Analysis
- max time kernel
143s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
19/05/2024, 14:17
Behavioral task
behavioral1
Sample
d45a6100f4e4090f858ee6ad6b46e3f0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
d45a6100f4e4090f858ee6ad6b46e3f0_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target d45a6100f4e4090f858ee6ad6b46e3f0_NeikiAnalytics.exe
- Size 226KB
- Sample240519-rlsdnsbe5x
- SHA256 119bb2d3d26760a1b599414dbc20331f7768cf02f1423a0d706a4000dc1ceda3
- MD5 d45a6100f4e4090f858ee6ad6b46e3f0
- SHA1 1855ac279a5470e394a692626226a7b7501190bc
- SHA512 5dcdc66f49f5e292100ffb761dedcef96d00abadf4867c9d8a97dbcf0ec787b0fbb5d531cd77b0e5d444f18c61c30b25b9fc51bf6a4040626b6de335d8188f7f
- SSDEEP 6144:+sLPd6YS4XfxqySSKpRmSKeTk7eT5ABrnL8MdYg:/LP1L5IKrEAlnLAg
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bpomem32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Mnpabe32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mfeeabda.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bmfqngcg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Egpgehnb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Iqgjmg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Naecop32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Oeheqm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Cfipef32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ckggnp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bjkcqdje.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hllcfnhm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Lflpmn32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lmheph32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Iebngial.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mkgfdgpq.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Odkcpi32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dbjade32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kbedaand.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mmdekf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Lgbloglj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gcimfg32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ldanloba.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ckfofe32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hepgkohh.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ecoaijio.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Cihjeq32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ifaepolg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Phbolflm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Fpeaeedg.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Egaejeej.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ckidcpjl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Apddce32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ffcpgcfj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Pnhacn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Fglnkm32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ieeimlep.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jhoeef32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Egdqph32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Fbpchb32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aaofedkl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jmccnk32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hfhgkmpj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bpcgpihi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Hfpenj32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Odfcjc32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ogbbqo32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ebpqjmpd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ddnfmqng.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Gkcigjel.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qhekaejj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Midfjnge.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hjoeoo32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kjpgmj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Nnfkgp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Eeodqocd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oeheqm32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mgeakekd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bddcenpi.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dkhgod32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ababkdij.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Fhllni32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dnienqbi.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Enpmld32.exe - Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/files/0x0008000000023238-6.dat family_berbew behavioral2/files/0x000900000002323d-14.dat family_berbew behavioral2/files/0x000700000002323f-22.dat family_berbew behavioral2/files/0x0007000000023241-30.dat family_berbew behavioral2/files/0x0007000000023243-38.dat family_berbew behavioral2/files/0x0007000000023245-46.dat family_berbew behavioral2/files/0x0007000000023247-49.dat family_berbew behavioral2/files/0x0007000000023247-54.dat family_berbew behavioral2/files/0x0007000000023249-62.dat family_berbew behavioral2/files/0x000700000002324c-70.dat family_berbew behavioral2/files/0x000700000002324e-73.dat family_berbew behavioral2/files/0x0007000000023250-86.dat family_berbew behavioral2/files/0x0007000000023252-94.dat family_berbew behavioral2/files/0x0007000000023254-98.dat family_berbew behavioral2/files/0x0007000000023256-110.dat family_berbew behavioral2/files/0x0007000000023258-118.dat family_berbew behavioral2/files/0x000700000002325a-126.dat family_berbew behavioral2/files/0x000700000002325c-134.dat family_berbew behavioral2/files/0x000700000002325e-142.dat family_berbew behavioral2/files/0x0007000000023260-145.dat family_berbew behavioral2/files/0x0007000000023260-151.dat family_berbew behavioral2/files/0x0007000000023263-158.dat family_berbew behavioral2/files/0x0007000000023265-166.dat family_berbew behavioral2/files/0x0007000000023267-175.dat family_berbew behavioral2/files/0x0007000000023269-182.dat family_berbew behavioral2/files/0x000700000002326b-190.dat family_berbew behavioral2/files/0x000700000002326d-198.dat family_berbew behavioral2/files/0x000700000002326f-206.dat family_berbew behavioral2/files/0x0007000000023271-214.dat family_berbew behavioral2/files/0x0007000000023273-222.dat family_berbew behavioral2/files/0x0007000000023275-230.dat family_berbew behavioral2/files/0x0007000000023277-233.dat family_berbew behavioral2/files/0x0007000000023277-238.dat family_berbew behavioral2/files/0x0007000000023279-246.dat family_berbew behavioral2/files/0x000700000002327b-254.dat family_berbew behavioral2/files/0x0007000000023294-329.dat family_berbew behavioral2/files/0x00070000000232a1-365.dat family_berbew behavioral2/files/0x00070000000232a7-383.dat family_berbew behavioral2/files/0x00070000000232ab-395.dat family_berbew behavioral2/files/0x00070000000232b0-407.dat family_berbew behavioral2/files/0x00070000000232ba-437.dat family_berbew behavioral2/files/0x00070000000232c4-467.dat family_berbew behavioral2/files/0x00070000000232ca-485.dat family_berbew behavioral2/files/0x00070000000232d0-503.dat family_berbew behavioral2/files/0x00070000000232dc-540.dat family_berbew behavioral2/files/0x00070000000232e2-560.dat family_berbew behavioral2/files/0x00070000000232e8-581.dat family_berbew behavioral2/files/0x0007000000023313-727.dat family_berbew behavioral2/files/0x0007000000023319-747.dat family_berbew behavioral2/files/0x000700000002331f-768.dat family_berbew behavioral2/files/0x0007000000023325-789.dat family_berbew behavioral2/files/0x000700000002332f-824.dat family_berbew behavioral2/files/0x0007000000023337-852.dat family_berbew behavioral2/files/0x0007000000023341-887.dat family_berbew behavioral2/files/0x000700000002334c-922.dat family_berbew behavioral2/files/0x0007000000023352-943.dat family_berbew behavioral2/files/0x0007000000023358-964.dat family_berbew behavioral2/files/0x0007000000023364-1006.dat family_berbew behavioral2/files/0x000700000002336c-1034.dat family_berbew behavioral2/files/0x0007000000023378-1076.dat family_berbew behavioral2/files/0x000700000002338b-1132.dat family_berbew behavioral2/files/0x0007000000023399-1179.dat family_berbew behavioral2/files/0x00070000000233a9-1233.dat family_berbew behavioral2/files/0x00070000000233af-1253.dat family_berbew - Executes dropped EXE 64 IoCs
pid Process 2464 Lgepom32.exe 3284 Mkhapk32.exe 3156 Mgobel32.exe 1796 Maiccajf.exe 4348 Mnpabe32.exe 4304 Ncofplba.exe 2388 Naecop32.exe 4356 Nhahaiec.exe 1344 Oeehkn32.exe 2548 Oeheqm32.exe 3760 Ojigdcll.exe 5068 Adfnofpd.exe 3628 Bhpfqcln.exe 1628 Bdgged32.exe 2044 Bdickcpo.exe 1456 Cfipef32.exe 3632 Cfnjpfcl.exe 3428 Cohkokgj.exe 4368 Dokgdkeh.exe 3668 Dbkqfe32.exe 1484 Digehphc.exe 2904 Ddnfmqng.exe 2620 Dfnbgc32.exe 1536 Eecphp32.exe 2732 Ennqfenp.exe 3276 Enpmld32.exe 2172 Felbnn32.exe 4424 Fbpchb32.exe 4816 Fbbpmb32.exe 4684 Fnipbc32.exe 2632 Fiaael32.exe 1676 Glbjggof.exe 2336 Gmdcfidg.exe 4748 Glipgf32.exe 736 Gmimai32.exe 1648 Gbeejp32.exe 3416 Hfcnpn32.exe 2016 Hffken32.exe 2608 Hfhgkmpj.exe 4276 Hoclopne.exe 2936 Hmdlmg32.exe 4608 Iikmbh32.exe 2120 Iebngial.exe 2872 Illfdc32.exe 4284 Igdgglfl.exe 1860 Ieidhh32.exe 2352 Jiglnf32.exe 4920 Jgkmgk32.exe 1448 Jgmjmjnb.exe 3836 Jgpfbjlo.exe 2028 Jokkgl32.exe 4912 Klahfp32.exe 3596 Kjeiodek.exe 5024 Kncaec32.exe 776 Kgkfnh32.exe 1776 Kfpcoefj.exe 2164 Lpfgmnfp.exe 4636 Lgbloglj.exe 3556 Lomqcjie.exe 4924 Lqmmmmph.exe 1568 Lqojclne.exe 1800 Mgloefco.exe 3176 Mfqlfb32.exe 2408 Mfchlbfd.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Cfipef32.exe Bdickcpo.exe File created C:\Windows\SysWOW64\Gdokakcj.dll Afnlpohj.exe File opened for modification C:\Windows\SysWOW64\Nefmgogl.exe Nhbmnj32.exe File created C:\Windows\SysWOW64\Pcmdgodo.dll Cpdgqmnb.exe File created C:\Windows\SysWOW64\Eojppe32.dll Nefmgogl.exe File created C:\Windows\SysWOW64\Nlaakbkm.dll Pknghk32.exe File created C:\Windows\SysWOW64\Lmkbeg32.exe Lbenho32.exe File created C:\Windows\SysWOW64\Bpfljc32.dll Fecadghc.exe File created C:\Windows\SysWOW64\Jdinng32.dll Gkcigjel.exe File created C:\Windows\SysWOW64\Hkmlnimb.exe Hqghqpnl.exe File created C:\Windows\SysWOW64\Dipgpf32.exe Debnjgcp.exe File created C:\Windows\SysWOW64\Jhdmmg32.dll Ogbbqo32.exe File opened for modification C:\Windows\SysWOW64\Enemaimp.exe Egkddo32.exe File created C:\Windows\SysWOW64\Nfnjbdep.exe Nocbfjmc.exe File created C:\Windows\SysWOW64\Kdbbihid.dll Gnanioad.exe File created C:\Windows\SysWOW64\Bjiqiemm.dll Kjpgmj32.exe File created C:\Windows\SysWOW64\Oahhgi32.dll Gbkdod32.exe File created C:\Windows\SysWOW64\Lmheph32.exe Lflpmn32.exe File opened for modification C:\Windows\SysWOW64\Egpgehnb.exe Epeohn32.exe File created C:\Windows\SysWOW64\Mfhgcbfo.exe Mpnngh32.exe File created C:\Windows\SysWOW64\Dpefaq32.exe Cepadh32.exe File created C:\Windows\SysWOW64\Deidjf32.exe Ddhhbngi.exe File created C:\Windows\SysWOW64\Ifaepolg.exe Infqklol.exe File created C:\Windows\SysWOW64\Kjopgh32.dll Jbghpc32.exe File created C:\Windows\SysWOW64\Fgcpfdbd.dll Eqlfhjig.exe File opened for modification C:\Windows\SysWOW64\Onqdhh32.exe Odhppclh.exe File created C:\Windows\SysWOW64\Faamghko.exe Flddoa32.exe File created C:\Windows\SysWOW64\Hligqnjp.exe Hoefgj32.exe File opened for modification C:\Windows\SysWOW64\Nfldgk32.exe Nmcpoedn.exe File created C:\Windows\SysWOW64\Ogajpp32.dll Cpljehpo.exe File opened for modification C:\Windows\SysWOW64\Bpomem32.exe Bnppkj32.exe File created C:\Windows\SysWOW64\Jkohjl32.dll Bqpbboeg.exe File created C:\Windows\SysWOW64\Mpkkgbmi.exe Lmkbeg32.exe File created C:\Windows\SysWOW64\Kiiajl32.dll Jhjcbljf.exe File created C:\Windows\SysWOW64\Nfldgk32.exe Nmcpoedn.exe File created C:\Windows\SysWOW64\Egkddo32.exe Djgdkk32.exe File created C:\Windows\SysWOW64\Infqklol.exe Icqmncof.exe File opened for modification C:\Windows\SysWOW64\Kakednfj.exe Kcgekjgp.exe File created C:\Windows\SysWOW64\Dnienqbi.exe Dbbdip32.exe File opened for modification C:\Windows\SysWOW64\Omdieb32.exe Ockdmmoj.exe File created C:\Windows\SysWOW64\Ejioqkck.dll Hgcmbj32.exe File opened for modification C:\Windows\SysWOW64\Hqjcgbbo.exe Hfeoijbi.exe File opened for modification C:\Windows\SysWOW64\Ipihpkkd.exe Ibegfglj.exe File created C:\Windows\SysWOW64\Llnnmhfe.exe Laiipofp.exe File created C:\Windows\SysWOW64\Afjpan32.dll Baepolni.exe File created C:\Windows\SysWOW64\Ecoaijio.exe Dekapfke.exe File opened for modification C:\Windows\SysWOW64\Ehklmd32.exe Ebnddn32.exe File created C:\Windows\SysWOW64\Dpjompqc.exe Dipgpf32.exe File created C:\Windows\SysWOW64\Lcccepbd.dll Qacameaj.exe File created C:\Windows\SysWOW64\Hjmodffo.exe Hepgkohh.exe File opened for modification C:\Windows\SysWOW64\Lpghfi32.exe Lfodmdni.exe File created C:\Windows\SysWOW64\Ohpefcna.dll Qpmmfbfl.exe File created C:\Windows\SysWOW64\Engaon32.exe Ebpqjmpd.exe File opened for modification C:\Windows\SysWOW64\Kkofofbb.exe Kcdakd32.exe File created C:\Windows\SysWOW64\Bahdob32.exe Bknlbhhe.exe File created C:\Windows\SysWOW64\Ogeacidl.dll Fofilp32.exe File created C:\Windows\SysWOW64\Oloipmfd.exe Obidcdfo.exe File created C:\Windows\SysWOW64\Qgjamboa.dll Iebngial.exe File created C:\Windows\SysWOW64\Qacameaj.exe Qaqegecm.exe File opened for modification C:\Windows\SysWOW64\Gkaclqkk.exe Galoohke.exe File created C:\Windows\SysWOW64\Ihmfco32.exe Iacngdgj.exe File created C:\Windows\SysWOW64\Bpenhh32.dll Nqaiecjd.exe File created C:\Windows\SysWOW64\Adkelplc.exe Qpmmfbfl.exe File created C:\Windows\SysWOW64\Dgeaknci.dll Akpoaj32.exe - Program crash 1 IoCs
pid pid_target Process procid_target 7640 8588 WerFault.exe 746 - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Bejobk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnlnbkcc.dll" Odkcpi32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Lqojclne.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Gnfooe32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Jhoeef32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ijhhenhf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Mkhapk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Enpmld32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hojncj32.dll" Enpmld32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Nfnjbdep.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Foakpc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Bgodjiio.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Hnphoj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Lohqnd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Lahbei32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eicfep32.dll" Cepadh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ddhhbngi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Lgbloglj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Hihibbjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Fhbbmc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ikhghi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ofgbflng.dll" Mpenmadn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ohhfknjf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Acdioc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Afboah32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Odfcjc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gbnblldi.dll" Gngeik32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Khlklj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Iholohii.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Alkeifga.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ilfjfdhp.dll" Pnhacn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Mmdekf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jkiocibf.dll" d45a6100f4e4090f858ee6ad6b46e3f0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ocaebc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Jldkeeig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aeohij32.dll" Afdkfh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cfdfhe32.dll" Kmaooihb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mejfbf32.dll" Nggjog32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Midfjnge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ggmdggnj.dll" Oaejhh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Mminfech.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nflnbh32.dll" Chdialdl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Infqklol.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Eipilmgh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qfhgbj32.dll" Aglnnkid.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ffcpgcfj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Kjpgmj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Gmimai32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ajjokd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Npgqep32.dll" Egkddo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mmhpkebp.dll" Bejobk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Fdadpk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jepplk32.dll" Hjoeoo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ceehcc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Gckcap32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Fbgbnkfm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fjoiip32.dll" Mhldbh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Keceoj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Aecialmb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Befogbik.dll" Cdnelpod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Afjpan32.dll" Baepolni.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Fgcjea32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gqnajlid.dll" Kjipmoai.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Lmheph32.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3532 wrote to memory of 2464 3532 d45a6100f4e4090f858ee6ad6b46e3f0_NeikiAnalytics.exe 90 PID 3532 wrote to memory of 2464 3532 d45a6100f4e4090f858ee6ad6b46e3f0_NeikiAnalytics.exe 90 PID 3532 wrote to memory of 2464 3532 d45a6100f4e4090f858ee6ad6b46e3f0_NeikiAnalytics.exe 90 PID 2464 wrote to memory of 3284 2464 Lgepom32.exe 91 PID 2464 wrote to memory of 3284 2464 Lgepom32.exe 91 PID 2464 wrote to memory of 3284 2464 Lgepom32.exe 91 PID 3284 wrote to memory of 3156 3284 Mkhapk32.exe 92 PID 3284 wrote to memory of 3156 3284 Mkhapk32.exe 92 PID 3284 wrote to memory of 3156 3284 Mkhapk32.exe 92 PID 3156 wrote to memory of 1796 3156 Mgobel32.exe 93 PID 3156 wrote to memory of 1796 3156 Mgobel32.exe 93 PID 3156 wrote to memory of 1796 3156 Mgobel32.exe 93 PID 1796 wrote to memory of 4348 1796 Maiccajf.exe 94 PID 1796 wrote to memory of 4348 1796 Maiccajf.exe 94 PID 1796 wrote to memory of 4348 1796 Maiccajf.exe 94 PID 4348 wrote to memory of 4304 4348 Mnpabe32.exe 95 PID 4348 wrote to memory of 4304 4348 Mnpabe32.exe 95 PID 4348 wrote to memory of 4304 4348 Mnpabe32.exe 95 PID 4304 wrote to memory of 2388 4304 Ncofplba.exe 96 PID 4304 wrote to memory of 2388 4304 Ncofplba.exe 96 PID 4304 wrote to memory of 2388 4304 Ncofplba.exe 96 PID 2388 wrote to memory of 4356 2388 Naecop32.exe 97 PID 2388 wrote to memory of 4356 2388 Naecop32.exe 97 PID 2388 wrote to memory of 4356 2388 Naecop32.exe 97 PID 4356 wrote to memory of 1344 4356 Nhahaiec.exe 98 PID 4356 wrote to memory of 1344 4356 Nhahaiec.exe 98 PID 4356 wrote to memory of 1344 4356 Nhahaiec.exe 98 PID 1344 wrote to memory of 2548 1344 Oeehkn32.exe 99 PID 1344 wrote to memory of 2548 1344 Oeehkn32.exe 99 PID 1344 wrote to memory of 2548 1344 Oeehkn32.exe 99 PID 2548 wrote to memory of 3760 2548 Oeheqm32.exe 100 PID 2548 wrote to memory of 3760 2548 Oeheqm32.exe 100 PID 2548 wrote to memory of 3760 2548 Oeheqm32.exe 100 PID 3760 wrote to memory of 5068 3760 Ojigdcll.exe 101 PID 3760 wrote to memory of 5068 3760 Ojigdcll.exe 101 PID 3760 wrote to memory of 5068 3760 Ojigdcll.exe 101 PID 5068 wrote to memory of 3628 5068 Adfnofpd.exe 102 PID 5068 wrote to memory of 3628 5068 Adfnofpd.exe 102 PID 5068 wrote to memory of 3628 5068 Adfnofpd.exe 102 PID 3628 wrote to memory of 1628 3628 Bhpfqcln.exe 103 PID 3628 wrote to memory of 1628 3628 Bhpfqcln.exe 103 PID 3628 wrote to memory of 1628 3628 Bhpfqcln.exe 103 PID 1628 wrote to memory of 2044 1628 Bdgged32.exe 104 PID 1628 wrote to memory of 2044 1628 Bdgged32.exe 104 PID 1628 wrote to memory of 2044 1628 Bdgged32.exe 104 PID 2044 wrote to memory of 1456 2044 Bdickcpo.exe 105 PID 2044 wrote to memory of 1456 2044 Bdickcpo.exe 105 PID 2044 wrote to memory of 1456 2044 Bdickcpo.exe 105 PID 1456 wrote to memory of 3632 1456 Cfipef32.exe 106 PID 1456 wrote to memory of 3632 1456 Cfipef32.exe 106 PID 1456 wrote to memory of 3632 1456 Cfipef32.exe 106 PID 3632 wrote to memory of 3428 3632 Cfnjpfcl.exe 107 PID 3632 wrote to memory of 3428 3632 Cfnjpfcl.exe 107 PID 3632 wrote to memory of 3428 3632 Cfnjpfcl.exe 107 PID 3428 wrote to memory of 4368 3428 Cohkokgj.exe 108 PID 3428 wrote to memory of 4368 3428 Cohkokgj.exe 108 PID 3428 wrote to memory of 4368 3428 Cohkokgj.exe 108 PID 4368 wrote to memory of 3668 4368 Dokgdkeh.exe 109 PID 4368 wrote to memory of 3668 4368 Dokgdkeh.exe 109 PID 4368 wrote to memory of 3668 4368 Dokgdkeh.exe 109 PID 3668 wrote to memory of 1484 3668 Dbkqfe32.exe 110 PID 3668 wrote to memory of 1484 3668 Dbkqfe32.exe 110 PID 3668 wrote to memory of 1484 3668 Dbkqfe32.exe 110 PID 1484 wrote to memory of 2904 1484 Digehphc.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\d45a6100f4e4090f858ee6ad6b46e3f0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\d45a6100f4e4090f858ee6ad6b46e3f0_NeikiAnalytics.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Windows\SysWOW64\Lgepom32.exeC:\Windows\system32\Lgepom32.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Windows\SysWOW64\Mkhapk32.exeC:\Windows\system32\Mkhapk32.exe3⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Windows\SysWOW64\Mgobel32.exeC:\Windows\system32\Mgobel32.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Windows\SysWOW64\Maiccajf.exeC:\Windows\system32\Maiccajf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Windows\SysWOW64\Mnpabe32.exeC:\Windows\system32\Mnpabe32.exe6⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Windows\SysWOW64\Ncofplba.exeC:\Windows\system32\Ncofplba.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Windows\SysWOW64\Naecop32.exeC:\Windows\system32\Naecop32.exe8⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Windows\SysWOW64\Nhahaiec.exeC:\Windows\system32\Nhahaiec.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Windows\SysWOW64\Oeehkn32.exeC:\Windows\system32\Oeehkn32.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Windows\SysWOW64\Oeheqm32.exeC:\Windows\system32\Oeheqm32.exe11⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\SysWOW64\Ojigdcll.exeC:\Windows\system32\Ojigdcll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Windows\SysWOW64\Adfnofpd.exeC:\Windows\system32\Adfnofpd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Windows\SysWOW64\Bhpfqcln.exeC:\Windows\system32\Bhpfqcln.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Windows\SysWOW64\Bdgged32.exeC:\Windows\system32\Bdgged32.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Windows\SysWOW64\Bdickcpo.exeC:\Windows\system32\Bdickcpo.exe16⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Windows\SysWOW64\Cfipef32.exeC:\Windows\system32\Cfipef32.exe17⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Windows\SysWOW64\Cfnjpfcl.exeC:\Windows\system32\Cfnjpfcl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Windows\SysWOW64\Cohkokgj.exeC:\Windows\system32\Cohkokgj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Windows\SysWOW64\Dokgdkeh.exeC:\Windows\system32\Dokgdkeh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Windows\SysWOW64\Dbkqfe32.exeC:\Windows\system32\Dbkqfe32.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Windows\SysWOW64\Digehphc.exeC:\Windows\system32\Digehphc.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Windows\SysWOW64\Ddnfmqng.exeC:\Windows\system32\Ddnfmqng.exe23⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2904 -
C:\Windows\SysWOW64\Dfnbgc32.exeC:\Windows\system32\Dfnbgc32.exe24⤵
- Executes dropped EXE
PID:2620 -
C:\Windows\SysWOW64\Eecphp32.exeC:\Windows\system32\Eecphp32.exe25⤵
- Executes dropped EXE
PID:1536 -
C:\Windows\SysWOW64\Ennqfenp.exeC:\Windows\system32\Ennqfenp.exe26⤵
- Executes dropped EXE
PID:2732 -
C:\Windows\SysWOW64\Enpmld32.exeC:\Windows\system32\Enpmld32.exe27⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:3276 -
C:\Windows\SysWOW64\Felbnn32.exeC:\Windows\system32\Felbnn32.exe28⤵
- Executes dropped EXE
PID:2172 -
C:\Windows\SysWOW64\Fbpchb32.exeC:\Windows\system32\Fbpchb32.exe29⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:4424 -
C:\Windows\SysWOW64\Fbbpmb32.exeC:\Windows\system32\Fbbpmb32.exe30⤵
- Executes dropped EXE
PID:4816 -
C:\Windows\SysWOW64\Fnipbc32.exeC:\Windows\system32\Fnipbc32.exe31⤵
- Executes dropped EXE
PID:4684 -
C:\Windows\SysWOW64\Fiaael32.exeC:\Windows\system32\Fiaael32.exe32⤵
- Executes dropped EXE
PID:2632 -
C:\Windows\SysWOW64\Glbjggof.exeC:\Windows\system32\Glbjggof.exe33⤵
- Executes dropped EXE
PID:1676 -
C:\Windows\SysWOW64\Gmdcfidg.exeC:\Windows\system32\Gmdcfidg.exe34⤵
- Executes dropped EXE
PID:2336 -
C:\Windows\SysWOW64\Glipgf32.exeC:\Windows\system32\Glipgf32.exe35⤵
- Executes dropped EXE
PID:4748 -
C:\Windows\SysWOW64\Gmimai32.exeC:\Windows\system32\Gmimai32.exe36⤵
- Executes dropped EXE
- Modifies registry class
PID:736 -
C:\Windows\SysWOW64\Gbeejp32.exeC:\Windows\system32\Gbeejp32.exe37⤵
- Executes dropped EXE
PID:1648 -
C:\Windows\SysWOW64\Hfcnpn32.exeC:\Windows\system32\Hfcnpn32.exe38⤵
- Executes dropped EXE
PID:3416 -
C:\Windows\SysWOW64\Hffken32.exeC:\Windows\system32\Hffken32.exe39⤵
- Executes dropped EXE
PID:2016 -
C:\Windows\SysWOW64\Hfhgkmpj.exeC:\Windows\system32\Hfhgkmpj.exe40⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2608 -
C:\Windows\SysWOW64\Hoclopne.exeC:\Windows\system32\Hoclopne.exe41⤵
- Executes dropped EXE
PID:4276 -
C:\Windows\SysWOW64\Hmdlmg32.exeC:\Windows\system32\Hmdlmg32.exe42⤵
- Executes dropped EXE
PID:2936 -
C:\Windows\SysWOW64\Iikmbh32.exeC:\Windows\system32\Iikmbh32.exe43⤵
- Executes dropped EXE
PID:4608 -
C:\Windows\SysWOW64\Iebngial.exeC:\Windows\system32\Iebngial.exe44⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:2120 -
C:\Windows\SysWOW64\Illfdc32.exeC:\Windows\system32\Illfdc32.exe45⤵
- Executes dropped EXE
PID:2872 -
C:\Windows\SysWOW64\Igdgglfl.exeC:\Windows\system32\Igdgglfl.exe46⤵
- Executes dropped EXE
PID:4284 -
C:\Windows\SysWOW64\Ieidhh32.exeC:\Windows\system32\Ieidhh32.exe47⤵
- Executes dropped EXE
PID:1860 -
C:\Windows\SysWOW64\Jiglnf32.exeC:\Windows\system32\Jiglnf32.exe48⤵
- Executes dropped EXE
PID:2352 -
C:\Windows\SysWOW64\Jgkmgk32.exeC:\Windows\system32\Jgkmgk32.exe49⤵
- Executes dropped EXE
PID:4920 -
C:\Windows\SysWOW64\Jgmjmjnb.exeC:\Windows\system32\Jgmjmjnb.exe50⤵
- Executes dropped EXE
PID:1448 -
C:\Windows\SysWOW64\Jgpfbjlo.exeC:\Windows\system32\Jgpfbjlo.exe51⤵
- Executes dropped EXE
PID:3836 -
C:\Windows\SysWOW64\Jokkgl32.exeC:\Windows\system32\Jokkgl32.exe52⤵
- Executes dropped EXE
PID:2028 -
C:\Windows\SysWOW64\Klahfp32.exeC:\Windows\system32\Klahfp32.exe53⤵
- Executes dropped EXE
PID:4912 -
C:\Windows\SysWOW64\Kjeiodek.exeC:\Windows\system32\Kjeiodek.exe54⤵
- Executes dropped EXE
PID:3596 -
C:\Windows\SysWOW64\Kncaec32.exeC:\Windows\system32\Kncaec32.exe55⤵
- Executes dropped EXE
PID:5024 -
C:\Windows\SysWOW64\Kgkfnh32.exeC:\Windows\system32\Kgkfnh32.exe56⤵
- Executes dropped EXE
PID:776 -
C:\Windows\SysWOW64\Kfpcoefj.exeC:\Windows\system32\Kfpcoefj.exe57⤵
- Executes dropped EXE
PID:1776 -
C:\Windows\SysWOW64\Lpfgmnfp.exeC:\Windows\system32\Lpfgmnfp.exe58⤵
- Executes dropped EXE
PID:2164 -
C:\Windows\SysWOW64\Lgbloglj.exeC:\Windows\system32\Lgbloglj.exe59⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:4636 -
C:\Windows\SysWOW64\Lomqcjie.exeC:\Windows\system32\Lomqcjie.exe60⤵
- Executes dropped EXE
PID:3556 -
C:\Windows\SysWOW64\Lqmmmmph.exeC:\Windows\system32\Lqmmmmph.exe61⤵
- Executes dropped EXE
PID:4924 -
C:\Windows\SysWOW64\Lqojclne.exeC:\Windows\system32\Lqojclne.exe62⤵
- Executes dropped EXE
- Modifies registry class
PID:1568 -
C:\Windows\SysWOW64\Mgloefco.exeC:\Windows\system32\Mgloefco.exe63⤵
- Executes dropped EXE
PID:1800 -
C:\Windows\SysWOW64\Mfqlfb32.exeC:\Windows\system32\Mfqlfb32.exe64⤵
- Executes dropped EXE
PID:3176 -
C:\Windows\SysWOW64\Mfchlbfd.exeC:\Windows\system32\Mfchlbfd.exe65⤵
- Executes dropped EXE
PID:2408 -
C:\Windows\SysWOW64\Mfeeabda.exeC:\Windows\system32\Mfeeabda.exe66⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2912 -
C:\Windows\SysWOW64\Mgeakekd.exeC:\Windows\system32\Mgeakekd.exe67⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4112 -
C:\Windows\SysWOW64\Nnojho32.exeC:\Windows\system32\Nnojho32.exe68⤵PID:3696
-
C:\Windows\SysWOW64\Nfjola32.exeC:\Windows\system32\Nfjola32.exe69⤵PID:1872
-
C:\Windows\SysWOW64\Ncnofeof.exeC:\Windows\system32\Ncnofeof.exe70⤵PID:2040
-
C:\Windows\SysWOW64\Nncccnol.exeC:\Windows\system32\Nncccnol.exe71⤵PID:1708
-
C:\Windows\SysWOW64\Nfohgqlg.exeC:\Windows\system32\Nfohgqlg.exe72⤵PID:4252
-
C:\Windows\SysWOW64\Nnhmnn32.exeC:\Windows\system32\Nnhmnn32.exe73⤵PID:4416
-
C:\Windows\SysWOW64\Oaifpi32.exeC:\Windows\system32\Oaifpi32.exe74⤵PID:4200
-
C:\Windows\SysWOW64\Ompfej32.exeC:\Windows\system32\Ompfej32.exe75⤵PID:3972
-
C:\Windows\SysWOW64\Ojfcdnjc.exeC:\Windows\system32\Ojfcdnjc.exe76⤵PID:4420
-
C:\Windows\SysWOW64\Ogjdmbil.exeC:\Windows\system32\Ogjdmbil.exe77⤵PID:1280
-
C:\Windows\SysWOW64\Ondljl32.exeC:\Windows\system32\Ondljl32.exe78⤵PID:1460
-
C:\Windows\SysWOW64\Ocaebc32.exeC:\Windows\system32\Ocaebc32.exe79⤵
- Modifies registry class
PID:1244 -
C:\Windows\SysWOW64\Pmiikh32.exeC:\Windows\system32\Pmiikh32.exe80⤵PID:2500
-
C:\Windows\SysWOW64\Pagbaglh.exeC:\Windows\system32\Pagbaglh.exe81⤵PID:916
-
C:\Windows\SysWOW64\Paiogf32.exeC:\Windows\system32\Paiogf32.exe82⤵PID:5128
-
C:\Windows\SysWOW64\Palklf32.exeC:\Windows\system32\Palklf32.exe83⤵PID:5172
-
C:\Windows\SysWOW64\Qaqegecm.exeC:\Windows\system32\Qaqegecm.exe84⤵
- Drops file in System32 directory
PID:5216 -
C:\Windows\SysWOW64\Qacameaj.exeC:\Windows\system32\Qacameaj.exe85⤵
- Drops file in System32 directory
PID:5276 -
C:\Windows\SysWOW64\Aknbkjfh.exeC:\Windows\system32\Aknbkjfh.exe86⤵PID:5324
-
C:\Windows\SysWOW64\Apjkcadp.exeC:\Windows\system32\Apjkcadp.exe87⤵PID:5384
-
C:\Windows\SysWOW64\Akpoaj32.exeC:\Windows\system32\Akpoaj32.exe88⤵
- Drops file in System32 directory
PID:5428 -
C:\Windows\SysWOW64\Apmhiq32.exeC:\Windows\system32\Apmhiq32.exe89⤵PID:5464
-
C:\Windows\SysWOW64\Adkqoohc.exeC:\Windows\system32\Adkqoohc.exe90⤵PID:5520
-
C:\Windows\SysWOW64\Akdilipp.exeC:\Windows\system32\Akdilipp.exe91⤵PID:5584
-
C:\Windows\SysWOW64\Apaadpng.exeC:\Windows\system32\Apaadpng.exe92⤵PID:5644
-
C:\Windows\SysWOW64\Bgkiaj32.exeC:\Windows\system32\Bgkiaj32.exe93⤵PID:5692
-
C:\Windows\SysWOW64\Bmeandma.exeC:\Windows\system32\Bmeandma.exe94⤵PID:5736
-
C:\Windows\SysWOW64\Bgnffj32.exeC:\Windows\system32\Bgnffj32.exe95⤵PID:5792
-
C:\Windows\SysWOW64\Bmhocd32.exeC:\Windows\system32\Bmhocd32.exe96⤵PID:5852
-
C:\Windows\SysWOW64\Bdagpnbk.exeC:\Windows\system32\Bdagpnbk.exe97⤵PID:5912
-
C:\Windows\SysWOW64\Bogkmgba.exeC:\Windows\system32\Bogkmgba.exe98⤵PID:5992
-
C:\Windows\SysWOW64\Bddcenpi.exeC:\Windows\system32\Bddcenpi.exe99⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6036 -
C:\Windows\SysWOW64\Bknlbhhe.exeC:\Windows\system32\Bknlbhhe.exe100⤵
- Drops file in System32 directory
PID:6084 -
C:\Windows\SysWOW64\Bahdob32.exeC:\Windows\system32\Bahdob32.exe101⤵PID:6124
-
C:\Windows\SysWOW64\Bkphhgfc.exeC:\Windows\system32\Bkphhgfc.exe102⤵PID:5140
-
C:\Windows\SysWOW64\Bajqda32.exeC:\Windows\system32\Bajqda32.exe103⤵PID:5224
-
C:\Windows\SysWOW64\Chdialdl.exeC:\Windows\system32\Chdialdl.exe104⤵
- Modifies registry class
PID:5308 -
C:\Windows\SysWOW64\Cnaaib32.exeC:\Windows\system32\Cnaaib32.exe105⤵PID:5420
-
C:\Windows\SysWOW64\Cponen32.exeC:\Windows\system32\Cponen32.exe106⤵PID:5480
-
C:\Windows\SysWOW64\Cgifbhid.exeC:\Windows\system32\Cgifbhid.exe107⤵PID:5560
-
C:\Windows\SysWOW64\Cglbhhga.exeC:\Windows\system32\Cglbhhga.exe108⤵PID:5688
-
C:\Windows\SysWOW64\Cpdgqmnb.exeC:\Windows\system32\Cpdgqmnb.exe109⤵
- Drops file in System32 directory
PID:5728 -
C:\Windows\SysWOW64\Ckjknfnh.exeC:\Windows\system32\Ckjknfnh.exe110⤵PID:5840
-
C:\Windows\SysWOW64\Cpfcfmlp.exeC:\Windows\system32\Cpfcfmlp.exe111⤵PID:5932
-
C:\Windows\SysWOW64\Cogddd32.exeC:\Windows\system32\Cogddd32.exe112⤵PID:6028
-
C:\Windows\SysWOW64\Dhphmj32.exeC:\Windows\system32\Dhphmj32.exe113⤵PID:6112
-
C:\Windows\SysWOW64\Dahmfpap.exeC:\Windows\system32\Dahmfpap.exe114⤵PID:3044
-
C:\Windows\SysWOW64\Dnonkq32.exeC:\Windows\system32\Dnonkq32.exe115⤵PID:5272
-
C:\Windows\SysWOW64\Dkcndeen.exeC:\Windows\system32\Dkcndeen.exe116⤵PID:5364
-
C:\Windows\SysWOW64\Ddkbmj32.exeC:\Windows\system32\Ddkbmj32.exe117⤵PID:5496
-
C:\Windows\SysWOW64\Dkhgod32.exeC:\Windows\system32\Dkhgod32.exe118⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5660 -
C:\Windows\SysWOW64\Egohdegl.exeC:\Windows\system32\Egohdegl.exe119⤵PID:5828
-
C:\Windows\SysWOW64\Egaejeej.exeC:\Windows\system32\Egaejeej.exe120⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5940 -
C:\Windows\SysWOW64\Egcaod32.exeC:\Windows\system32\Egcaod32.exe121⤵PID:6068
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-