description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	avbafit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	avbafit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	avbafit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	avbafit.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{47534147-4d48-4351-4753-41474D484351}\StubPath = "C:\\Windows\\system32\\ubpupooc.exe"	avbafit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{47534147-4d48-4351-4753-41474D484351}	avbafit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{47534147-4d48-4351-4753-41474D484351}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a"	avbafit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{47534147-4d48-4351-4753-41474D484351}\IsInstalled = "1"	avbafit.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe	avbafit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a"	avbafit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\dpoabeab.exe"	avbafit.exe

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\odtaroas-eavur.dll	avbafit.exe
File created	C:\Windows\SysWOW64\avbafit.exe	83218599358597d4b0637a32726630c0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\dpoabeab.exe	avbafit.exe
File opened for modification	C:\Windows\SysWOW64\ubpupooc.exe	avbafit.exe
File created	C:\Windows\SysWOW64\ubpupooc.exe	avbafit.exe
File opened for modification	C:\Windows\SysWOW64\avbafit.exe	83218599358597d4b0637a32726630c0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\dpoabeab.exe	avbafit.exe
File created	C:\Windows\SysWOW64\odtaroas-eavur.dll	avbafit.exe
File opened for modification	C:\Windows\SysWOW64\avbafit.exe	avbafit.exe

pid	Process
4704	avbafit.exe
4704	avbafit.exe
4704	avbafit.exe
4704	avbafit.exe
4704	avbafit.exe
4704	avbafit.exe
4704	avbafit.exe
4704	avbafit.exe
2772	avbafit.exe
2772	avbafit.exe
4704	avbafit.exe
4704	avbafit.exe
4704	avbafit.exe
4704	avbafit.exe
4704	avbafit.exe
4704	avbafit.exe
4704	avbafit.exe
4704	avbafit.exe
4704	avbafit.exe
4704	avbafit.exe
4704	avbafit.exe
4704	avbafit.exe
4704	avbafit.exe
4704	avbafit.exe
4704	avbafit.exe
4704	avbafit.exe
4704	avbafit.exe
4704	avbafit.exe
4704	avbafit.exe
4704	avbafit.exe
4704	avbafit.exe
4704	avbafit.exe
4704	avbafit.exe
4704	avbafit.exe
4704	avbafit.exe
4704	avbafit.exe
4704	avbafit.exe
4704	avbafit.exe
4704	avbafit.exe
4704	avbafit.exe
4704	avbafit.exe
4704	avbafit.exe
4704	avbafit.exe
4704	avbafit.exe
4704	avbafit.exe
4704	avbafit.exe
4704	avbafit.exe
4704	avbafit.exe
4704	avbafit.exe
4704	avbafit.exe
4704	avbafit.exe
4704	avbafit.exe
4704	avbafit.exe
4704	avbafit.exe
4704	avbafit.exe
4704	avbafit.exe
4704	avbafit.exe
4704	avbafit.exe
4704	avbafit.exe
4704	avbafit.exe
4704	avbafit.exe
4704	avbafit.exe
4704	avbafit.exe
4704	avbafit.exe

description	pid	Process	procid_target
PID 4672 wrote to memory of 4704	4672	83218599358597d4b0637a32726630c0_NeikiAnalytics.exe	80
PID 4672 wrote to memory of 4704	4672	83218599358597d4b0637a32726630c0_NeikiAnalytics.exe	80
PID 4672 wrote to memory of 4704	4672	83218599358597d4b0637a32726630c0_NeikiAnalytics.exe	80
PID 4704 wrote to memory of 2772	4704	avbafit.exe	81
PID 4704 wrote to memory of 2772	4704	avbafit.exe	81
PID 4704 wrote to memory of 2772	4704	avbafit.exe	81
PID 4704 wrote to memory of 612	4704	avbafit.exe	5
PID 4704 wrote to memory of 3388	4704	avbafit.exe	56
PID 4704 wrote to memory of 3388	4704	avbafit.exe	56
PID 4704 wrote to memory of 3388	4704	avbafit.exe	56
PID 4704 wrote to memory of 3388	4704	avbafit.exe	56
PID 4704 wrote to memory of 3388	4704	avbafit.exe	56
PID 4704 wrote to memory of 3388	4704	avbafit.exe	56
PID 4704 wrote to memory of 3388	4704	avbafit.exe	56
PID 4704 wrote to memory of 3388	4704	avbafit.exe	56
PID 4704 wrote to memory of 3388	4704	avbafit.exe	56
PID 4704 wrote to memory of 3388	4704	avbafit.exe	56
PID 4704 wrote to memory of 3388	4704	avbafit.exe	56
PID 4704 wrote to memory of 3388	4704	avbafit.exe	56
PID 4704 wrote to memory of 3388	4704	avbafit.exe	56
PID 4704 wrote to memory of 3388	4704	avbafit.exe	56
PID 4704 wrote to memory of 3388	4704	avbafit.exe	56
PID 4704 wrote to memory of 3388	4704	avbafit.exe	56
PID 4704 wrote to memory of 3388	4704	avbafit.exe	56
PID 4704 wrote to memory of 3388	4704	avbafit.exe	56
PID 4704 wrote to memory of 3388	4704	avbafit.exe	56
PID 4704 wrote to memory of 3388	4704	avbafit.exe	56
PID 4704 wrote to memory of 3388	4704	avbafit.exe	56
PID 4704 wrote to memory of 3388	4704	avbafit.exe	56
PID 4704 wrote to memory of 3388	4704	avbafit.exe	56
PID 4704 wrote to memory of 3388	4704	avbafit.exe	56
PID 4704 wrote to memory of 3388	4704	avbafit.exe	56
PID 4704 wrote to memory of 3388	4704	avbafit.exe	56
PID 4704 wrote to memory of 3388	4704	avbafit.exe	56
PID 4704 wrote to memory of 3388	4704	avbafit.exe	56
PID 4704 wrote to memory of 3388	4704	avbafit.exe	56
PID 4704 wrote to memory of 3388	4704	avbafit.exe	56
PID 4704 wrote to memory of 3388	4704	avbafit.exe	56
PID 4704 wrote to memory of 3388	4704	avbafit.exe	56
PID 4704 wrote to memory of 3388	4704	avbafit.exe	56
PID 4704 wrote to memory of 3388	4704	avbafit.exe	56
PID 4704 wrote to memory of 3388	4704	avbafit.exe	56
PID 4704 wrote to memory of 3388	4704	avbafit.exe	56
PID 4704 wrote to memory of 3388	4704	avbafit.exe	56
PID 4704 wrote to memory of 3388	4704	avbafit.exe	56
PID 4704 wrote to memory of 3388	4704	avbafit.exe	56
PID 4704 wrote to memory of 3388	4704	avbafit.exe	56
PID 4704 wrote to memory of 3388	4704	avbafit.exe	56
PID 4704 wrote to memory of 3388	4704	avbafit.exe	56
PID 4704 wrote to memory of 3388	4704	avbafit.exe	56
PID 4704 wrote to memory of 3388	4704	avbafit.exe	56
PID 4704 wrote to memory of 3388	4704	avbafit.exe	56
PID 4704 wrote to memory of 3388	4704	avbafit.exe	56
PID 4704 wrote to memory of 3388	4704	avbafit.exe	56
PID 4704 wrote to memory of 3388	4704	avbafit.exe	56
PID 4704 wrote to memory of 3388	4704	avbafit.exe	56
PID 4704 wrote to memory of 3388	4704	avbafit.exe	56
PID 4704 wrote to memory of 3388	4704	avbafit.exe	56
PID 4704 wrote to memory of 3388	4704	avbafit.exe	56
PID 4704 wrote to memory of 3388	4704	avbafit.exe	56
PID 4704 wrote to memory of 3388	4704	avbafit.exe	56
PID 4704 wrote to memory of 3388	4704	avbafit.exe	56
PID 4704 wrote to memory of 3388	4704	avbafit.exe	56
PID 4704 wrote to memory of 3388	4704	avbafit.exe	56

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.