79b8045202c0bf4bd00f1a87461f47e8dafdb9d465613779166a3eb50ac4608e

Analysis

max time kernel
141s
max time network
126s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 13:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e03df631de55cf489fac35e6afa42c40_NeikiAnalytics.exe
Size

45KB
MD5

e03df631de55cf489fac35e6afa42c40
SHA1

420aae5598297e4bfa34b2a69cc761e762429907
SHA256

79b8045202c0bf4bd00f1a87461f47e8dafdb9d465613779166a3eb50ac4608e
SHA512

87882ba92592a5d3f007fcc9db9069643eb96496d6eba3fe259c9db1aaa44d690f59eb1da7af387e699ee9d75ff6c0c874e905959a4391b5945d76b9f02f71f4
SSDEEP

768:QuEGfqR5Aib8mpYkLJjO0x8klMGPjOTSZHy/6T0GWTrFVPl0GSYAJT7E7kuLvFtV:QJGfqfVwmpYk9OuMUn5y/IQTjPltSYQY

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 38 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gaemjbcg.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hiqbndpb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hggomh32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iaeiieeb.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ilknfn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gaemjbcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hellne32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hlfdkoin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hlfdkoin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ioijbj32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hkkalk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	e03df631de55cf489fac35e6afa42c40_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ggpimica.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ggpimica.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hnagjbdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hobcak32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hcplhi32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hdfflm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hdfflm32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hjjddchg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hgbebiao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hgdbhi32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hlakpp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hkkalk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ilknfn32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hgbebiao.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hobcak32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hjjddchg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iaeiieeb.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ioijbj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hiqbndpb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hlakpp32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hggomh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hnagjbdf.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hellne32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hcplhi32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	e03df631de55cf489fac35e6afa42c40_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hgdbhi32.exe

Executes dropped EXE 19 IoCs

pid	Process
2164	Ggpimica.exe
2584	Gaemjbcg.exe
2712	Hgbebiao.exe
2264	Hiqbndpb.exe
2832	Hdfflm32.exe
2504	Hgdbhi32.exe
2960	Hlakpp32.exe
2852	Hggomh32.exe
2168	Hnagjbdf.exe
1616	Hobcak32.exe
1356	Hellne32.exe
2820	Hlfdkoin.exe
1212	Hcplhi32.exe
2104	Hjjddchg.exe
1848	Hkkalk32.exe
1936	Iaeiieeb.exe
1036	Ilknfn32.exe
988	Ioijbj32.exe
1076	Iagfoe32.exe

Loads dropped DLL 42 IoCs

pid	Process
2220	e03df631de55cf489fac35e6afa42c40_NeikiAnalytics.exe
2220	e03df631de55cf489fac35e6afa42c40_NeikiAnalytics.exe
2164	Ggpimica.exe
2164	Ggpimica.exe
2584	Gaemjbcg.exe
2584	Gaemjbcg.exe
2712	Hgbebiao.exe
2712	Hgbebiao.exe
2264	Hiqbndpb.exe
2264	Hiqbndpb.exe
2832	Hdfflm32.exe
2832	Hdfflm32.exe
2504	Hgdbhi32.exe
2504	Hgdbhi32.exe
2960	Hlakpp32.exe
2960	Hlakpp32.exe
2852	Hggomh32.exe
2852	Hggomh32.exe
2168	Hnagjbdf.exe
2168	Hnagjbdf.exe
1616	Hobcak32.exe
1616	Hobcak32.exe
1356	Hellne32.exe
1356	Hellne32.exe
2820	Hlfdkoin.exe
2820	Hlfdkoin.exe
1212	Hcplhi32.exe
1212	Hcplhi32.exe
2104	Hjjddchg.exe
2104	Hjjddchg.exe
1848	Hkkalk32.exe
1848	Hkkalk32.exe
1936	Iaeiieeb.exe
1936	Iaeiieeb.exe
1036	Ilknfn32.exe
1036	Ilknfn32.exe
988	Ioijbj32.exe
988	Ioijbj32.exe
2368	WerFault.exe
2368	WerFault.exe
2368	WerFault.exe
2368	WerFault.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Hlfdkoin.exe	Hellne32.exe
File created	C:\Windows\SysWOW64\Iagfoe32.exe	Ioijbj32.exe
File created	C:\Windows\SysWOW64\Hdfflm32.exe	Hiqbndpb.exe
File created	C:\Windows\SysWOW64\Hgdbhi32.exe	Hdfflm32.exe
File opened for modification	C:\Windows\SysWOW64\Ilknfn32.exe	Iaeiieeb.exe
File created	C:\Windows\SysWOW64\Hobcak32.exe	Hnagjbdf.exe
File opened for modification	C:\Windows\SysWOW64\Hcplhi32.exe	Hlfdkoin.exe
File created	C:\Windows\SysWOW64\Lponfjoo.dll	Hlfdkoin.exe
File created	C:\Windows\SysWOW64\Hjjddchg.exe	Hcplhi32.exe
File created	C:\Windows\SysWOW64\Gcaciakh.dll	Ggpimica.exe
File opened for modification	C:\Windows\SysWOW64\Hgbebiao.exe	Gaemjbcg.exe
File created	C:\Windows\SysWOW64\Anllbdkl.dll	Hgdbhi32.exe
File created	C:\Windows\SysWOW64\Jjcpjl32.dll	Gaemjbcg.exe
File opened for modification	C:\Windows\SysWOW64\Hlakpp32.exe	Hgdbhi32.exe
File created	C:\Windows\SysWOW64\Nokeef32.dll	Hnagjbdf.exe
File created	C:\Windows\SysWOW64\Njgcpp32.dll	e03df631de55cf489fac35e6afa42c40_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\Hgbebiao.exe	Gaemjbcg.exe
File created	C:\Windows\SysWOW64\Hnagjbdf.exe	Hggomh32.exe
File created	C:\Windows\SysWOW64\Pljpdpao.dll	Hobcak32.exe
File opened for modification	C:\Windows\SysWOW64\Iagfoe32.exe	Ioijbj32.exe
File opened for modification	C:\Windows\SysWOW64\Ggpimica.exe	e03df631de55cf489fac35e6afa42c40_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\Phofkg32.dll	Hiqbndpb.exe
File opened for modification	C:\Windows\SysWOW64\Hnagjbdf.exe	Hggomh32.exe
File created	C:\Windows\SysWOW64\Dgnijonn.dll	Ilknfn32.exe
File created	C:\Windows\SysWOW64\Hellne32.exe	Hobcak32.exe
File opened for modification	C:\Windows\SysWOW64\Hkkalk32.exe	Hjjddchg.exe
File opened for modification	C:\Windows\SysWOW64\Hiqbndpb.exe	Hgbebiao.exe
File created	C:\Windows\SysWOW64\Hlakpp32.exe	Hgdbhi32.exe
File opened for modification	C:\Windows\SysWOW64\Iaeiieeb.exe	Hkkalk32.exe
File created	C:\Windows\SysWOW64\Oiogaqdb.dll	Hellne32.exe
File created	C:\Windows\SysWOW64\Hcplhi32.exe	Hlfdkoin.exe
File created	C:\Windows\SysWOW64\Ggpimica.exe	e03df631de55cf489fac35e6afa42c40_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\Gaemjbcg.exe	Ggpimica.exe
File created	C:\Windows\SysWOW64\Omabcb32.dll	Hgbebiao.exe
File created	C:\Windows\SysWOW64\Gmibbifn.dll	Hkkalk32.exe
File opened for modification	C:\Windows\SysWOW64\Hggomh32.exe	Hlakpp32.exe
File created	C:\Windows\SysWOW64\Enlbgc32.dll	Hggomh32.exe
File opened for modification	C:\Windows\SysWOW64\Hlfdkoin.exe	Hellne32.exe
File created	C:\Windows\SysWOW64\Iaeiieeb.exe	Hkkalk32.exe
File created	C:\Windows\SysWOW64\Ioijbj32.exe	Ilknfn32.exe
File opened for modification	C:\Windows\SysWOW64\Hgdbhi32.exe	Hdfflm32.exe
File created	C:\Windows\SysWOW64\Cnkajfop.dll	Hdfflm32.exe
File created	C:\Windows\SysWOW64\Mhfkbo32.dll	Hcplhi32.exe
File created	C:\Windows\SysWOW64\Pdpfph32.dll	Iaeiieeb.exe
File created	C:\Windows\SysWOW64\Bhpdae32.dll	Hlakpp32.exe
File opened for modification	C:\Windows\SysWOW64\Hjjddchg.exe	Hcplhi32.exe
File created	C:\Windows\SysWOW64\Hkkalk32.exe	Hjjddchg.exe
File opened for modification	C:\Windows\SysWOW64\Gaemjbcg.exe	Ggpimica.exe
File created	C:\Windows\SysWOW64\Ilknfn32.exe	Iaeiieeb.exe
File opened for modification	C:\Windows\SysWOW64\Hobcak32.exe	Hnagjbdf.exe
File opened for modification	C:\Windows\SysWOW64\Hellne32.exe	Hobcak32.exe
File created	C:\Windows\SysWOW64\Ejdmpb32.dll	Hjjddchg.exe
File opened for modification	C:\Windows\SysWOW64\Ioijbj32.exe	Ilknfn32.exe
File created	C:\Windows\SysWOW64\Gjenmobn.dll	Ioijbj32.exe
File created	C:\Windows\SysWOW64\Hiqbndpb.exe	Hgbebiao.exe
File opened for modification	C:\Windows\SysWOW64\Hdfflm32.exe	Hiqbndpb.exe
File created	C:\Windows\SysWOW64\Hggomh32.exe	Hlakpp32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2368	1076	WerFault.exe	46

Modifies registry class 60 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	e03df631de55cf489fac35e6afa42c40_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hlfdkoin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hjjddchg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ioijbj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hgbebiao.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hobcak32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hcplhi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hkkalk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	e03df631de55cf489fac35e6afa42c40_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	e03df631de55cf489fac35e6afa42c40_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Enlbgc32.dll"	Hggomh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	e03df631de55cf489fac35e6afa42c40_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hdfflm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hgdbhi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hjjddchg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iaeiieeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gjenmobn.dll"	Ioijbj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	e03df631de55cf489fac35e6afa42c40_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Anllbdkl.dll"	Hgdbhi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hlakpp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hggomh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gcaciakh.dll"	Ggpimica.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gaemjbcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmibbifn.dll"	Hkkalk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdpfph32.dll"	Iaeiieeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hgbebiao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nokeef32.dll"	Hnagjbdf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ioijbj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Njgcpp32.dll"	e03df631de55cf489fac35e6afa42c40_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjcpjl32.dll"	Gaemjbcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gaemjbcg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hiqbndpb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iaeiieeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Phofkg32.dll"	Hiqbndpb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pljpdpao.dll"	Hobcak32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oiogaqdb.dll"	Hellne32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hellne32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hdfflm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hcplhi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cnkajfop.dll"	Hdfflm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hgdbhi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhpdae32.dll"	Hlakpp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hlfdkoin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ggpimica.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Omabcb32.dll"	Hgbebiao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lponfjoo.dll"	Hlfdkoin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hggomh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ejdmpb32.dll"	Hjjddchg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ilknfn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hlakpp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hnagjbdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dgnijonn.dll"	Ilknfn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ilknfn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hnagjbdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mhfkbo32.dll"	Hcplhi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hkkalk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ggpimica.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hiqbndpb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hobcak32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hellne32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2164	2220	e03df631de55cf489fac35e6afa42c40_NeikiAnalytics.exe	28
PID 2220 wrote to memory of 2164	2220	e03df631de55cf489fac35e6afa42c40_NeikiAnalytics.exe	28
PID 2220 wrote to memory of 2164	2220	e03df631de55cf489fac35e6afa42c40_NeikiAnalytics.exe	28
PID 2220 wrote to memory of 2164	2220	e03df631de55cf489fac35e6afa42c40_NeikiAnalytics.exe	28
PID 2164 wrote to memory of 2584	2164	Ggpimica.exe	29
PID 2164 wrote to memory of 2584	2164	Ggpimica.exe	29
PID 2164 wrote to memory of 2584	2164	Ggpimica.exe	29
PID 2164 wrote to memory of 2584	2164	Ggpimica.exe	29
PID 2584 wrote to memory of 2712	2584	Gaemjbcg.exe	30
PID 2584 wrote to memory of 2712	2584	Gaemjbcg.exe	30
PID 2584 wrote to memory of 2712	2584	Gaemjbcg.exe	30
PID 2584 wrote to memory of 2712	2584	Gaemjbcg.exe	30
PID 2712 wrote to memory of 2264	2712	Hgbebiao.exe	31
PID 2712 wrote to memory of 2264	2712	Hgbebiao.exe	31
PID 2712 wrote to memory of 2264	2712	Hgbebiao.exe	31
PID 2712 wrote to memory of 2264	2712	Hgbebiao.exe	31
PID 2264 wrote to memory of 2832	2264	Hiqbndpb.exe	32
PID 2264 wrote to memory of 2832	2264	Hiqbndpb.exe	32
PID 2264 wrote to memory of 2832	2264	Hiqbndpb.exe	32
PID 2264 wrote to memory of 2832	2264	Hiqbndpb.exe	32
PID 2832 wrote to memory of 2504	2832	Hdfflm32.exe	33
PID 2832 wrote to memory of 2504	2832	Hdfflm32.exe	33
PID 2832 wrote to memory of 2504	2832	Hdfflm32.exe	33
PID 2832 wrote to memory of 2504	2832	Hdfflm32.exe	33
PID 2504 wrote to memory of 2960	2504	Hgdbhi32.exe	34
PID 2504 wrote to memory of 2960	2504	Hgdbhi32.exe	34
PID 2504 wrote to memory of 2960	2504	Hgdbhi32.exe	34
PID 2504 wrote to memory of 2960	2504	Hgdbhi32.exe	34
PID 2960 wrote to memory of 2852	2960	Hlakpp32.exe	35
PID 2960 wrote to memory of 2852	2960	Hlakpp32.exe	35
PID 2960 wrote to memory of 2852	2960	Hlakpp32.exe	35
PID 2960 wrote to memory of 2852	2960	Hlakpp32.exe	35
PID 2852 wrote to memory of 2168	2852	Hggomh32.exe	36
PID 2852 wrote to memory of 2168	2852	Hggomh32.exe	36
PID 2852 wrote to memory of 2168	2852	Hggomh32.exe	36
PID 2852 wrote to memory of 2168	2852	Hggomh32.exe	36
PID 2168 wrote to memory of 1616	2168	Hnagjbdf.exe	37
PID 2168 wrote to memory of 1616	2168	Hnagjbdf.exe	37
PID 2168 wrote to memory of 1616	2168	Hnagjbdf.exe	37
PID 2168 wrote to memory of 1616	2168	Hnagjbdf.exe	37
PID 1616 wrote to memory of 1356	1616	Hobcak32.exe	38
PID 1616 wrote to memory of 1356	1616	Hobcak32.exe	38
PID 1616 wrote to memory of 1356	1616	Hobcak32.exe	38
PID 1616 wrote to memory of 1356	1616	Hobcak32.exe	38
PID 1356 wrote to memory of 2820	1356	Hellne32.exe	39
PID 1356 wrote to memory of 2820	1356	Hellne32.exe	39
PID 1356 wrote to memory of 2820	1356	Hellne32.exe	39
PID 1356 wrote to memory of 2820	1356	Hellne32.exe	39
PID 2820 wrote to memory of 1212	2820	Hlfdkoin.exe	40
PID 2820 wrote to memory of 1212	2820	Hlfdkoin.exe	40
PID 2820 wrote to memory of 1212	2820	Hlfdkoin.exe	40
PID 2820 wrote to memory of 1212	2820	Hlfdkoin.exe	40
PID 1212 wrote to memory of 2104	1212	Hcplhi32.exe	41
PID 1212 wrote to memory of 2104	1212	Hcplhi32.exe	41
PID 1212 wrote to memory of 2104	1212	Hcplhi32.exe	41
PID 1212 wrote to memory of 2104	1212	Hcplhi32.exe	41
PID 2104 wrote to memory of 1848	2104	Hjjddchg.exe	42
PID 2104 wrote to memory of 1848	2104	Hjjddchg.exe	42
PID 2104 wrote to memory of 1848	2104	Hjjddchg.exe	42
PID 2104 wrote to memory of 1848	2104	Hjjddchg.exe	42
PID 1848 wrote to memory of 1936	1848	Hkkalk32.exe	43
PID 1848 wrote to memory of 1936	1848	Hkkalk32.exe	43
PID 1848 wrote to memory of 1936	1848	Hkkalk32.exe	43
PID 1848 wrote to memory of 1936	1848	Hkkalk32.exe	43

C:\Users\Admin\AppData\Local\Temp\e03df631de55cf489fac35e6afa42c40_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\e03df631de55cf489fac35e6afa42c40_NeikiAnalytics.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\SysWOW64\Ggpimica.exe
  C:\Windows\system32\Ggpimica.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2164
- - C:\Windows\SysWOW64\Gaemjbcg.exe
    C:\Windows\system32\Gaemjbcg.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2584
  - - C:\Windows\SysWOW64\Hgbebiao.exe
      C:\Windows\system32\Hgbebiao.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2712
    - - C:\Windows\SysWOW64\Hiqbndpb.exe
        
        C:\Windows\system32\Hiqbndpb.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2264
      - C:\Windows\SysWOW64\Hdfflm32.exe
        
        C:\Windows\system32\Hdfflm32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2832
        
        C:\Windows\SysWOW64\Hgdbhi32.exe
        
        C:\Windows\system32\Hgdbhi32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2504
        
        C:\Windows\SysWOW64\Hlakpp32.exe
        
        C:\Windows\system32\Hlakpp32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2960
        
        C:\Windows\SysWOW64\Hggomh32.exe
        
        C:\Windows\system32\Hggomh32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2852
        
        C:\Windows\SysWOW64\Hnagjbdf.exe
        
        C:\Windows\system32\Hnagjbdf.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2168
        
        C:\Windows\SysWOW64\Hobcak32.exe
        
        C:\Windows\system32\Hobcak32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1616
        
        C:\Windows\SysWOW64\Hellne32.exe
        
        C:\Windows\system32\Hellne32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1356
        
        C:\Windows\SysWOW64\Hlfdkoin.exe
        
        C:\Windows\system32\Hlfdkoin.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2820
        
        C:\Windows\SysWOW64\Hcplhi32.exe
        
        C:\Windows\system32\Hcplhi32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1212
        
        C:\Windows\SysWOW64\Hjjddchg.exe
        
        C:\Windows\system32\Hjjddchg.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2104
        
        C:\Windows\SysWOW64\Hkkalk32.exe
        
        C:\Windows\system32\Hkkalk32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1848
        
        C:\Windows\SysWOW64\Iaeiieeb.exe
        
        C:\Windows\system32\Iaeiieeb.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Modifies registry class
        
        PID:1936
        
        C:\Windows\SysWOW64\Ilknfn32.exe
        
        C:\Windows\system32\Ilknfn32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Modifies registry class
        
        PID:1036
        
        C:\Windows\SysWOW64\Ioijbj32.exe
        
        C:\Windows\system32\Ioijbj32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Modifies registry class
        
        PID:988
        
        C:\Windows\SysWOW64\Iagfoe32.exe
        
        C:\Windows\system32\Iagfoe32.exe
        20⤵
        Executes dropped EXE
        
        PID:1076
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1076 -s 140
        21⤵
        Loads dropped DLL
        Program crash
        
        PID:2368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Hgdbhi32.exe

Filesize
45KB

MD5
18ad1bb767c186ad4be4f32d5433893d

SHA1
9541b4f4f068897c170363a7545afb2503e074d6

SHA256
5781ef3eed39e051a6d1a2567212518a158a0903fecf51b577510b2258dcf87d

SHA512
3300d908417264c31322b52a8af45abad33fefe3820aee94a24f21e8ee11605158ef55f1a8b59b62b203208790bfe2b33ec3a1623e59cef7be9331946bc8080e

Download Submit
C:\Windows\SysWOW64\Hggomh32.exe

Filesize
45KB

MD5
da0bcf8bb10ce53945cef71b1bc332ae

SHA1
5ea6a9dc8d664efa1df64e3a3d966b2c6bb6f916

SHA256
b78e84b3d9dd27e611240f3016deaba134e052636121a2e05b1435787a615c79

SHA512
6d896d0e9f7a92a7eaae9b58a8b8a6db7ca2b9e77c5ee9cb9c20d6f5f21bc615627bad71a31b4a95dfdaecbaa406b84fe3556d18c59186f4768590f7a0fe66c8

Download Submit
C:\Windows\SysWOW64\Hiqbndpb.exe

Filesize
45KB

MD5
f7014217f8058b3d4a08e8e054cab12e

SHA1
dc7090d0982d7ccec31f154cdfbd425582063fcc

SHA256
6b764014bddc2f3b1fc37daa0130d2bb6e47069017e64196eb516897fadeb5f1

SHA512
eb36758085be705825d3ff8f10eb446d0814e7e1b9070a1df9893978e57ce7322fabc1585ccb6f7f6464d21bcbd18252bc5055b64df179e7af4f9a78e0647452

Download Submit
C:\Windows\SysWOW64\Iagfoe32.exe

Filesize
45KB

MD5
5ed35f3fc314af086de776875e1f2c79

SHA1
4d97c34df123ff90b9ebaab439e1b77e74c3853f

SHA256
21dca66fadd3e9118a6e2f7153cdf4b1c11f6406df06ade2029818e5f9af7aa0

SHA512
1cb6453068ff28a3f8826439fb31f6b30da82ee6c54c11e8d533738d9e65b78bf02c46ea64f77b7a09167bb437e38825ffe9253779e28ee7be4702e90745606b

Download Submit
C:\Windows\SysWOW64\Ilknfn32.exe

Filesize
45KB

MD5
c4e2dee97eb00c6f0d5b117f7ead8f46

SHA1
b87c26ee09db51ccd135a707c6ed547ddbc7e26b

SHA256
d5d0bfba98e19a78ccc409bf8150f653c3d6446f67c1245a8243a49d4b9664d4

SHA512
97f5b1b65976926b99cda27e6c17c388f1c41611a8e5894cd2e50f24b162ec76fa18d54dbe182a967510acd1b8c5420593816dd887010acf5a5ed53498429d81

Download Submit
C:\Windows\SysWOW64\Ioijbj32.exe

Filesize
45KB

MD5
15ed1c1ad4a1b7255705632c466d0dcc

SHA1
bdb5c45993d6cb422d6f7670c2102c50b5b84e41

SHA256
c4e9a35f3793ddabf10b221294ce9863a5f2177acf73cb6a88c169389b1312f5

SHA512
787007c259680bbeff2c8b9a786084a0d2a0dba41dd7f27c8668b0556f3c30a935cb79c439c33cdeef09c4d1f9f69d99012513415953523e925789daa67daf16

Download Submit
\Windows\SysWOW64\Gaemjbcg.exe

Filesize
45KB

MD5
0f3f1ba7383d3ef32c9b74f0adc4e70b

SHA1
a9edf91b62f59a11133ff0c5970899b73d9a6932

SHA256
6a4606a2cb76ad10b644b8e0e01a8e10e3006a8b9c2ba992454d556d1c73ef6c

SHA512
17011f5ba80536dd9d818872850cf45a1bf15459c787106effbb57b18bbafa15f0fcfa240b80e420f460dde240893455d564d7a2dd2732bd70610a45fbfe22d7

Download Submit
\Windows\SysWOW64\Ggpimica.exe

Filesize
45KB

MD5
bf4fa724a3c556414e3b9f1b219c777c

SHA1
ad96031dd42268a74142bf06b8fabe86b58dda53

SHA256
3a1cd2bb88155f2e3bb7cb9fc40963b3b4fd6c06423af0d893288c16155195a7

SHA512
bdb3ab1a77b9d767de58271dccbcb3517dd226726fcbbcc4d391b94012b50df7fcebb4ce369d5a94f6524a0409a23abb4275383e889e859d1de39f800207af94

Download Submit
\Windows\SysWOW64\Hcplhi32.exe

Filesize
45KB

MD5
461dcc0eb1fb9b542b70cf7c0333b6ee

SHA1
c9941cec4aa0f93c6b0cd5fc7dffd491beb92c26

SHA256
f9ec73aad5984416db0e6683708e5627dee09a0a0e3684e0573b5d82323dff8e

SHA512
2b6d14a8f6320a9f070e555a3f9929949a06a451235e1c021572f2dbec90f882848e5b9252dbed732a241dcf6dca6480bc939e02aa20558065aaa61cf889daca

Download Submit
\Windows\SysWOW64\Hdfflm32.exe

Filesize
45KB

MD5
840c6e370504e74abc99753c68cc41a5

SHA1
f79ce20aea8d73e1b9a115bfb5eecdce53e1d79d

SHA256
b93d096b53105ca6a1610e2c9bc9f2bdd2679c7b681d29ac532f29b271306066

SHA512
49e4409de32da9fe0ece4695c7618a31a342d4f7893d9b66d418ae77a26ff21ff433499475119faa9ede4035bfaaec6f8e18a4dc7bb3a41cbfe3c4779b762ea3

Download Submit
\Windows\SysWOW64\Hellne32.exe

Filesize
45KB

MD5
519e8c547c4fdce650c9efc76c4b3c2a

SHA1
e6c7bfe7a21f797c5106210b1741ac507ec2e7c3

SHA256
f5d00c3c355ffd080151616d2539251be4dbced52b2fc4c9c0ef6c0bfd140ea9

SHA512
80c2c7ad527d4f26caee3f6b70cb30929fcc820afa4ae4202e6b62b54b64f4116e673ca5422d936ba620232dce62773469d633b2557470559b5a4a8275f611fd

Download Submit
\Windows\SysWOW64\Hgbebiao.exe

Filesize
45KB

MD5
5a291f6657f7e9c193260e3a49f2deb6

SHA1
46ee4141df2c4a75aa979bf1e46f7fab3295467a

SHA256
f083839ac4ed8bc82bd93187c30f002d0f79ec82a7cb64f9870c288ba5cc9dd9

SHA512
6a6a7bd2d2475d7d494de30131cd7dc9e057158c61a8e743b7542b0fd5220e2955d08c18eb8596b878e92feeab3f604223d0607ccaf5a0887abf9eb866c06d20

Download Submit
\Windows\SysWOW64\Hjjddchg.exe

Filesize
45KB

MD5
9c896fd2c2c707125ae01934712c9061

SHA1
c0a33b7cc5e997e0d7b8fee1ef7bdf9b0b4845b1

SHA256
da5d29151881d7a1adfc33e09c9bfaf75c6e5ed8cbfce46b7bf3b5dffbc473a4

SHA512
53fd2bf8bfbad675c667b3eab576b8014564f586c9916505fce633632f3b083e9cead2f6a2f8dfbb6bc8bd5029b220d35cd64689e101f8b924510177d0e16311

Download Submit
\Windows\SysWOW64\Hkkalk32.exe

Filesize
45KB

MD5
8f8790c7b8413ac75d74bc3d3d5bf45b

SHA1
21c9e8ed6f7b9ac10264258464d33c60f00e6253

SHA256
89db5ba4c2d425c29b29e05c819b2111e80e1b3c95ac85088f9685a7333c9413

SHA512
1d617dfc7091663ea6a7acccc56165bd579633b08ac67c301e7cadaa617b8347b88cbb523e542c6acf77c7d531bf7587c65acee85aa408f1b606de6fd8008451

Download Submit
\Windows\SysWOW64\Hlakpp32.exe

Filesize
45KB

MD5
d099bd6b1ddc7b553e6fda10e00368bb

SHA1
acb725ae6b378d09986ea378c1773f6b1c2bc3a0

SHA256
4da2024e94987e7154704e8532bcdb0cee4547ab7116aeb6967322e7078b0596

SHA512
77381c85001f9e023293b940dff2cfc064b51e21cab966dfbdf3ca7d760675b9ca3698c2fcc4c449178269f55bdd39ef127f12f26eb4e349cdc71a81d5c70ff8

Download Submit
\Windows\SysWOW64\Hlfdkoin.exe

Filesize
45KB

MD5
84f0f8630177756c83ce8a5104d96193

SHA1
5877a124bad87fd17ecb3a98dcb7c3cc7fce41f6

SHA256
5e01cb998309e427fca8be4ab675307715ecc5086802d1ff228312ed7d5fcb17

SHA512
317a56987a85d00603d31f3faad650866eacbe2302621f5fbf217b972823fc9861e66393d0206542b620a3422909756cc83cd7453f37579e030d81afc5ef360f

Download Submit
\Windows\SysWOW64\Hnagjbdf.exe

Filesize
45KB

MD5
5dfe4cbad398ddc5cc377f3ae4f34a22

SHA1
4ffd54f687faa9b308453b6ba2b83cee17434fc5

SHA256
fabd23563f4fed8d2bd22a48150ecbace6e0635b3433453f9fb1feb1f7cffc4d

SHA512
104bbbdee5fd3192f8d37913c208626ba2dff519d0bf564987eb93f1e6da123a7a0fbd1fcd2af7fcc4da28f3d53a02621b023a7151d3eea036806fd767619fb2

Download Submit
\Windows\SysWOW64\Hobcak32.exe

Filesize
45KB

MD5
653e0797106a4743c595196db1c6d35b

SHA1
81795b3150590042ee8603bc3168ce64ad68f567

SHA256
f17e7c581d0f7cd5eb29a1104af8538a42c07dfaf502f788715c9e42bb5f9133

SHA512
c09b11a19c9329820177d0cc762c4b9c1a8ff8e7a0d81a2c22c1c6c96c1fd87ea54d3832bc68d7aa220afa64aa6d4803b9c41ea06332e8db1b974e0466a050d1

Download Submit
\Windows\SysWOW64\Iaeiieeb.exe

Filesize
45KB

MD5
87161fae9036eb03dd2b7a751148ca76

SHA1
2a6e3c72485882594493759bdc15e576ae05c664

SHA256
2989d2f32ca4a6c532f3f120192fe627ca0d8b7e28f09ce350c82be30765eb03

SHA512
d8816cf9596444ce8209051fe13eb4cad5a190ea8bb9855bbec2da874d530d1579d3460bfc77ea6ef920a657f08f87d031e64d905ef1ca5dfa8e9d2423251c1e

Download Submit
memory/988-245-0x0000000000250000-0x000000000027F000-memory.dmp

Filesize
188KB

Download
memory/988-268-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/988-239-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1036-230-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1036-267-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1076-249-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1212-179-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1212-263-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1212-191-0x00000000002E0000-0x000000000030F000-memory.dmp

Filesize
188KB

Download
memory/1356-164-0x0000000000280000-0x00000000002AF000-memory.dmp

Filesize
188KB

Download
memory/1356-261-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1356-156-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1616-260-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1616-138-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1848-207-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1848-265-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1848-219-0x0000000000250000-0x000000000027F000-memory.dmp

Filesize
188KB

Download
memory/1936-266-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1936-220-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2104-192-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2104-264-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2104-200-0x00000000002E0000-0x000000000030F000-memory.dmp

Filesize
188KB

Download
memory/2164-26-0x0000000000250000-0x000000000027F000-memory.dmp

Filesize
188KB

Download
memory/2164-13-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2164-251-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2168-259-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2220-250-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2220-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2220-6-0x0000000000250000-0x000000000027F000-memory.dmp

Filesize
188KB

Download
memory/2264-67-0x0000000000250000-0x000000000027F000-memory.dmp

Filesize
188KB

Download
memory/2264-254-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2264-54-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2504-256-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2504-96-0x0000000000250000-0x000000000027F000-memory.dmp

Filesize
188KB

Download
memory/2504-90-0x0000000000250000-0x000000000027F000-memory.dmp

Filesize
188KB

Download
memory/2504-82-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2584-40-0x0000000000250000-0x000000000027F000-memory.dmp

Filesize
188KB

Download
memory/2584-252-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2584-27-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2712-253-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2712-41-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2820-171-0x0000000000250000-0x000000000027F000-memory.dmp

Filesize
188KB

Download
memory/2820-262-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2832-81-0x0000000000250000-0x000000000027F000-memory.dmp

Filesize
188KB

Download
memory/2832-68-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2832-255-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2852-258-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2852-123-0x0000000000250000-0x000000000027F000-memory.dmp

Filesize
188KB

Download
memory/2852-111-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2852-124-0x0000000000250000-0x000000000027F000-memory.dmp

Filesize
188KB

Download
memory/2960-257-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2960-110-0x0000000000250000-0x000000000027F000-memory.dmp

Filesize
188KB

Download
memory/2960-97-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads