Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
15/05/2024, 03:09
Static task
static1
Behavioral task
behavioral1
Sample
6cb62e334dc2c2325c9d98691f0be8d0_NeikiAnalytics.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
6cb62e334dc2c2325c9d98691f0be8d0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
6cb62e334dc2c2325c9d98691f0be8d0_NeikiAnalytics.exe
-
Size
124KB
-
MD5
6cb62e334dc2c2325c9d98691f0be8d0
-
SHA1
a42fde65ba94f9be9bc0cdf8e002cc2e032ad504
-
SHA256
e5caa697b96ff1c27be55eb8b6cc0e03d14816c821ce952a200210f032d601cd
-
SHA512
0a015243530cbfb15503c40f4709dd682adeee13869ac43a66a2846e3d9f3a55379e9ec7ee09b9732d6252619cfa2f7ff0bf66872b50331c93bf1f3aedcd77c0
-
SSDEEP
1536:A/bszV5YGhRO/N69BH3OoGa+FL9jKceRgrkjSo3E:cGzYGhkFoN3Oo1+F92SP
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 47 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" soihuc.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" leuren.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" jeute.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" kiiubin.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" zeeege.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" nuohuj.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" guwet.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" meiri.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 6cb62e334dc2c2325c9d98691f0be8d0_NeikiAnalytics.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" kueraig.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" cuule.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" liopiuw.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" voaoraw.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" yeuan.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" khfauq.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" wiiiwu.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" baahi.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" duomok.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" suamea.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" xaohiit.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" wrnod.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" kuauso.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" luiezer.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" naeujat.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" buiesu.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ceiiwu.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" dicoq.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" qeojaw.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" wiiwiih.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" voeelox.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ceimoes.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" vkciz.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" kiuqoez.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" danit.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" laejouc.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" laxes.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" seiji.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" woesae.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" fiuay.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" fzjid.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" vekuw.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" qaexia.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" neaiq.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" jautaa.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" keumod.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" puiawi.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" qaaeh.exe -
Executes dropped EXE 47 IoCs
pid Process 3008 buiesu.exe 2740 jautaa.exe 2524 baahi.exe 2108 duomok.exe 1440 ceiiwu.exe 2376 leuren.exe 872 dicoq.exe 1340 kueraig.exe 2888 jeute.exe 1088 suamea.exe 1044 qeojaw.exe 952 yeuan.exe 2840 xaohiit.exe 1272 wiiwiih.exe 1940 fzjid.exe 1964 wrnod.exe 2820 keumod.exe 2736 laxes.exe 1908 seiji.exe 2456 cuule.exe 1868 puiawi.exe 2128 voeelox.exe 2900 kuauso.exe 536 vekuw.exe 540 kiiubin.exe 3000 zeeege.exe 916 ceimoes.exe 1948 naeujat.exe 2600 nuohuj.exe 712 luiezer.exe 376 wiiiwu.exe 2400 guwet.exe 1612 qaaeh.exe 1228 liopiuw.exe 548 khfauq.exe 112 woesae.exe 1856 vkciz.exe 2940 qaexia.exe 2316 fiuay.exe 1164 neaiq.exe 1724 kiuqoez.exe 2988 danit.exe 2520 meiri.exe 1168 voaoraw.exe 1644 soihuc.exe 1632 laejouc.exe 108 hnzuef.exe -
Loads dropped DLL 64 IoCs
pid Process 1576 6cb62e334dc2c2325c9d98691f0be8d0_NeikiAnalytics.exe 1576 6cb62e334dc2c2325c9d98691f0be8d0_NeikiAnalytics.exe 3008 buiesu.exe 3008 buiesu.exe 2740 jautaa.exe 2740 jautaa.exe 2524 baahi.exe 2524 baahi.exe 2108 duomok.exe 2108 duomok.exe 1440 ceiiwu.exe 1440 ceiiwu.exe 2376 leuren.exe 2376 leuren.exe 872 dicoq.exe 872 dicoq.exe 1340 kueraig.exe 1340 kueraig.exe 2888 jeute.exe 2888 jeute.exe 1088 suamea.exe 1088 suamea.exe 1044 qeojaw.exe 1044 qeojaw.exe 952 yeuan.exe 952 yeuan.exe 2840 xaohiit.exe 2840 xaohiit.exe 1272 wiiwiih.exe 1272 wiiwiih.exe 1940 fzjid.exe 1940 fzjid.exe 1964 wrnod.exe 1964 wrnod.exe 2820 keumod.exe 2820 keumod.exe 2736 laxes.exe 2736 laxes.exe 1908 seiji.exe 1908 seiji.exe 2456 cuule.exe 2456 cuule.exe 1868 puiawi.exe 1868 puiawi.exe 2128 voeelox.exe 2128 voeelox.exe 2900 kuauso.exe 2900 kuauso.exe 536 vekuw.exe 536 vekuw.exe 540 kiiubin.exe 540 kiiubin.exe 3000 zeeege.exe 3000 zeeege.exe 916 ceimoes.exe 916 ceimoes.exe 1948 naeujat.exe 1948 naeujat.exe 2600 nuohuj.exe 2600 nuohuj.exe 712 luiezer.exe 712 luiezer.exe 376 wiiiwu.exe 376 wiiiwu.exe -
Adds Run key to start application 2 TTPs 47 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceiiwu = "C:\\Users\\Admin\\ceiiwu.exe /N" duomok.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\jeute = "C:\\Users\\Admin\\jeute.exe /o" kueraig.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\wrnod = "C:\\Users\\Admin\\wrnod.exe /v" fzjid.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\seiji = "C:\\Users\\Admin\\seiji.exe /C" laxes.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\vekuw = "C:\\Users\\Admin\\vekuw.exe /i" kuauso.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuohuj = "C:\\Users\\Admin\\nuohuj.exe /x" naeujat.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\qaexia = "C:\\Users\\Admin\\qaexia.exe /y" vkciz.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\buiesu = "C:\\Users\\Admin\\buiesu.exe /l" 6cb62e334dc2c2325c9d98691f0be8d0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\dicoq = "C:\\Users\\Admin\\dicoq.exe /G" leuren.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiiwiih = "C:\\Users\\Admin\\wiiwiih.exe /R" xaohiit.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeeege = "C:\\Users\\Admin\\zeeege.exe /f" kiiubin.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\luiezer = "C:\\Users\\Admin\\luiezer.exe /g" nuohuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\laejouc = "C:\\Users\\Admin\\laejouc.exe /O" soihuc.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\duomok = "C:\\Users\\Admin\\duomok.exe /I" baahi.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiiiwu = "C:\\Users\\Admin\\wiiiwu.exe /E" luiezer.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\woesae = "C:\\Users\\Admin\\woesae.exe /U" khfauq.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\hnzuef = "C:\\Users\\Admin\\hnzuef.exe /u" laejouc.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\keumod = "C:\\Users\\Admin\\keumod.exe /A" wrnod.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\voeelox = "C:\\Users\\Admin\\voeelox.exe /K" puiawi.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\suamea = "C:\\Users\\Admin\\suamea.exe /k" jeute.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeojaw = "C:\\Users\\Admin\\qeojaw.exe /A" suamea.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\xaohiit = "C:\\Users\\Admin\\xaohiit.exe /X" yeuan.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\fzjid = "C:\\Users\\Admin\\fzjid.exe /j" wiiwiih.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\qaaeh = "C:\\Users\\Admin\\qaaeh.exe /x" guwet.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\liopiuw = "C:\\Users\\Admin\\liopiuw.exe /x" qaaeh.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\kiuqoez = "C:\\Users\\Admin\\kiuqoez.exe /f" neaiq.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\soihuc = "C:\\Users\\Admin\\soihuc.exe /g" voaoraw.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeuan = "C:\\Users\\Admin\\yeuan.exe /K" qeojaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\kuauso = "C:\\Users\\Admin\\kuauso.exe /f" voeelox.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\khfauq = "C:\\Users\\Admin\\khfauq.exe /Q" liopiuw.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\fiuay = "C:\\Users\\Admin\\fiuay.exe /l" qaexia.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\danit = "C:\\Users\\Admin\\danit.exe /L" kiuqoez.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\baahi = "C:\\Users\\Admin\\baahi.exe /s" jautaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\leuren = "C:\\Users\\Admin\\leuren.exe /R" ceiiwu.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\laxes = "C:\\Users\\Admin\\laxes.exe /e" keumod.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\kiiubin = "C:\\Users\\Admin\\kiiubin.exe /w" vekuw.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceimoes = "C:\\Users\\Admin\\ceimoes.exe /e" zeeege.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\vkciz = "C:\\Users\\Admin\\vkciz.exe /H" woesae.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\jautaa = "C:\\Users\\Admin\\jautaa.exe /P" buiesu.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\kueraig = "C:\\Users\\Admin\\kueraig.exe /M" dicoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuule = "C:\\Users\\Admin\\cuule.exe /B" seiji.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\puiawi = "C:\\Users\\Admin\\puiawi.exe /s" cuule.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\naeujat = "C:\\Users\\Admin\\naeujat.exe /y" ceimoes.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\guwet = "C:\\Users\\Admin\\guwet.exe /w" wiiiwu.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\neaiq = "C:\\Users\\Admin\\neaiq.exe /b" fiuay.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\meiri = "C:\\Users\\Admin\\meiri.exe /J" danit.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\voaoraw = "C:\\Users\\Admin\\voaoraw.exe /Y" meiri.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 47 IoCs
pid Process 1576 6cb62e334dc2c2325c9d98691f0be8d0_NeikiAnalytics.exe 3008 buiesu.exe 2740 jautaa.exe 2524 baahi.exe 2108 duomok.exe 1440 ceiiwu.exe 2376 leuren.exe 872 dicoq.exe 1340 kueraig.exe 2888 jeute.exe 1088 suamea.exe 1044 qeojaw.exe 952 yeuan.exe 2840 xaohiit.exe 1272 wiiwiih.exe 1940 fzjid.exe 1964 wrnod.exe 2820 keumod.exe 2736 laxes.exe 1908 seiji.exe 2456 cuule.exe 1868 puiawi.exe 2128 voeelox.exe 2900 kuauso.exe 536 vekuw.exe 540 kiiubin.exe 3000 zeeege.exe 916 ceimoes.exe 1948 naeujat.exe 2600 nuohuj.exe 712 luiezer.exe 376 wiiiwu.exe 2400 guwet.exe 1612 qaaeh.exe 1228 liopiuw.exe 548 khfauq.exe 112 woesae.exe 1856 vkciz.exe 2940 qaexia.exe 2316 fiuay.exe 1164 neaiq.exe 1724 kiuqoez.exe 2988 danit.exe 2520 meiri.exe 1168 voaoraw.exe 1644 soihuc.exe 1632 laejouc.exe -
Suspicious use of SetWindowsHookEx 48 IoCs
pid Process 1576 6cb62e334dc2c2325c9d98691f0be8d0_NeikiAnalytics.exe 3008 buiesu.exe 2740 jautaa.exe 2524 baahi.exe 2108 duomok.exe 1440 ceiiwu.exe 2376 leuren.exe 872 dicoq.exe 1340 kueraig.exe 2888 jeute.exe 1088 suamea.exe 1044 qeojaw.exe 952 yeuan.exe 2840 xaohiit.exe 1272 wiiwiih.exe 1940 fzjid.exe 1964 wrnod.exe 2820 keumod.exe 2736 laxes.exe 1908 seiji.exe 2456 cuule.exe 1868 puiawi.exe 2128 voeelox.exe 2900 kuauso.exe 536 vekuw.exe 540 kiiubin.exe 3000 zeeege.exe 916 ceimoes.exe 1948 naeujat.exe 2600 nuohuj.exe 712 luiezer.exe 376 wiiiwu.exe 2400 guwet.exe 1612 qaaeh.exe 1228 liopiuw.exe 548 khfauq.exe 112 woesae.exe 1856 vkciz.exe 2940 qaexia.exe 2316 fiuay.exe 1164 neaiq.exe 1724 kiuqoez.exe 2988 danit.exe 2520 meiri.exe 1168 voaoraw.exe 1644 soihuc.exe 1632 laejouc.exe 108 hnzuef.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1576 wrote to memory of 3008 1576 6cb62e334dc2c2325c9d98691f0be8d0_NeikiAnalytics.exe 28 PID 1576 wrote to memory of 3008 1576 6cb62e334dc2c2325c9d98691f0be8d0_NeikiAnalytics.exe 28 PID 1576 wrote to memory of 3008 1576 6cb62e334dc2c2325c9d98691f0be8d0_NeikiAnalytics.exe 28 PID 1576 wrote to memory of 3008 1576 6cb62e334dc2c2325c9d98691f0be8d0_NeikiAnalytics.exe 28 PID 3008 wrote to memory of 2740 3008 buiesu.exe 29 PID 3008 wrote to memory of 2740 3008 buiesu.exe 29 PID 3008 wrote to memory of 2740 3008 buiesu.exe 29 PID 3008 wrote to memory of 2740 3008 buiesu.exe 29 PID 2740 wrote to memory of 2524 2740 jautaa.exe 30 PID 2740 wrote to memory of 2524 2740 jautaa.exe 30 PID 2740 wrote to memory of 2524 2740 jautaa.exe 30 PID 2740 wrote to memory of 2524 2740 jautaa.exe 30 PID 2524 wrote to memory of 2108 2524 baahi.exe 31 PID 2524 wrote to memory of 2108 2524 baahi.exe 31 PID 2524 wrote to memory of 2108 2524 baahi.exe 31 PID 2524 wrote to memory of 2108 2524 baahi.exe 31 PID 2108 wrote to memory of 1440 2108 duomok.exe 32 PID 2108 wrote to memory of 1440 2108 duomok.exe 32 PID 2108 wrote to memory of 1440 2108 duomok.exe 32 PID 2108 wrote to memory of 1440 2108 duomok.exe 32 PID 1440 wrote to memory of 2376 1440 ceiiwu.exe 33 PID 1440 wrote to memory of 2376 1440 ceiiwu.exe 33 PID 1440 wrote to memory of 2376 1440 ceiiwu.exe 33 PID 1440 wrote to memory of 2376 1440 ceiiwu.exe 33 PID 2376 wrote to memory of 872 2376 leuren.exe 34 PID 2376 wrote to memory of 872 2376 leuren.exe 34 PID 2376 wrote to memory of 872 2376 leuren.exe 34 PID 2376 wrote to memory of 872 2376 leuren.exe 34 PID 872 wrote to memory of 1340 872 dicoq.exe 35 PID 872 wrote to memory of 1340 872 dicoq.exe 35 PID 872 wrote to memory of 1340 872 dicoq.exe 35 PID 872 wrote to memory of 1340 872 dicoq.exe 35 PID 1340 wrote to memory of 2888 1340 kueraig.exe 36 PID 1340 wrote to memory of 2888 1340 kueraig.exe 36 PID 1340 wrote to memory of 2888 1340 kueraig.exe 36 PID 1340 wrote to memory of 2888 1340 kueraig.exe 36 PID 2888 wrote to memory of 1088 2888 jeute.exe 37 PID 2888 wrote to memory of 1088 2888 jeute.exe 37 PID 2888 wrote to memory of 1088 2888 jeute.exe 37 PID 2888 wrote to memory of 1088 2888 jeute.exe 37 PID 1088 wrote to memory of 1044 1088 suamea.exe 38 PID 1088 wrote to memory of 1044 1088 suamea.exe 38 PID 1088 wrote to memory of 1044 1088 suamea.exe 38 PID 1088 wrote to memory of 1044 1088 suamea.exe 38 PID 1044 wrote to memory of 952 1044 qeojaw.exe 39 PID 1044 wrote to memory of 952 1044 qeojaw.exe 39 PID 1044 wrote to memory of 952 1044 qeojaw.exe 39 PID 1044 wrote to memory of 952 1044 qeojaw.exe 39 PID 952 wrote to memory of 2840 952 yeuan.exe 40 PID 952 wrote to memory of 2840 952 yeuan.exe 40 PID 952 wrote to memory of 2840 952 yeuan.exe 40 PID 952 wrote to memory of 2840 952 yeuan.exe 40 PID 2840 wrote to memory of 1272 2840 xaohiit.exe 41 PID 2840 wrote to memory of 1272 2840 xaohiit.exe 41 PID 2840 wrote to memory of 1272 2840 xaohiit.exe 41 PID 2840 wrote to memory of 1272 2840 xaohiit.exe 41 PID 1272 wrote to memory of 1940 1272 wiiwiih.exe 44 PID 1272 wrote to memory of 1940 1272 wiiwiih.exe 44 PID 1272 wrote to memory of 1940 1272 wiiwiih.exe 44 PID 1272 wrote to memory of 1940 1272 wiiwiih.exe 44 PID 1940 wrote to memory of 1964 1940 fzjid.exe 45 PID 1940 wrote to memory of 1964 1940 fzjid.exe 45 PID 1940 wrote to memory of 1964 1940 fzjid.exe 45 PID 1940 wrote to memory of 1964 1940 fzjid.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\6cb62e334dc2c2325c9d98691f0be8d0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\6cb62e334dc2c2325c9d98691f0be8d0_NeikiAnalytics.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Users\Admin\buiesu.exe"C:\Users\Admin\buiesu.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\jautaa.exe"C:\Users\Admin\jautaa.exe"3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\baahi.exe"C:\Users\Admin\baahi.exe"4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\duomok.exe"C:\Users\Admin\duomok.exe"5⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Users\Admin\ceiiwu.exe"C:\Users\Admin\ceiiwu.exe"6⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Users\Admin\leuren.exe"C:\Users\Admin\leuren.exe"7⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\dicoq.exe"C:\Users\Admin\dicoq.exe"8⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Users\Admin\kueraig.exe"C:\Users\Admin\kueraig.exe"9⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Users\Admin\jeute.exe"C:\Users\Admin\jeute.exe"10⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\suamea.exe"C:\Users\Admin\suamea.exe"11⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Users\Admin\qeojaw.exe"C:\Users\Admin\qeojaw.exe"12⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Users\Admin\yeuan.exe"C:\Users\Admin\yeuan.exe"13⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Users\Admin\xaohiit.exe"C:\Users\Admin\xaohiit.exe"14⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\wiiwiih.exe"C:\Users\Admin\wiiwiih.exe"15⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Users\Admin\fzjid.exe"C:\Users\Admin\fzjid.exe"16⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Users\Admin\wrnod.exe"C:\Users\Admin\wrnod.exe"17⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1964 -
C:\Users\Admin\keumod.exe"C:\Users\Admin\keumod.exe"18⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2820 -
C:\Users\Admin\laxes.exe"C:\Users\Admin\laxes.exe"19⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2736 -
C:\Users\Admin\seiji.exe"C:\Users\Admin\seiji.exe"20⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1908 -
C:\Users\Admin\cuule.exe"C:\Users\Admin\cuule.exe"21⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2456 -
C:\Users\Admin\puiawi.exe"C:\Users\Admin\puiawi.exe"22⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1868 -
C:\Users\Admin\voeelox.exe"C:\Users\Admin\voeelox.exe"23⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2128 -
C:\Users\Admin\kuauso.exe"C:\Users\Admin\kuauso.exe"24⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2900 -
C:\Users\Admin\vekuw.exe"C:\Users\Admin\vekuw.exe"25⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:536 -
C:\Users\Admin\kiiubin.exe"C:\Users\Admin\kiiubin.exe"26⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:540 -
C:\Users\Admin\zeeege.exe"C:\Users\Admin\zeeege.exe"27⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3000 -
C:\Users\Admin\ceimoes.exe"C:\Users\Admin\ceimoes.exe"28⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:916 -
C:\Users\Admin\naeujat.exe"C:\Users\Admin\naeujat.exe"29⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1948 -
C:\Users\Admin\nuohuj.exe"C:\Users\Admin\nuohuj.exe"30⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2600 -
C:\Users\Admin\luiezer.exe"C:\Users\Admin\luiezer.exe"31⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:712 -
C:\Users\Admin\wiiiwu.exe"C:\Users\Admin\wiiiwu.exe"32⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:376 -
C:\Users\Admin\guwet.exe"C:\Users\Admin\guwet.exe"33⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2400 -
C:\Users\Admin\qaaeh.exe"C:\Users\Admin\qaaeh.exe"34⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1612 -
C:\Users\Admin\liopiuw.exe"C:\Users\Admin\liopiuw.exe"35⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1228 -
C:\Users\Admin\khfauq.exe"C:\Users\Admin\khfauq.exe"36⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:548 -
C:\Users\Admin\woesae.exe"C:\Users\Admin\woesae.exe"37⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:112 -
C:\Users\Admin\vkciz.exe"C:\Users\Admin\vkciz.exe"38⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1856 -
C:\Users\Admin\qaexia.exe"C:\Users\Admin\qaexia.exe"39⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2940 -
C:\Users\Admin\fiuay.exe"C:\Users\Admin\fiuay.exe"40⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2316 -
C:\Users\Admin\neaiq.exe"C:\Users\Admin\neaiq.exe"41⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1164 -
C:\Users\Admin\kiuqoez.exe"C:\Users\Admin\kiuqoez.exe"42⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1724 -
C:\Users\Admin\danit.exe"C:\Users\Admin\danit.exe"43⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2988 -
C:\Users\Admin\meiri.exe"C:\Users\Admin\meiri.exe"44⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2520 -
C:\Users\Admin\voaoraw.exe"C:\Users\Admin\voaoraw.exe"45⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1168 -
C:\Users\Admin\soihuc.exe"C:\Users\Admin\soihuc.exe"46⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1644 -
C:\Users\Admin\laejouc.exe"C:\Users\Admin\laejouc.exe"47⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1632 -
C:\Users\Admin\hnzuef.exe"C:\Users\Admin\hnzuef.exe"48⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:108
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
124KB
MD5ff4dbbcf116dbf861530abf5a38f2193
SHA1d3c3ac6e9b3294abaeb88bbccce9aab4d2201b4a
SHA256d0089e2c2b9b4dabe09a68fcdc00f79562079e7ddfdb995ed6b6c6faec17bc70
SHA512083ad93ef147e7087af3f234432a8ef7216f0c02f8a79f3eaf5edf8f2511cbac031c61796cf82dd78b4d7a61b01c851a23ba7c3875cae4550673dbdf2dc082a8
-
Filesize
124KB
MD598224e07d65b86f56c9fe7d2105838a5
SHA10367aff6601a0e58aed08a81ef74388b4460a619
SHA256de4e3c13b9964e6b856a8c423dec165eb695123578436d84143cb8e716082668
SHA512d7e86cce16b7d0b19f996d8a874922e1ec7c25f5b73d34f42037d1e0731aeed7494a5a93b3e79d4c991de90e1f4f3b1ada3b883f93d0a4a33ee1dd46d7672674
-
Filesize
124KB
MD51d1a56f0158419a46a487e5d4a8c3613
SHA131e8707ae37e4d8f21e921720e3d6c37c3924ac0
SHA256a97e48be8885b1266407f68ae33317ec3097e5274020fcdbd92e2a30d760c7b4
SHA51201b1f5e1262c49ac86075bf677853d590a6bca88a538c0938d5f0c83d588116ef2d5840eac47fdaede10d7650c7df1c82fc9fb3e7710a48332fbacce81372ddb
-
Filesize
124KB
MD58ffedc513e71350e1c54eb9431de30f1
SHA1a6c9bee4210dbcea9f0c70d74f50336e6eb927ec
SHA2561c02b3655f0b7b519afc79d5402fb94b3fd2d3e21010c3698eac3a10257761b5
SHA51216061f287c3b55f5ea757ae220fdf1ff4ceab69b41e5c19e160184ca9e857d6b01754fd11aef199856926fb8fc43cddc84f63f9fcfc5dc2597335c9391516657
-
Filesize
124KB
MD536b1ba92c9e2d98c83a66c4b962bea3c
SHA1f64c947a73dd8c3c7402cc9404cef7fc6178c786
SHA256f3d3e431ed26359a793c5dc74794e111d6adc9b1babca54147126c29fcf562b9
SHA512db56049de3f95dd9c10824e572062c9fa82d5f464e79f00a7795acc91dbe892eb119f97221f5921fb721d8b2ade269b663de2e85b1b9fee1e0eb8b4a155210ee
-
Filesize
124KB
MD582f1fe3f3d77adadf9046115337444f7
SHA1ea01add53955851f990a10942da0fb555da03abd
SHA25620b4270391723f37e4cf48f75f8298d7169e1a5bd4b35c7d9c866052769476ee
SHA512cadd4f7c0d46f078848b65274b9589e5eba94ce1b0235f05d668ce2453d225f654e095e274db1ce64191d1601b17698e48187457071eb27f7ce5d2691072c6fb
-
Filesize
124KB
MD5380f6cb98ef2f2cfa9b2b914a6ab8475
SHA19e56942e9e6c333661e481baeb14eb05c935c725
SHA2565b7096e592c09290b77190118a816f00a136b1ef73c9fc27b278da19ebac25d7
SHA512acf442411fc9ac01ccdebb9cca0da846dbe0132ebf17e706c2e5f5784355a82cbca858e3d5d43dbda175bf57b9d42cf8e2665300636f4241693792bbdb0d8d1b
-
Filesize
124KB
MD5b6c8d9825cbaae7664adf54b541e4e60
SHA1cde1e942f955194b202858c8473794995e8502c4
SHA256d3b509b4f00ee36daa3591b22b48ba56af1d1d91a3959b8969f33bb2ba911472
SHA512d7c692f7e9f0423bea40afa4f453527a11309d040e0bc88a138f84d89b24b99cae21c260cd01893e09b8d8112f1dff89ccfb853eb0dd058690bfa7e36b133426
-
Filesize
124KB
MD5f6aebe47d30e0c1ec39ff934563bdaed
SHA1f7c83224c72bf36228a34760fee08c4ddd946117
SHA256176e036fcddb70992c337e1e7e9f0e61c983e7bc0a6db71d5b0a7edba1b6a5fa
SHA512f6bc949158876a9bf4546b11800c77389ffcf2a790420ab365312dabccad7571d59410863900a137c6ec667a37dd8f089b56c2687cb769968df6aa2c61728253
-
Filesize
124KB
MD53b1de62ae31877e19d6c3f7b10b58d6f
SHA1ec7b1885406808c3d6f3f3b3c4ae2c3d778d2ef2
SHA2564fe0652fee8f2f33452101fcbd15b9f7c455ea2f65143d7209edf8432ac202dd
SHA512230236c9a7e8c2e5a5a33beddf6c2758520df2272a104253f31a3070a89c13e85f88604c278ba74f3f7e5bc4e59e4dd8694400b506ce1f5fbabd4a1758381900
-
Filesize
124KB
MD53c45df723e0e07b4f29d1266f1b297a2
SHA194cf1542f6d5c9baddd519615f26f0bbc4415888
SHA256a6ccfb28769cf76816c226eb4cbf8d206387c2a310e26b942460b25067e1dcb0
SHA512f21ebbdcc1bd39a3f65ee51608eacd1d1902d4db529142824122d2b5ccaa49202413c1b0f3eb2f965ca3ce4a84d465a02e94c98e3c09dec1913857e64db763e3
-
Filesize
124KB
MD5cd962c256114448cb95424a12373b792
SHA1e6eeadea9f432ff222f7c0dcda610758bcce9ca6
SHA2564724066492962b8fd517be60d780ef3601eea19d471b3981a0584d626f46250e
SHA51246b44191a0a92cb64b0f5d2447cdfd50993718d0e45ce4be7c2dc2cb9b5c8de13d48f0d01ac870a068d1c7a2f97c858df9012c3eb629417f6f710a87196cbf6b
-
Filesize
124KB
MD5ee21531bfbecca3acb3bac4c2582e2b4
SHA19f0f8d0748c2a31d2d5b1a5ec65acb2b33b1f785
SHA2566edaa26d491fd4027d341619d077b6b93f29293a53fa243b8e4ec3bec07a57c8
SHA512478e20980d0c2b1601b70ec57ad9bbc7246e9c665d48bc556c0c29a0f8570b568020f3bdc6d662bc4db000f4d0078e5d28c72956ddec37ef70da21a826a1d3bd
-
Filesize
124KB
MD517d23043041fe479c0f1be802e07a25e
SHA182b27488d4fd37beb34d092fd57e5b8e74511db0
SHA2566a615d0c120dc965eea8ad7b66517fc4719f316f277acec6a9f60ac9667f3925
SHA512ecc0640d5856152936f0edf795e2884b67ab633669421dcf6dec2585b2f2f0498d4ef3ec3ffa0b0a8c3a7c821cde7f3042bdd1966963355104ce53b8fa084b34
-
Filesize
124KB
MD522ce597a1af2d7c982226b9dd4890d25
SHA105819fd12dc5b59afadc80f997a8f2ea52f13ff8
SHA2567e30786011d8dd6ec9807d53d8cf240cf50ce0430b30cc628ed3adaf6a0c7b3c
SHA51291fdc33d3fc64dec6517df3f4861b24515afc5be75c28b1eb1c428c5eb600d535aab76e90858fb8b45378809e37fd6e5cf882b404ed66cef5d6ce42430f693b6
-
Filesize
124KB
MD5058fe68cb72e149a04e1ce12c401f887
SHA19019fb627ac14ebce3a9c57595322dac13772a89
SHA256ef70aea1bc4acb57daeab567dfef015f23627a34d31997ddc08a97b41c4f1ede
SHA512aa8b5191abb78a5fdc50632b181568b7b8161507a4d17753487c61713f7febcc61b164c36e8c194ec6c588cbf32d418ae96ce8f42e7a9d09adf8a2a207229498