description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	ixloden-for.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	ixloden-for.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	ixloden-for.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	ixloden-for.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4748505A-5247-4643-4748-505A52474643}	ixloden-for.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4748505A-5247-4643-4748-505A52474643}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a"	ixloden-for.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4748505A-5247-4643-4748-505A52474643}\IsInstalled = "1"	ixloden-for.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4748505A-5247-4643-4748-505A52474643}\StubPath = "C:\\Windows\\system32\\ounrigoap.exe"	ixloden-for.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe	ixloden-for.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a"	ixloden-for.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\eacheaxeak.exe"	ixloden-for.exe

pid	Process
1804	55c0af260d6707b8522bddb917281430_NeikiAnalytics.exe
1804	55c0af260d6707b8522bddb917281430_NeikiAnalytics.exe
2064	ixloden-for.exe

description	ioc	Process
File created	C:\Windows\SysWOW64\ixloden-for.exe	55c0af260d6707b8522bddb917281430_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\eacheaxeak.exe	ixloden-for.exe
File created	C:\Windows\SysWOW64\ounrigoap.exe	ixloden-for.exe
File created	C:\Windows\SysWOW64\etgosag-eteas.dll	ixloden-for.exe
File opened for modification	C:\Windows\SysWOW64\ixloden-for.exe	55c0af260d6707b8522bddb917281430_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\eacheaxeak.exe	ixloden-for.exe
File opened for modification	C:\Windows\SysWOW64\ounrigoap.exe	ixloden-for.exe
File opened for modification	C:\Windows\SysWOW64\etgosag-eteas.dll	ixloden-for.exe
File opened for modification	C:\Windows\SysWOW64\ixloden-for.exe	ixloden-for.exe

description	pid	Process
Token: SeDebugPrivilege	1804	55c0af260d6707b8522bddb917281430_NeikiAnalytics.exe
Token: SeDebugPrivilege	2064	ixloden-for.exe

description	pid	Process	procid_target
PID 1804 wrote to memory of 2064	1804	55c0af260d6707b8522bddb917281430_NeikiAnalytics.exe	28
PID 1804 wrote to memory of 2064	1804	55c0af260d6707b8522bddb917281430_NeikiAnalytics.exe	28
PID 1804 wrote to memory of 2064	1804	55c0af260d6707b8522bddb917281430_NeikiAnalytics.exe	28
PID 1804 wrote to memory of 2064	1804	55c0af260d6707b8522bddb917281430_NeikiAnalytics.exe	28
PID 2064 wrote to memory of 436	2064	ixloden-for.exe	5
PID 2064 wrote to memory of 1240	2064	ixloden-for.exe	21
PID 2064 wrote to memory of 1240	2064	ixloden-for.exe	21
PID 2064 wrote to memory of 1116	2064	ixloden-for.exe	29
PID 2064 wrote to memory of 1116	2064	ixloden-for.exe	29
PID 2064 wrote to memory of 1116	2064	ixloden-for.exe	29
PID 2064 wrote to memory of 1116	2064	ixloden-for.exe	29
PID 2064 wrote to memory of 1240	2064	ixloden-for.exe	21
PID 2064 wrote to memory of 1240	2064	ixloden-for.exe	21
PID 2064 wrote to memory of 1240	2064	ixloden-for.exe	21
PID 2064 wrote to memory of 1240	2064	ixloden-for.exe	21
PID 2064 wrote to memory of 1240	2064	ixloden-for.exe	21
PID 2064 wrote to memory of 1240	2064	ixloden-for.exe	21
PID 2064 wrote to memory of 1240	2064	ixloden-for.exe	21
PID 2064 wrote to memory of 1240	2064	ixloden-for.exe	21
PID 2064 wrote to memory of 1240	2064	ixloden-for.exe	21
PID 2064 wrote to memory of 1240	2064	ixloden-for.exe	21
PID 2064 wrote to memory of 1240	2064	ixloden-for.exe	21
PID 2064 wrote to memory of 1240	2064	ixloden-for.exe	21
PID 2064 wrote to memory of 1240	2064	ixloden-for.exe	21
PID 2064 wrote to memory of 1240	2064	ixloden-for.exe	21
PID 2064 wrote to memory of 1240	2064	ixloden-for.exe	21
PID 2064 wrote to memory of 1240	2064	ixloden-for.exe	21
PID 2064 wrote to memory of 1240	2064	ixloden-for.exe	21
PID 2064 wrote to memory of 1240	2064	ixloden-for.exe	21
PID 2064 wrote to memory of 1240	2064	ixloden-for.exe	21
PID 2064 wrote to memory of 1240	2064	ixloden-for.exe	21
PID 2064 wrote to memory of 1240	2064	ixloden-for.exe	21
PID 2064 wrote to memory of 1240	2064	ixloden-for.exe	21
PID 2064 wrote to memory of 1240	2064	ixloden-for.exe	21
PID 2064 wrote to memory of 1240	2064	ixloden-for.exe	21
PID 2064 wrote to memory of 1240	2064	ixloden-for.exe	21
PID 2064 wrote to memory of 1240	2064	ixloden-for.exe	21
PID 2064 wrote to memory of 1240	2064	ixloden-for.exe	21
PID 2064 wrote to memory of 1240	2064	ixloden-for.exe	21
PID 2064 wrote to memory of 1240	2064	ixloden-for.exe	21
PID 2064 wrote to memory of 1240	2064	ixloden-for.exe	21
PID 2064 wrote to memory of 1240	2064	ixloden-for.exe	21
PID 2064 wrote to memory of 1240	2064	ixloden-for.exe	21
PID 2064 wrote to memory of 1240	2064	ixloden-for.exe	21
PID 2064 wrote to memory of 1240	2064	ixloden-for.exe	21
PID 2064 wrote to memory of 1240	2064	ixloden-for.exe	21
PID 2064 wrote to memory of 1240	2064	ixloden-for.exe	21
PID 2064 wrote to memory of 1240	2064	ixloden-for.exe	21
PID 2064 wrote to memory of 1240	2064	ixloden-for.exe	21
PID 2064 wrote to memory of 1240	2064	ixloden-for.exe	21
PID 2064 wrote to memory of 1240	2064	ixloden-for.exe	21
PID 2064 wrote to memory of 1240	2064	ixloden-for.exe	21
PID 2064 wrote to memory of 1240	2064	ixloden-for.exe	21
PID 2064 wrote to memory of 1240	2064	ixloden-for.exe	21
PID 2064 wrote to memory of 1240	2064	ixloden-for.exe	21
PID 2064 wrote to memory of 1240	2064	ixloden-for.exe	21
PID 2064 wrote to memory of 1240	2064	ixloden-for.exe	21
PID 2064 wrote to memory of 1240	2064	ixloden-for.exe	21
PID 2064 wrote to memory of 1240	2064	ixloden-for.exe	21
PID 2064 wrote to memory of 1240	2064	ixloden-for.exe	21
PID 2064 wrote to memory of 1240	2064	ixloden-for.exe	21
PID 2064 wrote to memory of 1240	2064	ixloden-for.exe	21
PID 2064 wrote to memory of 1240	2064	ixloden-for.exe	21
PID 2064 wrote to memory of 1240	2064	ixloden-for.exe	21

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.