Analysis
- max time kernel
141s - max time network
159s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
11/05/2024, 04:36
Behavioral task
behavioral1
Sample
7e921f84a9378ba1dee4c8f84fe81a70_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
7e921f84a9378ba1dee4c8f84fe81a70_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 7e921f84a9378ba1dee4c8f84fe81a70_NeikiAnalytics.exe
- Size 368KB
- Sample240511-e8jzlagc69
- SHA256 4773201cb1db65dc5486286c97b68ab89259561857b05f6ee95b3728cc69d497
- MD5 7e921f84a9378ba1dee4c8f84fe81a70
- SHA1 f41b72e459b8ba85343468d5bdeb4aa3aaf6ee1c
- SHA512 17ab026e19a2a7c54b5a0d46297dceea90846f3047205cf5368ca93d3a3c4b8eb8bf62bb1e9719e724b1abbfb9a6d866df0b224f11b1b1e5b86d4707510d1f40
- SSDEEP 6144:2B7XCcB1E4f9FIUpOVw86CmOJfTo9FIUIhrcflDMxy9FIUpOVw86CmOJfTo9FIUb:2BaaAD6RrI1+lDMEAD6Rr2NWL
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Nfabok32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Qggebl32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bglgdi32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mpnglbkf.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dknnoofg.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qnbdjl32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ghcbohpp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ihjafd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Bagmdllg.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bndjfjhl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ndpcdjho.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Liabjh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Lancko32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Mcfkpjng.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Oacmchcl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fajgfiag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Dggkipii.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Koljgppp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Daeifj32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iapjgo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Hmmakk32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aklciimh.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dehgejep.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iapbodql.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kcjjhdjb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oophlo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Nggjog32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bijncb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Hqjcgbbo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kmaooihb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gnoacp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Gnoacp32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nkgoke32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pdeffgff.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mminfech.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cfmahknh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Eibmlc32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gbhpajlj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Kjqfmn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Mlgegcng.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mbamcm32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lcealh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dnkbcp32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nkjlqd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Bfnnmg32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aqilaplo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Eljchpnl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Egbdjhlp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eibmlc32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fjeibc32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gkcigjel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ddcogo32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lfodmdni.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jfgnka32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Cppelkeb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ehnpmkbg.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Emioab32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qggebl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Flbhia32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Nhegig32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Iapjgo32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jmepcj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Kbbhka32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bdapehop.exe - Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/files/0x000f00000002325c-5.dat family_berbew behavioral2/files/0x000800000002328b-14.dat family_berbew behavioral2/files/0x000700000002328d-22.dat family_berbew behavioral2/files/0x000700000002328f-30.dat family_berbew behavioral2/files/0x0007000000023291-33.dat family_berbew behavioral2/files/0x0007000000023293-46.dat family_berbew behavioral2/files/0x0007000000023295-54.dat family_berbew behavioral2/files/0x0007000000023298-62.dat family_berbew behavioral2/files/0x000700000002329a-70.dat family_berbew behavioral2/files/0x000700000002329c-78.dat family_berbew behavioral2/files/0x000700000002329e-85.dat family_berbew behavioral2/files/0x00070000000232a0-93.dat family_berbew behavioral2/files/0x00070000000232a2-102.dat family_berbew behavioral2/files/0x00070000000232a4-110.dat family_berbew behavioral2/files/0x00070000000232a6-118.dat family_berbew behavioral2/files/0x00070000000232a8-126.dat family_berbew behavioral2/files/0x00070000000232aa-134.dat family_berbew behavioral2/files/0x00070000000232ac-142.dat family_berbew behavioral2/files/0x00070000000232ae-150.dat family_berbew behavioral2/files/0x00070000000232b0-158.dat family_berbew behavioral2/files/0x00070000000232b2-166.dat family_berbew behavioral2/files/0x00070000000232b4-174.dat family_berbew behavioral2/files/0x00070000000232b6-182.dat family_berbew behavioral2/files/0x00070000000232b8-190.dat family_berbew behavioral2/files/0x00070000000232bc-198.dat family_berbew behavioral2/files/0x00070000000232be-206.dat family_berbew behavioral2/files/0x00070000000232c0-214.dat family_berbew behavioral2/files/0x00070000000232c2-222.dat family_berbew behavioral2/files/0x00070000000232c4-230.dat family_berbew behavioral2/files/0x00070000000232c6-238.dat family_berbew behavioral2/files/0x00070000000232c8-246.dat family_berbew behavioral2/files/0x00070000000232ca-254.dat family_berbew behavioral2/files/0x00070000000232cd-262.dat family_berbew behavioral2/files/0x00070000000232d9-294.dat family_berbew behavioral2/files/0x00070000000232e7-336.dat family_berbew behavioral2/files/0x00070000000232eb-348.dat family_berbew behavioral2/files/0x00070000000232f1-366.dat family_berbew behavioral2/files/0x00070000000232f7-384.dat family_berbew behavioral2/files/0x0007000000023303-420.dat family_berbew behavioral2/files/0x0007000000023307-432.dat family_berbew behavioral2/files/0x000700000002331b-492.dat family_berbew behavioral2/files/0x0007000000023321-510.dat family_berbew behavioral2/files/0x0007000000023333-568.dat family_berbew behavioral2/files/0x0007000000023337-582.dat family_berbew behavioral2/files/0x000700000002333f-610.dat family_berbew behavioral2/files/0x0007000000023344-631.dat family_berbew behavioral2/files/0x000700000002334a-652.dat family_berbew behavioral2/files/0x000700000002334c-660.dat family_berbew behavioral2/files/0x0007000000023354-687.dat family_berbew behavioral2/files/0x0007000000023364-743.dat family_berbew behavioral2/files/0x0007000000023378-806.dat family_berbew behavioral2/files/0x000700000002337d-820.dat family_berbew behavioral2/files/0x0007000000023381-834.dat family_berbew behavioral2/files/0x000700000002338e-876.dat family_berbew behavioral2/files/0x0007000000023396-904.dat family_berbew behavioral2/files/0x00070000000233a0-939.dat family_berbew behavioral2/files/0x00070000000233bd-1015.dat family_berbew behavioral2/files/0x00070000000233c5-1029.dat family_berbew behavioral2/files/0x00070000000233cb-1049.dat family_berbew behavioral2/files/0x00070000000233d7-1103.dat family_berbew behavioral2/files/0x00070000000233e1-1137.dat family_berbew behavioral2/files/0x00070000000233f8-1213.dat family_berbew behavioral2/files/0x00070000000233fc-1227.dat family_berbew behavioral2/files/0x0007000000023402-1248.dat family_berbew - Executes dropped EXE 64 IoCs
pid Process 2548 Kcjjhdjb.exe 1488 Lpepbgbd.exe 1288 Lancko32.exe 1948 Lhgkgijg.exe 324 Mfnhfm32.exe 4080 Mcaipa32.exe 3524 Nhegig32.exe 4612 Nhhdnf32.exe 4360 Nfnamjhk.exe 1188 Nmjfodne.exe 4648 Ofegni32.exe 2544 Oophlo32.exe 4256 Pjoppf32.exe 4152 Pplhhm32.exe 4720 Qbonoghb.exe 4216 Qikbaaml.exe 2264 Amikgpcc.exe 1732 Aiplmq32.exe 1704 Abjmkf32.exe 2552 Banjnm32.exe 3836 Bdapehop.exe 2272 Bagmdllg.exe 1844 Calfpk32.exe 4836 Cacmpj32.exe 4972 Dknnoofg.exe 2624 Dggkipii.exe 4408 Dncpkjoc.exe 2532 Ekngemhd.exe 2804 Eajlhg32.exe 1916 Fkemfl32.exe 4564 Fglnkm32.exe 3148 Fgnjqm32.exe 4088 Fnjocf32.exe 2440 Ggepalof.exe 3520 Gnohnffc.exe 3448 Gkcigjel.exe 4688 Gqpapacd.exe 4604 Hjolie32.exe 3656 Hnmeodjc.exe 3444 Iapjgo32.exe 2856 Ijkled32.exe 3128 Inidkb32.exe 3956 Ibgmaqfl.exe 456 Jehfcl32.exe 4620 Jacpcl32.exe 4168 Jbbmmo32.exe 1264 Koljgppp.exe 1404 Klbgfc32.exe 5024 Lkiamp32.exe 5076 Lhdggb32.exe 5004 Ldkhlcnb.exe 4076 Mdpagc32.exe 1560 Mcabej32.exe 1812 Mohbjkgp.exe 856 Mcfkpjng.exe 2316 Nlcidopb.exe 3368 Nhjjip32.exe 2324 Nconfh32.exe 2408 Ohncdobq.exe 2388 Ocdgahag.exe 384 Ofdqcc32.exe 4024 Oomelheh.exe 3372 Omcbkl32.exe 904 Qelcamcj.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Gnoacp32.exe Gjqinamq.exe File created C:\Windows\SysWOW64\Lajhpbme.exe Lfddci32.exe File created C:\Windows\SysWOW64\Omhnja32.dll Kbbhka32.exe File opened for modification C:\Windows\SysWOW64\Mpnglbkf.exe Liabjh32.exe File opened for modification C:\Windows\SysWOW64\Pdklebje.exe Oggllnkl.exe File opened for modification C:\Windows\SysWOW64\Iefedcmk.exe Hlnqln32.exe File created C:\Windows\SysWOW64\Lgmbkcbp.dll Gnoacp32.exe File created C:\Windows\SysWOW64\Phiaee32.dll Ehnpmkbg.exe File created C:\Windows\SysWOW64\Oebdml32.dll Ghcbohpp.exe File created C:\Windows\SysWOW64\Neeheggd.dll Liabjh32.exe File opened for modification C:\Windows\SysWOW64\Dggkipii.exe Dknnoofg.exe File opened for modification C:\Windows\SysWOW64\Ohncdobq.exe Nconfh32.exe File created C:\Windows\SysWOW64\Mjdmlonn.dll Bemlhj32.exe File created C:\Windows\SysWOW64\Fffcpnjo.dll Hcifmdeo.exe File created C:\Windows\SysWOW64\Kdhlepkl.exe Knkcmild.exe File opened for modification C:\Windows\SysWOW64\Qbonoghb.exe Pplhhm32.exe File created C:\Windows\SysWOW64\Eljchpnl.exe Epcbbohh.exe File created C:\Windows\SysWOW64\Pjegen32.dll Jgekdq32.exe File created C:\Windows\SysWOW64\Mmmiiidk.dll Ldckan32.exe File opened for modification C:\Windows\SysWOW64\Nfabok32.exe Mminfech.exe File created C:\Windows\SysWOW64\Iaehfp32.dll Lfodmdni.exe File created C:\Windows\SysWOW64\Ikmpcicg.exe Ifphkbep.exe File created C:\Windows\SysWOW64\Ofgbflng.dll Mfofjk32.exe File created C:\Windows\SysWOW64\Blcnqjjo.dll Pjoppf32.exe File created C:\Windows\SysWOW64\Kdbamc32.dll Epcbbohh.exe File opened for modification C:\Windows\SysWOW64\Bbhhlccb.exe Akopoi32.exe File opened for modification C:\Windows\SysWOW64\Nleaha32.exe Npldnp32.exe File opened for modification C:\Windows\SysWOW64\Kbedaand.exe Kmhlijpm.exe File created C:\Windows\SysWOW64\Kcikfcab.exe Kjqfmn32.exe File created C:\Windows\SysWOW64\Eqnmad32.dll Kjqfmn32.exe File opened for modification C:\Windows\SysWOW64\Eedmlo32.exe Ehnpmkbg.exe File created C:\Windows\SysWOW64\Oejhoq32.dll Oacmchcl.exe File opened for modification C:\Windows\SysWOW64\Bemlhj32.exe Aecialmb.exe File opened for modification C:\Windows\SysWOW64\Cbnknpqj.exe Cghgpgqd.exe File created C:\Windows\SysWOW64\Bdchhk32.dll Jhqqlmba.exe File created C:\Windows\SysWOW64\Mmgmmdep.dll Jfikaqme.exe File created C:\Windows\SysWOW64\Fljloomi.dll Gqpapacd.exe File created C:\Windows\SysWOW64\Pkjhlh32.dll Cifdjg32.exe File created C:\Windows\SysWOW64\Kcblbn32.dll Iebfmfdg.exe File opened for modification C:\Windows\SysWOW64\Cbknhqbl.exe Cbfema32.exe File created C:\Windows\SysWOW64\Mlmncc32.dll Jmepcj32.exe File created C:\Windows\SysWOW64\Hjpdjplo.dll Dnienqbi.exe File created C:\Windows\SysWOW64\Nleaha32.exe Npldnp32.exe File opened for modification C:\Windows\SysWOW64\Bagmdllg.exe Bdapehop.exe File opened for modification C:\Windows\SysWOW64\Hjolie32.exe Gqpapacd.exe File created C:\Windows\SysWOW64\Cqbolk32.dll Aecialmb.exe File created C:\Windows\SysWOW64\Bndjfjhl.exe Belemd32.exe File created C:\Windows\SysWOW64\Hqjcgbbo.exe Hcdfho32.exe File created C:\Windows\SysWOW64\Fcodfa32.exe Fifomlap.exe File created C:\Windows\SysWOW64\Ijhhenhf.exe Inagpm32.exe File created C:\Windows\SysWOW64\Ngifef32.exe Nggjog32.exe File opened for modification C:\Windows\SysWOW64\Clffalkf.exe Cppelkeb.exe File created C:\Windows\SysWOW64\Niaekl32.dll Npldnp32.exe File created C:\Windows\SysWOW64\Kdbbihid.dll Gfjfhbpb.exe File created C:\Windows\SysWOW64\Ebagdddp.exe Dbehienn.exe File created C:\Windows\SysWOW64\Olikhnjp.dll Oggllnkl.exe File created C:\Windows\SysWOW64\Kkckgd32.dll Eiobbgcl.exe File created C:\Windows\SysWOW64\Npldnp32.exe Nfabok32.exe File created C:\Windows\SysWOW64\Fnjocf32.exe Fgnjqm32.exe File created C:\Windows\SysWOW64\Foeeml32.dll Gjqinamq.exe File opened for modification C:\Windows\SysWOW64\Igneda32.exe Imiagi32.exe File created C:\Windows\SysWOW64\Goamlkpk.exe Giddddad.exe File created C:\Windows\SysWOW64\Bhgnka32.dll Icooig32.exe File created C:\Windows\SysWOW64\Aknmjgje.dll Aijlgkjq.exe - Program crash 1 IoCs
pid pid_target Process procid_target 7592 800 WerFault.exe 376 - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Lfodmdni.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Dendok32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Emioab32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Clkaqh32.dll" Cnnllhpa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fhcpildd.dll" Qomghp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lagqnoge.dll" Kaihonhl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Nmjfodne.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbelak32.dll" Cfmahknh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Midfjnge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Nplkhf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Jfikaqme.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Kkofofbb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Bdapehop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mnokmd32.dll" Cacmpj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Cidgdg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Hcdfho32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Jmijnfgd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Bndjfjhl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ofdqcc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Hcifmdeo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Jhqqlmba.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gqnajlid.dll" Kmhlijpm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Banjnm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bfnafolo.dll" Mopeofjl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Mmebpbod.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Dbehienn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Oophlo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Jmijnfgd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ibgmaqfl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hkfdijnh.dll" Kpilekqj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jgnhmn32.dll" Laglkb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Mmebpbod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cdkdne32.dll" Omcbkl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Eoladdeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhgnka32.dll" Icooig32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lgmbkcbp.dll" Gnoacp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Eljchpnl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Npldnp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Hcifmdeo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Nkjlqd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Hcommoin.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Janpnfee.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Mdkabmjf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Lpepbgbd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ppbjhj32.dll" Dekapfke.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Clffalkf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Okiboajh.dll" Ebnddn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Hjolie32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Iebfmfdg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Npldnp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Fgnjqm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Mdpagc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Aecialmb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Giddddad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lhlgjo32.dll" Fgnjqm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ghcbohpp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Fnjocf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Nkgoke32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Lkkekdhe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Dmkcpdao.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Knifging.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Kbedaand.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Eedmlo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ahnljade.dll" Kgemahmg.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1348 wrote to memory of 2548 1348 7e921f84a9378ba1dee4c8f84fe81a70_NeikiAnalytics.exe 91 PID 1348 wrote to memory of 2548 1348 7e921f84a9378ba1dee4c8f84fe81a70_NeikiAnalytics.exe 91 PID 1348 wrote to memory of 2548 1348 7e921f84a9378ba1dee4c8f84fe81a70_NeikiAnalytics.exe 91 PID 2548 wrote to memory of 1488 2548 Kcjjhdjb.exe 92 PID 2548 wrote to memory of 1488 2548 Kcjjhdjb.exe 92 PID 2548 wrote to memory of 1488 2548 Kcjjhdjb.exe 92 PID 1488 wrote to memory of 1288 1488 Lpepbgbd.exe 93 PID 1488 wrote to memory of 1288 1488 Lpepbgbd.exe 93 PID 1488 wrote to memory of 1288 1488 Lpepbgbd.exe 93 PID 1288 wrote to memory of 1948 1288 Lancko32.exe 94 PID 1288 wrote to memory of 1948 1288 Lancko32.exe 94 PID 1288 wrote to memory of 1948 1288 Lancko32.exe 94 PID 1948 wrote to memory of 324 1948 Lhgkgijg.exe 95 PID 1948 wrote to memory of 324 1948 Lhgkgijg.exe 95 PID 1948 wrote to memory of 324 1948 Lhgkgijg.exe 95 PID 324 wrote to memory of 4080 324 Mfnhfm32.exe 96 PID 324 wrote to memory of 4080 324 Mfnhfm32.exe 96 PID 324 wrote to memory of 4080 324 Mfnhfm32.exe 96 PID 4080 wrote to memory of 3524 4080 Mcaipa32.exe 97 PID 4080 wrote to memory of 3524 4080 Mcaipa32.exe 97 PID 4080 wrote to memory of 3524 4080 Mcaipa32.exe 97 PID 3524 wrote to memory of 4612 3524 Nhegig32.exe 98 PID 3524 wrote to memory of 4612 3524 Nhegig32.exe 98 PID 3524 wrote to memory of 4612 3524 Nhegig32.exe 98 PID 4612 wrote to memory of 4360 4612 Nhhdnf32.exe 99 PID 4612 wrote to memory of 4360 4612 Nhhdnf32.exe 99 PID 4612 wrote to memory of 4360 4612 Nhhdnf32.exe 99 PID 4360 wrote to memory of 1188 4360 Nfnamjhk.exe 100 PID 4360 wrote to memory of 1188 4360 Nfnamjhk.exe 100 PID 4360 wrote to memory of 1188 4360 Nfnamjhk.exe 100 PID 1188 wrote to memory of 4648 1188 Nmjfodne.exe 101 PID 1188 wrote to memory of 4648 1188 Nmjfodne.exe 101 PID 1188 wrote to memory of 4648 1188 Nmjfodne.exe 101 PID 4648 wrote to memory of 2544 4648 Ofegni32.exe 102 PID 4648 wrote to memory of 2544 4648 Ofegni32.exe 102 PID 4648 wrote to memory of 2544 4648 Ofegni32.exe 102 PID 2544 wrote to memory of 4256 2544 Oophlo32.exe 103 PID 2544 wrote to memory of 4256 2544 Oophlo32.exe 103 PID 2544 wrote to memory of 4256 2544 Oophlo32.exe 103 PID 4256 wrote to memory of 4152 4256 Pjoppf32.exe 104 PID 4256 wrote to memory of 4152 4256 Pjoppf32.exe 104 PID 4256 wrote to memory of 4152 4256 Pjoppf32.exe 104 PID 4152 wrote to memory of 4720 4152 Pplhhm32.exe 105 PID 4152 wrote to memory of 4720 4152 Pplhhm32.exe 105 PID 4152 wrote to memory of 4720 4152 Pplhhm32.exe 105 PID 4720 wrote to memory of 4216 4720 Qbonoghb.exe 106 PID 4720 wrote to memory of 4216 4720 Qbonoghb.exe 106 PID 4720 wrote to memory of 4216 4720 Qbonoghb.exe 106 PID 4216 wrote to memory of 2264 4216 Qikbaaml.exe 107 PID 4216 wrote to memory of 2264 4216 Qikbaaml.exe 107 PID 4216 wrote to memory of 2264 4216 Qikbaaml.exe 107 PID 2264 wrote to memory of 1732 2264 Amikgpcc.exe 108 PID 2264 wrote to memory of 1732 2264 Amikgpcc.exe 108 PID 2264 wrote to memory of 1732 2264 Amikgpcc.exe 108 PID 1732 wrote to memory of 1704 1732 Aiplmq32.exe 109 PID 1732 wrote to memory of 1704 1732 Aiplmq32.exe 109 PID 1732 wrote to memory of 1704 1732 Aiplmq32.exe 109 PID 1704 wrote to memory of 2552 1704 Abjmkf32.exe 110 PID 1704 wrote to memory of 2552 1704 Abjmkf32.exe 110 PID 1704 wrote to memory of 2552 1704 Abjmkf32.exe 110 PID 2552 wrote to memory of 3836 2552 Banjnm32.exe 111 PID 2552 wrote to memory of 3836 2552 Banjnm32.exe 111 PID 2552 wrote to memory of 3836 2552 Banjnm32.exe 111 PID 3836 wrote to memory of 2272 3836 Bdapehop.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\7e921f84a9378ba1dee4c8f84fe81a70_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\7e921f84a9378ba1dee4c8f84fe81a70_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Windows\SysWOW64\Kcjjhdjb.exeC:\Windows\system32\Kcjjhdjb.exe2⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\SysWOW64\Lpepbgbd.exeC:\Windows\system32\Lpepbgbd.exe3⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Windows\SysWOW64\Lancko32.exeC:\Windows\system32\Lancko32.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Windows\SysWOW64\Lhgkgijg.exeC:\Windows\system32\Lhgkgijg.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Windows\SysWOW64\Mfnhfm32.exeC:\Windows\system32\Mfnhfm32.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:324 -
C:\Windows\SysWOW64\Mcaipa32.exeC:\Windows\system32\Mcaipa32.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Windows\SysWOW64\Nhegig32.exeC:\Windows\system32\Nhegig32.exe8⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\Windows\SysWOW64\Nhhdnf32.exeC:\Windows\system32\Nhhdnf32.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Windows\SysWOW64\Nfnamjhk.exeC:\Windows\system32\Nfnamjhk.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Windows\SysWOW64\Nmjfodne.exeC:\Windows\system32\Nmjfodne.exe11⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Windows\SysWOW64\Ofegni32.exeC:\Windows\system32\Ofegni32.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Windows\SysWOW64\Oophlo32.exeC:\Windows\system32\Oophlo32.exe13⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Windows\SysWOW64\Pjoppf32.exeC:\Windows\system32\Pjoppf32.exe14⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Windows\SysWOW64\Pplhhm32.exeC:\Windows\system32\Pplhhm32.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Windows\SysWOW64\Qbonoghb.exeC:\Windows\system32\Qbonoghb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Windows\SysWOW64\Qikbaaml.exeC:\Windows\system32\Qikbaaml.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Windows\SysWOW64\Amikgpcc.exeC:\Windows\system32\Amikgpcc.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\SysWOW64\Aiplmq32.exeC:\Windows\system32\Aiplmq32.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Windows\SysWOW64\Abjmkf32.exeC:\Windows\system32\Abjmkf32.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Windows\SysWOW64\Banjnm32.exeC:\Windows\system32\Banjnm32.exe21⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Windows\SysWOW64\Bdapehop.exeC:\Windows\system32\Bdapehop.exe22⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Windows\SysWOW64\Bagmdllg.exeC:\Windows\system32\Bagmdllg.exe23⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2272 -
C:\Windows\SysWOW64\Calfpk32.exeC:\Windows\system32\Calfpk32.exe24⤵
- Executes dropped EXE
PID:1844 -
C:\Windows\SysWOW64\Cacmpj32.exeC:\Windows\system32\Cacmpj32.exe25⤵
- Executes dropped EXE
- Modifies registry class
PID:4836 -
C:\Windows\SysWOW64\Daeifj32.exeC:\Windows\system32\Daeifj32.exe26⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2000 -
C:\Windows\SysWOW64\Dknnoofg.exeC:\Windows\system32\Dknnoofg.exe27⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:4972 -
C:\Windows\SysWOW64\Dggkipii.exeC:\Windows\system32\Dggkipii.exe28⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2624 -
C:\Windows\SysWOW64\Dncpkjoc.exeC:\Windows\system32\Dncpkjoc.exe29⤵
- Executes dropped EXE
PID:4408 -
C:\Windows\SysWOW64\Ekngemhd.exeC:\Windows\system32\Ekngemhd.exe30⤵
- Executes dropped EXE
PID:2532 -
C:\Windows\SysWOW64\Eajlhg32.exeC:\Windows\system32\Eajlhg32.exe31⤵
- Executes dropped EXE
PID:2804 -
C:\Windows\SysWOW64\Fkemfl32.exeC:\Windows\system32\Fkemfl32.exe32⤵
- Executes dropped EXE
PID:1916 -
C:\Windows\SysWOW64\Fglnkm32.exeC:\Windows\system32\Fglnkm32.exe33⤵
- Executes dropped EXE
PID:4564 -
C:\Windows\SysWOW64\Fgnjqm32.exeC:\Windows\system32\Fgnjqm32.exe34⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:3148 -
C:\Windows\SysWOW64\Fnjocf32.exeC:\Windows\system32\Fnjocf32.exe35⤵
- Executes dropped EXE
- Modifies registry class
PID:4088 -
C:\Windows\SysWOW64\Ggepalof.exeC:\Windows\system32\Ggepalof.exe36⤵
- Executes dropped EXE
PID:2440 -
C:\Windows\SysWOW64\Gnohnffc.exeC:\Windows\system32\Gnohnffc.exe37⤵
- Executes dropped EXE
PID:3520 -
C:\Windows\SysWOW64\Gkcigjel.exeC:\Windows\system32\Gkcigjel.exe38⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:3448 -
C:\Windows\SysWOW64\Gqpapacd.exeC:\Windows\system32\Gqpapacd.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4688 -
C:\Windows\SysWOW64\Hjolie32.exeC:\Windows\system32\Hjolie32.exe40⤵
- Executes dropped EXE
- Modifies registry class
PID:4604 -
C:\Windows\SysWOW64\Hnmeodjc.exeC:\Windows\system32\Hnmeodjc.exe41⤵
- Executes dropped EXE
PID:3656 -
C:\Windows\SysWOW64\Iapjgo32.exeC:\Windows\system32\Iapjgo32.exe42⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:3444 -
C:\Windows\SysWOW64\Ijkled32.exeC:\Windows\system32\Ijkled32.exe43⤵
- Executes dropped EXE
PID:2856 -
C:\Windows\SysWOW64\Inidkb32.exeC:\Windows\system32\Inidkb32.exe44⤵
- Executes dropped EXE
PID:3128 -
C:\Windows\SysWOW64\Ibgmaqfl.exeC:\Windows\system32\Ibgmaqfl.exe45⤵
- Executes dropped EXE
- Modifies registry class
PID:3956 -
C:\Windows\SysWOW64\Jehfcl32.exeC:\Windows\system32\Jehfcl32.exe46⤵
- Executes dropped EXE
PID:456 -
C:\Windows\SysWOW64\Jacpcl32.exeC:\Windows\system32\Jacpcl32.exe47⤵
- Executes dropped EXE
PID:4620 -
C:\Windows\SysWOW64\Jbbmmo32.exeC:\Windows\system32\Jbbmmo32.exe48⤵
- Executes dropped EXE
PID:4168 -
C:\Windows\SysWOW64\Koljgppp.exeC:\Windows\system32\Koljgppp.exe49⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1264 -
C:\Windows\SysWOW64\Klbgfc32.exeC:\Windows\system32\Klbgfc32.exe50⤵
- Executes dropped EXE
PID:1404 -
C:\Windows\SysWOW64\Lkiamp32.exeC:\Windows\system32\Lkiamp32.exe51⤵
- Executes dropped EXE
PID:5024 -
C:\Windows\SysWOW64\Lhdggb32.exeC:\Windows\system32\Lhdggb32.exe52⤵
- Executes dropped EXE
PID:5076 -
C:\Windows\SysWOW64\Ldkhlcnb.exeC:\Windows\system32\Ldkhlcnb.exe53⤵
- Executes dropped EXE
PID:5004 -
C:\Windows\SysWOW64\Mdpagc32.exeC:\Windows\system32\Mdpagc32.exe54⤵
- Executes dropped EXE
- Modifies registry class
PID:4076 -
C:\Windows\SysWOW64\Mcabej32.exeC:\Windows\system32\Mcabej32.exe55⤵
- Executes dropped EXE
PID:1560 -
C:\Windows\SysWOW64\Mohbjkgp.exeC:\Windows\system32\Mohbjkgp.exe56⤵
- Executes dropped EXE
PID:1812 -
C:\Windows\SysWOW64\Mcfkpjng.exeC:\Windows\system32\Mcfkpjng.exe57⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:856 -
C:\Windows\SysWOW64\Nlcidopb.exeC:\Windows\system32\Nlcidopb.exe58⤵
- Executes dropped EXE
PID:2316 -
C:\Windows\SysWOW64\Nhjjip32.exeC:\Windows\system32\Nhjjip32.exe59⤵
- Executes dropped EXE
PID:3368 -
C:\Windows\SysWOW64\Nconfh32.exeC:\Windows\system32\Nconfh32.exe60⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2324 -
C:\Windows\SysWOW64\Ohncdobq.exeC:\Windows\system32\Ohncdobq.exe61⤵
- Executes dropped EXE
PID:2408 -
C:\Windows\SysWOW64\Ocdgahag.exeC:\Windows\system32\Ocdgahag.exe62⤵
- Executes dropped EXE
PID:2388 -
C:\Windows\SysWOW64\Ofdqcc32.exeC:\Windows\system32\Ofdqcc32.exe63⤵
- Executes dropped EXE
- Modifies registry class
PID:384 -
C:\Windows\SysWOW64\Oomelheh.exeC:\Windows\system32\Oomelheh.exe64⤵
- Executes dropped EXE
PID:4024 -
C:\Windows\SysWOW64\Omcbkl32.exeC:\Windows\system32\Omcbkl32.exe65⤵
- Executes dropped EXE
- Modifies registry class
PID:3372 -
C:\Windows\SysWOW64\Qelcamcj.exeC:\Windows\system32\Qelcamcj.exe66⤵
- Executes dropped EXE
PID:904 -
C:\Windows\SysWOW64\Aijlgkjq.exeC:\Windows\system32\Aijlgkjq.exe67⤵
- Drops file in System32 directory
PID:4160 -
C:\Windows\SysWOW64\Afnlpohj.exeC:\Windows\system32\Afnlpohj.exe68⤵PID:3616
-
C:\Windows\SysWOW64\Aecialmb.exeC:\Windows\system32\Aecialmb.exe69⤵
- Drops file in System32 directory
- Modifies registry class
PID:4952 -
C:\Windows\SysWOW64\Bemlhj32.exeC:\Windows\system32\Bemlhj32.exe70⤵
- Drops file in System32 directory
PID:4624 -
C:\Windows\SysWOW64\Cidgdg32.exeC:\Windows\system32\Cidgdg32.exe71⤵
- Modifies registry class
PID:4468 -
C:\Windows\SysWOW64\Cifdjg32.exeC:\Windows\system32\Cifdjg32.exe72⤵
- Drops file in System32 directory
PID:4968 -
C:\Windows\SysWOW64\Cfmahknh.exeC:\Windows\system32\Cfmahknh.exe73⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:2724 -
C:\Windows\SysWOW64\Clijablo.exeC:\Windows\system32\Clijablo.exe74⤵PID:5012
-
C:\Windows\SysWOW64\Ddcogo32.exeC:\Windows\system32\Ddcogo32.exe75⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3528 -
C:\Windows\SysWOW64\Dmkcpdao.exeC:\Windows\system32\Dmkcpdao.exe76⤵
- Modifies registry class
PID:536 -
C:\Windows\SysWOW64\Dekapfke.exeC:\Windows\system32\Dekapfke.exe77⤵
- Modifies registry class
PID:1588 -
C:\Windows\SysWOW64\Epcbbohh.exeC:\Windows\system32\Epcbbohh.exe78⤵
- Drops file in System32 directory
PID:4444 -
C:\Windows\SysWOW64\Eljchpnl.exeC:\Windows\system32\Eljchpnl.exe79⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:5152 -
C:\Windows\SysWOW64\Emioab32.exeC:\Windows\system32\Emioab32.exe80⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:5192 -
C:\Windows\SysWOW64\Egbdjhlp.exeC:\Windows\system32\Egbdjhlp.exe81⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5228 -
C:\Windows\SysWOW64\Ecidpiad.exeC:\Windows\system32\Ecidpiad.exe82⤵PID:5272
-
C:\Windows\SysWOW64\Eibmlc32.exeC:\Windows\system32\Eibmlc32.exe83⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5324 -
C:\Windows\SysWOW64\Fjeibc32.exeC:\Windows\system32\Fjeibc32.exe84⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5372 -
C:\Windows\SysWOW64\Fdjnolfd.exeC:\Windows\system32\Fdjnolfd.exe85⤵PID:5416
-
C:\Windows\SysWOW64\Fcpkph32.exeC:\Windows\system32\Fcpkph32.exe86⤵PID:5476
-
C:\Windows\SysWOW64\Fdadpk32.exeC:\Windows\system32\Fdadpk32.exe87⤵PID:5524
-
C:\Windows\SysWOW64\Ffcpgcfj.exeC:\Windows\system32\Ffcpgcfj.exe88⤵PID:5568
-
C:\Windows\SysWOW64\Gjqinamq.exeC:\Windows\system32\Gjqinamq.exe89⤵
- Drops file in System32 directory
PID:5616 -
C:\Windows\SysWOW64\Gnoacp32.exeC:\Windows\system32\Gnoacp32.exe90⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:5660 -
C:\Windows\SysWOW64\Gfjfhbpb.exeC:\Windows\system32\Gfjfhbpb.exe91⤵
- Drops file in System32 directory
PID:5708 -
C:\Windows\SysWOW64\Ggicbe32.exeC:\Windows\system32\Ggicbe32.exe92⤵PID:5752
-
C:\Windows\SysWOW64\Hnhdjn32.exeC:\Windows\system32\Hnhdjn32.exe93⤵PID:5792
-
C:\Windows\SysWOW64\Hdbmfhbi.exeC:\Windows\system32\Hdbmfhbi.exe94⤵PID:5840
-
C:\Windows\SysWOW64\Hmmakk32.exeC:\Windows\system32\Hmmakk32.exe95⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5888 -
C:\Windows\SysWOW64\Hcifmdeo.exeC:\Windows\system32\Hcifmdeo.exe96⤵
- Drops file in System32 directory
- Modifies registry class
PID:5936 -
C:\Windows\SysWOW64\Hdicggla.exeC:\Windows\system32\Hdicggla.exe97⤵PID:5980
-
C:\Windows\SysWOW64\Inagpm32.exeC:\Windows\system32\Inagpm32.exe98⤵
- Drops file in System32 directory
PID:6024 -
C:\Windows\SysWOW64\Ijhhenhf.exeC:\Windows\system32\Ijhhenhf.exe99⤵PID:6068
-
C:\Windows\SysWOW64\Imiagi32.exeC:\Windows\system32\Imiagi32.exe100⤵
- Drops file in System32 directory
PID:6112 -
C:\Windows\SysWOW64\Igneda32.exeC:\Windows\system32\Igneda32.exe101⤵PID:5140
-
C:\Windows\SysWOW64\Iebfmfdg.exeC:\Windows\system32\Iebfmfdg.exe102⤵
- Drops file in System32 directory
- Modifies registry class
PID:5216 -
C:\Windows\SysWOW64\Icgbob32.exeC:\Windows\system32\Icgbob32.exe103⤵PID:5304
-
C:\Windows\SysWOW64\Jgekdq32.exeC:\Windows\system32\Jgekdq32.exe104⤵
- Drops file in System32 directory
PID:2320 -
C:\Windows\SysWOW64\Janpnfee.exeC:\Windows\system32\Janpnfee.exe105⤵
- Modifies registry class
PID:5396 -
C:\Windows\SysWOW64\Jmijnfgd.exeC:\Windows\system32\Jmijnfgd.exe106⤵
- Modifies registry class
PID:5520 -
C:\Windows\SysWOW64\Knifging.exeC:\Windows\system32\Knifging.exe107⤵
- Modifies registry class
PID:5612 -
C:\Windows\SysWOW64\Knkcmild.exeC:\Windows\system32\Knkcmild.exe108⤵
- Drops file in System32 directory
PID:5688 -
C:\Windows\SysWOW64\Kdhlepkl.exeC:\Windows\system32\Kdhlepkl.exe109⤵PID:5736
-
C:\Windows\SysWOW64\Logbigbg.exeC:\Windows\system32\Logbigbg.exe110⤵PID:5836
-
C:\Windows\SysWOW64\Ldckan32.exeC:\Windows\system32\Ldckan32.exe111⤵
- Drops file in System32 directory
PID:5896 -
C:\Windows\SysWOW64\Laglkb32.exeC:\Windows\system32\Laglkb32.exe112⤵
- Modifies registry class
PID:5988 -
C:\Windows\SysWOW64\Lfddci32.exeC:\Windows\system32\Lfddci32.exe113⤵
- Drops file in System32 directory
PID:6076 -
C:\Windows\SysWOW64\Lajhpbme.exeC:\Windows\system32\Lajhpbme.exe114⤵PID:5160
-
C:\Windows\SysWOW64\Lfgahikm.exeC:\Windows\system32\Lfgahikm.exe115⤵PID:5280
-
C:\Windows\SysWOW64\Mdkabmjf.exeC:\Windows\system32\Mdkabmjf.exe116⤵
- Modifies registry class
PID:5916 -
C:\Windows\SysWOW64\Mopeofjl.exeC:\Windows\system32\Mopeofjl.exe117⤵
- Modifies registry class
PID:5656 -
C:\Windows\SysWOW64\Mmebpbod.exeC:\Windows\system32\Mmebpbod.exe118⤵
- Modifies registry class
PID:5824 -
C:\Windows\SysWOW64\Mgngih32.exeC:\Windows\system32\Mgngih32.exe119⤵PID:5932
-
C:\Windows\SysWOW64\Mmhofbma.exeC:\Windows\system32\Mmhofbma.exe120⤵PID:3916
-
C:\Windows\SysWOW64\Mhppik32.exeC:\Windows\system32\Mhppik32.exe121⤵PID:5176
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-