9487321f1c857f2d1f8cd05b11ea158403db0e4d661960c5194d1e0a21688e6b

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 20:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
36c2944dc1da8d29a1b3cb164cf8ad80_NeikiAnalytics.exe
Size 664KB
Sample240511-zees1aba44
SHA256 9487321f1c857f2d1f8cd05b11ea158403db0e4d661960c5194d1e0a21688e6b
MD5 36c2944dc1da8d29a1b3cb164cf8ad80
SHA1 7a5d29fa2da82826a7c75110ff4f70b0477c35ad
SHA512 51ac9916969e0b8f556a6f8f2e246763ab967fd3730b13347a18e49cc86ae4803a7fa206d569e8f09986b4a9fc27daf594a817ade40f0f8430663a9a63b2bc9b
SSDEEP 12288:kXv2tKapV6yYP4rbpV6yYPg058KpV6yYPNUir2MhNl6zX3w9As/xO23WM6tJmDYx:q+txW4XWleKWNUir2MhNl6zX3w9As/xi
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

backdoor dropper persistence trojan

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 18 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mncmjfmk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njljefql.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	36c2944dc1da8d29a1b3cb164cf8ad80_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lphfpbdi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lphfpbdi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjcgohig.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mncmjfmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Njljefql.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nkqpjidj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdkhapfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mdkhapfj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgidml32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nafokcol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	36c2944dc1da8d29a1b3cb164cf8ad80_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mjcgohig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mgidml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nafokcol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nkqpjidj.exe

Malware Dropper & Backdoor - Berbew 9 IoCs

Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.

backdoor trojan dropper

resource	yara_rule
behavioral2/files/0x0006000000022fa8-6.dat	family_berbew
behavioral2/files/0x000700000002346f-14.dat	family_berbew
behavioral2/files/0x0007000000023471-22.dat	family_berbew
behavioral2/files/0x0007000000023473-31.dat	family_berbew
behavioral2/files/0x0007000000023475-38.dat	family_berbew
behavioral2/files/0x0007000000023477-46.dat	family_berbew
behavioral2/files/0x0007000000023479-55.dat	family_berbew
behavioral2/files/0x000800000002346b-62.dat	family_berbew
behavioral2/files/0x000700000002347c-70.dat	family_berbew

Executes dropped EXE 9 IoCs

pid	Process
4892	Lphfpbdi.exe
5100	Mjcgohig.exe
3864	Mdkhapfj.exe
3964	Mgidml32.exe
1060	Mncmjfmk.exe
1316	Njljefql.exe
1796	Nafokcol.exe
4960	Nkqpjidj.exe
2236	Nkcmohbg.exe

Drops file in System32 directory 27 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Mjcgohig.exe	Lphfpbdi.exe
File opened for modification	C:\Windows\SysWOW64\Mncmjfmk.exe	Mgidml32.exe
File created	C:\Windows\SysWOW64\Hnibdpde.dll	Nkqpjidj.exe
File created	C:\Windows\SysWOW64\Nafokcol.exe	Njljefql.exe
File opened for modification	C:\Windows\SysWOW64\Nafokcol.exe	Njljefql.exe
File created	C:\Windows\SysWOW64\Jcoegc32.dll	Njljefql.exe
File created	C:\Windows\SysWOW64\Ogpnaafp.dll	Nafokcol.exe
File created	C:\Windows\SysWOW64\Mdkhapfj.exe	Mjcgohig.exe
File created	C:\Windows\SysWOW64\Mgidml32.exe	Mdkhapfj.exe
File created	C:\Windows\SysWOW64\Cnacjn32.dll	Mdkhapfj.exe
File opened for modification	C:\Windows\SysWOW64\Nkqpjidj.exe	Nafokcol.exe
File created	C:\Windows\SysWOW64\Mjcgohig.exe	Lphfpbdi.exe
File created	C:\Windows\SysWOW64\Njcqqgjb.dll	Mjcgohig.exe
File created	C:\Windows\SysWOW64\Mncmjfmk.exe	Mgidml32.exe
File opened for modification	C:\Windows\SysWOW64\Njljefql.exe	Mncmjfmk.exe
File created	C:\Windows\SysWOW64\Nkqpjidj.exe	Nafokcol.exe
File created	C:\Windows\SysWOW64\Lphfpbdi.exe	36c2944dc1da8d29a1b3cb164cf8ad80_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\Lphfpbdi.exe	36c2944dc1da8d29a1b3cb164cf8ad80_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\Mdkhapfj.exe	Mjcgohig.exe
File opened for modification	C:\Windows\SysWOW64\Mgidml32.exe	Mdkhapfj.exe
File opened for modification	C:\Windows\SysWOW64\Nkcmohbg.exe	Nkqpjidj.exe
File created	C:\Windows\SysWOW64\Ciiqgjgg.dll	Mgidml32.exe
File created	C:\Windows\SysWOW64\Njljefql.exe	Mncmjfmk.exe
File created	C:\Windows\SysWOW64\Kcbibebo.dll	Mncmjfmk.exe
File created	C:\Windows\SysWOW64\Nkcmohbg.exe	Nkqpjidj.exe
File created	C:\Windows\SysWOW64\Mglppmnd.dll	36c2944dc1da8d29a1b3cb164cf8ad80_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\Ocbakl32.dll	Lphfpbdi.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2436	2236	WerFault.exe	93

Modifies registry class 30 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Njcqqgjb.dll"	Mjcgohig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcoegc32.dll"	Njljefql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogpnaafp.dll"	Nafokcol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ocbakl32.dll"	Lphfpbdi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mjcgohig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mncmjfmk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Njljefql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mdkhapfj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	36c2944dc1da8d29a1b3cb164cf8ad80_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	36c2944dc1da8d29a1b3cb164cf8ad80_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mjcgohig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kcbibebo.dll"	Mncmjfmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Lphfpbdi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mncmjfmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nafokcol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mgidml32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nkqpjidj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mglppmnd.dll"	36c2944dc1da8d29a1b3cb164cf8ad80_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	36c2944dc1da8d29a1b3cb164cf8ad80_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lphfpbdi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cnacjn32.dll"	Mdkhapfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ciiqgjgg.dll"	Mgidml32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mdkhapfj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mgidml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nkqpjidj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	36c2944dc1da8d29a1b3cb164cf8ad80_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}	36c2944dc1da8d29a1b3cb164cf8ad80_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Njljefql.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nafokcol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnibdpde.dll"	Nkqpjidj.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 3756 wrote to memory of 4892	3756	36c2944dc1da8d29a1b3cb164cf8ad80_NeikiAnalytics.exe	83
PID 3756 wrote to memory of 4892	3756	36c2944dc1da8d29a1b3cb164cf8ad80_NeikiAnalytics.exe	83
PID 3756 wrote to memory of 4892	3756	36c2944dc1da8d29a1b3cb164cf8ad80_NeikiAnalytics.exe	83
PID 4892 wrote to memory of 5100	4892	Lphfpbdi.exe	84
PID 4892 wrote to memory of 5100	4892	Lphfpbdi.exe	84
PID 4892 wrote to memory of 5100	4892	Lphfpbdi.exe	84
PID 5100 wrote to memory of 3864	5100	Mjcgohig.exe	85
PID 5100 wrote to memory of 3864	5100	Mjcgohig.exe	85
PID 5100 wrote to memory of 3864	5100	Mjcgohig.exe	85
PID 3864 wrote to memory of 3964	3864	Mdkhapfj.exe	86
PID 3864 wrote to memory of 3964	3864	Mdkhapfj.exe	86
PID 3864 wrote to memory of 3964	3864	Mdkhapfj.exe	86
PID 3964 wrote to memory of 1060	3964	Mgidml32.exe	87
PID 3964 wrote to memory of 1060	3964	Mgidml32.exe	87
PID 3964 wrote to memory of 1060	3964	Mgidml32.exe	87
PID 1060 wrote to memory of 1316	1060	Mncmjfmk.exe	88
PID 1060 wrote to memory of 1316	1060	Mncmjfmk.exe	88
PID 1060 wrote to memory of 1316	1060	Mncmjfmk.exe	88
PID 1316 wrote to memory of 1796	1316	Njljefql.exe	89
PID 1316 wrote to memory of 1796	1316	Njljefql.exe	89
PID 1316 wrote to memory of 1796	1316	Njljefql.exe	89
PID 1796 wrote to memory of 4960	1796	Nafokcol.exe	90
PID 1796 wrote to memory of 4960	1796	Nafokcol.exe	90
PID 1796 wrote to memory of 4960	1796	Nafokcol.exe	90
PID 4960 wrote to memory of 2236	4960	Nkqpjidj.exe	93
PID 4960 wrote to memory of 2236	4960	Nkqpjidj.exe	93
PID 4960 wrote to memory of 2236	4960	Nkqpjidj.exe	93

C:\Users\Admin\AppData\Local\Temp\36c2944dc1da8d29a1b3cb164cf8ad80_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\36c2944dc1da8d29a1b3cb164cf8ad80_NeikiAnalytics.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3756
- C:\Windows\SysWOW64\Lphfpbdi.exe
  C:\Windows\system32\Lphfpbdi.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4892
- - C:\Windows\SysWOW64\Mjcgohig.exe
    C:\Windows\system32\Mjcgohig.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:5100
  - - C:\Windows\SysWOW64\Mdkhapfj.exe
      C:\Windows\system32\Mdkhapfj.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3864
    - - C:\Windows\SysWOW64\Mgidml32.exe
        
        C:\Windows\system32\Mgidml32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3964
      - C:\Windows\SysWOW64\Mncmjfmk.exe
        
        C:\Windows\system32\Mncmjfmk.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1060
        
        C:\Windows\SysWOW64\Njljefql.exe
        
        C:\Windows\system32\Njljefql.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1316
        
        C:\Windows\SysWOW64\Nafokcol.exe
        
        C:\Windows\system32\Nafokcol.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1796
        
        C:\Windows\SysWOW64\Nkqpjidj.exe
        
        C:\Windows\system32\Nkqpjidj.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4960
        
        C:\Windows\SysWOW64\Nkcmohbg.exe
        
        C:\Windows\system32\Nkcmohbg.exe
        10⤵
        Executes dropped EXE
        
        PID:2236
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2236 -s 412
        11⤵
        Program crash
        
        PID:2436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2236 -ip 2236
1⤵
PID:5064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Ciiqgjgg.dll

Path C:\Windows\SysWOW64\Ciiqgjgg.dll
Size 7KB
SHA256 82a4ef90948bf3d9b520d635cdc80ddb35b0dd73b68fec1c93368e0f2aa6d8f5
MD5 cc9810a0f6e353ddce418830d2b3f122
SHA1 9d9b863bc9b5f9c5335b7be4aae197ab07c3e2c6
SHA512 70d107124b49862a284fce03b868dde4e4da7e2b460bb5189810c2a6d6bab142fd6d35e689f5f86c95e902b5d1cf4a7a32bdc285bcefb5894a332772c4d5b718
SSDEEP 96:wb4VHccYJUC/aFbz/j0OvaPHzd3cX5aXW:wUaJf/aFbP0Omz2JaX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lphfpbdi.exe

Path C:\Windows\SysWOW64\Lphfpbdi.exe
Size 664KB
SHA256 b1da4865e933ebac93b7861287a2279cf4ac45ed5f7ce08d230287be2ac7a9d6
MD5 3a2a4dafe788a83503d22733ea1b6287
SHA1 fcea661978ab2ff8150109d0e21af7409a7be586
SHA512 d59773539edbb572becd645521281714c27984ec1dad93e85559da1f84a6ceef459505b0c65e9e8d0e0640c110ce72f4c3d6827bc769d19fb694c4f0c24885c2
SSDEEP 12288:faOo6pV6yYP4rbpV6yYPg058KpV6yYPNUir2MhNl6zX3w9As/xO23WM6tJmDYjm:faObW4XWleKWNUir2MhNl6zX3w9As/xi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mdkhapfj.exe

Path C:\Windows\SysWOW64\Mdkhapfj.exe
Size 664KB
SHA256 ccde4d644bc00f558e60ea8e982cadad34ef2168c92c80fc51c6d4cab9322c12
MD5 bde3440b55f5e67998d86efdbe4853d3
SHA1 757b3a691c5cf43667a4ee1551a0d3a63a27e767
SHA512 77e62722e9376fd67a154a36b1dc9dad8e1a6aa48eeefc2b4e445c84a0a91ded879f9bb73fbb706cf7ba38abff326bfc0580c89b31c5eae2dfb2b56dac1fc7e8
SSDEEP 12288:0BupV6yYP4rbpV6yYPg058KpV6yYPNUir2MhNl6zX3w9As/xO23WM6tJmDYjmR54:0BuW4XWleKWNUir2MhNl6zX3w9As/xOX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mgidml32.exe

Path C:\Windows\SysWOW64\Mgidml32.exe
Size 664KB
SHA256 64ae98d76292d0f941d5b4a13e1eef731575009044558ed49a5dec32f34e2434
MD5 39143e1486c563d39ccab4002bcd7e3e
SHA1 73185456ae93291042a11e85dd59e0a6bb090112
SHA512 b5437907efcf4e3a2f3084973d7aba6ede7e4a0ee369d13b87940ea329dd7471e84646e4d76bdaf056f8b2ebcc04764935643a3668452e7d17d0e4c0d0240e03
SSDEEP 12288:0vr97pV6yYP4rbpV6yYPg058KpV6yYPNUir2MhNl6zX3w9As/xO23WM6tJmDYjm:i97W4XWleKWNUir2MhNl6zX3w9As/xOX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mjcgohig.exe

Path C:\Windows\SysWOW64\Mjcgohig.exe
Size 664KB
SHA256 90f767ae92adbcaa1d953bebd033ff465d3bac21462312a7c356959dbdfffe6b
MD5 3ce41d5d33e43d0db453533e655bf572
SHA1 8d99f11bc2e4caa9e7cfd50f23a0587ae72601e7
SHA512 84f6bc110838e8682a314a5ce307072dbb7a80497a482930a385739b2e5d466ed18b8834544678088945f7d49365f8c6a032ace485bf814642b2c2c8603dc4ea
SSDEEP 12288:rD+NSpV6yYP4rbpV6yYPg058KpV6yYPNUir2MhNl6zX3w9As/xO23WM6tJmDYjm:3XW4XWleKWNUir2MhNl6zX3w9As/xO2k
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mncmjfmk.exe

Path C:\Windows\SysWOW64\Mncmjfmk.exe
Size 664KB
SHA256 79770b81baa51b9449393db6526cd5456acc86368d2e3804304d1534fb8ca32f
MD5 7b88ac60b3679c2555856c4e3c5735cb
SHA1 f53d405ad367abb2d8cddf78a779cc7809e18af2
SHA512 b9aa65c804ba1d114a8b7f0d06201bc35bf476074ebda00d047fe8c6ad4b13c9338ee9753f2df9ee1752c8d57c0051636cd282c0223d27176f5ad0152142c077
SSDEEP 12288:YGfpV6yYP4rbpV6yYPg058KpV6yYPNUir2MhNl6zX3w9As/xO23WM6tJmDYjmR54:7W4XWleKWNUir2MhNl6zX3w9As/xO23U
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nafokcol.exe

Path C:\Windows\SysWOW64\Nafokcol.exe
Size 664KB
SHA256 d2af55743670c4ae83ee260140cdaa83a09cd11874fd91ad8aa7810a8a93fe19
MD5 566ee6d858c3f4a3f3c59216b8ce7a4f
SHA1 40b73fab4e4993f314f72c9d851a7469014dbe23
SHA512 6bba431daa446e5c2f86e9e9ff156cc069787a83d128558da65e87bdacfdcd24e63510b885af6a8adba6c2f32c5dbf771afeb451e956cb7ad5a9cf4acfff2203
SSDEEP 12288:fHbspV6yYP4rbpV6yYPg058KpV6yYPNUir2MhNl6zX3w9As/xO23WM6tJmDYjmRS:f7sW4XWleKWNUir2MhNl6zX3w9As/xOX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Njljefql.exe

Path C:\Windows\SysWOW64\Njljefql.exe
Size 664KB
SHA256 674b4ea114273f970725b171e8c19171e11d62063b0e9277da342b669332d8d4
MD5 004f29689ea739784530d5f662d00a46
SHA1 924194322f2256c99c07f70d2b0e892e8ec2db4e
SHA512 4c7565cbba150682e137d13dc01a22d3e15a0dead98610169539cf78dffeca8d0e5cddad40fd11d308110911cdd3488d85446e0295430421e91a7cb99fc80e29
SSDEEP 12288:RJRzNpV6yYP4rbpV6yYPg058KpV6yYPNUir2MhNl6zX3w9As/xO23WM6tJmDYjm:vRzNW4XWleKWNUir2MhNl6zX3w9As/xi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nkcmohbg.exe

Path C:\Windows\SysWOW64\Nkcmohbg.exe
Size 664KB
SHA256 d85c1739e7d6a14c17c27770a16bd972ec5ab5d2c16c81cff82947b77d88eb59
MD5 e2d7980f79b439e79b1a1854bdfd6b20
SHA1 8b550ca9ae788b1e42a881ff7104e67eb9d9fb4a
SHA512 61607dc737266f664ee9eb89139a5f55e238e5ea610864376a3b3ea2d827f50b342d2711a8401a736d455cb72e61925ce54e08c8421a76302b9c6cad8a737d23
SSDEEP 12288:L4pV6yYP4rbpV6yYPg058KpV6yYPNUir2MhNl6zX3w9As/xO23WM6tJmDYjmR54F:0W4XWleKWNUir2MhNl6zX3w9As/xO23U
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nkqpjidj.exe

Path C:\Windows\SysWOW64\Nkqpjidj.exe
Size 664KB
SHA256 6dd0a552bbf6593ffc818338dfc9686860a185ecea3dec7dcdd9cf75d5f390dc
MD5 fe3f5d8f0b5a3bfd80b399377cd152e6
SHA1 378e114bc4b3ff4726c0d957d752b5d3f841c81c
SHA512 47fb081985ff65162daeacafae1e1b6a7718e6648f3f319357277ac54674dc25d0e25c4c1b8ed46cc52f22120d0a9697325012b4cbbc0191ed97dfd0ee27d780
SSDEEP 12288:5DspV6yYP4rbpV6yYPg058KpV6yYPNUir2MhNl6zX3w9As/xO23WM6tJmDYjmR54:OW4XWleKWNUir2MhNl6zX3w9As/xO23U
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1060-44-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1316-76-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1316-47-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1796-75-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1796-56-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2236-73-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2236-71-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3756-80-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3756-0-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3864-28-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3964-78-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3964-36-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4892-8-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4892-79-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4960-63-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4960-74-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/5100-77-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/5100-16-0x0000000000400000-0x0000000000435000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads