18a872321f8e6ff8925aa75e8e59880c354c252e49bcefe5c5b54ffc814424ce

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 22:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
399c0874694175fec5d76cb3e73c3fc0_NeikiAnalytics.exe
Size 115KB
Sample240514-2knzzace42
SHA256 18a872321f8e6ff8925aa75e8e59880c354c252e49bcefe5c5b54ffc814424ce
MD5 399c0874694175fec5d76cb3e73c3fc0
SHA1 6d58bbf521caf2122586acb201c411566c4ec41c
SHA512 0f7db9ff6d3811fec7bfd6d76fb3e74c01aedf164ce851b6419691a3e02e41e864b948d28f7495fe2f64004d93d665869aee8e724d47734b16c8d29758b4ebe3
SSDEEP 1536:i5IdhwUgnQO97bA4AS802L/yvCbrIRQW1ooQUPRMcu30MUwZkTKr4:1wVRBj+/dbrIR/SoQUP5u30KqTKr4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

backdoor dropper persistence trojan

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 44 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mglack32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mjjmog32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndbnboqb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njacpf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqklmpdd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndidbn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpmokb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgghhlhq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mjhqjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ncihikcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nnolfdcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nqklmpdd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdkhapfj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjhqjg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpaifalo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mpaifalo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ndbnboqb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mkbchk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mpdelajl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mglack32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nkjjij32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njogjfoj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njacpf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	399c0874694175fec5d76cb3e73c3fc0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mpmokb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpdelajl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcbahlip.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnolfdcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	399c0874694175fec5d76cb3e73c3fc0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkgmcjld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nqiogp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mkgmcjld.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjjmog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mcbahlip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgghhlhq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkbchk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mdkhapfj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgidml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgidml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nkjjij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njogjfoj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqiogp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncihikcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ndidbn32.exe

Malware Dropper & Backdoor - Berbew 22 IoCs

Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.

backdoor trojan dropper

resource	yara_rule
behavioral2/files/0x0008000000022f51-7.dat	family_berbew
behavioral2/files/0x00080000000233f7-15.dat	family_berbew
behavioral2/files/0x00070000000233fd-24.dat	family_berbew
behavioral2/files/0x00070000000233ff-31.dat	family_berbew
behavioral2/files/0x0007000000023401-40.dat	family_berbew
behavioral2/files/0x0007000000023403-48.dat	family_berbew
behavioral2/files/0x0007000000023405-54.dat	family_berbew
behavioral2/files/0x0007000000023407-64.dat	family_berbew
behavioral2/files/0x0007000000023409-72.dat	family_berbew
behavioral2/files/0x000700000002340b-78.dat	family_berbew
behavioral2/files/0x000700000002340d-88.dat	family_berbew
behavioral2/files/0x000700000002340f-97.dat	family_berbew
behavioral2/files/0x0007000000023411-104.dat	family_berbew
behavioral2/files/0x0007000000023413-111.dat	family_berbew
behavioral2/files/0x0007000000023415-119.dat	family_berbew
behavioral2/files/0x0007000000023417-127.dat	family_berbew
behavioral2/files/0x0007000000023419-135.dat	family_berbew
behavioral2/files/0x000700000002341b-143.dat	family_berbew
behavioral2/files/0x000700000002341d-151.dat	family_berbew
behavioral2/files/0x000700000002341f-159.dat	family_berbew
behavioral2/files/0x0007000000023421-167.dat	family_berbew
behavioral2/files/0x0007000000023423-175.dat	family_berbew

Executes dropped EXE 22 IoCs

pid	Process
2212	Mpmokb32.exe
1500	Mgghhlhq.exe
4388	Mkbchk32.exe
4980	Mdkhapfj.exe
2848	Mgidml32.exe
4936	Mjhqjg32.exe
1740	Mpaifalo.exe
2772	Mglack32.exe
4784	Mkgmcjld.exe
4968	Mjjmog32.exe
2520	Mpdelajl.exe
2700	Mcbahlip.exe
5044	Nkjjij32.exe
3456	Ndbnboqb.exe
1328	Njogjfoj.exe
2184	Nqiogp32.exe
1924	Njacpf32.exe
3760	Nqklmpdd.exe
3672	Ncihikcg.exe
3476	Nnolfdcn.exe
4736	Ndidbn32.exe
3288	Nkcmohbg.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Mglack32.exe	Mpaifalo.exe
File opened for modification	C:\Windows\SysWOW64\Mjhqjg32.exe	Mgidml32.exe
File opened for modification	C:\Windows\SysWOW64\Mpdelajl.exe	Mjjmog32.exe
File created	C:\Windows\SysWOW64\Egqcbapl.dll	Mcbahlip.exe
File opened for modification	C:\Windows\SysWOW64\Nnolfdcn.exe	Ncihikcg.exe
File created	C:\Windows\SysWOW64\Hnibdpde.dll	Ndidbn32.exe
File created	C:\Windows\SysWOW64\Dihcoe32.dll	Nkjjij32.exe
File created	C:\Windows\SysWOW64\Pponmema.dll	Njogjfoj.exe
File created	C:\Windows\SysWOW64\Nqklmpdd.exe	Njacpf32.exe
File created	C:\Windows\SysWOW64\Nnolfdcn.exe	Ncihikcg.exe
File created	C:\Windows\SysWOW64\Njacpf32.exe	Nqiogp32.exe
File created	C:\Windows\SysWOW64\Bkankc32.dll	399c0874694175fec5d76cb3e73c3fc0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\Mgghhlhq.exe	Mpmokb32.exe
File opened for modification	C:\Windows\SysWOW64\Mdkhapfj.exe	Mkbchk32.exe
File created	C:\Windows\SysWOW64\Mcbahlip.exe	Mpdelajl.exe
File opened for modification	C:\Windows\SysWOW64\Mkbchk32.exe	Mgghhlhq.exe
File created	C:\Windows\SysWOW64\Cnacjn32.dll	Mdkhapfj.exe
File created	C:\Windows\SysWOW64\Ncihikcg.exe	Nqklmpdd.exe
File created	C:\Windows\SysWOW64\Opbnic32.dll	Nnolfdcn.exe
File created	C:\Windows\SysWOW64\Mpmokb32.exe	399c0874694175fec5d76cb3e73c3fc0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\Agbnmibj.dll	Mpmokb32.exe
File created	C:\Windows\SysWOW64\Njcqqgjb.dll	Mkbchk32.exe
File created	C:\Windows\SysWOW64\Mglack32.exe	Mpaifalo.exe
File opened for modification	C:\Windows\SysWOW64\Mpmokb32.exe	399c0874694175fec5d76cb3e73c3fc0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\Njogjfoj.exe	Ndbnboqb.exe
File opened for modification	C:\Windows\SysWOW64\Ncihikcg.exe	Nqklmpdd.exe
File opened for modification	C:\Windows\SysWOW64\Mgidml32.exe	Mdkhapfj.exe
File opened for modification	C:\Windows\SysWOW64\Mcbahlip.exe	Mpdelajl.exe
File created	C:\Windows\SysWOW64\Lelgbkio.dll	Mpdelajl.exe
File created	C:\Windows\SysWOW64\Nqiogp32.exe	Njogjfoj.exe
File created	C:\Windows\SysWOW64\Cknpkhch.dll	Ncihikcg.exe
File created	C:\Windows\SysWOW64\Gqffnmfa.dll	Mgghhlhq.exe
File created	C:\Windows\SysWOW64\Fnelfilp.dll	Mjhqjg32.exe
File created	C:\Windows\SysWOW64\Njogjfoj.exe	Ndbnboqb.exe
File created	C:\Windows\SysWOW64\Ljfemn32.dll	Njacpf32.exe
File created	C:\Windows\SysWOW64\Mdkhapfj.exe	Mkbchk32.exe
File opened for modification	C:\Windows\SysWOW64\Ndbnboqb.exe	Nkjjij32.exe
File created	C:\Windows\SysWOW64\Mgidml32.exe	Mdkhapfj.exe
File created	C:\Windows\SysWOW64\Mjhqjg32.exe	Mgidml32.exe
File created	C:\Windows\SysWOW64\Geegicjl.dll	Mkgmcjld.exe
File created	C:\Windows\SysWOW64\Nkjjij32.exe	Mcbahlip.exe
File opened for modification	C:\Windows\SysWOW64\Mpaifalo.exe	Mjhqjg32.exe
File created	C:\Windows\SysWOW64\Gbbkdl32.dll	Mjjmog32.exe
File opened for modification	C:\Windows\SysWOW64\Nkjjij32.exe	Mcbahlip.exe
File created	C:\Windows\SysWOW64\Pkckjila.dll	Nqklmpdd.exe
File created	C:\Windows\SysWOW64\Ndbnboqb.exe	Nkjjij32.exe
File created	C:\Windows\SysWOW64\Lfcbokki.dll	Ndbnboqb.exe
File opened for modification	C:\Windows\SysWOW64\Njacpf32.exe	Nqiogp32.exe
File created	C:\Windows\SysWOW64\Ndidbn32.exe	Nnolfdcn.exe
File created	C:\Windows\SysWOW64\Mpaifalo.exe	Mjhqjg32.exe
File created	C:\Windows\SysWOW64\Oaehlf32.dll	Mpaifalo.exe
File created	C:\Windows\SysWOW64\Ekipni32.dll	Mglack32.exe
File created	C:\Windows\SysWOW64\Mpdelajl.exe	Mjjmog32.exe
File opened for modification	C:\Windows\SysWOW64\Ndidbn32.exe	Nnolfdcn.exe
File opened for modification	C:\Windows\SysWOW64\Mjjmog32.exe	Mkgmcjld.exe
File created	C:\Windows\SysWOW64\Nkcmohbg.exe	Ndidbn32.exe
File opened for modification	C:\Windows\SysWOW64\Nkcmohbg.exe	Ndidbn32.exe
File opened for modification	C:\Windows\SysWOW64\Mgghhlhq.exe	Mpmokb32.exe
File created	C:\Windows\SysWOW64\Mkbchk32.exe	Mgghhlhq.exe
File created	C:\Windows\SysWOW64\Gpnkgo32.dll	Mgidml32.exe
File opened for modification	C:\Windows\SysWOW64\Mkgmcjld.exe	Mglack32.exe
File opened for modification	C:\Windows\SysWOW64\Nqklmpdd.exe	Njacpf32.exe
File created	C:\Windows\SysWOW64\Mkgmcjld.exe	Mglack32.exe
File created	C:\Windows\SysWOW64\Mjjmog32.exe	Mkgmcjld.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
364	3288	WerFault.exe	104

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mkgmcjld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mpdelajl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	399c0874694175fec5d76cb3e73c3fc0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mjhqjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dihcoe32.dll"	Nkjjij32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ndbnboqb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nqiogp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ncihikcg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mgidml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lelgbkio.dll"	Mpdelajl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nkjjij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lmbnpm32.dll"	Nqiogp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkckjila.dll"	Nqklmpdd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	399c0874694175fec5d76cb3e73c3fc0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mpmokb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	399c0874694175fec5d76cb3e73c3fc0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekipni32.dll"	Mglack32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mjhqjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oaehlf32.dll"	Mpaifalo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mjjmog32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mcbahlip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pponmema.dll"	Njogjfoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ljfemn32.dll"	Njacpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mkbchk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gpnkgo32.dll"	Mgidml32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ndidbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ndidbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfcbokki.dll"	Ndbnboqb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Njogjfoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Opbnic32.dll"	Nnolfdcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nnolfdcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnibdpde.dll"	Ndidbn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mkbchk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mpdelajl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mpaifalo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mkgmcjld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Agbnmibj.dll"	Mpmokb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cnacjn32.dll"	Mdkhapfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Geegicjl.dll"	Mkgmcjld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Njacpf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nkjjij32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nqiogp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nnolfdcn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	399c0874694175fec5d76cb3e73c3fc0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mjjmog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mgghhlhq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mgidml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fnelfilp.dll"	Mjhqjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cknpkhch.dll"	Ncihikcg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	399c0874694175fec5d76cb3e73c3fc0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mpmokb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ndbnboqb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Njacpf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ncihikcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Njcqqgjb.dll"	Mkbchk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mdkhapfj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mgghhlhq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nqklmpdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Egqcbapl.dll"	Mcbahlip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mcbahlip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bkankc32.dll"	399c0874694175fec5d76cb3e73c3fc0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mpaifalo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Njogjfoj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nqklmpdd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 2212	2960	399c0874694175fec5d76cb3e73c3fc0_NeikiAnalytics.exe	81
PID 2960 wrote to memory of 2212	2960	399c0874694175fec5d76cb3e73c3fc0_NeikiAnalytics.exe	81
PID 2960 wrote to memory of 2212	2960	399c0874694175fec5d76cb3e73c3fc0_NeikiAnalytics.exe	81
PID 2212 wrote to memory of 1500	2212	Mpmokb32.exe	82
PID 2212 wrote to memory of 1500	2212	Mpmokb32.exe	82
PID 2212 wrote to memory of 1500	2212	Mpmokb32.exe	82
PID 1500 wrote to memory of 4388	1500	Mgghhlhq.exe	83
PID 1500 wrote to memory of 4388	1500	Mgghhlhq.exe	83
PID 1500 wrote to memory of 4388	1500	Mgghhlhq.exe	83
PID 4388 wrote to memory of 4980	4388	Mkbchk32.exe	84
PID 4388 wrote to memory of 4980	4388	Mkbchk32.exe	84
PID 4388 wrote to memory of 4980	4388	Mkbchk32.exe	84
PID 4980 wrote to memory of 2848	4980	Mdkhapfj.exe	85
PID 4980 wrote to memory of 2848	4980	Mdkhapfj.exe	85
PID 4980 wrote to memory of 2848	4980	Mdkhapfj.exe	85
PID 2848 wrote to memory of 4936	2848	Mgidml32.exe	86
PID 2848 wrote to memory of 4936	2848	Mgidml32.exe	86
PID 2848 wrote to memory of 4936	2848	Mgidml32.exe	86
PID 4936 wrote to memory of 1740	4936	Mjhqjg32.exe	87
PID 4936 wrote to memory of 1740	4936	Mjhqjg32.exe	87
PID 4936 wrote to memory of 1740	4936	Mjhqjg32.exe	87
PID 1740 wrote to memory of 2772	1740	Mpaifalo.exe	88
PID 1740 wrote to memory of 2772	1740	Mpaifalo.exe	88
PID 1740 wrote to memory of 2772	1740	Mpaifalo.exe	88
PID 2772 wrote to memory of 4784	2772	Mglack32.exe	89
PID 2772 wrote to memory of 4784	2772	Mglack32.exe	89
PID 2772 wrote to memory of 4784	2772	Mglack32.exe	89
PID 4784 wrote to memory of 4968	4784	Mkgmcjld.exe	90
PID 4784 wrote to memory of 4968	4784	Mkgmcjld.exe	90
PID 4784 wrote to memory of 4968	4784	Mkgmcjld.exe	90
PID 4968 wrote to memory of 2520	4968	Mjjmog32.exe	91
PID 4968 wrote to memory of 2520	4968	Mjjmog32.exe	91
PID 4968 wrote to memory of 2520	4968	Mjjmog32.exe	91
PID 2520 wrote to memory of 2700	2520	Mpdelajl.exe	92
PID 2520 wrote to memory of 2700	2520	Mpdelajl.exe	92
PID 2520 wrote to memory of 2700	2520	Mpdelajl.exe	92
PID 2700 wrote to memory of 5044	2700	Mcbahlip.exe	93
PID 2700 wrote to memory of 5044	2700	Mcbahlip.exe	93
PID 2700 wrote to memory of 5044	2700	Mcbahlip.exe	93
PID 5044 wrote to memory of 3456	5044	Nkjjij32.exe	94
PID 5044 wrote to memory of 3456	5044	Nkjjij32.exe	94
PID 5044 wrote to memory of 3456	5044	Nkjjij32.exe	94
PID 3456 wrote to memory of 1328	3456	Ndbnboqb.exe	96
PID 3456 wrote to memory of 1328	3456	Ndbnboqb.exe	96
PID 3456 wrote to memory of 1328	3456	Ndbnboqb.exe	96
PID 1328 wrote to memory of 2184	1328	Njogjfoj.exe	97
PID 1328 wrote to memory of 2184	1328	Njogjfoj.exe	97
PID 1328 wrote to memory of 2184	1328	Njogjfoj.exe	97
PID 2184 wrote to memory of 1924	2184	Nqiogp32.exe	98
PID 2184 wrote to memory of 1924	2184	Nqiogp32.exe	98
PID 2184 wrote to memory of 1924	2184	Nqiogp32.exe	98
PID 1924 wrote to memory of 3760	1924	Njacpf32.exe	100
PID 1924 wrote to memory of 3760	1924	Njacpf32.exe	100
PID 1924 wrote to memory of 3760	1924	Njacpf32.exe	100
PID 3760 wrote to memory of 3672	3760	Nqklmpdd.exe	101
PID 3760 wrote to memory of 3672	3760	Nqklmpdd.exe	101
PID 3760 wrote to memory of 3672	3760	Nqklmpdd.exe	101
PID 3672 wrote to memory of 3476	3672	Ncihikcg.exe	102
PID 3672 wrote to memory of 3476	3672	Ncihikcg.exe	102
PID 3672 wrote to memory of 3476	3672	Ncihikcg.exe	102
PID 3476 wrote to memory of 4736	3476	Nnolfdcn.exe	103
PID 3476 wrote to memory of 4736	3476	Nnolfdcn.exe	103
PID 3476 wrote to memory of 4736	3476	Nnolfdcn.exe	103
PID 4736 wrote to memory of 3288	4736	Ndidbn32.exe	104

C:\Users\Admin\AppData\Local\Temp\399c0874694175fec5d76cb3e73c3fc0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\399c0874694175fec5d76cb3e73c3fc0_NeikiAnalytics.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Windows\SysWOW64\Mpmokb32.exe
  C:\Windows\system32\Mpmokb32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2212
- - C:\Windows\SysWOW64\Mgghhlhq.exe
    C:\Windows\system32\Mgghhlhq.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1500
  - - C:\Windows\SysWOW64\Mkbchk32.exe
      C:\Windows\system32\Mkbchk32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4388
    - - C:\Windows\SysWOW64\Mdkhapfj.exe
        
        C:\Windows\system32\Mdkhapfj.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4980
      - C:\Windows\SysWOW64\Mgidml32.exe
        
        C:\Windows\system32\Mgidml32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2848
        
        C:\Windows\SysWOW64\Mjhqjg32.exe
        
        C:\Windows\system32\Mjhqjg32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4936
        
        C:\Windows\SysWOW64\Mpaifalo.exe
        
        C:\Windows\system32\Mpaifalo.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1740
        
        C:\Windows\SysWOW64\Mglack32.exe
        
        C:\Windows\system32\Mglack32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2772
        
        C:\Windows\SysWOW64\Mkgmcjld.exe
        
        C:\Windows\system32\Mkgmcjld.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4784
        
        C:\Windows\SysWOW64\Mjjmog32.exe
        
        C:\Windows\system32\Mjjmog32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4968
        
        C:\Windows\SysWOW64\Mpdelajl.exe
        
        C:\Windows\system32\Mpdelajl.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2520
        
        C:\Windows\SysWOW64\Mcbahlip.exe
        
        C:\Windows\system32\Mcbahlip.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2700
        
        C:\Windows\SysWOW64\Nkjjij32.exe
        
        C:\Windows\system32\Nkjjij32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5044
        
        C:\Windows\SysWOW64\Ndbnboqb.exe
        
        C:\Windows\system32\Ndbnboqb.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3456
        
        C:\Windows\SysWOW64\Njogjfoj.exe
        
        C:\Windows\system32\Njogjfoj.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1328
        
        C:\Windows\SysWOW64\Nqiogp32.exe
        
        C:\Windows\system32\Nqiogp32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2184
        
        C:\Windows\SysWOW64\Njacpf32.exe
        
        C:\Windows\system32\Njacpf32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1924
        
        C:\Windows\SysWOW64\Nqklmpdd.exe
        
        C:\Windows\system32\Nqklmpdd.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3760
        
        C:\Windows\SysWOW64\Ncihikcg.exe
        
        C:\Windows\system32\Ncihikcg.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3672
        
        C:\Windows\SysWOW64\Nnolfdcn.exe
        
        C:\Windows\system32\Nnolfdcn.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3476
        
        C:\Windows\SysWOW64\Ndidbn32.exe
        
        C:\Windows\system32\Ndidbn32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4736
        
        C:\Windows\SysWOW64\Nkcmohbg.exe
        
        C:\Windows\system32\Nkcmohbg.exe
        23⤵
        Executes dropped EXE
        
        PID:3288
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3288 -s 400
        24⤵
        Program crash
        
        PID:364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3288 -ip 3288
1⤵
PID:3480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Mcbahlip.exe

Path C:\Windows\SysWOW64\Mcbahlip.exe
Size 115KB
SHA256 4e4558cd3eb6849d37fd5701e001f6fc4b19c13f69f72ed757cf8ff593596673
MD5 10ae03a8b04bf6180772a7bb2be9002b
SHA1 26145e67fd22288b1bc12f43b16a6f566ba7f4c0
SHA512 fce9ab1880d8466c490d264f1b6f5a21d923ba047cf509bbc68ebed71ce9556aa77b58e67e4fdf34e62c50d975911471f2b1cdf3f92fc599a016c522951f5906
SSDEEP 3072:3F71CFVWKyoewjdbrIR/SoQUP5u30KqTKr4:N1KsKyWjhrIooQUPoDqTKE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mdkhapfj.exe

Path C:\Windows\SysWOW64\Mdkhapfj.exe
Size 115KB
SHA256 03fa3a253dced923c8543a84cc08ade1e5b5ff0ff6af4b8f371905b3d5f413c3
MD5 d46bdf13f1c9cc64d65f2ebb5762e5a4
SHA1 7e638662d42cec94b6f6cfee48e1ecb963c5ce8b
SHA512 be5f78a7dc85ab95699093e49f3f5fcbd26b9bd09b2e0da4f977f10b227e26491813420341346523da6b86187221750d23c24fdc6f89ca3b3a7c9c763742df3e
SSDEEP 1536:9E2RF5ORvslQzcRs9W/xWY+bYt2LyyvCbrIRQW1ooQUPRMcu30MUwZkTKr4:9FKdY+ydbrIR/SoQUP5u30KqTKr4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mgghhlhq.exe

Path C:\Windows\SysWOW64\Mgghhlhq.exe
Size 115KB
SHA256 c24792cac7c05121d85f0d437354246b0f28127e6bf906cc43dda34486541e37
MD5 3e6796cbb01b6192938cac51a7c98ad1
SHA1 d7ae49ce9c34ced2c68e92ca459fb105cc4c5bde
SHA512 998d51d6147d789616872e02b95e61a8da6959276d8fa09b78061f93ca2e5899cee46a2ac56cc50560e4475c8f9de87dacd0bf8a8478f8fc8477dfca0022ca65
SSDEEP 3072:oNkAsj7KvSyvLuIDNfdbrIR/SoQUP5u30KqTKr4:qZvLfNfhrIooQUPoDqTKE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mgidml32.exe

Path C:\Windows\SysWOW64\Mgidml32.exe
Size 115KB
SHA256 63d1888eaa93330ab7036a9d2d97b3518251a1666532d0b89c25225ff91b1692
MD5 1232c52171aab59df7dbb3e4da19bd4e
SHA1 a447fd1cb4556c72f87887c1ea127353930b299b
SHA512 d3977bae9f9e62c65e1f70df3255f0b02c1eb742681424053bb1774ec5266a4ec0d6d6e5e08cfff042b39be6751b6d10839424af07ed0447f405aa53a616ef80
SSDEEP 3072:whLnFY4s+94s2YXdbrIR/SoQUP5u30KqTKr4:ojFY/sDXhrIooQUPoDqTKE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mglack32.exe

Path C:\Windows\SysWOW64\Mglack32.exe
Size 115KB
SHA256 eb01b40eff4717f2ff121bde5f8fd39edd429730d8e7a48c62b8eb0b2cdfe4fd
MD5 ddfe9c31b35fb86f8b34922eddf88cc8
SHA1 ccadd54635630733d6253adf8a32c1062b039311
SHA512 71bf739382092eb0a2f43ae4bceab8703ce4a503df2971e22bfb18bafff4c0cef0108648e4b6a75d25d73a8c1e76ab78cb3e8dfd380eed0652dab451021e53a1
SSDEEP 3072:Eq67d7eoj6LchwK0uJCdbrIR/SoQUP5u30KqTKr4:IReq6VAChrIooQUPoDqTKE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mjhqjg32.exe

Path C:\Windows\SysWOW64\Mjhqjg32.exe
Size 115KB
SHA256 824f438c6e8ab0716ebabb1bb85fba9433b482d59ce230d76223f122685cd88c
MD5 23de6bcf9af768f8bc07cc0424ec36b8
SHA1 f469b3e53fae846747615005576a2e345754755a
SHA512 33d423a44257576820329a90679368fcdddd07b16079520d321cc7012acfd404441d9308da22b2ed4e7012f8d0c58c6c1acb186403619e30a752fe4a4027344e
SSDEEP 3072:LGv5rlcF5IF7pBWmdbrIR/SoQUP5u30KqTKr4:i5r+g2mhrIooQUPoDqTKE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mjjmog32.exe

Path C:\Windows\SysWOW64\Mjjmog32.exe
Size 115KB
SHA256 d04dd1b1392684b0d1d82dffbbae1301cfd2a45d945c2fd1d47cccf6b0547bab
MD5 779cb97f3bcd133eed20a96f3f3c57db
SHA1 fae1d45a5762a69841496da0366b8d3847ef2a3a
SHA512 fa8042cd25fe157727dce7b288b718b0711f6596ee78e6491b2c008ab6c31e6179450fe04143f897999ff657c7b6c9dbd8e6563f326aa4ccf9af4c3a6d2796cd
SSDEEP 3072:Yy4/YMA3Lnt/k5InhdbrIR/SoQUP5u30KqTKr4:F4/SDt/k5InhhrIooQUPoDqTKE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mkbchk32.exe

Path C:\Windows\SysWOW64\Mkbchk32.exe
Size 115KB
SHA256 10e7b3c5de5823202104637e7f28d02e593cfc2d55f69661f7458fbbe4f71206
MD5 a3695564ff8011d9a5eada7f617b0860
SHA1 ad9d34fbd4a0c7c9da649160f2ad059901fd6801
SHA512 f2a54cea581aff0a135d2b92b495e248995f1582a2516a428c4cb663d12a490f6ac42d022c5a5ce8fb7da9369a764272127dd8eec0ea08301b09d9061615d598
SSDEEP 3072:vRhCAo8vDWjoz8dbrIR/SoQUP5u30KqTKr4:vRhDfDWjm8hrIooQUPoDqTKE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mkgmcjld.exe

Path C:\Windows\SysWOW64\Mkgmcjld.exe
Size 115KB
SHA256 032e7a546bdcca9b9212dbb97a9e2cd1cd4cd1947e85dd0ef1a93201665e5161
MD5 3d4b200185ef064bae107d8040a89d87
SHA1 74d425410172423fadbb586f5b2d094517571b5a
SHA512 0d4d5e5f448652ba153a97688c2f1018f9ccb73b1d1de91744e9925a556a9885d7f7c7392d8c20f307dd4cc0ab921f6869fef7002568e30ea46c8225889ab72c
SSDEEP 3072:kDkfjH/MBHtcGzdbrIR/SoQUP5u30KqTKr4:kDQHDYhrIooQUPoDqTKE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mpaifalo.exe

Path C:\Windows\SysWOW64\Mpaifalo.exe
Size 115KB
SHA256 5b10fe842a5dff38cfada62154e2a1a32ebc183c9a3a6e57e14b9710121f4e57
MD5 2f77bca7ea79ce958050ee879673855a
SHA1 37eedd3fab4ee44d66476cd6ad667b071f65de4f
SHA512 5926bb188d347550b0775974a42241a2e74080583e80a457eb2aab95f98df00e1e48a2c37d42cd1d786146b288bb2a5341873cd6f3f42ec8aeac99759f9a2678
SSDEEP 1536:G5dtdXNV5/K2p5WrkJuftD2LgyvCbrIRQW1ooQUPRMcu30MUwZkTKr4:Gjrg2LJIGgdbrIR/SoQUP5u30KqTKr4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mpdelajl.exe

Path C:\Windows\SysWOW64\Mpdelajl.exe
Size 115KB
SHA256 abc0ce4cbb6082e558eeba5b6a33bb1ff91c59c771556f0caa16e735dae5ae9a
MD5 aec099cd34280cb0ce475d839193ff74
SHA1 779a839c8f69fcda4bbf1bdb84d868c8b5a3bfc7
SHA512 06c0e0e8ad417a0b034331dbefb9f05476fa3547c0871a5ff23abb21d128cbf430d2848b640048a9486601877df01b0b1d10079d1fad0049bfa0f48c7d33ff40
SSDEEP 3072:BJn2aWVknf+lsQBAGV+dbrIR/SoQUP5u30KqTKr4:rn2aCV+hrIooQUPoDqTKE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mpmokb32.exe

Path C:\Windows\SysWOW64\Mpmokb32.exe
Size 115KB
SHA256 a7aab1436e4754332a3cfbb5b5434fac7906ae2e67903e0186764f3098b9be75
MD5 dd69d82d4ed7c5a2d89996cb86fd9449
SHA1 8a5875e61b77fbded176210c86d2510fec592bc0
SHA512 a998ea08edf51c7b80784c35a1908bb95a63884878148f33a80a37b30462e1b46d1e190c488e0efa5f3c6b3abb68e98b173405510a8794150e5eeedc1e822a25
SSDEEP 3072:Ccfq6NL3pXnD8QVMdbrIR/SoQUP5u30KqTKr4:E6hOQVMhrIooQUPoDqTKE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ncihikcg.exe

Path C:\Windows\SysWOW64\Ncihikcg.exe
Size 115KB
SHA256 0e87e900193edcdcc924b9a2306898d040f947a6b585b371de992e9d830498c0
MD5 5f830cf49d33ca28afacbf2682ddd530
SHA1 8ebda3a448930356908148c46552c25080d1c0d4
SHA512 c82a4a5a12778d697c4a4481d8f7664510876f0b69fdd84887fcb10ea2a8526da234c57ebcdcfab7626076b061d522efa9b4cdcf32ce7feaeae97b0b981da5e4
SSDEEP 3072:HhO97FGVjkS3SdbrIR/SoQUP5u30KqTKr4:HhO97FukS3ShrIooQUPoDqTKE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ndbnboqb.exe

Path C:\Windows\SysWOW64\Ndbnboqb.exe
Size 115KB
SHA256 b4abcdb63148dff0ce32140cf0bf1839521a16f9f1a6528a759a36b8b5c69892
MD5 9dd5a3c0a697f9a9febce84fa7ac9375
SHA1 6c57273301e285c6f41d23a9dd2bbbd137855cd1
SHA512 2686e82ec42a6fc90c11cbd3468e4cfb6945e551a24462517c2a79bb73b6f8ffdba1b67deb096d3f16b9de00884dabecd5eaca6f581a7d89930f3b43f63ba2a4
SSDEEP 3072:06D9zmtqU54dbrIR/SoQUP5u30KqTKr4:049zmgUuhrIooQUPoDqTKE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ndidbn32.exe

Path C:\Windows\SysWOW64\Ndidbn32.exe
Size 115KB
SHA256 5535775c4171a8df69aa362257a3d044fc8ca508f23531849e31bb148892d1df
MD5 08224233ad6e43a818140e5164c8dced
SHA1 2dc3e80c4c75ace2aad14625af4d5663427d89c1
SHA512 3cebedd2b0b38a4bc62af8d284964a8e111d977c3ab470d54fd3164d4c160fcba50a083bd4d407b55f09240a448501b0f7510cb0bb52930c5b635eeeb33dbd5e
SSDEEP 3072:S2wQKo4ttLrb5CbdbrIR/SoQUP5u30KqTKr4:S2tKo4bUbhrIooQUPoDqTKE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Njacpf32.exe

Path C:\Windows\SysWOW64\Njacpf32.exe
Size 115KB
SHA256 cd105dc1f4925812e2049c239571308e2c755903f5dda4091375c9759cb5085b
MD5 c0fc5eb146dc93a5fb8e17d346383534
SHA1 d339103aabc96c78411ef390940ed44b9194e3fe
SHA512 191e6615f535a9caf82d48a021e080a3f952207b5da0d70ba8616236987f18963eb38a2eb92f15b6849854ee3e0adaed7c1ff4009372653e42017f328718be8a
SSDEEP 3072:36+3DK9wgzVeQSGTYdwdHFdbrIR/SoQUP5u30KqTKr4:zK/VeQTIiHFhrIooQUPoDqTKE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Njogjfoj.exe

Path C:\Windows\SysWOW64\Njogjfoj.exe
Size 115KB
SHA256 5a0ad9776bcacb391dd88791e64c3a9cf63f8cd2ecb88894f0832ee99eb10258
MD5 2ecef7a6d95b5db9d92cbc00ab274883
SHA1 82ed86f05c86709a3448ebf2d435696336b59227
SHA512 82be77d7c31d4a5196ef802adcf4b2dd34d8082a95706498e4407277fc36a00127b630038b2d9ed5d488b4fa1430b410d5d8fa1861f2be9e1b7edcc8cd0e9294
SSDEEP 3072:B/D/f1YpGVbwjZdbrIR/SoQUP5u30KqTKr4:B/D/dYpnjZhrIooQUPoDqTKE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nkcmohbg.exe

Path C:\Windows\SysWOW64\Nkcmohbg.exe
Size 115KB
SHA256 13116936edf13c99dc4a371abe9b9ffa2b30cc243249193d9b9bd13fb0af890b
MD5 13d080b44e1d565603dbaa0aa7ba0fe0
SHA1 a5f9fcff787e7c6e0fd9a93fbf720cd84c4970b0
SHA512 42f0787b7a7ead09e0a8093aedfd8499821d9e7ede9e16c83d0b23bff70f6a65018e18c145f53bc1717ba26a03f148d830ae5052bfbc9f152ead82949f04d4d1
SSDEEP 3072:a+o/CbXbgQRMgU5s+KdbrIR/SoQUP5u30KqTKr4:QcLEG+KhrIooQUPoDqTKE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nkjjij32.exe

Path C:\Windows\SysWOW64\Nkjjij32.exe
Size 115KB
SHA256 b2bd1dfb5dc51c45597238dd3718fec9e85a8a2b19f228262e25d512a5b08b9c
MD5 45dc7e9a32c3845ba41f0b2cad53e2ab
SHA1 82bc3e1dc46d9db79af19a36a2db205402cac44d
SHA512 0881938f0343d89a92702bec3278a7101cd95d53f3f763ea6fd29aa14fbe7aa959f0cb4d5cececc6db01847ae38a9d8484f72f621e0a5fb8e65ce706f7d534ed
SSDEEP 3072:iA4L5oFOylsSnfZjbx1TdbrIR/SoQUP5u30KqTKr4:nrZZfZjbx1ThrIooQUPoDqTKE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nnolfdcn.exe

Path C:\Windows\SysWOW64\Nnolfdcn.exe
Size 115KB
SHA256 2925c870ce92d828ec659bab02abda0493adaf352a34a7590d6608fb8bcb50b5
MD5 75a02dd4c89082bcd52d48ddbc8a5733
SHA1 ceb9928dc3ba0337a9eaf4ebbbe81c6862d138b9
SHA512 e0e53a0906b25772ba70a94548dccfc7736625a8c64c9542ccbdba56b3178502842fd0d567ba555ad920557b3fcff5f4cd41a8b38c5f4984fd88847c78c4751e
SSDEEP 3072:wFJmbzni+H5HHOOOFZ7dbrIR/SoQUP5u30KqTKr4:IUfpH5HHOOOX7hrIooQUPoDqTKE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nqiogp32.exe

Path C:\Windows\SysWOW64\Nqiogp32.exe
Size 115KB
SHA256 453bfd8b0faae88007cb6852eb94f7ddd0e383cfdb14b12a6cabe9ec03afe109
MD5 2025f0cf255d18f0c3a509e0be1a946d
SHA1 cbe3fd8aeda768e44ac44c4de66fc10d14a2a9dc
SHA512 86fc8894d61853d4ab733d87a94bdf0ccb20b17ad578ef62f96c3df2bcea9349787585d9bdd76ae956d06999da9609da83129b5fe8039787477814a78a656875
SSDEEP 3072:g16UvHIdqmhGdbrIR/SoQUP5u30KqTKr4:O6UvHU1GhrIooQUPoDqTKE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nqklmpdd.exe

Path C:\Windows\SysWOW64\Nqklmpdd.exe
Size 115KB
SHA256 9b824b19e9b2fe8b3f412a5d218518ac1b416c9dcb864811a496675d01680d8e
MD5 cdf7500ed02e77fe27d4a10c5b6b2431
SHA1 a1f14a2634b629c962f749edcb4531de4c389653
SHA512 e995d2b848a08a0f17d0fef5c80b6530221016a97d0e405bdabbd75bff27c1bc7953781d553a7da6f61f16368c35beebc47d47913793b4da29047d65f2cd5d44
SSDEEP 3072:vEl5ODrtnF39dbrIR/SoQUP5u30KqTKr4:8vODxn59hrIooQUPoDqTKE
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1328-121-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/1328-186-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/1500-195-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/1500-16-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/1740-57-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/1740-191-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/1924-137-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/1924-183-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/2184-184-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/2184-129-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/2212-196-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/2212-9-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/2520-189-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/2520-92-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/2700-188-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/2700-96-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/2772-69-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/2848-192-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/2848-45-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/2960-0-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/2960-1-0x0000000000431000-0x0000000000432000-memory.dmp

Download

memory/2960-197-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/3288-176-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/3288-178-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/3456-185-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/3456-112-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/3476-161-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/3476-180-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/3672-181-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/3672-153-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/3760-182-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/3760-145-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/4388-25-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/4388-194-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/4736-168-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/4736-179-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/4784-79-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/4936-55-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/4968-190-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/4968-80-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/4980-193-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/4980-33-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/5044-187-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/5044-105-0x0000000000400000-0x0000000000439000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads