Analysis
- max time kernel
153s - max time network
159s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
11/05/2024, 04:31
Behavioral task
behavioral1
Sample
7d7d2cd7dcaba16161ebf1cf4be626a0_NeikiAnalytics.exe
Resource
win7-20240215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
7d7d2cd7dcaba16161ebf1cf4be626a0_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 7d7d2cd7dcaba16161ebf1cf4be626a0_NeikiAnalytics.exe
- Size 346KB
- Sample240511-e5e68sdd6t
- SHA256 1b161043116d651644f0470b31c38b5dce6d3abcdb425ac81e333b8ce7f3a421
- MD5 7d7d2cd7dcaba16161ebf1cf4be626a0
- SHA1 c50931cd17c1533010e7455468ec6b4c882aa281
- SHA512 813fd054757e9d88b56aa4d7d7da80413a68c8f74ac727bd749ded6583e540f38b32fcb4f694096f4f8706f91c71521f8accb44e864191ee372a9bd3a1e694f0
- SSDEEP 6144:/T9rrmfhdsFj5t13LJhrmMsFj5tzOvfFOM:/5rOhds15tFrls15tz4FT
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gebimmco.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bqpbboeg.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dagajlal.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mbamcm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Menpgmap.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bokeai32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bmggingc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dagiba32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dpckclld.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mhoiih32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Process not Found Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Process not Found Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bkjpkg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dcnqid32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jjgkab32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fncibg32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lcbmlbig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cokgonmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lnanadfi.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dkdmpl32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bmomecoi.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ccnnmmbp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qbonoghb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ocpghj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gkeonggf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Qcepem32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ephlnn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pignccea.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pcgmiiii.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kfehoj32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Phqbaj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Doiabgqc.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Process not Found Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eepkkefp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Process not Found Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Process not Found Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ejmkiiha.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fdijkmbl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jdbheajp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Knabne32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Process not Found Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Obfhmd32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Flpkcbqm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Apobakpn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pbhdafdd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Klgqmfpj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Process not Found Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Process not Found Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Llnnmhfe.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ophjdehd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lemjlcgo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kibeoo32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ocopncke.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jkjclk32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Process not Found Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Emhmkh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Flghognq.exe - Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/files/0x000800000002325e-6.dat family_berbew behavioral2/files/0x000b00000001ea83-14.dat family_berbew behavioral2/files/0x0007000000023262-22.dat family_berbew behavioral2/files/0x0007000000023264-30.dat family_berbew behavioral2/files/0x0007000000023266-33.dat family_berbew behavioral2/files/0x0007000000023268-46.dat family_berbew behavioral2/files/0x000700000002326a-54.dat family_berbew behavioral2/files/0x000700000002326c-64.dat family_berbew behavioral2/files/0x000700000002326e-72.dat family_berbew behavioral2/files/0x0007000000023270-79.dat family_berbew behavioral2/files/0x0007000000023272-87.dat family_berbew behavioral2/files/0x0007000000023274-99.dat family_berbew behavioral2/files/0x0007000000023276-108.dat family_berbew behavioral2/files/0x0007000000023278-114.dat family_berbew behavioral2/files/0x000700000002327a-124.dat family_berbew behavioral2/files/0x000700000002327e-141.dat family_berbew behavioral2/files/0x000700000002327c-134.dat family_berbew behavioral2/files/0x0007000000023280-150.dat family_berbew behavioral2/files/0x0007000000023282-159.dat family_berbew behavioral2/files/0x0007000000023287-180.dat family_berbew behavioral2/files/0x0007000000023289-186.dat family_berbew behavioral2/files/0x000700000002328b-196.dat family_berbew behavioral2/files/0x0007000000023284-169.dat family_berbew behavioral2/files/0x000700000002328d-204.dat family_berbew behavioral2/files/0x000700000002328f-213.dat family_berbew behavioral2/files/0x0007000000023293-223.dat family_berbew behavioral2/files/0x0007000000023295-232.dat family_berbew behavioral2/files/0x0007000000023299-252.dat family_berbew behavioral2/files/0x0007000000023297-242.dat family_berbew behavioral2/files/0x000700000002329b-259.dat family_berbew behavioral2/files/0x000700000002329d-263.dat family_berbew behavioral2/files/0x000700000002329f-279.dat family_berbew behavioral2/files/0x00070000000232a1-286.dat family_berbew behavioral2/files/0x00070000000232b1-338.dat family_berbew behavioral2/files/0x00070000000232b5-352.dat family_berbew behavioral2/files/0x00070000000232bb-373.dat family_berbew behavioral2/files/0x00070000000232bf-387.dat family_berbew behavioral2/files/0x00070000000232d0-443.dat family_berbew behavioral2/files/0x00070000000232de-492.dat family_berbew behavioral2/files/0x00070000000232f8-583.dat family_berbew behavioral2/files/0x000700000002330a-646.dat family_berbew behavioral2/files/0x000700000002330e-660.dat family_berbew behavioral2/files/0x0007000000023317-695.dat family_berbew behavioral2/files/0x0007000000023325-744.dat family_berbew behavioral2/files/0x000700000002332b-765.dat family_berbew behavioral2/files/0x0007000000023343-849.dat family_berbew behavioral2/files/0x000700000002334b-876.dat family_berbew behavioral2/files/0x0007000000023353-904.dat family_berbew behavioral2/files/0x000700000002335b-932.dat family_berbew behavioral2/files/0x0007000000023362-946.dat family_berbew behavioral2/files/0x000700000002337b-1030.dat family_berbew behavioral2/files/0x000700000002338a-1078.dat family_berbew behavioral2/files/0x000700000002338c-1086.dat family_berbew behavioral2/files/0x0007000000023391-1099.dat family_berbew behavioral2/files/0x000700000002339c-1134.dat family_berbew behavioral2/files/0x00070000000233a0-1148.dat family_berbew behavioral2/files/0x00070000000233a4-1162.dat family_berbew behavioral2/files/0x00070000000233a6-1170.dat family_berbew behavioral2/files/0x00070000000233b0-1190.dat family_berbew behavioral2/files/0x00070000000233bf-1225.dat family_berbew behavioral2/files/0x00080000000233b2-1267.dat family_berbew behavioral2/files/0x00070000000233d1-1302.dat family_berbew behavioral2/files/0x00070000000233df-1341.dat family_berbew behavioral2/files/0x00070000000233e5-1362.dat family_berbew - Executes dropped EXE 64 IoCs
pid Process 4520 Ddifgk32.exe 2688 Fecadghc.exe 2044 Galoohke.exe 1792 Ggkqgaol.exe 1384 Giljfddl.exe 4360 Hahokfag.exe 228 Hnnljj32.exe 1376 Hppeim32.exe 3504 Inebjihf.exe 996 Iafkld32.exe 1280 Ihbponja.exe 2476 Jidinqpb.exe 3324 Jihbip32.exe 4180 Jbagbebm.exe 3432 Jpgdai32.exe 2964 Kibeoo32.exe 3056 Kidben32.exe 2028 Kcmfnd32.exe 1480 Lllagh32.exe 2276 Llnnmhfe.exe 3552 Llcghg32.exe 868 Modpib32.exe 1152 Mhldbh32.exe 4284 Mcdeeq32.exe 3800 Nblolm32.exe 1032 Nodiqp32.exe 2596 Obgohklm.exe 4160 Oqhoeb32.exe 2192 Ocihgnam.exe 180 Ofjqihnn.exe 4760 Pimfpc32.exe 2524 Pcbkml32.exe 3100 Pmkofa32.exe 2136 Qbonoghb.exe 896 Bpqjjjjl.exe 1080 Bmggingc.exe 3532 Bmidnm32.exe 4768 Cajjjk32.exe 1552 Ccppmc32.exe 620 Cgmhcaac.exe 632 Dncpkjoc.exe 4908 Epdime32.exe 4576 Ephbhd32.exe 4456 Egegjn32.exe 5108 Fncibg32.exe 1204 Fnhbmgmk.exe 3828 Gkoplk32.exe 1124 Ggepalof.exe 2036 Gdknpp32.exe 3272 Gjhfif32.exe 2892 Hqdkkp32.exe 1464 Hnhkdd32.exe 552 Hkmlnimb.exe 2496 Hchqbkkm.exe 1040 Hghfnioq.exe 368 Ibnjkbog.exe 2772 Ijkled32.exe 5080 Ilmedf32.exe 756 Iajmmm32.exe 1216 Jlanpfkj.exe 3316 Jjgkab32.exe 3576 Jlfhke32.exe 548 Jlidpe32.exe 3520 Koimbpbc.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Bmggingc.exe Bpqjjjjl.exe File opened for modification C:\Windows\SysWOW64\Mkgfdgpq.exe Mehafq32.exe File created C:\Windows\SysWOW64\Nejlok32.dll Cjofambd.exe File created C:\Windows\SysWOW64\Mccqgk32.dll Process not Found File created C:\Windows\SysWOW64\Qmekbhdn.dll Nejgbn32.exe File created C:\Windows\SysWOW64\Ahoino32.dll Bqpbboeg.exe File created C:\Windows\SysWOW64\Oegbgf32.dll Nlknbb32.exe File created C:\Windows\SysWOW64\Chagiqhm.exe Cagolf32.exe File created C:\Windows\SysWOW64\Nalpbf32.exe Process not Found File created C:\Windows\SysWOW64\Gdknpp32.exe Ggepalof.exe File created C:\Windows\SysWOW64\Fndjec32.dll Mmpbkm32.exe File created C:\Windows\SysWOW64\Nncqojmh.dll Gpioca32.exe File created C:\Windows\SysWOW64\Mpebjb32.exe Lepnli32.exe File opened for modification C:\Windows\SysWOW64\Cgioah32.exe Process not Found File created C:\Windows\SysWOW64\Ieaqqigc.dll Lahbei32.exe File created C:\Windows\SysWOW64\Ocligb32.dll Aefcif32.exe File created C:\Windows\SysWOW64\Oifglb32.dll Fgffka32.exe File opened for modification C:\Windows\SysWOW64\Dccbln32.exe Dcaefo32.exe File created C:\Windows\SysWOW64\Gdncfl32.exe Gkeonggf.exe File created C:\Windows\SysWOW64\Qcbfjqkp.exe Qhlamhkj.exe File created C:\Windows\SysWOW64\Eknodnil.dll Process not Found File created C:\Windows\SysWOW64\Gcjdjb32.exe Process not Found File created C:\Windows\SysWOW64\Cajjjk32.exe Bmidnm32.exe File opened for modification C:\Windows\SysWOW64\Ejbknnid.exe Elojej32.exe File created C:\Windows\SysWOW64\Ojhijjll.exe Ojfmdk32.exe File created C:\Windows\SysWOW64\Kfedpccg.dll Fneohd32.exe File created C:\Windows\SysWOW64\Qjohiimm.dll Process not Found File created C:\Windows\SysWOW64\Npgklofp.dll Process not Found File created C:\Windows\SysWOW64\Fogpoiia.dll Lkqgno32.exe File created C:\Windows\SysWOW64\Goamlkpk.exe Gehice32.exe File opened for modification C:\Windows\SysWOW64\Ahffqk32.exe Anmagenh.exe File created C:\Windows\SysWOW64\Adiigf32.dll Bjlgnh32.exe File created C:\Windows\SysWOW64\Komoed32.exe Kfejmobh.exe File created C:\Windows\SysWOW64\Lemjlcgo.exe Lfgnkgbf.exe File opened for modification C:\Windows\SysWOW64\Kleajegi.exe Process not Found File opened for modification C:\Windows\SysWOW64\Dknnhekd.exe Process not Found File created C:\Windows\SysWOW64\Hpfiln32.dll Gdknpp32.exe File created C:\Windows\SysWOW64\Ghijbq32.dll Egbdjhlp.exe File created C:\Windows\SysWOW64\Bdemhoen.dll Lpcedbjp.exe File created C:\Windows\SysWOW64\Bqdbec32.exe Bmfjodgc.exe File created C:\Windows\SysWOW64\Jbieebha.exe Jfbdpabn.exe File created C:\Windows\SysWOW64\Dbkfia32.dll Kmegkp32.exe File opened for modification C:\Windows\SysWOW64\Amkabind.exe Acbmjcgd.exe File opened for modification C:\Windows\SysWOW64\Bnobfn32.exe Bloflk32.exe File created C:\Windows\SysWOW64\Gighom32.exe Gmqgjl32.exe File created C:\Windows\SysWOW64\Pafcda32.dll Process not Found File created C:\Windows\SysWOW64\Ddifgk32.exe 7d7d2cd7dcaba16161ebf1cf4be626a0_NeikiAnalytics.exe File created C:\Windows\SysWOW64\Afgfhaab.dll Jjgkab32.exe File opened for modification C:\Windows\SysWOW64\Ibagmiie.exe Imdndbkn.exe File created C:\Windows\SysWOW64\Ocknmjcf.exe Olaeqp32.exe File opened for modification C:\Windows\SysWOW64\Elpppcdl.exe Echkgnnl.exe File created C:\Windows\SysWOW64\Bcfkiock.exe Ainfpi32.exe File opened for modification C:\Windows\SysWOW64\Hlldaape.exe Process not Found File opened for modification C:\Windows\SysWOW64\Ffekom32.exe Fokbbcmo.exe File opened for modification C:\Windows\SysWOW64\Hclaeocp.exe Hifmhf32.exe File created C:\Windows\SysWOW64\Jphcmp32.exe Jfpocjfa.exe File created C:\Windows\SysWOW64\Imajlp32.dll Cjjcof32.exe File created C:\Windows\SysWOW64\Dabhomea.exe Celgjlpn.exe File opened for modification C:\Windows\SysWOW64\Jbieebha.exe Jfbdpabn.exe File created C:\Windows\SysWOW64\Oljkcpnb.exe Odnfonag.exe File created C:\Windows\SysWOW64\Gmcidg32.dll Dkehlo32.exe File created C:\Windows\SysWOW64\Dlifbblk.dll Process not Found File created C:\Windows\SysWOW64\Odfjpcbb.dll Process not Found File created C:\Windows\SysWOW64\Flaiho32.exe Egbdjhlp.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cqiehnml.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kgmlde32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Klgqmfpj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dhbllc32.dll" Fdijkmbl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hiefmp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dfqdid32.dll" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Inkjfk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ploloqjj.dll" Ndpcdjho.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Headnoed.dll" Belemd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ihicah32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gdkgam32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iobbbpgd.dll" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ccegac32.dll" Giljfddl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dllffa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gnckooob.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jgabnp32.dll" Iicboncn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gomkkagl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gbdcekfc.dll" Llofnh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hcfjka32.dll" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Qppkhfec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Balgcpkn.dll" Oqhoeb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Offeahhp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bfabhppm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gepkahmm.dll" Ejoogm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Clbiilpi.dll" Pgaelcgm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ljdbjpnm.dll" Meogbcel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Oocmcn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aampgb32.dll" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jmfphjcf.dll" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dibdeegc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ceeojndk.dll" Gbcffk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ciebfc32.dll" Acclejeb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oggdgb32.dll" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gefpidln.dll" Nmlhaa32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jahgpf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Epcengma.dll" Agqekeeb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ecbjdcml.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cfeplh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Elighial.dll" Dagiba32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Amcmie32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dpllbp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Egnhcgeb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlafbnic.dll" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Icldmjph.dll" Albkieqj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jfkhfmdm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jbnopbdl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fmehnn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jijhom32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dkbomgde.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Deenhilj.dll" Dicbfhni.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qblnjopb.dll" Fhchhm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nhfcjc32.dll" Pngbam32.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3372 wrote to memory of 4520 3372 7d7d2cd7dcaba16161ebf1cf4be626a0_NeikiAnalytics.exe 91 PID 3372 wrote to memory of 4520 3372 7d7d2cd7dcaba16161ebf1cf4be626a0_NeikiAnalytics.exe 91 PID 3372 wrote to memory of 4520 3372 7d7d2cd7dcaba16161ebf1cf4be626a0_NeikiAnalytics.exe 91 PID 4520 wrote to memory of 2688 4520 Ddifgk32.exe 92 PID 4520 wrote to memory of 2688 4520 Ddifgk32.exe 92 PID 4520 wrote to memory of 2688 4520 Ddifgk32.exe 92 PID 2688 wrote to memory of 2044 2688 Fecadghc.exe 93 PID 2688 wrote to memory of 2044 2688 Fecadghc.exe 93 PID 2688 wrote to memory of 2044 2688 Fecadghc.exe 93 PID 2044 wrote to memory of 1792 2044 Galoohke.exe 94 PID 2044 wrote to memory of 1792 2044 Galoohke.exe 94 PID 2044 wrote to memory of 1792 2044 Galoohke.exe 94 PID 1792 wrote to memory of 1384 1792 Ggkqgaol.exe 95 PID 1792 wrote to memory of 1384 1792 Ggkqgaol.exe 95 PID 1792 wrote to memory of 1384 1792 Ggkqgaol.exe 95 PID 1384 wrote to memory of 4360 1384 Giljfddl.exe 96 PID 1384 wrote to memory of 4360 1384 Giljfddl.exe 96 PID 1384 wrote to memory of 4360 1384 Giljfddl.exe 96 PID 4360 wrote to memory of 228 4360 Hahokfag.exe 97 PID 4360 wrote to memory of 228 4360 Hahokfag.exe 97 PID 4360 wrote to memory of 228 4360 Hahokfag.exe 97 PID 228 wrote to memory of 1376 228 Hnnljj32.exe 98 PID 228 wrote to memory of 1376 228 Hnnljj32.exe 98 PID 228 wrote to memory of 1376 228 Hnnljj32.exe 98 PID 1376 wrote to memory of 3504 1376 Hppeim32.exe 99 PID 1376 wrote to memory of 3504 1376 Hppeim32.exe 99 PID 1376 wrote to memory of 3504 1376 Hppeim32.exe 99 PID 3504 wrote to memory of 996 3504 Inebjihf.exe 100 PID 3504 wrote to memory of 996 3504 Inebjihf.exe 100 PID 3504 wrote to memory of 996 3504 Inebjihf.exe 100 PID 996 wrote to memory of 1280 996 Iafkld32.exe 101 PID 996 wrote to memory of 1280 996 Iafkld32.exe 101 PID 996 wrote to memory of 1280 996 Iafkld32.exe 101 PID 1280 wrote to memory of 2476 1280 Ihbponja.exe 102 PID 1280 wrote to memory of 2476 1280 Ihbponja.exe 102 PID 1280 wrote to memory of 2476 1280 Ihbponja.exe 102 PID 2476 wrote to memory of 3324 2476 Jidinqpb.exe 103 PID 2476 wrote to memory of 3324 2476 Jidinqpb.exe 103 PID 2476 wrote to memory of 3324 2476 Jidinqpb.exe 103 PID 3324 wrote to memory of 4180 3324 Jihbip32.exe 104 PID 3324 wrote to memory of 4180 3324 Jihbip32.exe 104 PID 3324 wrote to memory of 4180 3324 Jihbip32.exe 104 PID 4180 wrote to memory of 3432 4180 Jbagbebm.exe 105 PID 4180 wrote to memory of 3432 4180 Jbagbebm.exe 105 PID 4180 wrote to memory of 3432 4180 Jbagbebm.exe 105 PID 3432 wrote to memory of 2964 3432 Jpgdai32.exe 106 PID 3432 wrote to memory of 2964 3432 Jpgdai32.exe 106 PID 3432 wrote to memory of 2964 3432 Jpgdai32.exe 106 PID 2964 wrote to memory of 3056 2964 Kibeoo32.exe 107 PID 2964 wrote to memory of 3056 2964 Kibeoo32.exe 107 PID 2964 wrote to memory of 3056 2964 Kibeoo32.exe 107 PID 3056 wrote to memory of 2028 3056 Kidben32.exe 108 PID 3056 wrote to memory of 2028 3056 Kidben32.exe 108 PID 3056 wrote to memory of 2028 3056 Kidben32.exe 108 PID 2028 wrote to memory of 1480 2028 Kcmfnd32.exe 109 PID 2028 wrote to memory of 1480 2028 Kcmfnd32.exe 109 PID 2028 wrote to memory of 1480 2028 Kcmfnd32.exe 109 PID 1480 wrote to memory of 2276 1480 Lllagh32.exe 110 PID 1480 wrote to memory of 2276 1480 Lllagh32.exe 110 PID 1480 wrote to memory of 2276 1480 Lllagh32.exe 110 PID 2276 wrote to memory of 3552 2276 Llnnmhfe.exe 111 PID 2276 wrote to memory of 3552 2276 Llnnmhfe.exe 111 PID 2276 wrote to memory of 3552 2276 Llnnmhfe.exe 111 PID 3552 wrote to memory of 868 3552 Llcghg32.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\7d7d2cd7dcaba16161ebf1cf4be626a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\7d7d2cd7dcaba16161ebf1cf4be626a0_NeikiAnalytics.exe"1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Windows\SysWOW64\Ddifgk32.exeC:\Windows\system32\Ddifgk32.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Windows\SysWOW64\Fecadghc.exeC:\Windows\system32\Fecadghc.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Windows\SysWOW64\Galoohke.exeC:\Windows\system32\Galoohke.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Windows\SysWOW64\Ggkqgaol.exeC:\Windows\system32\Ggkqgaol.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Windows\SysWOW64\Giljfddl.exeC:\Windows\system32\Giljfddl.exe6⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Windows\SysWOW64\Hahokfag.exeC:\Windows\system32\Hahokfag.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Windows\SysWOW64\Hnnljj32.exeC:\Windows\system32\Hnnljj32.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
C:\Windows\SysWOW64\Hppeim32.exeC:\Windows\system32\Hppeim32.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Windows\SysWOW64\Inebjihf.exeC:\Windows\system32\Inebjihf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Windows\SysWOW64\Iafkld32.exeC:\Windows\system32\Iafkld32.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Windows\SysWOW64\Ihbponja.exeC:\Windows\system32\Ihbponja.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Windows\SysWOW64\Jidinqpb.exeC:\Windows\system32\Jidinqpb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Windows\SysWOW64\Jihbip32.exeC:\Windows\system32\Jihbip32.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Windows\SysWOW64\Jbagbebm.exeC:\Windows\system32\Jbagbebm.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Windows\SysWOW64\Jpgdai32.exeC:\Windows\system32\Jpgdai32.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Windows\SysWOW64\Kibeoo32.exeC:\Windows\system32\Kibeoo32.exe17⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Windows\SysWOW64\Kidben32.exeC:\Windows\system32\Kidben32.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Windows\SysWOW64\Kcmfnd32.exeC:\Windows\system32\Kcmfnd32.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\SysWOW64\Lllagh32.exeC:\Windows\system32\Lllagh32.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Windows\SysWOW64\Llnnmhfe.exeC:\Windows\system32\Llnnmhfe.exe21⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Windows\SysWOW64\Llcghg32.exeC:\Windows\system32\Llcghg32.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Windows\SysWOW64\Modpib32.exeC:\Windows\system32\Modpib32.exe23⤵
- Executes dropped EXE
PID:868 -
C:\Windows\SysWOW64\Mhldbh32.exeC:\Windows\system32\Mhldbh32.exe24⤵
- Executes dropped EXE
PID:1152 -
C:\Windows\SysWOW64\Mcdeeq32.exeC:\Windows\system32\Mcdeeq32.exe25⤵
- Executes dropped EXE
PID:4284 -
C:\Windows\SysWOW64\Nblolm32.exeC:\Windows\system32\Nblolm32.exe26⤵
- Executes dropped EXE
PID:3800 -
C:\Windows\SysWOW64\Nijqcf32.exeC:\Windows\system32\Nijqcf32.exe27⤵PID:4416
-
C:\Windows\SysWOW64\Nodiqp32.exeC:\Windows\system32\Nodiqp32.exe28⤵
- Executes dropped EXE
PID:1032 -
C:\Windows\SysWOW64\Obgohklm.exeC:\Windows\system32\Obgohklm.exe29⤵
- Executes dropped EXE
PID:2596 -
C:\Windows\SysWOW64\Oqhoeb32.exeC:\Windows\system32\Oqhoeb32.exe30⤵
- Executes dropped EXE
- Modifies registry class
PID:4160 -
C:\Windows\SysWOW64\Ocihgnam.exeC:\Windows\system32\Ocihgnam.exe31⤵
- Executes dropped EXE
PID:2192 -
C:\Windows\SysWOW64\Ofjqihnn.exeC:\Windows\system32\Ofjqihnn.exe32⤵
- Executes dropped EXE
PID:180 -
C:\Windows\SysWOW64\Pimfpc32.exeC:\Windows\system32\Pimfpc32.exe33⤵
- Executes dropped EXE
PID:4760 -
C:\Windows\SysWOW64\Pcbkml32.exeC:\Windows\system32\Pcbkml32.exe34⤵
- Executes dropped EXE
PID:2524 -
C:\Windows\SysWOW64\Pmkofa32.exeC:\Windows\system32\Pmkofa32.exe35⤵
- Executes dropped EXE
PID:3100 -
C:\Windows\SysWOW64\Qbonoghb.exeC:\Windows\system32\Qbonoghb.exe36⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2136 -
C:\Windows\SysWOW64\Bpqjjjjl.exeC:\Windows\system32\Bpqjjjjl.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:896 -
C:\Windows\SysWOW64\Bmggingc.exeC:\Windows\system32\Bmggingc.exe38⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1080 -
C:\Windows\SysWOW64\Bmidnm32.exeC:\Windows\system32\Bmidnm32.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3532 -
C:\Windows\SysWOW64\Cajjjk32.exeC:\Windows\system32\Cajjjk32.exe40⤵
- Executes dropped EXE
PID:4768 -
C:\Windows\SysWOW64\Ccppmc32.exeC:\Windows\system32\Ccppmc32.exe41⤵
- Executes dropped EXE
PID:1552 -
C:\Windows\SysWOW64\Cgmhcaac.exeC:\Windows\system32\Cgmhcaac.exe42⤵
- Executes dropped EXE
PID:620 -
C:\Windows\SysWOW64\Dncpkjoc.exeC:\Windows\system32\Dncpkjoc.exe43⤵
- Executes dropped EXE
PID:632 -
C:\Windows\SysWOW64\Epdime32.exeC:\Windows\system32\Epdime32.exe44⤵
- Executes dropped EXE
PID:4908 -
C:\Windows\SysWOW64\Ephbhd32.exeC:\Windows\system32\Ephbhd32.exe45⤵
- Executes dropped EXE
PID:4576 -
C:\Windows\SysWOW64\Egegjn32.exeC:\Windows\system32\Egegjn32.exe46⤵
- Executes dropped EXE
PID:4456 -
C:\Windows\SysWOW64\Fncibg32.exeC:\Windows\system32\Fncibg32.exe47⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:5108 -
C:\Windows\SysWOW64\Fnhbmgmk.exeC:\Windows\system32\Fnhbmgmk.exe48⤵
- Executes dropped EXE
PID:1204 -
C:\Windows\SysWOW64\Gkoplk32.exeC:\Windows\system32\Gkoplk32.exe49⤵
- Executes dropped EXE
PID:3828 -
C:\Windows\SysWOW64\Ggepalof.exeC:\Windows\system32\Ggepalof.exe50⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1124 -
C:\Windows\SysWOW64\Gdknpp32.exeC:\Windows\system32\Gdknpp32.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2036 -
C:\Windows\SysWOW64\Gjhfif32.exeC:\Windows\system32\Gjhfif32.exe52⤵
- Executes dropped EXE
PID:3272 -
C:\Windows\SysWOW64\Hqdkkp32.exeC:\Windows\system32\Hqdkkp32.exe53⤵
- Executes dropped EXE
PID:2892 -
C:\Windows\SysWOW64\Hnhkdd32.exeC:\Windows\system32\Hnhkdd32.exe54⤵
- Executes dropped EXE
PID:1464 -
C:\Windows\SysWOW64\Hkmlnimb.exeC:\Windows\system32\Hkmlnimb.exe55⤵
- Executes dropped EXE
PID:552 -
C:\Windows\SysWOW64\Hchqbkkm.exeC:\Windows\system32\Hchqbkkm.exe56⤵
- Executes dropped EXE
PID:2496 -
C:\Windows\SysWOW64\Hghfnioq.exeC:\Windows\system32\Hghfnioq.exe57⤵
- Executes dropped EXE
PID:1040 -
C:\Windows\SysWOW64\Ibnjkbog.exeC:\Windows\system32\Ibnjkbog.exe58⤵
- Executes dropped EXE
PID:368 -
C:\Windows\SysWOW64\Ijkled32.exeC:\Windows\system32\Ijkled32.exe59⤵
- Executes dropped EXE
PID:2772 -
C:\Windows\SysWOW64\Ilmedf32.exeC:\Windows\system32\Ilmedf32.exe60⤵
- Executes dropped EXE
PID:5080 -
C:\Windows\SysWOW64\Iajmmm32.exeC:\Windows\system32\Iajmmm32.exe61⤵
- Executes dropped EXE
PID:756 -
C:\Windows\SysWOW64\Jlanpfkj.exeC:\Windows\system32\Jlanpfkj.exe62⤵
- Executes dropped EXE
PID:1216 -
C:\Windows\SysWOW64\Jjgkab32.exeC:\Windows\system32\Jjgkab32.exe63⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:3316 -
C:\Windows\SysWOW64\Jlfhke32.exeC:\Windows\system32\Jlfhke32.exe64⤵
- Executes dropped EXE
PID:3576 -
C:\Windows\SysWOW64\Jlidpe32.exeC:\Windows\system32\Jlidpe32.exe65⤵
- Executes dropped EXE
PID:548 -
C:\Windows\SysWOW64\Koimbpbc.exeC:\Windows\system32\Koimbpbc.exe66⤵
- Executes dropped EXE
PID:3520 -
C:\Windows\SysWOW64\Kkpnga32.exeC:\Windows\system32\Kkpnga32.exe67⤵PID:2684
-
C:\Windows\SysWOW64\Klpjad32.exeC:\Windows\system32\Klpjad32.exe68⤵PID:4116
-
C:\Windows\SysWOW64\Kdkoef32.exeC:\Windows\system32\Kdkoef32.exe69⤵PID:3104
-
C:\Windows\SysWOW64\Kaopoj32.exeC:\Windows\system32\Kaopoj32.exe70⤵PID:60
-
C:\Windows\SysWOW64\Kocphojh.exeC:\Windows\system32\Kocphojh.exe71⤵PID:4472
-
C:\Windows\SysWOW64\Kdpiqehp.exeC:\Windows\system32\Kdpiqehp.exe72⤵PID:1856
-
C:\Windows\SysWOW64\Loemnnhe.exeC:\Windows\system32\Loemnnhe.exe73⤵PID:4996
-
C:\Windows\SysWOW64\Ldbefe32.exeC:\Windows\system32\Ldbefe32.exe74⤵PID:3764
-
C:\Windows\SysWOW64\Laffpi32.exeC:\Windows\system32\Laffpi32.exe75⤵PID:5012
-
C:\Windows\SysWOW64\Llkjmb32.exeC:\Windows\system32\Llkjmb32.exe76⤵PID:4352
-
C:\Windows\SysWOW64\Lahbei32.exeC:\Windows\system32\Lahbei32.exe77⤵
- Drops file in System32 directory
PID:4912 -
C:\Windows\SysWOW64\Lkqgno32.exeC:\Windows\system32\Lkqgno32.exe78⤵
- Drops file in System32 directory
PID:1860 -
C:\Windows\SysWOW64\Lkcccn32.exeC:\Windows\system32\Lkcccn32.exe79⤵PID:2296
-
C:\Windows\SysWOW64\Lehhqg32.exeC:\Windows\system32\Lehhqg32.exe80⤵PID:1872
-
C:\Windows\SysWOW64\Mclhjkfa.exeC:\Windows\system32\Mclhjkfa.exe81⤵PID:4780
-
C:\Windows\SysWOW64\Moefdljc.exeC:\Windows\system32\Moefdljc.exe82⤵PID:4900
-
C:\Windows\SysWOW64\Mafofggd.exeC:\Windows\system32\Mafofggd.exe83⤵PID:1936
-
C:\Windows\SysWOW64\Mahklf32.exeC:\Windows\system32\Mahklf32.exe84⤵PID:5144
-
C:\Windows\SysWOW64\Nkapelka.exeC:\Windows\system32\Nkapelka.exe85⤵PID:5188
-
C:\Windows\SysWOW64\Nkcmjlio.exeC:\Windows\system32\Nkcmjlio.exe86⤵PID:5232
-
C:\Windows\SysWOW64\Noaeqjpe.exeC:\Windows\system32\Noaeqjpe.exe87⤵PID:5280
-
C:\Windows\SysWOW64\Nocbfjmc.exeC:\Windows\system32\Nocbfjmc.exe88⤵PID:5336
-
C:\Windows\SysWOW64\Nlgbon32.exeC:\Windows\system32\Nlgbon32.exe89⤵PID:5380
-
C:\Windows\SysWOW64\Obfhmd32.exeC:\Windows\system32\Obfhmd32.exe90⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5424 -
C:\Windows\SysWOW64\Ookhfigk.exeC:\Windows\system32\Ookhfigk.exe91⤵PID:5468
-
C:\Windows\SysWOW64\Ofdqcc32.exeC:\Windows\system32\Ofdqcc32.exe92⤵PID:5516
-
C:\Windows\SysWOW64\Obkahddl.exeC:\Windows\system32\Obkahddl.exe93⤵PID:5560
-
C:\Windows\SysWOW64\Ofijnbkb.exeC:\Windows\system32\Ofijnbkb.exe94⤵PID:5604
-
C:\Windows\SysWOW64\Pdngpo32.exeC:\Windows\system32\Pdngpo32.exe95⤵PID:5648
-
C:\Windows\SysWOW64\Pdqcenmg.exeC:\Windows\system32\Pdqcenmg.exe96⤵PID:5692
-
C:\Windows\SysWOW64\Pbddobla.exeC:\Windows\system32\Pbddobla.exe97⤵PID:5740
-
C:\Windows\SysWOW64\Pfbmdabh.exeC:\Windows\system32\Pfbmdabh.exe98⤵PID:5788
-
C:\Windows\SysWOW64\Pbimjb32.exeC:\Windows\system32\Pbimjb32.exe99⤵PID:5832
-
C:\Windows\SysWOW64\Pomncfge.exeC:\Windows\system32\Pomncfge.exe100⤵PID:5876
-
C:\Windows\SysWOW64\Qppkhfec.exeC:\Windows\system32\Qppkhfec.exe101⤵
- Modifies registry class
PID:5920 -
C:\Windows\SysWOW64\Qkfkng32.exeC:\Windows\system32\Qkfkng32.exe102⤵PID:5964
-
C:\Windows\SysWOW64\Aeopfl32.exeC:\Windows\system32\Aeopfl32.exe103⤵PID:6008
-
C:\Windows\SysWOW64\Akihcfid.exeC:\Windows\system32\Akihcfid.exe104⤵PID:6052
-
C:\Windows\SysWOW64\Aimhmkgn.exeC:\Windows\system32\Aimhmkgn.exe105⤵PID:6096
-
C:\Windows\SysWOW64\Acbmjcgd.exeC:\Windows\system32\Acbmjcgd.exe106⤵
- Drops file in System32 directory
PID:6140 -
C:\Windows\SysWOW64\Amkabind.exeC:\Windows\system32\Amkabind.exe107⤵PID:5172
-
C:\Windows\SysWOW64\Aiabhj32.exeC:\Windows\system32\Aiabhj32.exe108⤵PID:5244
-
C:\Windows\SysWOW64\Albkieqj.exeC:\Windows\system32\Albkieqj.exe109⤵
- Modifies registry class
PID:5320 -
C:\Windows\SysWOW64\Bldgoeog.exeC:\Windows\system32\Bldgoeog.exe110⤵PID:5392
-
C:\Windows\SysWOW64\Bemlhj32.exeC:\Windows\system32\Bemlhj32.exe111⤵PID:5476
-
C:\Windows\SysWOW64\Bmfqngcg.exeC:\Windows\system32\Bmfqngcg.exe112⤵PID:5544
-
C:\Windows\SysWOW64\Beaecjab.exeC:\Windows\system32\Beaecjab.exe113⤵PID:5624
-
C:\Windows\SysWOW64\Bcbeqaia.exeC:\Windows\system32\Bcbeqaia.exe114⤵PID:5704
-
C:\Windows\SysWOW64\Bedbhi32.exeC:\Windows\system32\Bedbhi32.exe115⤵PID:5820
-
C:\Windows\SysWOW64\Cibkohef.exeC:\Windows\system32\Cibkohef.exe116⤵PID:5896
-
C:\Windows\SysWOW64\Cehlcikj.exeC:\Windows\system32\Cehlcikj.exe117⤵PID:5956
-
C:\Windows\SysWOW64\Cekhihig.exeC:\Windows\system32\Cekhihig.exe118⤵PID:6028
-
C:\Windows\SysWOW64\Ciiaogon.exeC:\Windows\system32\Ciiaogon.exe119⤵PID:6116
-
C:\Windows\SysWOW64\Cfmahknh.exeC:\Windows\system32\Cfmahknh.exe120⤵PID:5132
-
C:\Windows\SysWOW64\Dllffa32.exeC:\Windows\system32\Dllffa32.exe121⤵
- Modifies registry class
PID:5272
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-