6de70ece4674e6c09397abdfa2e7a4c20ca8453cd0a8063edef283fa545bc4e8

Analysis

max time kernel
136s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19/05/2024, 22:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4b5616b5619da6474f7a3e3b1839e190_NeikiAnalytics.exe
Size 768KB
Sample240519-2bvq6adf72
SHA256 6de70ece4674e6c09397abdfa2e7a4c20ca8453cd0a8063edef283fa545bc4e8
MD5 4b5616b5619da6474f7a3e3b1839e190
SHA1 040a684119a2c5db7ab57a7fff3d8db4e3a2abc7
SHA512 0da44d9aed71821c4dab050c248e52686700330e286b01e21e617c366ba5bfc8eac07f7bd3aac74bf3bf73cf99abf023ee4c4ec9369b1d7210ae844ba382b9d0
SSDEEP 12288:E83vb6IveDVqvQ6IvYvc6IveDVqvQ6IvBaSHaMaZRBEYyqmaf2qwiHPKgRC4gvGJ:7q5h3q5htaSHFaZRBEYyqmaf2qwiHPKu
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

backdoor dropper persistence trojan

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 30 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnolfdcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lknjmkdo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnlfigcc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpkbebbf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgnnhk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nceonl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	4b5616b5619da6474f7a3e3b1839e190_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lphfpbdi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnmopdep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nnolfdcn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgpagm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lcgblncm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndghmo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	4b5616b5619da6474f7a3e3b1839e190_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpfijcfl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lgpagm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lknjmkdo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njljefql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njljefql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mpkbebbf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nnmopdep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lphfpbdi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nceonl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ndghmo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgnnhk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lpfijcfl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcgblncm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mnlfigcc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mciobn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mciobn32.exe

Malware Dropper & Backdoor - Berbew 15 IoCs

Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.

backdoor trojan dropper

resource	yara_rule
behavioral2/files/0x00090000000233ea-7.dat	family_berbew
behavioral2/files/0x000700000002341d-15.dat	family_berbew
behavioral2/files/0x000700000002341f-24.dat	family_berbew
behavioral2/files/0x0007000000023421-31.dat	family_berbew
behavioral2/files/0x0007000000023423-40.dat	family_berbew
behavioral2/files/0x0007000000023427-55.dat	family_berbew
behavioral2/files/0x0007000000023425-48.dat	family_berbew
behavioral2/files/0x000700000002342a-63.dat	family_berbew
behavioral2/files/0x000700000002342c-71.dat	family_berbew
behavioral2/files/0x000700000002342e-79.dat	family_berbew
behavioral2/files/0x0007000000023430-87.dat	family_berbew
behavioral2/files/0x0007000000023432-95.dat	family_berbew
behavioral2/files/0x0007000000023433-103.dat	family_berbew
behavioral2/files/0x0007000000023435-111.dat	family_berbew
behavioral2/files/0x0007000000023438-120.dat	family_berbew

Executes dropped EXE 15 IoCs

pid	Process
4140	Lpfijcfl.exe
3768	Lgpagm32.exe
3328	Lphfpbdi.exe
960	Lcgblncm.exe
1876	Lknjmkdo.exe
3264	Mnlfigcc.exe
892	Mpkbebbf.exe
1544	Mciobn32.exe
1352	Mgnnhk32.exe
1468	Njljefql.exe
2376	Nceonl32.exe
5040	Nnmopdep.exe
3624	Ndghmo32.exe
1396	Nnolfdcn.exe
2952	Nkcmohbg.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Lphfpbdi.exe	Lgpagm32.exe
File created	C:\Windows\SysWOW64\Lknjmkdo.exe	Lcgblncm.exe
File created	C:\Windows\SysWOW64\Mnlfigcc.exe	Lknjmkdo.exe
File created	C:\Windows\SysWOW64\Lifenaok.dll	Mpkbebbf.exe
File created	C:\Windows\SysWOW64\Hnfmbf32.dll	Mciobn32.exe
File created	C:\Windows\SysWOW64\Nnolfdcn.exe	Ndghmo32.exe
File created	C:\Windows\SysWOW64\Nkcmohbg.exe	Nnolfdcn.exe
File created	C:\Windows\SysWOW64\Lgpagm32.exe	Lpfijcfl.exe
File opened for modification	C:\Windows\SysWOW64\Mnlfigcc.exe	Lknjmkdo.exe
File created	C:\Windows\SysWOW64\Kcbibebo.dll	Mgnnhk32.exe
File created	C:\Windows\SysWOW64\Fcdjjo32.dll	Njljefql.exe
File opened for modification	C:\Windows\SysWOW64\Nnolfdcn.exe	Ndghmo32.exe
File opened for modification	C:\Windows\SysWOW64\Nkcmohbg.exe	Nnolfdcn.exe
File created	C:\Windows\SysWOW64\Hnibdpde.dll	Nnolfdcn.exe
File opened for modification	C:\Windows\SysWOW64\Lcgblncm.exe	Lphfpbdi.exe
File created	C:\Windows\SysWOW64\Lphfpbdi.exe	Lgpagm32.exe
File created	C:\Windows\SysWOW64\Mglppmnd.dll	Lgpagm32.exe
File created	C:\Windows\SysWOW64\Nceonl32.exe	Njljefql.exe
File opened for modification	C:\Windows\SysWOW64\Ndghmo32.exe	Nnmopdep.exe
File opened for modification	C:\Windows\SysWOW64\Lgpagm32.exe	Lpfijcfl.exe
File created	C:\Windows\SysWOW64\Mciobn32.exe	Mpkbebbf.exe
File opened for modification	C:\Windows\SysWOW64\Mgnnhk32.exe	Mciobn32.exe
File created	C:\Windows\SysWOW64\Bdknoa32.dll	Nnmopdep.exe
File created	C:\Windows\SysWOW64\Mpkbebbf.exe	Mnlfigcc.exe
File opened for modification	C:\Windows\SysWOW64\Lpfijcfl.exe	4b5616b5619da6474f7a3e3b1839e190_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\Mpkbebbf.exe	Mnlfigcc.exe
File created	C:\Windows\SysWOW64\Kmdigkkd.dll	Mnlfigcc.exe
File created	C:\Windows\SysWOW64\Mgnnhk32.exe	Mciobn32.exe
File created	C:\Windows\SysWOW64\Njljefql.exe	Mgnnhk32.exe
File opened for modification	C:\Windows\SysWOW64\Nnmopdep.exe	Nceonl32.exe
File created	C:\Windows\SysWOW64\Ndghmo32.exe	Nnmopdep.exe
File created	C:\Windows\SysWOW64\Lpfijcfl.exe	4b5616b5619da6474f7a3e3b1839e190_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\Nnmopdep.exe	Nceonl32.exe
File created	C:\Windows\SysWOW64\Bidjkmlh.dll	Lknjmkdo.exe
File created	C:\Windows\SysWOW64\Lcgblncm.exe	Lphfpbdi.exe
File created	C:\Windows\SysWOW64\Plilol32.dll	Lphfpbdi.exe
File created	C:\Windows\SysWOW64\Jnngob32.dll	Lcgblncm.exe
File opened for modification	C:\Windows\SysWOW64\Mciobn32.exe	Mpkbebbf.exe
File created	C:\Windows\SysWOW64\Mbaohn32.dll	4b5616b5619da6474f7a3e3b1839e190_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\Lknjmkdo.exe	Lcgblncm.exe
File opened for modification	C:\Windows\SysWOW64\Njljefql.exe	Mgnnhk32.exe
File opened for modification	C:\Windows\SysWOW64\Nceonl32.exe	Njljefql.exe
File created	C:\Windows\SysWOW64\Cgfgaq32.dll	Nceonl32.exe
File created	C:\Windows\SysWOW64\Cknpkhch.dll	Ndghmo32.exe
File created	C:\Windows\SysWOW64\Bbgkjl32.dll	Lpfijcfl.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4292	2952	WerFault.exe	101

Modifies registry class 48 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cgfgaq32.dll"	Nceonl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ndghmo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	4b5616b5619da6474f7a3e3b1839e190_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	4b5616b5619da6474f7a3e3b1839e190_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lgpagm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Plilol32.dll"	Lphfpbdi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	4b5616b5619da6474f7a3e3b1839e190_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bbgkjl32.dll"	Lpfijcfl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mciobn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nceonl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	4b5616b5619da6474f7a3e3b1839e190_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lpfijcfl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mgnnhk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Njljefql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mnlfigcc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mciobn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mgnnhk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Njljefql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jnngob32.dll"	Lcgblncm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lknjmkdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bidjkmlh.dll"	Lknjmkdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmdigkkd.dll"	Mnlfigcc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fcdjjo32.dll"	Njljefql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nnolfdcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mpkbebbf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnfmbf32.dll"	Mciobn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kcbibebo.dll"	Mgnnhk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mbaohn32.dll"	4b5616b5619da6474f7a3e3b1839e190_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lpfijcfl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lcgblncm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lcgblncm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ndghmo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnibdpde.dll"	Nnolfdcn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lgpagm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mnlfigcc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lifenaok.dll"	Mpkbebbf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nceonl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nnmopdep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cknpkhch.dll"	Ndghmo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nnolfdcn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	4b5616b5619da6474f7a3e3b1839e190_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mglppmnd.dll"	Lgpagm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lphfpbdi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lphfpbdi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lknjmkdo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mpkbebbf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nnmopdep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bdknoa32.dll"	Nnmopdep.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 4372 wrote to memory of 4140	4372	4b5616b5619da6474f7a3e3b1839e190_NeikiAnalytics.exe	84
PID 4372 wrote to memory of 4140	4372	4b5616b5619da6474f7a3e3b1839e190_NeikiAnalytics.exe	84
PID 4372 wrote to memory of 4140	4372	4b5616b5619da6474f7a3e3b1839e190_NeikiAnalytics.exe	84
PID 4140 wrote to memory of 3768	4140	Lpfijcfl.exe	85
PID 4140 wrote to memory of 3768	4140	Lpfijcfl.exe	85
PID 4140 wrote to memory of 3768	4140	Lpfijcfl.exe	85
PID 3768 wrote to memory of 3328	3768	Lgpagm32.exe	86
PID 3768 wrote to memory of 3328	3768	Lgpagm32.exe	86
PID 3768 wrote to memory of 3328	3768	Lgpagm32.exe	86
PID 3328 wrote to memory of 960	3328	Lphfpbdi.exe	87
PID 3328 wrote to memory of 960	3328	Lphfpbdi.exe	87
PID 3328 wrote to memory of 960	3328	Lphfpbdi.exe	87
PID 960 wrote to memory of 1876	960	Lcgblncm.exe	88
PID 960 wrote to memory of 1876	960	Lcgblncm.exe	88
PID 960 wrote to memory of 1876	960	Lcgblncm.exe	88
PID 1876 wrote to memory of 3264	1876	Lknjmkdo.exe	89
PID 1876 wrote to memory of 3264	1876	Lknjmkdo.exe	89
PID 1876 wrote to memory of 3264	1876	Lknjmkdo.exe	89
PID 3264 wrote to memory of 892	3264	Mnlfigcc.exe	90
PID 3264 wrote to memory of 892	3264	Mnlfigcc.exe	90
PID 3264 wrote to memory of 892	3264	Mnlfigcc.exe	90
PID 892 wrote to memory of 1544	892	Mpkbebbf.exe	91
PID 892 wrote to memory of 1544	892	Mpkbebbf.exe	91
PID 892 wrote to memory of 1544	892	Mpkbebbf.exe	91
PID 1544 wrote to memory of 1352	1544	Mciobn32.exe	94
PID 1544 wrote to memory of 1352	1544	Mciobn32.exe	94
PID 1544 wrote to memory of 1352	1544	Mciobn32.exe	94
PID 1352 wrote to memory of 1468	1352	Mgnnhk32.exe	95
PID 1352 wrote to memory of 1468	1352	Mgnnhk32.exe	95
PID 1352 wrote to memory of 1468	1352	Mgnnhk32.exe	95
PID 1468 wrote to memory of 2376	1468	Njljefql.exe	97
PID 1468 wrote to memory of 2376	1468	Njljefql.exe	97
PID 1468 wrote to memory of 2376	1468	Njljefql.exe	97
PID 2376 wrote to memory of 5040	2376	Nceonl32.exe	98
PID 2376 wrote to memory of 5040	2376	Nceonl32.exe	98
PID 2376 wrote to memory of 5040	2376	Nceonl32.exe	98
PID 5040 wrote to memory of 3624	5040	Nnmopdep.exe	99
PID 5040 wrote to memory of 3624	5040	Nnmopdep.exe	99
PID 5040 wrote to memory of 3624	5040	Nnmopdep.exe	99
PID 3624 wrote to memory of 1396	3624	Ndghmo32.exe	100
PID 3624 wrote to memory of 1396	3624	Ndghmo32.exe	100
PID 3624 wrote to memory of 1396	3624	Ndghmo32.exe	100
PID 1396 wrote to memory of 2952	1396	Nnolfdcn.exe	101
PID 1396 wrote to memory of 2952	1396	Nnolfdcn.exe	101
PID 1396 wrote to memory of 2952	1396	Nnolfdcn.exe	101

C:\Users\Admin\AppData\Local\Temp\4b5616b5619da6474f7a3e3b1839e190_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4b5616b5619da6474f7a3e3b1839e190_NeikiAnalytics.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Windows\SysWOW64\Lpfijcfl.exe
  C:\Windows\system32\Lpfijcfl.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4140
- - C:\Windows\SysWOW64\Lgpagm32.exe
    C:\Windows\system32\Lgpagm32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3768
  - - C:\Windows\SysWOW64\Lphfpbdi.exe
      C:\Windows\system32\Lphfpbdi.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3328
    - - C:\Windows\SysWOW64\Lcgblncm.exe
        
        C:\Windows\system32\Lcgblncm.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:960
      - C:\Windows\SysWOW64\Lknjmkdo.exe
        
        C:\Windows\system32\Lknjmkdo.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1876
        
        C:\Windows\SysWOW64\Mnlfigcc.exe
        
        C:\Windows\system32\Mnlfigcc.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3264
        
        C:\Windows\SysWOW64\Mpkbebbf.exe
        
        C:\Windows\system32\Mpkbebbf.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:892
        
        C:\Windows\SysWOW64\Mciobn32.exe
        
        C:\Windows\system32\Mciobn32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1544
        
        C:\Windows\SysWOW64\Mgnnhk32.exe
        
        C:\Windows\system32\Mgnnhk32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1352
        
        C:\Windows\SysWOW64\Njljefql.exe
        
        C:\Windows\system32\Njljefql.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1468
        
        C:\Windows\SysWOW64\Nceonl32.exe
        
        C:\Windows\system32\Nceonl32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2376
        
        C:\Windows\SysWOW64\Nnmopdep.exe
        
        C:\Windows\system32\Nnmopdep.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5040
        
        C:\Windows\SysWOW64\Ndghmo32.exe
        
        C:\Windows\system32\Ndghmo32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3624
        
        C:\Windows\SysWOW64\Nnolfdcn.exe
        
        C:\Windows\system32\Nnolfdcn.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1396
        
        C:\Windows\SysWOW64\Nkcmohbg.exe
        
        C:\Windows\system32\Nkcmohbg.exe
        16⤵
        Executes dropped EXE
        
        PID:2952
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2952 -s 400
        17⤵
        Program crash
        
        PID:4292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2952 -ip 2952
1⤵
PID:2792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Lcgblncm.exe

Path C:\Windows\SysWOW64\Lcgblncm.exe
Size 768KB
SHA256 1ef2cc14ca9ca3ebb48245883972b700f35b4322f91842118b970ce40fe8fa38
MD5 48c4fe467cca6b43b2da319e4fd3a8d9
SHA1 5f1954b1f71aa55b37459aa237f9ea3719b75eb8
SHA512 b9b5b230acd8fd0be775631e041ea5805a26c656c0b1bf4ee9cf7b8702d000ad97cb7307c9772c11256a8617923922fd4e0ff20852f9dee30f61247643104f77
SSDEEP 12288:Xtqzvv6IveDVqvQ6IvYvc6IveDVqvQ6IvBaSHaMaZRBEYyqmaf2qwiHPKgRC4gvO:Xtqjq5h3q5htaSHFaZRBEYyqmaf2qwiv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lgpagm32.exe

Path C:\Windows\SysWOW64\Lgpagm32.exe
Size 768KB
SHA256 93f5d983fa7133a2400325c1711c5d3de14a808d9354acc3e9981caa5e2f9a81
MD5 76fceecc06af8161ddfc8d0cb3319b02
SHA1 b21ea7f66bb270721d68582bdf2358f7cf5d9fef
SHA512 2e9db90c3679a28812ca79c656a205bf347b44b169544b1047ec2b34bda08944c70732cba17e6c3f6d54e63cc29b381bb1ee420166697a3b6cff5bf45039d35a
SSDEEP 12288:f1kvk6IveDVqvQ6IvYvc6IveDVqvQ6IvBaSHaMaZRBEYyqmaf2qwiHPKgRC4gvGJ:ftq5h3q5htaSHFaZRBEYyqmaf2qwiHPX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lknjmkdo.exe

Path C:\Windows\SysWOW64\Lknjmkdo.exe
Size 768KB
SHA256 dba9378cf7aed2f5e0d558880c8bfe4ee37c5b9a042998d571c6a9cdc6b55826
MD5 797242fb8c400bcc4766145dee8f4cf4
SHA1 4f2d9bcf8d68f49d4d670b48ddd4ca93f3eecbbe
SHA512 641b7d779a2775e5019e7622ca2ecea155f56be009ff7f77820a24e668e0c8a6833e6b0152d81a177f4205f74ccf0a964fe92bd5731fd6c9eb920aee3239c84e
SSDEEP 12288:Rr9vo6IveDVqvQ6IvYvc6IveDVqvQ6IvBaSHaMaZRBEYyqmaf2qwiHPKgRC4gvGJ:Qq5h3q5htaSHFaZRBEYyqmaf2qwiHPKu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lpfijcfl.exe

Path C:\Windows\SysWOW64\Lpfijcfl.exe
Size 768KB
SHA256 999483b9aa1a9652f849ec523889087f5420b3fbe1cbb318e115e0d028fcc1a2
MD5 54f3c3b474e95153fc5181f709bd53a9
SHA1 fa2becd6c67023ce089a874364875f02692dea5f
SHA512 d1c05a43e5d7d3035ac755923bb49aa75f2db78bf3dc20adaa1f9d6a1d848a157714f4b3896db83d2a1de3c3fb3427b6851b7c4bd544bf356abc4c2da706094f
SSDEEP 12288:pp9DvT6IveDVqvQ6IvYvc6IveDVqvQ6IvBaSHaMaZRBEYyqmaf2qwiHPKgRC4gvO:ppNq5h3q5htaSHFaZRBEYyqmaf2qwiHP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lphfpbdi.exe

Path C:\Windows\SysWOW64\Lphfpbdi.exe
Size 768KB
SHA256 25a4cfd35d3171ac402e33aa10de178295109e8713ac4e2e17eb243d23047c19
MD5 cf8557a7624d3b49905bb9d641ac4dbb
SHA1 fff8a5dec2bae7fd86013dbbf1f271bcf70d4cd7
SHA512 56643f6a5a5e4ef0e1761b2aae1afd5935b30b2bb03d78c1ace0b478b2a14e1b39df5e02aa761c05c3acecaefce930abe304eeeb66fc0bbaa9babec6458b9748
SSDEEP 12288:0ze5vD6IveDVqvQ6IvYvc6IveDVqvQ6IvBaSHaMaZRBEYyqmaf2qwiHPKgRC4gvO:0zepq5h3q5htaSHFaZRBEYyqmaf2qwiv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mciobn32.exe

Path C:\Windows\SysWOW64\Mciobn32.exe
Size 768KB
SHA256 48a646f59487a8889ec6b291ac5713091218a732f0af98b475580084822eab2c
MD5 01eff9ad5ebb6fa8db3b0aa436071e99
SHA1 382a28cc56469f08490bd6dd65291fcecf5054dd
SHA512 2a287c961d20a043331f3a671c933165a72aa1c657b4f5f10a72797bdc785a7c69c5e9bb7d594c6152be4183f945b5c74fdaa5d5984ec48bd1762e73239593a2
SSDEEP 12288:Ef/1vz6IveDVqvQ6IvYvc6IveDVqvQ6IvBaSHaMaZRBEYyqmaf2qwiHPKgRC4gvO:Efxq5h3q5htaSHFaZRBEYyqmaf2qwiHP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mgnnhk32.exe

Path C:\Windows\SysWOW64\Mgnnhk32.exe
Size 768KB
SHA256 dc174020473c6d317a2f946a85a08904081c1efdd8eebe094badac3b74c9f90f
MD5 8ed17aa3713dab8b0ea03c54ff0bdc14
SHA1 1bfb166034cc7d4320d50026c06343e0669e55f2
SHA512 ee34c4bf2ff43fb77a7502d6e64e1df0bc9b5ca54ef453e9dd919474b74afd6738b76c068356d7cf11566618798ba4155a41f153f94be3dc8eb571491b61ab36
SSDEEP 12288:GgcajEv76IveDVqvQ6IvYvc6IveDVqvQ6IvBaSHaMaZRBEYyqmaf2qwiHPKgRC45:GNq5h3q5htaSHFaZRBEYyqmaf2qwiHPX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mnlfigcc.exe

Path C:\Windows\SysWOW64\Mnlfigcc.exe
Size 768KB
SHA256 52952347a3c0af681aca957f0b0cde2a7e7cd073bd4f322f74a70c5949eded6e
MD5 ad3aab884185412b55f3c9b54076e2e2
SHA1 1a44729dc8508e5f9fe4a9bf76c47243302b261b
SHA512 639a1bd0d2909fad68caacdc1bf5dc6fff329655f1fd6987571dc811b0a8b11227c84c566c0743a0845cdbc996cbb9207d0ebd8a9b9b891d96a0e0ec80691d17
SSDEEP 12288:J9E68w8zvH6IveDVqvQ6IvYvc6IveDVqvQ6IvBaSHaMaZRBEYyqmaf2qwiHPKgRP:J9E6+Dq5h3q5htaSHFaZRBEYyqmaf2qL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mpkbebbf.exe

Path C:\Windows\SysWOW64\Mpkbebbf.exe
Size 768KB
SHA256 a9866759000f8919aae9ca4b59f2ba5a60214d8e6dd496b0a84807ad469899bb
MD5 c6b2d29062094684a01349b9d792eac9
SHA1 30d88744e633287bbde1abf3c9e888015514a59a
SHA512 35b148df317fb763a6ebe5a6819a9304a1ec4a11f983fb46915c603818ff359c888f6aedcd65c069963355478fcd4bd4ec7d0dbefe5b2aa44cf7ddb66944a937
SSDEEP 12288:l+7XFtPnvI6IveDVqvQ6IvYvc6IveDVqvQ6IvBaSHaMaZRBEYyqmaf2qwiHPKgRP:2XFtoq5h3q5htaSHFaZRBEYyqmaf2qwc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nceonl32.exe

Path C:\Windows\SysWOW64\Nceonl32.exe
Size 768KB
SHA256 829292d5d5e55daa017b73bb0168d8fe885b1e40475ba58edd360b7163ef98cd
MD5 3f49c5aeaecd4dfd782c355f80eef706
SHA1 a1be8a89c60db95b85b594016c823de4082062e4
SHA512 16fc79919234002bba63efa55b0da1e8f2e2e246e6e76cde24e7f97bedd7e7f461d5c6d081511020dad14dba8b3a1bc99b0edde7987defd3291b53f7555ab091
SSDEEP 12288:lj1v66IveDVqvQ6IvYvc6IveDVqvQ6IvBaSHaMaZRBEYyqmaf2qwiHPKgRC4gvGJ:x4q5h3q5htaSHFaZRBEYyqmaf2qwiHPX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ndghmo32.exe

Path C:\Windows\SysWOW64\Ndghmo32.exe
Size 768KB
SHA256 bb27739ce5064d239833657041f39a24c11f72fdc29655c9ec2d725355f094d1
MD5 2d338bd0d8b2a32e8e2bb0313e146734
SHA1 8a2404e9340be56825a62c022875588778634282
SHA512 489387c495e4fde2076b7184401bd091184915c41c269018a376d7b5ff420e526a3a477801920cd618e4d84c6c691ed36d888aa6aec57c7117309b5c0438da29
SSDEEP 12288:Vzk4TUWKj8vo6IveDVqvQ6IvYvc6IveDVqvQ6IvBaSHaMaZRBEYyqmaf2qwiHPKu:Vzk4TUWkLq5h3q5htaSHFaZRBEYyqmaH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Njljefql.exe

Path C:\Windows\SysWOW64\Njljefql.exe
Size 768KB
SHA256 045a0bb1c88e1931508cf23f7659081d3b1a0b558e32e4708faa97605437224b
MD5 4e24ca9dea77b58809ba11f36dc50075
SHA1 34d52f0551414413276c5105fc65a51e13e3fe8c
SHA512 42244e79a9c585927730474a83772c4d9bc69dd7ad4cad69a6193c0f58ff909bef8a6ca331a6353c7ac828a63bb6f6379bd673088ee865dfac7a2deed16d5f6b
SSDEEP 12288:WRlQvu6IveDVqvQ6IvYvc6IveDVqvQ6IvBaSHaMaZRBEYyqmaf2qwiHPKgRC4gvO:WRnq5h3q5htaSHFaZRBEYyqmaf2qwiHP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nkcmohbg.exe

Path C:\Windows\SysWOW64\Nkcmohbg.exe
Size 768KB
SHA256 ecbed464db25c8be935dc825e7d6989a2ddc10b3751521a40318d103532483a2
MD5 ef30b1c25caa3b72752308af0d6d38db
SHA1 b2206ef09ff0e291011ae29f31f06c712825f650
SHA512 2966dcf17f7d08b23f84c912454ab68ab965176944f42de80da92be5b606d473f3c6dc29823cd330c8522590f6f17e65633536fdc221f57b3de7f2e1e9eb6511
SSDEEP 12288:SSbzlnmcv56IveDVqvQ6IvYvc6IveDVqvQ6IvBaSHaMaZRBEYyqmaf2qwiHPKgRP:SSbFjq5h3q5htaSHFaZRBEYyqmaf2qwc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nnmopdep.exe

Path C:\Windows\SysWOW64\Nnmopdep.exe
Size 768KB
SHA256 82733b5b8e12a78c981ad881cfd448c73c0c0a15f699d5e701038b9e2aab2334
MD5 afc022e06f7686f36c73822f4244e9ba
SHA1 cd2307c534aeb0fb260ce2e8f71e26b65161be9e
SHA512 36a840f292bd994bf43290e8d1b4599fb932ee4e4ef35685164a58a7d5795a2c289f748fd3384051f4a0a5dd5ce1864e48e25a5a3c8546a43a739a2a0bf7abaf
SSDEEP 12288:3QO7vh6IveDVqvQ6IvYvc6IveDVqvQ6IvBaSHaMaZRBEYyqmaf2qwiHPKgRC4gvO:3Q0q5h3q5htaSHFaZRBEYyqmaf2qwiHP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nnolfdcn.exe

Path C:\Windows\SysWOW64\Nnolfdcn.exe
Size 768KB
SHA256 cf56932e0150a6b5218ec44e97a58f2d0d5d9e269a064a200cc2ff7501bb835c
MD5 eb95cb2b1f2d5c99ecfbeb9416c00c1b
SHA1 53abd2c8e5abd19559973b485a0f898304212fed
SHA512 e2658a2f5e4ac0dc26e009f2f24050ce900b87f4d6f25075aff1e0bef684a1f307b3a148b15948e80dcd12e952586c0039eb839f356fc35978536eed9bb5cd4b
SSDEEP 12288:KUvA6IveDVqvQ6IvYvc6IveDVqvQ6IvBaSHaMaZRBEYyqmaf2qwiHPKgRC4gvGZX:KLq5h3q5htaSHFaZRBEYyqmaf2qwiHPX
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/892-61-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/960-36-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/960-138-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1352-73-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1352-131-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1396-117-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1468-86-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1544-65-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1544-133-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1876-136-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1876-45-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2376-90-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2376-128-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2952-121-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3264-60-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3328-28-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3328-140-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3624-105-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3624-126-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3768-21-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4140-143-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4140-9-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4372-1-0x0000000000431000-0x0000000000432000-memory.dmp

Download

memory/4372-145-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4372-0-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5040-127-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5040-98-0x0000000000400000-0x0000000000433000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads