a5ef533195b95b70f7cc82941b1f41a5c905fee4dff8683c41d3062fdf52c274

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 05:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8a615a59ccc529e14c74a2dc30cffab0_NeikiAnalytics.exe
Size 109KB
Sample240511-gb96maba73
SHA256 a5ef533195b95b70f7cc82941b1f41a5c905fee4dff8683c41d3062fdf52c274
MD5 8a615a59ccc529e14c74a2dc30cffab0
SHA1 1453d982e3e95f622a8f5377a8037b745a4fcd6e
SHA512 ca127497fc7b7556b8e569d6c9a05945c8a1d763ae0af0cc8a357bb403bce5d6c5af9c88456fa6c843197221dbf403e024117d723481de9b873b32b7a4a35b79
SSDEEP 3072:sG+NCIlFALZrDcI2GTJ90LLCqwzBu1DjHLMVDqqkSpR:92ABH2GTJ9Kwtu1DjrFqhz
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

backdoor dropper persistence trojan

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 14 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngedij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ngedij32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njcpee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nnolfdcn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	8a615a59ccc529e14c74a2dc30cffab0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqklmpdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ncihikcg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njacpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Njacpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Njcpee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nqklmpdd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnolfdcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	8a615a59ccc529e14c74a2dc30cffab0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncihikcg.exe

Malware Dropper & Backdoor - Berbew 22 IoCs

Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.

backdoor trojan dropper

resource	yara_rule
behavioral2/memory/4712-0-0x0000000000400000-0x0000000000444000-memory.dmp	family_berbew
behavioral2/files/0x0008000000022f51-6.dat	family_berbew
behavioral2/memory/852-8-0x0000000000400000-0x0000000000444000-memory.dmp	family_berbew
behavioral2/memory/1556-16-0x0000000000400000-0x0000000000444000-memory.dmp	family_berbew
behavioral2/files/0x000700000002341d-15.dat	family_berbew
behavioral2/files/0x000700000002341f-22.dat	family_berbew
behavioral2/files/0x0007000000023421-30.dat	family_berbew
behavioral2/memory/3744-33-0x0000000000400000-0x0000000000444000-memory.dmp	family_berbew
behavioral2/files/0x0007000000023425-47.dat	family_berbew
behavioral2/memory/756-44-0x0000000000400000-0x0000000000444000-memory.dmp	family_berbew
behavioral2/files/0x0007000000023423-39.dat	family_berbew
behavioral2/memory/4424-28-0x0000000000400000-0x0000000000444000-memory.dmp	family_berbew
behavioral2/memory/2752-48-0x0000000000400000-0x0000000000444000-memory.dmp	family_berbew
behavioral2/files/0x0007000000023427-54.dat	family_berbew
behavioral2/files/0x0007000000023427-49.dat	family_berbew
behavioral2/memory/1264-56-0x0000000000400000-0x0000000000444000-memory.dmp	family_berbew
behavioral2/memory/1264-57-0x0000000000400000-0x0000000000444000-memory.dmp	family_berbew
behavioral2/memory/2752-58-0x0000000000400000-0x0000000000444000-memory.dmp	family_berbew
behavioral2/memory/1556-60-0x0000000000400000-0x0000000000444000-memory.dmp	family_berbew
behavioral2/memory/4712-62-0x0000000000400000-0x0000000000444000-memory.dmp	family_berbew
behavioral2/memory/852-61-0x0000000000400000-0x0000000000444000-memory.dmp	family_berbew
behavioral2/memory/3744-59-0x0000000000400000-0x0000000000444000-memory.dmp	family_berbew

Executes dropped EXE 7 IoCs

pid	Process
852	Njacpf32.exe
1556	Nqklmpdd.exe
4424	Ncihikcg.exe
3744	Ngedij32.exe
756	Njcpee32.exe
2752	Nnolfdcn.exe
1264	Nkcmohbg.exe

Drops file in System32 directory 21 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Njacpf32.exe	8a615a59ccc529e14c74a2dc30cffab0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\Ljfemn32.dll	Njacpf32.exe
File created	C:\Windows\SysWOW64\Pkckjila.dll	Nqklmpdd.exe
File opened for modification	C:\Windows\SysWOW64\Ngedij32.exe	Ncihikcg.exe
File opened for modification	C:\Windows\SysWOW64\Ncihikcg.exe	Nqklmpdd.exe
File created	C:\Windows\SysWOW64\Paadnmaq.dll	Ncihikcg.exe
File created	C:\Windows\SysWOW64\Njcpee32.exe	Ngedij32.exe
File created	C:\Windows\SysWOW64\Hnibdpde.dll	Nnolfdcn.exe
File created	C:\Windows\SysWOW64\Ddpfgd32.dll	Ngedij32.exe
File created	C:\Windows\SysWOW64\Nnolfdcn.exe	Njcpee32.exe
File opened for modification	C:\Windows\SysWOW64\Nkcmohbg.exe	Nnolfdcn.exe
File opened for modification	C:\Windows\SysWOW64\Njacpf32.exe	8a615a59ccc529e14c74a2dc30cffab0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\Nqklmpdd.exe	Njacpf32.exe
File created	C:\Windows\SysWOW64\Ngedij32.exe	Ncihikcg.exe
File opened for modification	C:\Windows\SysWOW64\Njcpee32.exe	Ngedij32.exe
File created	C:\Windows\SysWOW64\Cknpkhch.dll	Njcpee32.exe
File created	C:\Windows\SysWOW64\Nkcmohbg.exe	Nnolfdcn.exe
File created	C:\Windows\SysWOW64\Lmbnpm32.dll	8a615a59ccc529e14c74a2dc30cffab0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\Nqklmpdd.exe	Njacpf32.exe
File created	C:\Windows\SysWOW64\Ncihikcg.exe	Nqklmpdd.exe
File opened for modification	C:\Windows\SysWOW64\Nnolfdcn.exe	Njcpee32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4956	1264	WerFault.exe	90

Modifies registry class 24 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkckjila.dll"	Nqklmpdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Paadnmaq.dll"	Ncihikcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ncihikcg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nnolfdcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnibdpde.dll"	Nnolfdcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nnolfdcn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	8a615a59ccc529e14c74a2dc30cffab0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	8a615a59ccc529e14c74a2dc30cffab0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ngedij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cknpkhch.dll"	Njcpee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Njcpee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lmbnpm32.dll"	8a615a59ccc529e14c74a2dc30cffab0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ljfemn32.dll"	Njacpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nqklmpdd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	8a615a59ccc529e14c74a2dc30cffab0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nqklmpdd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Njacpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Njacpf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ncihikcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ddpfgd32.dll"	Ngedij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ngedij32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Njcpee32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	8a615a59ccc529e14c74a2dc30cffab0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}	8a615a59ccc529e14c74a2dc30cffab0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4712 wrote to memory of 852	4712	8a615a59ccc529e14c74a2dc30cffab0_NeikiAnalytics.exe	82
PID 4712 wrote to memory of 852	4712	8a615a59ccc529e14c74a2dc30cffab0_NeikiAnalytics.exe	82
PID 4712 wrote to memory of 852	4712	8a615a59ccc529e14c74a2dc30cffab0_NeikiAnalytics.exe	82
PID 852 wrote to memory of 1556	852	Njacpf32.exe	83
PID 852 wrote to memory of 1556	852	Njacpf32.exe	83
PID 852 wrote to memory of 1556	852	Njacpf32.exe	83
PID 1556 wrote to memory of 4424	1556	Nqklmpdd.exe	84
PID 1556 wrote to memory of 4424	1556	Nqklmpdd.exe	84
PID 1556 wrote to memory of 4424	1556	Nqklmpdd.exe	84
PID 4424 wrote to memory of 3744	4424	Ncihikcg.exe	85
PID 4424 wrote to memory of 3744	4424	Ncihikcg.exe	85
PID 4424 wrote to memory of 3744	4424	Ncihikcg.exe	85
PID 3744 wrote to memory of 756	3744	Ngedij32.exe	87
PID 3744 wrote to memory of 756	3744	Ngedij32.exe	87
PID 3744 wrote to memory of 756	3744	Ngedij32.exe	87
PID 756 wrote to memory of 2752	756	Njcpee32.exe	88
PID 756 wrote to memory of 2752	756	Njcpee32.exe	88
PID 756 wrote to memory of 2752	756	Njcpee32.exe	88
PID 2752 wrote to memory of 1264	2752	Nnolfdcn.exe	90
PID 2752 wrote to memory of 1264	2752	Nnolfdcn.exe	90
PID 2752 wrote to memory of 1264	2752	Nnolfdcn.exe	90

C:\Users\Admin\AppData\Local\Temp\8a615a59ccc529e14c74a2dc30cffab0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\8a615a59ccc529e14c74a2dc30cffab0_NeikiAnalytics.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Windows\SysWOW64\Njacpf32.exe
  C:\Windows\system32\Njacpf32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:852
- - C:\Windows\SysWOW64\Nqklmpdd.exe
    C:\Windows\system32\Nqklmpdd.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1556
  - - C:\Windows\SysWOW64\Ncihikcg.exe
      C:\Windows\system32\Ncihikcg.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4424
    - - C:\Windows\SysWOW64\Ngedij32.exe
        
        C:\Windows\system32\Ngedij32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3744
      - C:\Windows\SysWOW64\Njcpee32.exe
        
        C:\Windows\system32\Njcpee32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:756
        
        C:\Windows\SysWOW64\Nnolfdcn.exe
        
        C:\Windows\system32\Nnolfdcn.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2752
        
        C:\Windows\SysWOW64\Nkcmohbg.exe
        
        C:\Windows\system32\Nkcmohbg.exe
        8⤵
        Executes dropped EXE
        
        PID:1264
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1264 -s 412
        9⤵
        Program crash
        
        PID:4956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1264 -ip 1264
1⤵
PID:4704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Ddpfgd32.dll

Path C:\Windows\SysWOW64\Ddpfgd32.dll
Size 7KB
SHA256 c086fbe258cd5a022c8ec9ba82131f4765032736f79a6d89dea7d82b99ad662d
MD5 4570e7b1c878299ff398462957717b43
SHA1 8e64aac53cc74fe8023414f4028024e5cf9b24e6
SHA512 909627a5a9462c6f1cce3f75fbb9c1173028a71ae66df44b869917aaa4e54edfb273ab14c9af3ee29e0f0f61f7456277fab0a377c7a95858523c2050464b5b1e
SSDEEP 48:66ay5YVO3EVkApc2wp8hH1NZn5EquglQ067YbPWsbABbgL3q9J5S2hmc:b3EVkApcX4Hiv0hbPeq3qX5S2hV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ncihikcg.exe

Path C:\Windows\SysWOW64\Ncihikcg.exe
Size 109KB
SHA256 073475cd993d498db0f158b1af9522d6b821e038c8983d03326b10a13b4345e2
MD5 fc25de2fee057a3b23a34638dd25e128
SHA1 4402fb3746e5489dc6c0f8a049534e30bf6502a2
SHA512 7e8dde304ed18ee6235d93d8cfccb7bfc38b91746d1069a2c8cf99456e0d86a456de0088f10511952bad47b022049bf4b3259a7870e78f64a2c20041ea3689c6
SSDEEP 3072:3wASyZNHfTigyAg7zfSgQRIJ9MLCqwzBu1DjHLMVDqqkSpR:AASCN/TirAezfSgNJ90wtu1DjrFqhz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ngedij32.exe

Path C:\Windows\SysWOW64\Ngedij32.exe
Size 109KB
SHA256 6860b78ccda072586d7a0ee98516230be247d7c1f222c80e8cb094ffaee06bfd
MD5 9748eaef88a2c4bbaf082fe32acdd282
SHA1 efd389328083c7a5a72ac592583964479c840928
SHA512 ca7ef8877e736683acff581311f6fcc17c0a2ac44831cfab06370f5732f70a1f9177a55ed8034b770542d1c150d5abfa289ae25fcf7c26ac9f7df5639d08ec31
SSDEEP 3072:HfgWHTp4L8hhb42mqJ9oLCqwzBu1DjHLMVDqqkSpR:VDhMiJ9owtu1DjrFqhz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Njacpf32.exe

Path C:\Windows\SysWOW64\Njacpf32.exe
Size 109KB
SHA256 4efc27d89a46fa204ba277108ac9dac2f80d38b962b5d7e2682662bc3511b8a5
MD5 2f50fec339f31f4e67f34bd9edeca581
SHA1 ec9ec025cd314d39d270433c3a049b2b3ee42d83
SHA512 2799f55eac5feb7efa929543a482ce1694859c10aaf533ce3d2f1607f0e24a8a0246bc3e1952164cb7ce71c395600cadd8d320122728e077e650f32b62513ca6
SSDEEP 3072:jLzI8g+jTKwdEXJ9RLCqwzBu1DjHLMVDqqkSpR:jA8HjTrdIJ95wtu1DjrFqhz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Njcpee32.exe

Path C:\Windows\SysWOW64\Njcpee32.exe
Size 109KB
SHA256 af7935d9410d050d35c547b63312eb171865df4715216c38fda3a3d7dd577945
MD5 9dc8b71bd56c95ad24d446575f9f4503
SHA1 59ef64460b06e812923bb4191b210acd6e9fb96c
SHA512 4f374cbb76c66fe2054ba252267ec0fadc4156412e259935a21c5b29a3643b476e643a70b2a25ddda5259530d4beb26df778237109fb638a594de9683d85f6c5
SSDEEP 3072:8YSTseLLbbJiiDp4zLctt5MjF7P6guMqrNPzzrrOsAnaSxJ99LCqwzBu1DjHLMVr:Sf4wbgwBqna8J9twtu1DjrFqhz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nkcmohbg.exe

Path C:\Windows\SysWOW64\Nkcmohbg.exe
Size 109KB
SHA256 e8e1043404975521653f33814f8499d6e029cf6407dc6d14b91a4c72db5e81a2
MD5 6784aaae095071ec3e1cb71491e5cb45
SHA1 fe9e068224dc75fab739753378c10010e6ea1e4d
SHA512 994f5c43e5e86dee0bdf4f82afac7ebadb9f7facaf7568c39c70c3ad5e74309c3522436482200b113b636faf98857249ef1d4b924f26783c39ead7e91f49ee9f
SSDEEP 3072:zaOiAdBVlt3dBJ9/LCqwzBu1DjHLMVDqqkSpR:zaR8flt3dBJ9zwtu1DjrFqhz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nkcmohbg.exe

Path C:\Windows\SysWOW64\Nkcmohbg.exe
Size 109KB
SHA256 0490cd86feda1192347c47d787fb7f761904868411a92357d8fcc69bb98ef6ee
MD5 9a385ffc26ca64009144992cbdb9e8c4
SHA1 19b0a80bfe1f8254d417c0955e5255348ac3e653
SHA512 de6e209e7f23be98f421f13cf50b72c5ba7d38179e7ab967d159c4d0797baa07df0f8984d686c1c9e245e707961868fffdb808374f959d45d5b9b1ca49d391ec
SSDEEP 3072:C9eLt8k+5cJI+/rlv0isJ9/LCqwzBu1DjHLMVDqqkSpR:hLC9d+/hvsJ9zwtu1DjrFqhz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nnolfdcn.exe

Path C:\Windows\SysWOW64\Nnolfdcn.exe
Size 109KB
SHA256 e8e8750f4b128d1f70e91f8964748fb6529cf2ff20644885826434d7745be207
MD5 5fbda466fcd7c0405f855b3ea969597f
SHA1 2508cdca799f7b3ac9d0546718a110601166fef6
SHA512 ccea88dba57cf420fc431e0e6faf785bb3a99c42d09cbf975efcf15265c2c22fb06c7b1e28122a7a6b6039c9d90d48b1a9b52daa72dd5e70c22b81b6870de388
SSDEEP 3072:zaOiAdBVlt3d7WOJ95LCqwzBu1DjHLMVDqqkSpR:zaR8flt3dKOJ9Bwtu1DjrFqhz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nqklmpdd.exe

Path C:\Windows\SysWOW64\Nqklmpdd.exe
Size 109KB
SHA256 9d782bbc60ea314b1813640b5a8919da144d54160b303c8150dccf831200bc90
MD5 2bd8029a49db6a3d068f6ebc7fd243b0
SHA1 7a547d512c9c1be4053775d365bc91b25170714f
SHA512 c63d1ed53ac57663b88393206225cfbba2c8a4c910e0a7810ea8a5a8722ce9ba3dc2ef216f8fcf6f11dcfb36b66adc5c1f47800cb37b7c921323a0f034d14209
SSDEEP 3072:IDGaBd6DMoMCQfuberXhBntEJ9BLCqwzBu1DjHLMVDqqkSpR:eld6DgCQ7hEJ9Jwtu1DjrFqhz
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/756-44-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/852-8-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/852-61-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/1264-56-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/1264-57-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/1556-60-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/1556-16-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/2752-48-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/2752-58-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/3744-33-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/3744-59-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/4424-28-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/4712-0-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/4712-62-0x0000000000400000-0x0000000000444000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads