⤵
- Drops file in System32 directory
PID:6024 -
C:\Windows\SysWOW64\Cldjkl32.exeC:\Windows\system32\Cldjkl32.exe96⤵PID:6068
-
C:\Windows\SysWOW64\Cpbbak32.exeC:\Windows\system32\Cpbbak32.exe97⤵PID:6112
-
C:\Windows\SysWOW64\Cfljnejl.exeC:\Windows\system32\Cfljnejl.exe98⤵PID:5124
-
C:\Windows\SysWOW64\Dbckcf32.exeC:\Windows\system32\Dbckcf32.exe99⤵PID:5208
-
C:\Windows\SysWOW64\Dlnlak32.exeC:\Windows\system32\Dlnlak32.exe100⤵PID:5268
-
C:\Windows\SysWOW64\Defajqko.exeC:\Windows\system32\Defajqko.exe101⤵PID:5372
-
C:\Windows\SysWOW64\Eekjep32.exeC:\Windows\system32\Eekjep32.exe102⤵PID:5428
-
C:\Windows\SysWOW64\Efjgpc32.exeC:\Windows\system32\Efjgpc32.exe103⤵
- Modifies registry class
PID:5480 -
C:\Windows\SysWOW64\Ebagdddp.exeC:\Windows\system32\Ebagdddp.exe104⤵
- Drops file in System32 directory
PID:5544 -
C:\Windows\SysWOW64\Elilmi32.exeC:\Windows\system32\Elilmi32.exe105⤵PID:5632
-
C:\Windows\SysWOW64\Efopjbjg.exeC:\Windows\system32\Efopjbjg.exe106⤵PID:5660
-
C:\Windows\SysWOW64\Epgdch32.exeC:\Windows\system32\Epgdch32.exe107⤵
- Modifies registry class
PID:5776 -
C:\Windows\SysWOW64\Foakpc32.exeC:\Windows\system32\Foakpc32.exe108⤵PID:5840
-
C:\Windows\SysWOW64\Fekclnif.exeC:\Windows\system32\Fekclnif.exe109⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5912 -
C:\Windows\SysWOW64\Fcodfa32.exeC:\Windows\system32\Fcodfa32.exe110⤵PID:5988
-
C:\Windows\SysWOW64\Fhnichde.exeC:\Windows\system32\Fhnichde.exe111⤵PID:5736
-
C:\Windows\SysWOW64\Gebimmco.exeC:\Windows\system32\Gebimmco.exe112⤵PID:3608
-
C:\Windows\SysWOW64\Gcfjfqah.exeC:\Windows\system32\Gcfjfqah.exe113⤵PID:1640
-
C:\Windows\SysWOW64\Goadfa32.exeC:\Windows\system32\Goadfa32.exe114⤵PID:5196
-
C:\Windows\SysWOW64\Geklckkd.exeC:\Windows\system32\Geklckkd.exe115⤵PID:5288
-
C:\Windows\SysWOW64\Gledpe32.exeC:\Windows\system32\Gledpe32.exe116⤵PID:5404
-
C:\Windows\SysWOW64\Hfniikha.exeC:\Windows\system32\Hfniikha.exe117⤵
- Drops file in System32 directory
PID:5508 -
C:\Windows\SysWOW64\Hofmaq32.exeC:\Windows\system32\Hofmaq32.exe118⤵PID:5624
-
C:\Windows\SysWOW64\Hfpenj32.exeC:\Windows\system32\Hfpenj32.exe119⤵PID:5712
-
C:\Windows\SysWOW64\Hljnkdnk.exeC:\Windows\system32\Hljnkdnk.exe120⤵PID:5792
-
C:\Windows\SysWOW64\Hgpbhmna.exeC:\Windows\system32\Hgpbhmna.exe121⤵
- Modifies registry class
PID:5896
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-