Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
15/05/2024, 19:54
Static task
static1
Behavioral task
behavioral1
Sample
2563be922867d94e2722a26d3cbb02c0_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2563be922867d94e2722a26d3cbb02c0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
2563be922867d94e2722a26d3cbb02c0_NeikiAnalytics.exe
-
Size
124KB
-
MD5
2563be922867d94e2722a26d3cbb02c0
-
SHA1
84abafd2ffa91e8903524bc80a7ee590d1ae179c
-
SHA256
50c997fd2cc2eee8389af74135c2e59703f9d3c0af459bca028b7f01fdbfe5fd
-
SHA512
1cf9e5bc20f093954a6e34879ed2222773f3156d77aa1d79f0bae68270a918f25fbfb7dbe740e760594fedfcc514fa5cbefc79ed7eeb01b2f1e679b23b3ccb83
-
SSDEEP
1536:HsszN5YLZPhRO/N69BH3OoGa+FL9jKceRgrkjSo:MGbYlhkFoN3Oo1+F92S
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 47 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" moaoheh.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ddcax.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" xoeah.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" moooq.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" baoleuj.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" piiwiu.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" bbkiob.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" zeoum.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" hjjoeh.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" beeovu.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" retig.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" pkduq.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" loobi.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" qeiuzih.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" dairev.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" vqcuin.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" mgkeez.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" likon.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" jeeolo.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" beuqeih.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" xesej.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" jouqo.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" yeaud.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" naiyaef.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" zvdios.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 2563be922867d94e2722a26d3cbb02c0_NeikiAnalytics.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" baodii.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" tqkin.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" boujai.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" daozif.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ruubov.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" xgloat.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" haohie.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" nmfix.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" peuine.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" dimer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" hiisa.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" toafao.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" qqyik.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" gkmub.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ceefo.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" faeebo.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" lauas.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" yuuheur.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" kaaoqot.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" reehe.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" sailuk.exe -
Executes dropped EXE 47 IoCs
pid Process 2832 beuqeih.exe 2656 hiisa.exe 2780 baoleuj.exe 2528 baodii.exe 284 nmfix.exe 2800 xoeah.exe 2128 loobi.exe 304 jouqo.exe 1512 qeiuzih.exe 1676 kaaoqot.exe 572 peuine.exe 1128 reehe.exe 300 moooq.exe 1628 xesej.exe 2972 vqcuin.exe 1564 bbkiob.exe 844 tqkin.exe 3004 boujai.exe 2468 daozif.exe 2936 zeoum.exe 2816 piiwiu.exe 1960 mgkeez.exe 1584 ruubov.exe 1516 yeaud.exe 2416 hjjoeh.exe 2436 moaoheh.exe 1644 qqyik.exe 1076 likon.exe 3000 gkmub.exe 2736 beeovu.exe 2584 ceefo.exe 372 naiyaef.exe 1840 faeebo.exe 1528 retig.exe 1236 lauas.exe 1540 xgloat.exe 1612 ddcax.exe 2664 pkduq.exe 1148 yuuheur.exe 2564 zvdios.exe 2164 jeeolo.exe 2940 toafao.exe 1040 haohie.exe 2248 dimer.exe 1048 sailuk.exe 2760 dairev.exe 1964 trriz.exe -
Loads dropped DLL 64 IoCs
pid Process 1276 2563be922867d94e2722a26d3cbb02c0_NeikiAnalytics.exe 1276 2563be922867d94e2722a26d3cbb02c0_NeikiAnalytics.exe 2832 beuqeih.exe 2832 beuqeih.exe 2656 hiisa.exe 2656 hiisa.exe 2780 baoleuj.exe 2780 baoleuj.exe 2528 baodii.exe 2528 baodii.exe 284 nmfix.exe 284 nmfix.exe 2800 xoeah.exe 2800 xoeah.exe 2128 loobi.exe 2128 loobi.exe 304 jouqo.exe 304 jouqo.exe 1512 qeiuzih.exe 1512 qeiuzih.exe 1676 kaaoqot.exe 1676 kaaoqot.exe 572 peuine.exe 572 peuine.exe 1128 reehe.exe 1128 reehe.exe 300 moooq.exe 300 moooq.exe 1628 xesej.exe 1628 xesej.exe 2972 vqcuin.exe 2972 vqcuin.exe 1564 bbkiob.exe 1564 bbkiob.exe 844 tqkin.exe 844 tqkin.exe 3004 boujai.exe 3004 boujai.exe 2468 daozif.exe 2468 daozif.exe 2936 zeoum.exe 2936 zeoum.exe 2816 piiwiu.exe 2816 piiwiu.exe 1960 mgkeez.exe 1960 mgkeez.exe 1584 ruubov.exe 1584 ruubov.exe 1516 yeaud.exe 1516 yeaud.exe 2416 hjjoeh.exe 2416 hjjoeh.exe 2436 moaoheh.exe 2436 moaoheh.exe 1644 qqyik.exe 1644 qqyik.exe 1076 likon.exe 1076 likon.exe 3000 gkmub.exe 3000 gkmub.exe 2736 beeovu.exe 2736 beeovu.exe 2584 ceefo.exe 2584 ceefo.exe -
Adds Run key to start application 2 TTPs 47 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\jeeolo = "C:\\Users\\Admin\\jeeolo.exe /N" zvdios.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\xoeah = "C:\\Users\\Admin\\xoeah.exe /o" nmfix.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\loobi = "C:\\Users\\Admin\\loobi.exe /I" xoeah.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\vqcuin = "C:\\Users\\Admin\\vqcuin.exe /A" xesej.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\moaoheh = "C:\\Users\\Admin\\moaoheh.exe /N" hjjoeh.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\likon = "C:\\Users\\Admin\\likon.exe /w" qqyik.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceefo = "C:\\Users\\Admin\\ceefo.exe /S" beeovu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\zvdios = "C:\\Users\\Admin\\zvdios.exe /p" yuuheur.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\haohie = "C:\\Users\\Admin\\haohie.exe /m" toafao.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\jouqo = "C:\\Users\\Admin\\jouqo.exe /Q" loobi.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\tqkin = "C:\\Users\\Admin\\tqkin.exe /X" bbkiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\piiwiu = "C:\\Users\\Admin\\piiwiu.exe /k" zeoum.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\ruubov = "C:\\Users\\Admin\\ruubov.exe /T" mgkeez.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\naiyaef = "C:\\Users\\Admin\\naiyaef.exe /H" ceefo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\xgloat = "C:\\Users\\Admin\\xgloat.exe /d" lauas.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\baodii = "C:\\Users\\Admin\\baodii.exe /p" baoleuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\retig = "C:\\Users\\Admin\\retig.exe /B" faeebo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\toafao = "C:\\Users\\Admin\\toafao.exe /g" jeeolo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\dairev = "C:\\Users\\Admin\\dairev.exe /k" sailuk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\reehe = "C:\\Users\\Admin\\reehe.exe /t" peuine.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\xesej = "C:\\Users\\Admin\\xesej.exe /l" moooq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\mgkeez = "C:\\Users\\Admin\\mgkeez.exe /O" piiwiu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\beeovu = "C:\\Users\\Admin\\beeovu.exe /i" gkmub.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\beuqeih = "C:\\Users\\Admin\\beuqeih.exe /A" 2563be922867d94e2722a26d3cbb02c0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeiuzih = "C:\\Users\\Admin\\qeiuzih.exe /G" jouqo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\boujai = "C:\\Users\\Admin\\boujai.exe /M" tqkin.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\daozif = "C:\\Users\\Admin\\daozif.exe /t" boujai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\hjjoeh = "C:\\Users\\Admin\\hjjoeh.exe /g" yeaud.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\pkduq = "C:\\Users\\Admin\\pkduq.exe /H" ddcax.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\yuuheur = "C:\\Users\\Admin\\yuuheur.exe /W" pkduq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\sailuk = "C:\\Users\\Admin\\sailuk.exe /B" dimer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\baoleuj = "C:\\Users\\Admin\\baoleuj.exe /E" hiisa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\nmfix = "C:\\Users\\Admin\\nmfix.exe /z" baodii.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\moooq = "C:\\Users\\Admin\\moooq.exe /k" reehe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeoum = "C:\\Users\\Admin\\zeoum.exe /B" daozif.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeaud = "C:\\Users\\Admin\\yeaud.exe /n" ruubov.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\lauas = "C:\\Users\\Admin\\lauas.exe /C" retig.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\trriz = "C:\\Users\\Admin\\trriz.exe /S" dairev.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\kaaoqot = "C:\\Users\\Admin\\kaaoqot.exe /c" qeiuzih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\peuine = "C:\\Users\\Admin\\peuine.exe /v" kaaoqot.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\gkmub = "C:\\Users\\Admin\\gkmub.exe /l" likon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\faeebo = "C:\\Users\\Admin\\faeebo.exe /e" naiyaef.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\dimer = "C:\\Users\\Admin\\dimer.exe /u" haohie.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiisa = "C:\\Users\\Admin\\hiisa.exe /I" beuqeih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\bbkiob = "C:\\Users\\Admin\\bbkiob.exe /b" vqcuin.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\qqyik = "C:\\Users\\Admin\\qqyik.exe /v" moaoheh.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\ddcax = "C:\\Users\\Admin\\ddcax.exe /t" xgloat.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 47 IoCs
pid Process 1276 2563be922867d94e2722a26d3cbb02c0_NeikiAnalytics.exe 2832 beuqeih.exe 2656 hiisa.exe 2780 baoleuj.exe 2528 baodii.exe 284 nmfix.exe 2800 xoeah.exe 2128 loobi.exe 304 jouqo.exe 1512 qeiuzih.exe 1676 kaaoqot.exe 572 peuine.exe 1128 reehe.exe 300 moooq.exe 1628 xesej.exe 2972 vqcuin.exe 1564 bbkiob.exe 844 tqkin.exe 3004 boujai.exe 2468 daozif.exe 2936 zeoum.exe 2816 piiwiu.exe 1960 mgkeez.exe 1584 ruubov.exe 1516 yeaud.exe 2416 hjjoeh.exe 2436 moaoheh.exe 1644 qqyik.exe 1076 likon.exe 3000 gkmub.exe 2736 beeovu.exe 2584 ceefo.exe 372 naiyaef.exe 1840 faeebo.exe 1528 retig.exe 1236 lauas.exe 1540 xgloat.exe 1612 ddcax.exe 2664 pkduq.exe 1148 yuuheur.exe 2564 zvdios.exe 2164 jeeolo.exe 2940 toafao.exe 1040 haohie.exe 2248 dimer.exe 1048 sailuk.exe 2760 dairev.exe -
Suspicious use of SetWindowsHookEx 48 IoCs
pid Process 1276 2563be922867d94e2722a26d3cbb02c0_NeikiAnalytics.exe 2832 beuqeih.exe 2656 hiisa.exe 2780 baoleuj.exe 2528 baodii.exe 284 nmfix.exe 2800 xoeah.exe 2128 loobi.exe 304 jouqo.exe 1512 qeiuzih.exe 1676 kaaoqot.exe 572 peuine.exe 1128 reehe.exe 300 moooq.exe 1628 xesej.exe 2972 vqcuin.exe 1564 bbkiob.exe 844 tqkin.exe 3004 boujai.exe 2468 daozif.exe 2936 zeoum.exe 2816 piiwiu.exe 1960 mgkeez.exe 1584 ruubov.exe 1516 yeaud.exe 2416 hjjoeh.exe 2436 moaoheh.exe 1644 qqyik.exe 1076 likon.exe 3000 gkmub.exe 2736 beeovu.exe 2584 ceefo.exe 372 naiyaef.exe 1840 faeebo.exe 1528 retig.exe 1236 lauas.exe 1540 xgloat.exe 1612 ddcax.exe 2664 pkduq.exe 1148 yuuheur.exe 2564 zvdios.exe 2164 jeeolo.exe 2940 toafao.exe 1040 haohie.exe 2248 dimer.exe 1048 sailuk.exe 2760 dairev.exe 1964 trriz.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1276 wrote to memory of 2832 1276 2563be922867d94e2722a26d3cbb02c0_NeikiAnalytics.exe 28 PID 1276 wrote to memory of 2832 1276 2563be922867d94e2722a26d3cbb02c0_NeikiAnalytics.exe 28 PID 1276 wrote to memory of 2832 1276 2563be922867d94e2722a26d3cbb02c0_NeikiAnalytics.exe 28 PID 1276 wrote to memory of 2832 1276 2563be922867d94e2722a26d3cbb02c0_NeikiAnalytics.exe 28 PID 2832 wrote to memory of 2656 2832 beuqeih.exe 29 PID 2832 wrote to memory of 2656 2832 beuqeih.exe 29 PID 2832 wrote to memory of 2656 2832 beuqeih.exe 29 PID 2832 wrote to memory of 2656 2832 beuqeih.exe 29 PID 2656 wrote to memory of 2780 2656 hiisa.exe 30 PID 2656 wrote to memory of 2780 2656 hiisa.exe 30 PID 2656 wrote to memory of 2780 2656 hiisa.exe 30 PID 2656 wrote to memory of 2780 2656 hiisa.exe 30 PID 2780 wrote to memory of 2528 2780 baoleuj.exe 31 PID 2780 wrote to memory of 2528 2780 baoleuj.exe 31 PID 2780 wrote to memory of 2528 2780 baoleuj.exe 31 PID 2780 wrote to memory of 2528 2780 baoleuj.exe 31 PID 2528 wrote to memory of 284 2528 baodii.exe 32 PID 2528 wrote to memory of 284 2528 baodii.exe 32 PID 2528 wrote to memory of 284 2528 baodii.exe 32 PID 2528 wrote to memory of 284 2528 baodii.exe 32 PID 284 wrote to memory of 2800 284 nmfix.exe 33 PID 284 wrote to memory of 2800 284 nmfix.exe 33 PID 284 wrote to memory of 2800 284 nmfix.exe 33 PID 284 wrote to memory of 2800 284 nmfix.exe 33 PID 2800 wrote to memory of 2128 2800 xoeah.exe 34 PID 2800 wrote to memory of 2128 2800 xoeah.exe 34 PID 2800 wrote to memory of 2128 2800 xoeah.exe 34 PID 2800 wrote to memory of 2128 2800 xoeah.exe 34 PID 2128 wrote to memory of 304 2128 loobi.exe 35 PID 2128 wrote to memory of 304 2128 loobi.exe 35 PID 2128 wrote to memory of 304 2128 loobi.exe 35 PID 2128 wrote to memory of 304 2128 loobi.exe 35 PID 304 wrote to memory of 1512 304 jouqo.exe 36 PID 304 wrote to memory of 1512 304 jouqo.exe 36 PID 304 wrote to memory of 1512 304 jouqo.exe 36 PID 304 wrote to memory of 1512 304 jouqo.exe 36 PID 1512 wrote to memory of 1676 1512 qeiuzih.exe 37 PID 1512 wrote to memory of 1676 1512 qeiuzih.exe 37 PID 1512 wrote to memory of 1676 1512 qeiuzih.exe 37 PID 1512 wrote to memory of 1676 1512 qeiuzih.exe 37 PID 1676 wrote to memory of 572 1676 kaaoqot.exe 38 PID 1676 wrote to memory of 572 1676 kaaoqot.exe 38 PID 1676 wrote to memory of 572 1676 kaaoqot.exe 38 PID 1676 wrote to memory of 572 1676 kaaoqot.exe 38 PID 572 wrote to memory of 1128 572 peuine.exe 39 PID 572 wrote to memory of 1128 572 peuine.exe 39 PID 572 wrote to memory of 1128 572 peuine.exe 39 PID 572 wrote to memory of 1128 572 peuine.exe 39 PID 1128 wrote to memory of 300 1128 reehe.exe 40 PID 1128 wrote to memory of 300 1128 reehe.exe 40 PID 1128 wrote to memory of 300 1128 reehe.exe 40 PID 1128 wrote to memory of 300 1128 reehe.exe 40 PID 300 wrote to memory of 1628 300 moooq.exe 41 PID 300 wrote to memory of 1628 300 moooq.exe 41 PID 300 wrote to memory of 1628 300 moooq.exe 41 PID 300 wrote to memory of 1628 300 moooq.exe 41 PID 1628 wrote to memory of 2972 1628 xesej.exe 42 PID 1628 wrote to memory of 2972 1628 xesej.exe 42 PID 1628 wrote to memory of 2972 1628 xesej.exe 42 PID 1628 wrote to memory of 2972 1628 xesej.exe 42 PID 2972 wrote to memory of 1564 2972 vqcuin.exe 45 PID 2972 wrote to memory of 1564 2972 vqcuin.exe 45 PID 2972 wrote to memory of 1564 2972 vqcuin.exe 45 PID 2972 wrote to memory of 1564 2972 vqcuin.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2563be922867d94e2722a26d3cbb02c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2563be922867d94e2722a26d3cbb02c0_NeikiAnalytics.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Users\Admin\beuqeih.exe"C:\Users\Admin\beuqeih.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\hiisa.exe"C:\Users\Admin\hiisa.exe"3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\baoleuj.exe"C:\Users\Admin\baoleuj.exe"4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\baodii.exe"C:\Users\Admin\baodii.exe"5⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\nmfix.exe"C:\Users\Admin\nmfix.exe"6⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:284 -
C:\Users\Admin\xoeah.exe"C:\Users\Admin\xoeah.exe"7⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\loobi.exe"C:\Users\Admin\loobi.exe"8⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\jouqo.exe"C:\Users\Admin\jouqo.exe"9⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:304 -
C:\Users\Admin\qeiuzih.exe"C:\Users\Admin\qeiuzih.exe"10⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Users\Admin\kaaoqot.exe"C:\Users\Admin\kaaoqot.exe"11⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\peuine.exe"C:\Users\Admin\peuine.exe"12⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:572 -
C:\Users\Admin\reehe.exe"C:\Users\Admin\reehe.exe"13⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Users\Admin\moooq.exe"C:\Users\Admin\moooq.exe"14⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:300 -
C:\Users\Admin\xesej.exe"C:\Users\Admin\xesej.exe"15⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Users\Admin\vqcuin.exe"C:\Users\Admin\vqcuin.exe"16⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\bbkiob.exe"C:\Users\Admin\bbkiob.exe"17⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1564 -
C:\Users\Admin\tqkin.exe"C:\Users\Admin\tqkin.exe"18⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:844 -
C:\Users\Admin\boujai.exe"C:\Users\Admin\boujai.exe"19⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3004 -
C:\Users\Admin\daozif.exe"C:\Users\Admin\daozif.exe"20⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2468 -
C:\Users\Admin\zeoum.exe"C:\Users\Admin\zeoum.exe"21⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2936 -
C:\Users\Admin\piiwiu.exe"C:\Users\Admin\piiwiu.exe"22⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2816 -
C:\Users\Admin\mgkeez.exe"C:\Users\Admin\mgkeez.exe"23⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1960 -
C:\Users\Admin\ruubov.exe"C:\Users\Admin\ruubov.exe"24⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1584 -
C:\Users\Admin\yeaud.exe"C:\Users\Admin\yeaud.exe"25⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1516 -
C:\Users\Admin\hjjoeh.exe"C:\Users\Admin\hjjoeh.exe"26⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2416 -
C:\Users\Admin\moaoheh.exe"C:\Users\Admin\moaoheh.exe"27⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2436 -
C:\Users\Admin\qqyik.exe"C:\Users\Admin\qqyik.exe"28⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1644 -
C:\Users\Admin\likon.exe"C:\Users\Admin\likon.exe"29⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1076 -
C:\Users\Admin\gkmub.exe"C:\Users\Admin\gkmub.exe"30⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3000 -
C:\Users\Admin\beeovu.exe"C:\Users\Admin\beeovu.exe"31⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2736 -
C:\Users\Admin\ceefo.exe"C:\Users\Admin\ceefo.exe"32⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2584 -
C:\Users\Admin\naiyaef.exe"C:\Users\Admin\naiyaef.exe"33⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:372 -
C:\Users\Admin\faeebo.exe"C:\Users\Admin\faeebo.exe"34⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1840 -
C:\Users\Admin\retig.exe"C:\Users\Admin\retig.exe"35⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1528 -
C:\Users\Admin\lauas.exe"C:\Users\Admin\lauas.exe"36⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1236 -
C:\Users\Admin\xgloat.exe"C:\Users\Admin\xgloat.exe"37⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1540 -
C:\Users\Admin\ddcax.exe"C:\Users\Admin\ddcax.exe"38⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1612 -
C:\Users\Admin\pkduq.exe"C:\Users\Admin\pkduq.exe"39⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2664 -
C:\Users\Admin\yuuheur.exe"C:\Users\Admin\yuuheur.exe"40⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1148 -
C:\Users\Admin\zvdios.exe"C:\Users\Admin\zvdios.exe"41⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2564 -
C:\Users\Admin\jeeolo.exe"C:\Users\Admin\jeeolo.exe"42⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2164 -
C:\Users\Admin\toafao.exe"C:\Users\Admin\toafao.exe"43⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2940 -
C:\Users\Admin\haohie.exe"C:\Users\Admin\haohie.exe"44⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1040 -
C:\Users\Admin\dimer.exe"C:\Users\Admin\dimer.exe"45⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2248 -
C:\Users\Admin\sailuk.exe"C:\Users\Admin\sailuk.exe"46⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1048 -
C:\Users\Admin\dairev.exe"C:\Users\Admin\dairev.exe"47⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2760 -
C:\Users\Admin\trriz.exe"C:\Users\Admin\trriz.exe"48⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1964
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
124KB
MD5701fdc9aa4b3a4f197210f76b37bc280
SHA1d34118e038488f084b8e6bcb6c6b3d0d158c4745
SHA256e229d6565b08ae7e389d1cb8fb531e65a72674955a329cc6f2ef11e9f6701125
SHA512048e6add08a5cf166b536f6b254fe4597fbdf4c27d33bab60017f5c063209357ebf11e103d67131a290e661aa58ffcd26955f56682d98c3116c61c56dcf04aae
-
Filesize
124KB
MD5ea2bd64d35f9ce683c10ea1729645884
SHA15fc82a0c3587f941f393c0874837e469c2dafd9e
SHA256f4785759d63367a53f5f37694e7e5c03a109fa05234e893d8e78d52858567849
SHA5128d259d8122affabe9ed89a10562422f57cabfd2a7587363d0566e42eb91d2b8c3c1623b891df91b1f09df9b9479889fdf6ca16b3ac39e1b6c2c048ddeffae203
-
Filesize
124KB
MD5cff1cd428c04ea4dfba41d4064aa452c
SHA10932945374c03f54c54bf81250f3de144b83ca8c
SHA2560e7ee997634397124c0fa33799af4494ca04c7e29053637d57daf45f0aa4f1e2
SHA512f804a74e039e259d274bdede844822b0a71133ed69611f68146a53628748fcb0719e3e0a30050d4e4ba0402a4346174cff5a8283fd13ea3fba4ae6022d8a21c1
-
Filesize
124KB
MD5a9c93fc08ddbee9f6f4b82958297bbc1
SHA115c92dfda7743c0014a5549ad50cc2a12e2c28e1
SHA256e14b8eddafdd959c02a253d03b7e6c61a6d202c254f2bffe23a3297267a4f326
SHA51269dc4a86256571318c5f444d85fc8e9058a74cd0befa7aa915b74359f80f0de88aadf09a43f1ab1ff86059389295e6c963b0b7f3c30b69d0b5a935cea06ee3c4
-
Filesize
124KB
MD587d1767c164adeabed5872acca424ec2
SHA1d4fba898e35ff4d5c210809c55c90a7cd4190f93
SHA25630ad859b35f8269e5eeb1ae432ab4318e03712c1aa97ae6bb6a77ef887e030da
SHA512dde231752c0855ca9bdcad3302f5657d27613ca34883e9f7fcf7d346ffa47862ee810f6fec7fdb6718236e0616fcfa0f62df128feff90d0a1faba47657b9f401
-
Filesize
124KB
MD5bdbba59392c7dff1824fc99bbe3fe463
SHA1c3bb4cb194d8ad30ddc17624dfb0892130376f26
SHA2565ea2a8b4456064322699fa4181ac525774d8c35be810cd0a136e28885a6a52bd
SHA512fa846de44374ccf359a54bf4d1a34391284e7b5b504c395f46a69e9dd35678ba32c4d6ff7806018de44dc34eb0017bdd484a86f2d83e1cece33bf10fc2ca3b27
-
Filesize
124KB
MD5df34ba830e0c8e4a7df218e071c9830f
SHA16547a72512c3a9d75349471eaa3f4273daf96174
SHA256a8935bb37091f2ba765be7ca57051750b338f045111826de7f8cb868be551a61
SHA512c52f8ecfba813eace43e451b0b5764e9e40ddef33918f831db5e7fd69db7f36711f6536cf5ae988e31d6e5f2a0c29afcec1b455e253e254ab45ba1cf55f21aa6
-
Filesize
124KB
MD509566e374cc2bdb6d0c24abe634a95e5
SHA1866e7ac8ef1cbc2e6f7812434bcf587898500ea3
SHA256d95ec317b28e24219e4dc10948a5302ff36e5d7f307bc568f77747847376dd31
SHA5129947f87b90ee93af516614993f401b184e810e3db60c1e816ea8da36c22ae060cc3bc5509a2dcff4113a0eb7e78c0372a915d7bf5e732d86cf332cea13e0b935
-
Filesize
124KB
MD58cacdee6ce360382c1fa1f3294d25e8e
SHA1b11719827bfd35e1ea9f9339a10eb9f831ed8bdb
SHA25674f1a0c2be5434a383d4ae9d48c21bc8cbb25dd8ac4d51c6a51889648fd55685
SHA51207724f54d28709fd1f53551eed083493df12cbd6d4d5db2ec020e6474b2cbb392cd6f1cf72190e3c3aba4c3c8cc05c1643ba16547dd62b28c149ba699b2de7fd
-
Filesize
124KB
MD5fe52c61447cfbb2a2d011c5df760fea6
SHA161499f2f95a4773db66bfb5d0b6e5a874294ae34
SHA25682fd877463b673f383b13dd7556da3f6cb58a90caeb2db5bb372eb1a1151c5f2
SHA5127c76a35a53912267578dc4f12bc2812c744a50f626bbcf394f4d099ce6a4d255212f14beab638a5b442b8b249e6be32a110be198bb374f88f05996df1aff4f6e
-
Filesize
124KB
MD513a2021dd3148edc5ff7e69e92c01bc5
SHA18ccd5554c50f932d31cfa0099609c454345840ff
SHA25600eeec9ebf43e88b62ba88fcd68eedff62bbf306d3bddd185f091dbb57c82466
SHA5126a6fd443a58ead77e2c5aa6fe231adbb2332c24a3f7a9bd981ad6b018ff1dc7bcc0286b0e3b0ddc8f5f2306537d6a203c3aa15c3f526b6d1154260a774e97ce1
-
Filesize
124KB
MD561bfffb3ac773248f061b39106f88a28
SHA11ce00f6fde9c2ec06f21a4820c3f445620c5c120
SHA256c28cbe27bfda04b1768e23a87fa4485419753daf0e045afbe72ff323747f12d1
SHA512c4e73eab2a5bf79537795782b11328b659e2fa0992c16de3ea55400edbc7e67fde093dd1dbb43b5a0b6337ae725eb29a08f10e5769fb6e2520beba36f8f6496e
-
Filesize
124KB
MD5809e7569b701e82ba1b914caa783fada
SHA1c6355c703d9ab93894ab3418ad0c5ab70dfe284c
SHA2561107af88c6db561e7775c0ca4ba4b8f8af00b12b885a7adeb05cc6e6cc1fbb18
SHA512af73d624a3958cd1aad0ddc79c6851fcdf7829fea54631acd7bbbd717c2ccb624b337467796e96f04c29ce41e79af48d8c529b4fe38ef35ae7775edeb9c859fa
-
Filesize
124KB
MD50944729c12678a735a44d43fcbc72ca9
SHA184fc2b0bd806a81c78f38bd645089f6d4f88be77
SHA256fa4cc4da4e6757d4963ec2cbd5c9b44778935488ad37c5ee53b093e8ceff4bc1
SHA512222b3a232e899c080e1125e2ef619c9310fb9593aa40dc7f9a41a17499d270a777871a9bb8d69b0e85fa4a597b7e94edba8927bed104a92a371d5bd3a58a6e1e
-
Filesize
124KB
MD569b817cab2c141e1ce4d883744f6e1d5
SHA119fbb9d84141877d8f6a748ecebedb3f824011bf
SHA2564cca50a6181abc2cb7d1f0c258663d3e0c1ce9e7fd89b3ebec2a665c354cec61
SHA512b173ea6801b59056124ef5a60304333b043051448ad778f34ed26a010acaf94832e218af2dbfc149b22c759862b7e322eac6fe8078455c47b6315c0ec00f9919
-
Filesize
124KB
MD553986697775e517755deae258586936e
SHA1b3598da83880203aa1d2f1c1a0638296b1b8996c
SHA2560446e358a375c43b6f08a56f232e5d44cef197954f1b5eb8a9741aa6d2d2e468
SHA512c2395c9fde41c1252acb1717042817e093a71a6da4229abfe9d16b27afe6ee4f06c9ba653cb016554c91db893592d2fc9a8c54cbfde817d50a04633a62ad345d