e926c75748a58a92966a499b1503c7d06205bc823dd21e0b7d6257d8d1eaf423

Analysis

max time kernel
150s
max time network
148s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 08:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aed07f00b67382027af544a03ae22ea0_NeikiAnalytics.exe
Size

457KB
MD5

aed07f00b67382027af544a03ae22ea0
SHA1

b984c64693f050d8d44b084b9da26442b7569630
SHA256

e926c75748a58a92966a499b1503c7d06205bc823dd21e0b7d6257d8d1eaf423
SHA512

2e9839ccce890a99339b5587e8df4da06d20ba85de261730beba8ca4c301b716d97ab7c8cb01c504dc06d6ba574ad7bb20771a79600c20b9e7f3b36af5f908aa
SSDEEP

6144:mY+32WWluqvHpVmXWEjFJRWci+WUd20rUU5EYCTvaBju4zh:dnWwvHpVmXpjJIUd2cUusvalxzh

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\\RJQ4C2J.exe\""	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\\RJQ4C2J.exe\""	lsass.exe

Modifies visibility of file extensions in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	system.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	lsass.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	system.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	lsass.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Sets file execution options in registry 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\debugger = "C:\\Windows\\notepad.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\debugger = "C:\\Windows\\notepad.exe"	system.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\debugger = "C:\\Windows\\notepad.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\debugger = "C:\\Windows\\notepad.exe"	system.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\debugger = "C:\\Windows\\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\\regedit.cmd"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	system.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\debugger = "C:\\Windows\\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\\regedit.cmd"	system.exe

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x00080000000146a7-143.dat	acprotect

Executes dropped EXE 4 IoCs

pid	Process
2276	service.exe
2840	smss.exe
2788	system.exe
1984	lsass.exe

Loads dropped DLL 6 IoCs

pid	Process
2288	aed07f00b67382027af544a03ae22ea0_NeikiAnalytics.exe
2288	aed07f00b67382027af544a03ae22ea0_NeikiAnalytics.exe
2288	aed07f00b67382027af544a03ae22ea0_NeikiAnalytics.exe
2288	aed07f00b67382027af544a03ae22ea0_NeikiAnalytics.exe
2288	aed07f00b67382027af544a03ae22ea0_NeikiAnalytics.exe
2288	aed07f00b67382027af544a03ae22ea0_NeikiAnalytics.exe

Modifies system executable filetype association 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	lsass.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00080000000146a7-143.dat	upx
behavioral1/memory/2788-214-0x0000000010000000-0x0000000010075000-memory.dmp	upx
behavioral1/memory/2788-223-0x0000000010000000-0x0000000010075000-memory.dmp	upx

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN\0C2JUG = "C:\\Windows\\KNX5H7N.exe"	system.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\sOU5H7N0 = "C:\\Windows\\system32\\TON1U6PQUG0C0Y.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN\0C2JUG = "C:\\Windows\\KNX5H7N.exe"	lsass.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\sOU5H7N0 = "C:\\Windows\\system32\\TON1U6PQUG0C0Y.exe"	system.exe

Drops desktop.ini file(s) 28 IoCs

description	ioc	Process
File created	\??\UNC\UIBNQNMA\desktop.ini	lsass.exe
File created	\??\UNC\UIBNQNMA\G$\desktop.ini	lsass.exe
File created	\??\UNC\UIBNQNMA\K$\desktop.ini	lsass.exe
File created	\??\UNC\UIBNQNMA\O$\desktop.ini	lsass.exe
File created	\??\UNC\UIBNQNMA\X$\desktop.ini	lsass.exe
File created	\??\UNC\UIBNQNMA\C$\desktop.ini	lsass.exe
File created	\??\UNC\UIBNQNMA\H$\desktop.ini	lsass.exe
File created	\??\UNC\UIBNQNMA\J$\desktop.ini	lsass.exe
File created	\??\UNC\UIBNQNMA\M$\desktop.ini	lsass.exe
File created	\??\UNC\UIBNQNMA\R$\desktop.ini	lsass.exe
File created	\??\UNC\UIBNQNMA\ADMIN$\desktop.ini	lsass.exe
File created	\??\UNC\UIBNQNMA\V$\desktop.ini	lsass.exe
File created	\??\UNC\UIBNQNMA\Y$\desktop.ini	lsass.exe
File created	\??\UNC\UIBNQNMA\I$\desktop.ini	lsass.exe
File created	\??\UNC\UIBNQNMA\U$\desktop.ini	lsass.exe
File created	\??\UNC\UIBNQNMA\F$\desktop.ini	lsass.exe
File created	\??\UNC\UIBNQNMA\L$\desktop.ini	lsass.exe
File created	\??\UNC\UIBNQNMA\N$\desktop.ini	lsass.exe
File created	\??\UNC\UIBNQNMA\W$\desktop.ini	lsass.exe
File created	\??\UNC\UIBNQNMA\Z$\desktop.ini	lsass.exe
File created	\??\UNC\UIBNQNMA\D$\desktop.ini	lsass.exe
File created	\??\UNC\UIBNQNMA\T$\desktop.ini	lsass.exe
File created	\??\UNC\UIBNQNMA\A$\desktop.ini	lsass.exe
File created	\??\UNC\UIBNQNMA\B$\desktop.ini	lsass.exe
File created	\??\UNC\UIBNQNMA\P$\desktop.ini	lsass.exe
File created	\??\UNC\UIBNQNMA\Q$\desktop.ini	lsass.exe
File created	\??\UNC\UIBNQNMA\E$\desktop.ini	lsass.exe
File created	\??\UNC\UIBNQNMA\S$\desktop.ini	lsass.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	service.exe
File opened (read-only)	\??\I:	service.exe
File opened (read-only)	\??\L:	service.exe
File opened (read-only)	\??\P:	service.exe
File opened (read-only)	\??\W:	service.exe
File opened (read-only)	\??\X:	service.exe
File opened (read-only)	\??\N:	service.exe
File opened (read-only)	\??\O:	service.exe
File opened (read-only)	\??\Q:	service.exe
File opened (read-only)	\??\T:	service.exe
File opened (read-only)	\??\Z:	service.exe
File opened (read-only)	\??\V:	service.exe
File opened (read-only)	\??\E:	service.exe
File opened (read-only)	\??\H:	service.exe
File opened (read-only)	\??\J:	service.exe
File opened (read-only)	\??\R:	service.exe
File opened (read-only)	\??\U:	service.exe
File opened (read-only)	\??\G:	service.exe
File opened (read-only)	\??\K:	service.exe
File opened (read-only)	\??\M:	service.exe
File opened (read-only)	\??\S:	service.exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\systear.dll	smss.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	lsass.exe
File opened for modification	C:\Windows\SysWOW64\MDF6I7S	aed07f00b67382027af544a03ae22ea0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	service.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	aed07f00b67382027af544a03ae22ea0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\DYF6K4V.exe	aed07f00b67382027af544a03ae22ea0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\DYF6K4V.exe	service.exe
File opened for modification	C:\Windows\SysWOW64\MDF6I7S\TON1U6P.cmd	lsass.exe
File opened for modification	C:\Windows\SysWOW64\TON1U6PQUG0C0Y.exe	aed07f00b67382027af544a03ae22ea0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	service.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	system.exe
File opened for modification	C:\Windows\SysWOW64\TON1U6PQUG0C0Y.exe	system.exe
File opened for modification	C:\Windows\SysWOW64\DYF6K4V.exe	lsass.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	aed07f00b67382027af544a03ae22ea0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\MDF6I7S\TON1U6P.cmd	smss.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	service.exe
File opened for modification	C:\Windows\SysWOW64\MDF6I7S\TON1U6P.cmd	service.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	lsass.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	system.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	system.exe
File opened for modification	C:\Windows\SysWOW64\MDF6I7S	smss.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	smss.exe
File opened for modification	C:\Windows\SysWOW64\TON1U6PQUG0C0Y.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\MDF6I7S	service.exe
File opened for modification	C:\Windows\SysWOW64\MDF6I7S	system.exe
File opened for modification	C:\Windows\SysWOW64\DYF6K4V.exe	system.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	lsass.exe
File opened for modification	C:\Windows\SysWOW64\TON1U6PQUG0C0Y.exe	lsass.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	aed07f00b67382027af544a03ae22ea0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\MDF6I7S\TON1U6P.cmd	aed07f00b67382027af544a03ae22ea0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\DYF6K4V.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\TON1U6PQUG0C0Y.exe	service.exe
File opened for modification	C:\Windows\SysWOW64\MDF6I7S\TON1U6P.cmd	system.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\MDF6I7S	lsass.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\lsass.exe	smss.exe
File created	C:\Windows\MooNlight.R.txt	smss.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe	system.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe	system.exe
File created	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\MYpIC.zip	system.exe
File created	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\zia02536	system.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\regedit.cmd	aed07f00b67382027af544a03ae22ea0_NeikiAnalytics.exe
File opened for modification	C:\Windows\QUG0C0Y.exe	aed07f00b67382027af544a03ae22ea0_NeikiAnalytics.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe	service.exe
File opened for modification	C:\Windows\QUG0C0Y.exe	service.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\HKH5L3E.com	service.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\RJQ4C2J.exe	service.exe
File opened for modification	C:\Windows\moonlight.dll	system.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	system.exe
File opened for modification	C:\Windows\moonlight.dll	aed07f00b67382027af544a03ae22ea0_NeikiAnalytics.exe
File opened for modification	C:\Windows\QUG0C0Y.exe	smss.exe
File opened for modification	C:\Windows\cypreg.dll	service.exe
File opened for modification	C:\Windows\moonlight.dll	lsass.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\regedit.cmd	lsass.exe
File opened for modification	C:\Windows\QUG0C0Y.exe	lsass.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe	aed07f00b67382027af544a03ae22ea0_NeikiAnalytics.exe
File opened for modification	C:\Windows\onceinabluemoon.mid	smss.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe	smss.exe
File opened for modification	C:\Windows\KNX5H7N.exe	smss.exe
File opened for modification	C:\Windows\lsass.exe	service.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}	aed07f00b67382027af544a03ae22ea0_NeikiAnalytics.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}	system.exe
File opened for modification	C:\Windows\onceinabluemoon.mid	lsass.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\winlogon.exe	lsass.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe	lsass.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe	service.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe	lsass.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\regedit.cmd	system.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}	service.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe	system.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\RJQ4C2J.exe	system.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe	lsass.exe
File opened for modification	C:\Windows\KNX5H7N.exe	aed07f00b67382027af544a03ae22ea0_NeikiAnalytics.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\regedit.cmd	smss.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	service.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\winlogon.exe	service.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\regedit.cmd	service.exe
File opened for modification	C:\Windows\lsass.exe	system.exe
File opened for modification	C:\Windows\lsass.exe	lsass.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\RJQ4C2J.exe	lsass.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe	smss.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\MYpIC.zip	system.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	lsass.exe
File opened for modification	C:\Windows\64enc.en	system.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\winlogon.exe	aed07f00b67382027af544a03ae22ea0_NeikiAnalytics.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe	smss.exe
File opened for modification	C:\Windows\onceinabluemoon.mid	service.exe
File opened for modification	C:\Windows\KNX5H7N.exe	service.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\winlogon.exe	system.exe
File opened for modification	C:\Windows\KNX5H7N.exe	system.exe
File opened for modification	C:\Windows\cypreg.dll	aed07f00b67382027af544a03ae22ea0_NeikiAnalytics.exe
File opened for modification	C:\Windows\KNX5H7N.exe	lsass.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\RJQ4C2J.exe	aed07f00b67382027af544a03ae22ea0_NeikiAnalytics.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\HKH5L3E.com	aed07f00b67382027af544a03ae22ea0_NeikiAnalytics.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\HKH5L3E.com	smss.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}	lsass.exe
File opened for modification	C:\Windows\cypreg.dll	lsass.exe
File opened for modification	C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe	aed07f00b67382027af544a03ae22ea0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	aed07f00b67382027af544a03ae22ea0_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 8 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "File Folder"	system.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	system.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "File Folder"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	lsass.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeBackupPrivilege	2788	system.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2288	aed07f00b67382027af544a03ae22ea0_NeikiAnalytics.exe
2276	service.exe
2840	smss.exe
2788	system.exe
1984	lsass.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 2276	2288	aed07f00b67382027af544a03ae22ea0_NeikiAnalytics.exe	28
PID 2288 wrote to memory of 2276	2288	aed07f00b67382027af544a03ae22ea0_NeikiAnalytics.exe	28
PID 2288 wrote to memory of 2276	2288	aed07f00b67382027af544a03ae22ea0_NeikiAnalytics.exe	28
PID 2288 wrote to memory of 2276	2288	aed07f00b67382027af544a03ae22ea0_NeikiAnalytics.exe	28
PID 2288 wrote to memory of 2840	2288	aed07f00b67382027af544a03ae22ea0_NeikiAnalytics.exe	29
PID 2288 wrote to memory of 2840	2288	aed07f00b67382027af544a03ae22ea0_NeikiAnalytics.exe	29
PID 2288 wrote to memory of 2840	2288	aed07f00b67382027af544a03ae22ea0_NeikiAnalytics.exe	29
PID 2288 wrote to memory of 2840	2288	aed07f00b67382027af544a03ae22ea0_NeikiAnalytics.exe	29
PID 2288 wrote to memory of 2788	2288	aed07f00b67382027af544a03ae22ea0_NeikiAnalytics.exe	30
PID 2288 wrote to memory of 2788	2288	aed07f00b67382027af544a03ae22ea0_NeikiAnalytics.exe	30
PID 2288 wrote to memory of 2788	2288	aed07f00b67382027af544a03ae22ea0_NeikiAnalytics.exe	30
PID 2288 wrote to memory of 2788	2288	aed07f00b67382027af544a03ae22ea0_NeikiAnalytics.exe	30
PID 2288 wrote to memory of 1984	2288	aed07f00b67382027af544a03ae22ea0_NeikiAnalytics.exe	31
PID 2288 wrote to memory of 1984	2288	aed07f00b67382027af544a03ae22ea0_NeikiAnalytics.exe	31
PID 2288 wrote to memory of 1984	2288	aed07f00b67382027af544a03ae22ea0_NeikiAnalytics.exe	31
PID 2288 wrote to memory of 1984	2288	aed07f00b67382027af544a03ae22ea0_NeikiAnalytics.exe	31

C:\Users\Admin\AppData\Local\Temp\aed07f00b67382027af544a03ae22ea0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\aed07f00b67382027af544a03ae22ea0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe
  "C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:2276
- C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe
  "C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:2840
- C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe
  "C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Sets file execution options in registry
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2788
- C:\Windows\lsass.exe
  "C:\Windows\lsass.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Sets file execution options in registry
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Adds Run key to start application
  - Drops desktop.ini file(s)
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:1984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Secret.exe

Filesize
457KB

MD5
91f1911a42f3d8b5546c2fedbdb054ed

SHA1
b8cb45eb7024982954ca7a00848382fbad4912ea

SHA256
0bf80406405f6088753aa43db565f767b4a31ad7afd313e4ed6e406e72e98ad7

SHA512
c754d82a84a415a580a012a1e92d3deb2863096e8cf2dd2c9f05e3bfa9f6709cfd1a114dbd500f3f63f214c4fe16905e3cbb116d1f1ed3c6600e4e60a2cb6ab9

Download Submit
C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\HKH5L3E.com

Filesize
457KB

MD5
83f3f4538bd299be8c91bd33ee9ef1a5

SHA1
820e6e239909eee06fa0de81988587990ce78c9b

SHA256
002bfe8702f790835b9463f2aaee9eb6a146a0d65ca6f5e317b6324679aad67e

SHA512
de7c1f03571a679b7f3a54bf4276f174fbd1be502532145d440d47148f66a62e61875d88cbdd15269bae6472e3e4b91589c92257e77cf04847d71690ff926b45

Download Submit
C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\HKH5L3E.com

Filesize
457KB

MD5
c6c1551328d9a4ba98f9ffcd96391e75

SHA1
1d195f01c88b5b98ec483b72f53659667c9c3432

SHA256
79ba92bf44d7cb9660ff13797eccaae0018bbf68401f3e00b70f5e07a4616f20

SHA512
18a27e4b607aa47d072080462ed523a296aa420431af12ab1eb3bc8eff2c5e5e1abd47725f7176c8179b8c7870e99d3df6f250471cf9519a302fcb12da488279

Download Submit
C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\RJQ4C2J.exe

Filesize
457KB

MD5
9ccb72238f189b63eb5465129a4c77f3

SHA1
8c5b16e81683bd57c0ec4cf4003691a7cdfee4c0

SHA256
05af829ad1c11f464893146b95b3f6088a1a993ccd2253512efe0cc475258466

SHA512
0d093ea9104f76538d7ebbdd543d37cee77caa10d0fe8ec1c30dac5999e7a522704ed13771d61269d766ce74d3adbb2df3732a87f578a503055faa57a6ada48c

Download Submit
C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\regedit.cmd

Filesize
457KB

MD5
53cd9f5481483426ce4df0899ca62a24

SHA1
bc9d47c7d2e5fe7d4f98fac3e00af642f876c840

SHA256
e753434239306ecc9ea44cdb0906d4477e33e5864ac06f4ad5d551d511988fc1

SHA512
e2487f7480e0a6436fd1e2082d49b02b20807e69d35a4f83acfbc74b235c250debad5fb560864e7a063a4d11eb5da3ef343a871fcbb21d64ad8f6c67a3a9814f

Download Submit
C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe

Filesize
457KB

MD5
8415e3ba4b92d99528bf141ab9e80642

SHA1
af6464bdff006368e964c7a8a600b50d945ca548

SHA256
ad4f74581ee57c351f07e7654a2a13a7c1f8bf5b6f94121e3f8c208fd621b1f6

SHA512
f85597e6967b49cae02445600dbbdbcd6d88217f3db234db89c33221d969ee822fbe531be4f765835103a890ad69d0c7d4ddadee508eaa869aa60e65ab73a336

Download Submit
C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe

Filesize
457KB

MD5
0a03faa1708b6dec4296b22ab7746254

SHA1
55dd7adcdc8a89a32314c1fd44d10d80c32b5126

SHA256
409fcc21acb7e7329ebf4946d7ee50fcab668510b547bf9c74d602772741c5b0

SHA512
3f76909d029731dc3e8e3cdb7c00c54fff66404e7b84e09772d1985f322e75ec7b4ae60ffb706de694fe796a9f939af1e1bed5492b6b138a0139de8246aa07f2

Download Submit
C:\Windows\IOU2V5J.{645FF040-5081-101B-9F08-00AA002F954E}\winlogon.exe

Filesize
457KB

MD5
acf97aac4f88759cd61602569e83352a

SHA1
8c711d3cee5ed266879144b7b99893088d714e0c

SHA256
dd1501a55220a09fd4712bdf747b71c692b3526660b5acb84d2b8ebe2ec9e2ba

SHA512
31c46d8441e16510493a55319cda4dc53fbc1e43961db485c359ed7060bf0dc54b25e1343b12c3735af6c863ad9193135d23e55745db27056e97ca318e2521b0

Download Submit
C:\Windows\KNX5H7N.exe

Filesize
457KB

MD5
f2fcab8cc8d7caf2ce6e0ac60f09793f

SHA1
b2ae0c22f812ed63e9200c24726b7db42e50835f

SHA256
2ef91696f3549bfdfccd796b73d274a0214069132e2686abf7c2fb3ab57b5682

SHA512
32b678986d93489007c9608923e7ccf22eacd450536c234b8c956d99c72af867e64014626f4c08f1ec9866e1fc2fbb77a1a19cdec9390830224eee4d81c4b5be

Download Submit
C:\Windows\KNX5H7N.exe

Filesize
457KB

MD5
68787e3e1ec4355ec3a63a7b46bd45e6

SHA1
0a7f9b65efe61e198ac8d5b31ded06cb4f39bb22

SHA256
3ea51f6ad48a123385c2ed8876204b51a3f438c96db242d5dfc4fe58e2871d0d

SHA512
652a9adefa67a052473b9f1124ec01c5766691aecee952a6d683676cdc6060ff77572d45c0e7ee216af024c545a76a953cf3175371e69ce2cc55008b7a5daca0

Download Submit
C:\Windows\KNX5H7N.exe

Filesize
457KB

MD5
b018f416ce6abf93157ef986a10a3c22

SHA1
3554a65aeaacc1782a112272c3389efb388d4928

SHA256
bc56d2e94d799c05c83719dc3cd09d62c8d1a25296780dc67ebe30e2242234e9

SHA512
9e631b592a27437e7d4339081dadb236869bd07edf2d977cea2a7f874915e932207b136287c4bff6df589c466ca4eb26577c7c6e225c49e8864778faa8d904cf

Download Submit
C:\Windows\QUG0C0Y.exe

Filesize
457KB

MD5
eb6f9891f8f2bc133c24ed5b1a9ea59a

SHA1
172e55dafd340d1f026a99ea030a8cd215105627

SHA256
5bbd58484b20ada4e182fa0f650457aadde688fdf318e241fe316e8ce833e685

SHA512
b8139e50d5bd1425a8fc699d4d744ea27e5fbb4aa044995a9c26a0bf4768aee03690b4e4098e43a95e84e5b9e11f63465b0dfb1424e3225e9225bdd91a03a254

Download Submit
C:\Windows\QUG0C0Y.exe

Filesize
457KB

MD5
f6e7705ce5747dc28a0e64d408467377

SHA1
f9ee25080dc1325cc918e294e23341360c6bf59e

SHA256
2228175cc7d3514ea11ad45efa5b66c04f45c95c97c129e833bfcd613ee35429

SHA512
018aa9405eba015685cf62a72cfd89e6457bee2d350d708c687140db3eb21c33f79b60ed2c218c82b4d45d4b678383874c9968dc11ba8613278658476d130a4f

Download Submit
C:\Windows\QUG0C0Y.exe

Filesize
457KB

MD5
1fd03b079fba95f40687242d3a691c4d

SHA1
dd8f1799493e84bd63c9b27fce94ddbfa77b0575

SHA256
72933a29c8c90bda7dc1c6df8f9ea0d6bc6815446a365bd5d9dc99c2ce39a6b1

SHA512
bbfc985802f2eed5550bbec71aa58885411ee528d231213d4af7e45f1fd03662c41b014476105426182c409f36608bf00e8e2b6c5af99ec5fdc7f316c8398903

Download Submit
C:\Windows\SysWOW64\DYF6K4V.exe

Filesize
457KB

MD5
57c039e53e8830d85c8e94e9d42af897

SHA1
1ef00c2fa348c194b006f52d3d774cfd46431135

SHA256
cd1149479226b16efe111f578f7e7e0491805f79470794c91eac04742b8fde53

SHA512
e721ca8ee145ba8880b75e98965caf02e6683614ce1c33cfda7d2386f2fdfa37ae0be090dc215f53a35e39a2562774508c583b59a06e58160b8c70beb60c12ce

Download Submit
C:\Windows\SysWOW64\DYF6K4V.exe

Filesize
457KB

MD5
fa39fd020a05b6fde6f9e64e34cd284e

SHA1
33a473bd1d11c5e5f8fcc7a3d0051cbb6658e49d

SHA256
1533e91314d6f9a6e48fd2e60e3f38809ead1184b593438983d1751bc270df86

SHA512
5d7c5fc314196cabe2683c55cf733eaf8575b799979916e25399dd9dc140880e61915955857e89ac03324a2742a3a0e752a44e7cea0ccaa50b0772714c27b6e8

Download Submit
C:\Windows\SysWOW64\MDF6I7S\TON1U6P.cmd

Filesize
457KB

MD5
e500b6db79d23812fa3d1f9973f22c6a

SHA1
b3bfbd57c37e7de7abb575f6391a51a14b45f3fb

SHA256
53eab63aec46db8cb6d16e737decbc01f1aaf02c0bde7f09588b03a8c5156829

SHA512
2069631363d273e589bb9d188e96aad722f64871ae4539312fb9a20e748ebbf562bb1e5dbca512236a9c1cc329d4cbfe8c7ce1da306f39bbfd7f8cec424b0c1f

Download Submit
C:\Windows\SysWOW64\TON1U6PQUG0C0Y.exe

Filesize
457KB

MD5
dfca66e38ef53fd2e50178bb660fbaac

SHA1
cf50c40df7191bb50b9aabaed3a29f6fbf92db9c

SHA256
161059bc88bd85d66568130324433555eba0ae57f2dab437754681c2f7178923

SHA512
106e681e920a192423322a8d0d8da5216abf32d07c3c7e8ba833dfd9b55703f2f37b0f216b0e742d96f0e8b5e72896aa7d6bba7bd49aec4f7beac4011201de79

Download Submit
C:\Windows\SysWOW64\TON1U6PQUG0C0Y.exe

Filesize
457KB

MD5
aed07f00b67382027af544a03ae22ea0

SHA1
b984c64693f050d8d44b084b9da26442b7569630

SHA256
e926c75748a58a92966a499b1503c7d06205bc823dd21e0b7d6257d8d1eaf423

SHA512
2e9839ccce890a99339b5587e8df4da06d20ba85de261730beba8ca4c301b716d97ab7c8cb01c504dc06d6ba574ad7bb20771a79600c20b9e7f3b36af5f908aa

Download Submit
C:\Windows\SysWOW64\TON1U6PQUG0C0Y.exe

Filesize
457KB

MD5
817281845db6dacb3ceeafd0837d5c33

SHA1
cd3967e24fc703e64bc46e8e0586a94560a876b0

SHA256
a820ddcdce70e470b5459b385bb51a0836ee71a9c487c22dace49233cbbacf5b

SHA512
4555080f5b264aada6e5df72c37ab77f6beed0583d5cd3d11c41240a98b96eb7a9ae68965d14aca8e512ec657403aa3761010646234ff2c15deb83bbaf59705b

Download Submit
C:\Windows\SysWOW64\systear.dll

Filesize
141B

MD5
aca5c7af85fbbd00af7c0a8f15bdb600

SHA1
2420e8cec8e97c17d1a53b134cef279e52c1d0eb

SHA256
29982d0057d8d6255ca247f31ecd0deaddd62cd212947dfdd2d39808ac12bcfd

SHA512
774caff5c4bbd8db7f92c691f78fe63e4a675a71f1a92b6a4d959005f641ca362f390f3cdedf217357a545717ec2964ad37582e5d1e74ec3ae1928a8b323ec8f

Download Submit
C:\Windows\SysWOW64\systear.dll

Filesize
127B

MD5
2d35261e7dd0c6b762e1f61ed6c7bfaa

SHA1
d6a62a49858e266a3ecd56add7f013a49b1d8b0d

SHA256
61a7583b5b9f57b34b9a1a51d2d799b3bfc913daf0e00d38ac9d9737e669710f

SHA512
e98c74fbf9850b3235f9c1f7899abcb94e84ab4a6a78f1cb7a76513f3a3c716ae849cdb938bde85e7301f9e0ded7a83c5d941ba47b4a5758d8e0e4e187e91717

Download Submit
C:\Windows\cypreg.dll

Filesize
417KB

MD5
3e4aa52683adf2ae9b4ab3f64a02d1a2

SHA1
b7e309eb33f95a409401effd72f919c720030edb

SHA256
15c9ad0863df8f1db620e11044020a237fc27af295404ae62bc4bbd2608c5538

SHA512
2fb67a139fe992317e77c0acc291da363481a949f359b8472ceb0131c20a17d17d14d25682ab9b215290734532e564d72d75e8c1cc88d43dcd3fbba618732385

Download Submit
C:\Windows\lsass.exe

Filesize
457KB

MD5
562b64b7aada5ecafb9da9ab3ef035fc

SHA1
80576295d9f7546c4c13b5c6de3aa7e50c5932e2

SHA256
4cf80b2a11ee0c590451721dc606a3de4cf5c4f493c4d77e994e6808cb3d16ea

SHA512
bd422225030d1402870f88536ff078920795dd32c92f2800c15d8d3a51aff606566b08f122a73c7b31b19871485bb4e4da1fc16af079f9674b5c019a9a6754ee

Download Submit
C:\Windows\lsass.exe

Filesize
457KB

MD5
fc5eb4582c491db5d367933b65338783

SHA1
4ab4747192fa1aea5cea9f1eb9cbb4924dad6a91

SHA256
d54dabe0087c54ed0758b90854e7fd550ee43346eadeabe7398b0b19711a1588

SHA512
3eb4f9ae9aa770f8e6d3d62f7f790516be0c58a66c3277470cbc4fb9f6cff45c61484d475ca3d707a9a06f7bc35a4b744406691e0fd560eb03fedf9d84abea9f

Download Submit
C:\Windows\lsass.exe

Filesize
457KB

MD5
17ae9e7388383b7beb8c65327da447b1

SHA1
ad82972c50cb3cd1f0ffee092e6acf82463e580c

SHA256
1831a18915b07eb22416a24f23683d9c88e7b81c9c599997a582c7e1e62be8fa

SHA512
c34691f5b452a7dfcbcc577ef0b6c1904339cd2674713eba463cf436008455ebc1f24f0e1b91b017967b451889d6aafeaa9f42a70e072f717787c0fa30dd2b72

Download Submit
C:\Windows\lsass.exe

Filesize
457KB

MD5
12c137f0575c7efda596317a86054388

SHA1
ecb386cbf54863e9b3e9520a0cc01afdd3880683

SHA256
d2fb5bafa040110f861e4ab4b797b09aa674a35ed7bed71e7bb936206aa81ac2

SHA512
1736be39987145c3745e6397fe60520fda3e3c3c18b99fbc1f430f135d1a49a7c31b159026c4fe52b73ce78245dbc6680aeb8b35e31ad2799a4d166724eb051d

Download Submit
C:\Windows\moonlight.dll

Filesize
65KB

MD5
c55534452c57efa04f4109310f71ccca

SHA1
b97a3d9e2c1ad9314562b7d0d77b2a4b34e77d61

SHA256
4cbbe69bcd0a2debae6a584e1fa49f8d4a27f90d9cd364255bbbd930ca0a38bc

SHA512
ad324f1f1bfde9c9b6057d5526ae62155b3b897d27225ed74fdb867a2c6d5f21cebfb63e3dc68bd807993b0f4c72fb3ce880696b9c3358b3b982204d60c7161a

Download Submit
C:\Windows\onceinabluemoon.mid

Filesize
8KB

MD5
0e528d000aad58b255c1cf8fd0bb1089

SHA1
2445d2cc0921aea9ae53b8920d048d6537940ec6

SHA256
c8aa5c023bf32f1c1e27b8136cf4d622101e58a80417d97271d3c0ba44528cae

SHA512
89ff6a1f1bf364925704a83ab4d222e2335e6486e0b90641f0133236b5f6b0fede1e9f17b577d6d069537e737b761f745d1fde4a9d0b43cb59143edf2d9c2116

Download Submit
C:\Windows\system\msvbvm60.dll

Filesize
1.3MB

MD5
16867ae0e357299fad74f85b55820412

SHA1
9e3f01ad427cd0b2aab9383793cb8b232c0d9602

SHA256
f104add33ae09a5184506b751028d346fd4cd80558fbdbd89ba6e57194e9cb68

SHA512
2ae7252f63029aabfabf94ddb8412c8c7aae97c981b4b726456fdc45410a5b49bfb182522bb2f6290af8580f8908e9f55c305797a90ba5de85d2ff51714fe290

Download Submit
memory/1984-174-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1984-224-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2276-58-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2276-212-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2288-175-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2288-49-0x0000000000700000-0x0000000000710000-memory.dmp

Filesize
64KB

Download
memory/2288-171-0x0000000003E00000-0x0000000003E78000-memory.dmp

Filesize
480KB

Download
memory/2288-170-0x0000000003E00000-0x0000000003E78000-memory.dmp

Filesize
480KB

Download
memory/2288-56-0x0000000003520000-0x0000000003598000-memory.dmp

Filesize
480KB

Download
memory/2288-55-0x0000000003520000-0x0000000003598000-memory.dmp

Filesize
480KB

Download
memory/2288-74-0x0000000003520000-0x0000000003598000-memory.dmp

Filesize
480KB

Download
memory/2288-0-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2788-214-0x0000000010000000-0x0000000010075000-memory.dmp

Filesize
468KB

Download
memory/2788-222-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2788-223-0x0000000010000000-0x0000000010075000-memory.dmp

Filesize
468KB

Download
memory/2840-67-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2840-213-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads