5f73100613d7c5f44617718c655aa68a70ce1920f94cd5aee3dfcf6f543b0aa5

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 19:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1742b7ea87ca59699429c850a7fb4d90_NeikiAnalytics.exe
Size 199KB
Sample240514-yemceach91
SHA256 5f73100613d7c5f44617718c655aa68a70ce1920f94cd5aee3dfcf6f543b0aa5
MD5 1742b7ea87ca59699429c850a7fb4d90
SHA1 f958b464f34c878980db32f545f724d036a4596e
SHA512 1b32ac16562764e18700a925d162637df94bb02e6c15b12faf70189a60f70a544bbc4a2ddb4d76d193cd171d828358362eec930323be24459c659777e64aa8e4
SSDEEP 6144:jf2+TWlSZSCZj81+jq4peBK034YOmFz1h:j2itZSCG1+jheBbOmFxh
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

backdoor dropper persistence trojan

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 18 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndghmo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ndghmo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nnhfee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	1742b7ea87ca59699429c850a7fb4d90_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nceonl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nceonl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nnjbke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nkqpjidj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	1742b7ea87ca59699429c850a7fb4d90_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqiogp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nqiogp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nkqpjidj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nqmhbpba.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnhfee32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njacpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njacpf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqmhbpba.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnjbke32.exe

Malware Dropper & Backdoor - Berbew 9 IoCs

Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.

backdoor trojan dropper

resource	yara_rule
behavioral2/files/0x0006000000023270-7.dat	family_berbew
behavioral2/files/0x00070000000233c1-15.dat	family_berbew
behavioral2/files/0x00070000000233c3-23.dat	family_berbew
behavioral2/files/0x00070000000233c5-31.dat	family_berbew
behavioral2/files/0x00070000000233c7-39.dat	family_berbew
behavioral2/files/0x00070000000233c9-47.dat	family_berbew
behavioral2/files/0x00070000000233cb-55.dat	family_berbew
behavioral2/files/0x00070000000233cd-63.dat	family_berbew
behavioral2/files/0x00070000000233cf-71.dat	family_berbew

Executes dropped EXE 9 IoCs

pid	Process
4840	Nnhfee32.exe
1544	Nceonl32.exe
1956	Nnjbke32.exe
4100	Nqiogp32.exe
2852	Njacpf32.exe
2880	Ndghmo32.exe
680	Nkqpjidj.exe
3712	Nqmhbpba.exe
2500	Nkcmohbg.exe

Drops file in System32 directory 27 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Hlmobp32.dll	1742b7ea87ca59699429c850a7fb4d90_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\Bghhihab.dll	Nkqpjidj.exe
File created	C:\Windows\SysWOW64\Fcdjjo32.dll	Nnhfee32.exe
File opened for modification	C:\Windows\SysWOW64\Nnjbke32.exe	Nceonl32.exe
File created	C:\Windows\SysWOW64\Lmbnpm32.dll	Nqiogp32.exe
File opened for modification	C:\Windows\SysWOW64\Ndghmo32.exe	Njacpf32.exe
File opened for modification	C:\Windows\SysWOW64\Nqmhbpba.exe	Nkqpjidj.exe
File created	C:\Windows\SysWOW64\Hnibdpde.dll	Nqmhbpba.exe
File created	C:\Windows\SysWOW64\Pponmema.dll	Nnjbke32.exe
File opened for modification	C:\Windows\SysWOW64\Nnhfee32.exe	1742b7ea87ca59699429c850a7fb4d90_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\Nceonl32.exe	Nnhfee32.exe
File created	C:\Windows\SysWOW64\Njacpf32.exe	Nqiogp32.exe
File created	C:\Windows\SysWOW64\Nceonl32.exe	Nnhfee32.exe
File created	C:\Windows\SysWOW64\Kmalco32.dll	Nceonl32.exe
File created	C:\Windows\SysWOW64\Nqiogp32.exe	Nnjbke32.exe
File created	C:\Windows\SysWOW64\Nkcmohbg.exe	Nqmhbpba.exe
File opened for modification	C:\Windows\SysWOW64\Nqiogp32.exe	Nnjbke32.exe
File created	C:\Windows\SysWOW64\Ndghmo32.exe	Njacpf32.exe
File created	C:\Windows\SysWOW64\Nkqpjidj.exe	Ndghmo32.exe
File created	C:\Windows\SysWOW64\Ogpnaafp.dll	Ndghmo32.exe
File created	C:\Windows\SysWOW64\Nqmhbpba.exe	Nkqpjidj.exe
File opened for modification	C:\Windows\SysWOW64\Nkcmohbg.exe	Nqmhbpba.exe
File created	C:\Windows\SysWOW64\Nnhfee32.exe	1742b7ea87ca59699429c850a7fb4d90_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\Nnjbke32.exe	Nceonl32.exe
File opened for modification	C:\Windows\SysWOW64\Njacpf32.exe	Nqiogp32.exe
File created	C:\Windows\SysWOW64\Bdknoa32.dll	Njacpf32.exe
File opened for modification	C:\Windows\SysWOW64\Nkqpjidj.exe	Ndghmo32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3412	2500	WerFault.exe	88

Modifies registry class 30 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nkqpjidj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnibdpde.dll"	Nqmhbpba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	1742b7ea87ca59699429c850a7fb4d90_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nceonl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmalco32.dll"	Nceonl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nnjbke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nnjbke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogpnaafp.dll"	Ndghmo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nceonl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nqiogp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	1742b7ea87ca59699429c850a7fb4d90_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	1742b7ea87ca59699429c850a7fb4d90_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fcdjjo32.dll"	Nnhfee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pponmema.dll"	Nnjbke32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	1742b7ea87ca59699429c850a7fb4d90_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ndghmo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nqmhbpba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlmobp32.dll"	1742b7ea87ca59699429c850a7fb4d90_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Njacpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ndghmo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bghhihab.dll"	Nkqpjidj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	1742b7ea87ca59699429c850a7fb4d90_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nnhfee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nqiogp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Njacpf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nnhfee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bdknoa32.dll"	Njacpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nqmhbpba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lmbnpm32.dll"	Nqiogp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nkqpjidj.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 4612 wrote to memory of 4840	4612	1742b7ea87ca59699429c850a7fb4d90_NeikiAnalytics.exe	80
PID 4612 wrote to memory of 4840	4612	1742b7ea87ca59699429c850a7fb4d90_NeikiAnalytics.exe	80
PID 4612 wrote to memory of 4840	4612	1742b7ea87ca59699429c850a7fb4d90_NeikiAnalytics.exe	80
PID 4840 wrote to memory of 1544	4840	Nnhfee32.exe	81
PID 4840 wrote to memory of 1544	4840	Nnhfee32.exe	81
PID 4840 wrote to memory of 1544	4840	Nnhfee32.exe	81
PID 1544 wrote to memory of 1956	1544	Nceonl32.exe	82
PID 1544 wrote to memory of 1956	1544	Nceonl32.exe	82
PID 1544 wrote to memory of 1956	1544	Nceonl32.exe	82
PID 1956 wrote to memory of 4100	1956	Nnjbke32.exe	83
PID 1956 wrote to memory of 4100	1956	Nnjbke32.exe	83
PID 1956 wrote to memory of 4100	1956	Nnjbke32.exe	83
PID 4100 wrote to memory of 2852	4100	Nqiogp32.exe	84
PID 4100 wrote to memory of 2852	4100	Nqiogp32.exe	84
PID 4100 wrote to memory of 2852	4100	Nqiogp32.exe	84
PID 2852 wrote to memory of 2880	2852	Njacpf32.exe	85
PID 2852 wrote to memory of 2880	2852	Njacpf32.exe	85
PID 2852 wrote to memory of 2880	2852	Njacpf32.exe	85
PID 2880 wrote to memory of 680	2880	Ndghmo32.exe	86
PID 2880 wrote to memory of 680	2880	Ndghmo32.exe	86
PID 2880 wrote to memory of 680	2880	Ndghmo32.exe	86
PID 680 wrote to memory of 3712	680	Nkqpjidj.exe	87
PID 680 wrote to memory of 3712	680	Nkqpjidj.exe	87
PID 680 wrote to memory of 3712	680	Nkqpjidj.exe	87
PID 3712 wrote to memory of 2500	3712	Nqmhbpba.exe	88
PID 3712 wrote to memory of 2500	3712	Nqmhbpba.exe	88
PID 3712 wrote to memory of 2500	3712	Nqmhbpba.exe	88

C:\Users\Admin\AppData\Local\Temp\1742b7ea87ca59699429c850a7fb4d90_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\1742b7ea87ca59699429c850a7fb4d90_NeikiAnalytics.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4612
- C:\Windows\SysWOW64\Nnhfee32.exe
  C:\Windows\system32\Nnhfee32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4840
- - C:\Windows\SysWOW64\Nceonl32.exe
    C:\Windows\system32\Nceonl32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1544
  - - C:\Windows\SysWOW64\Nnjbke32.exe
      C:\Windows\system32\Nnjbke32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:1956
    - - C:\Windows\SysWOW64\Nqiogp32.exe
        
        C:\Windows\system32\Nqiogp32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4100
      - C:\Windows\SysWOW64\Njacpf32.exe
        
        C:\Windows\system32\Njacpf32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2852
        
        C:\Windows\SysWOW64\Ndghmo32.exe
        
        C:\Windows\system32\Ndghmo32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2880
        
        C:\Windows\SysWOW64\Nkqpjidj.exe
        
        C:\Windows\system32\Nkqpjidj.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:680
        
        C:\Windows\SysWOW64\Nqmhbpba.exe
        
        C:\Windows\system32\Nqmhbpba.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3712
        
        C:\Windows\SysWOW64\Nkcmohbg.exe
        
        C:\Windows\system32\Nkcmohbg.exe
        10⤵
        Executes dropped EXE
        
        PID:2500
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2500 -s 400
        11⤵
        Program crash
        
        PID:3412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2500 -ip 2500
1⤵
PID:4808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Nceonl32.exe

Path C:\Windows\SysWOW64\Nceonl32.exe
Size 199KB
SHA256 f1dcc6d5dda43f09de7583584d875254321b489d956366cafe43ee57185b8378
MD5 55f0781fb3db432374bff970ebdfda02
SHA1 64f6cf99fbadf84607c54c601b31067a7042b49d
SHA512 69fc56ef97aa9e5a1c31514aefde547757380ad3fc3b8a1cefe40f3e70b1adeb911e814abdab01fa9dc0b54893ddbe3b7750688151431840395a2cba2d27c1c4
SSDEEP 3072:J9zRYyW8bcCS5DSCopsIm81+jq2832dp5Xp+7+10K03Rq/ghavVQXxFaPsRbh:B9bcCSZSCZj81+jq4peBK034YOmFz1h
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ndghmo32.exe

Path C:\Windows\SysWOW64\Ndghmo32.exe
Size 199KB
SHA256 2b9b69cc9b87ee477e6c65a6fde6407ad334b321d0ae09cacca2568c6768cc26
MD5 457aa9cb3ef2a040cc2abb98f373612f
SHA1 1a19f3a65a797d01a7f5f08143264afa2f72d23e
SHA512 f8027c9bef50462d64bf6bc52fe4852d522b6f7b2188716d342c02b0c838a2113444b39712c7a359256afa9dc3db72e192c83a87f02a563e98767d051488155b
SSDEEP 6144:W/OcIJLAVSZSCZj81+jq4peBK034YOmFz1h:tBZSCG1+jheBbOmFxh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Njacpf32.exe

Path C:\Windows\SysWOW64\Njacpf32.exe
Size 199KB
SHA256 394b12682b105cd253cd4addd173527a11c629bd74c7f5645f9ade4a4d00a9ea
MD5 b736b830eaabcd5e72b7c68aef5a64f1
SHA1 fedf6bdd87059f991f66c4308d71ce67a64f95eb
SHA512 41b1bfd02e500fec4a137e179762f2524175ceece1b326736b355d9327c5c3e105d38441fec96f3321550e5c27f26a40d3b6b1aaf53771d83be07679e2d7f1f8
SSDEEP 6144:RK/VeQTIijaSZSCZj81+jq4peBK034YOmFz1h:RK9/TIi7ZSCG1+jheBbOmFxh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nkcmohbg.exe

Path C:\Windows\SysWOW64\Nkcmohbg.exe
Size 199KB
SHA256 cd27fcdad90a4156f232aa0306305f5ca19998135f8de9768a3fe5d098296dc5
MD5 dff7773706788b3875272229bd803c7e
SHA1 8d611f196c9431f903a3522c4ff97885fb7e4677
SHA512 4448580cf37b7ce0e255e9046f86fa3766a301c4602b2146c3f1155634b651d02681c918e81cba76e7e1b54a279c1625f408a28298f132970b1cdb2375f2e5c5
SSDEEP 6144:qcLEGazSZSCZj81+jq4peBK034YOmFz1h:qcAGTZSCG1+jheBbOmFxh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nkqpjidj.exe

Path C:\Windows\SysWOW64\Nkqpjidj.exe
Size 199KB
SHA256 8e36da2d53443e4dc86505b0fa759c44451d28f6d9f32bcdd46bce03d7a6d45a
MD5 6c3efc5dc2dc240b5984dea75ad22025
SHA1 4c075a83345e1b9ceefcd14d51f817d4cb93fd50
SHA512 f2bd02d041f53cc0d8a6c268c74e653c46a8b830e851c1429b563c6398a2b50c1157779bf246a290e499d79da52b0170f1ffd6898e5b2e821c124f35106fc493
SSDEEP 6144:gcR6tiTiCSZSCZj81+jq4peBK034YOmFz1h:gW6tpZSCG1+jheBbOmFxh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nnhfee32.exe

Path C:\Windows\SysWOW64\Nnhfee32.exe
Size 199KB
SHA256 79c1e0e00272176bfcc6170b8fa4f0cc2d40b2dfb1bb81fa9f89dfd0dfea7010
MD5 402641ac45922ab2c64462d617105dbc
SHA1 37c9c7cc01f1bc3a9b6615cc6c63f38d55a332c8
SHA512 9e0bca3e0c6894d6d2232afa9a0c4b547507d520f5c47541fb1433ca914124b5b551eaf947c1a21645f0c6058df7bd55cf4c22815fa844fafd67afee998e6f5b
SSDEEP 6144:uw4zK0fvSZSCZj81+jq4peBK034YOmFz1h:uw4UZSCG1+jheBbOmFxh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nnjbke32.exe

Path C:\Windows\SysWOW64\Nnjbke32.exe
Size 199KB
SHA256 3d81c14f52f68f802152ea888a92f3bc9e0029a3b654a81d67088d9a819c171b
MD5 1bfef0dd1701b31a9b833d2eb2d95297
SHA1 22ee6986c14b26b462f5b4ec48c7f7c435ffae27
SHA512 af3aa16126c4a48ac508ddfe55080bab6da69b30588c3468832cd1898d803d6a4d61055deec9f581f1c0097a7bb675e5d27b5fa1cd3bf1ec2684d3ba92472dc9
SSDEEP 3072:QmCLOGSvYsptS5DSCopsIm81+jq2832dp5Xp+7+10K03Rq/ghavVQXxFaPsRbh:XCGtSZSCZj81+jq4peBK034YOmFz1h
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nqiogp32.exe

Path C:\Windows\SysWOW64\Nqiogp32.exe
Size 199KB
SHA256 5a3bf6153168ccde3dd17cc5396a0f02faa49dc8a2ec6dceebedaeb1e35a4fbb
MD5 d6a0f4ade58c111f58f1228edfc5b75a
SHA1 6079843a0c6635f3965ab8be2e38c33b2b978cef
SHA512 971039c2903333425238cfa781ac54092cb44d75b431ab122fa747f5acb0244cfa91b75ef11a3c9956b53093b57f44297551c3bb6d0474e9b79a1b18f7a2c69e
SSDEEP 6144:c6UvHUdFSZSCZj81+jq4peBK034YOmFz1h:QbZSCG1+jheBbOmFxh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nqmhbpba.exe

Path C:\Windows\SysWOW64\Nqmhbpba.exe
Size 199KB
SHA256 ac6b952b77393ac125517c13982beb023e406fb85d413c828cf1d13956e9a671
MD5 d68c21adce09e428fcc4dcc86f62c60d
SHA1 6fe94eba0111570c9dfafafcb552ffb189f50bb8
SHA512 3be43ed7cc5abdb9ed30e787ebd0774e18a30e6853589311eef8d40ede240c5be7041a55452a4d5aed692aba932c6ee59f17549c3fec40c5ef2a0f6121370091
SSDEEP 6144:WXT4tuTSZSCZj81+jq4peBK034YOmFz1h:WXUxZSCG1+jheBbOmFxh
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/680-56-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/680-77-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1544-17-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1544-81-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1956-80-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1956-25-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2500-74-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2500-72-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2852-41-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2852-79-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2880-48-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2880-76-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3712-64-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3712-75-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4100-78-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4100-33-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4612-5-0x0000000000431000-0x0000000000432000-memory.dmp

Download

memory/4612-83-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4612-0-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4840-82-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4840-8-0x0000000000400000-0x000000000043E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads