47216150b78f4b14586ab5b8593c25a55e09e1a0379e142ca49e903fbe97e812

Analysis

max time kernel
93s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19/05/2024, 14:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d56ae449f4d827da561687487e4ebbd0_NeikiAnalytics.exe
Size 164KB
Sample240519-rn9qqsbd85
SHA256 47216150b78f4b14586ab5b8593c25a55e09e1a0379e142ca49e903fbe97e812
MD5 d56ae449f4d827da561687487e4ebbd0
SHA1 c5508c81e5cd5c47acb2628b0bdbe79a149db5a0
SHA512 b02b5ba1647243ee1129ca7c00f2900aeff31d54e4158d59036eb16067126f193f6ce59e8e754f58ad4dc8e8c72ba2d9384ee9c50ab162c4bd7a5237731466ea
SSDEEP 3072:PJTodeDbn6+4M1A/zRmUL4z1hG08uFafmHURHAVgnvedh6DRyU:Voq6j7NL2hG08uF8YU8gnve7GR
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

backdoor dropper persistence trojan

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 18 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nnmopdep.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	d56ae449f4d827da561687487e4ebbd0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ndbnboqb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nafokcol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nkqpjidj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ncldnkae.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndbnboqb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngpjnkpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ndghmo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nkqpjidj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncldnkae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nafokcol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ncgkcl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndghmo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnmopdep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	d56ae449f4d827da561687487e4ebbd0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ngpjnkpf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncgkcl32.exe

Malware Dropper & Backdoor - Berbew 9 IoCs

Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.

backdoor trojan dropper

resource	yara_rule
behavioral2/files/0x00090000000233c1-7.dat	family_berbew
behavioral2/files/0x00070000000233c8-14.dat	family_berbew
behavioral2/files/0x00070000000233cb-23.dat	family_berbew
behavioral2/files/0x00070000000233cd-31.dat	family_berbew
behavioral2/files/0x00070000000233cf-38.dat	family_berbew
behavioral2/files/0x00070000000233d1-46.dat	family_berbew
behavioral2/files/0x00070000000233d3-54.dat	family_berbew
behavioral2/files/0x00070000000233d5-62.dat	family_berbew
behavioral2/files/0x00070000000233d7-70.dat	family_berbew

Executes dropped EXE 9 IoCs

pid	Process
2068	Ndbnboqb.exe
3448	Ngpjnkpf.exe
468	Nafokcol.exe
1692	Ncgkcl32.exe
320	Nnmopdep.exe
2932	Ndghmo32.exe
1468	Nkqpjidj.exe
4988	Ncldnkae.exe
3648	Nkcmohbg.exe

Drops file in System32 directory 27 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Dihcoe32.dll	d56ae449f4d827da561687487e4ebbd0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\Ngpjnkpf.exe	Ndbnboqb.exe
File created	C:\Windows\SysWOW64\Nkqpjidj.exe	Ndghmo32.exe
File opened for modification	C:\Windows\SysWOW64\Ncldnkae.exe	Nkqpjidj.exe
File created	C:\Windows\SysWOW64\Hnibdpde.dll	Ncldnkae.exe
File created	C:\Windows\SysWOW64\Ndbnboqb.exe	d56ae449f4d827da561687487e4ebbd0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\Ngpjnkpf.exe	Ndbnboqb.exe
File created	C:\Windows\SysWOW64\Mlhblb32.dll	Ndbnboqb.exe
File opened for modification	C:\Windows\SysWOW64\Nkqpjidj.exe	Ndghmo32.exe
File created	C:\Windows\SysWOW64\Dlddhggk.dll	Nkqpjidj.exe
File created	C:\Windows\SysWOW64\Pipfna32.dll	Nafokcol.exe
File created	C:\Windows\SysWOW64\Nnmopdep.exe	Ncgkcl32.exe
File created	C:\Windows\SysWOW64\Ogpnaafp.dll	Ndghmo32.exe
File opened for modification	C:\Windows\SysWOW64\Ndghmo32.exe	Nnmopdep.exe
File created	C:\Windows\SysWOW64\Cgfgaq32.dll	Ncgkcl32.exe
File created	C:\Windows\SysWOW64\Ncldnkae.exe	Nkqpjidj.exe
File opened for modification	C:\Windows\SysWOW64\Nkcmohbg.exe	Ncldnkae.exe
File created	C:\Windows\SysWOW64\Nafokcol.exe	Ngpjnkpf.exe
File opened for modification	C:\Windows\SysWOW64\Nafokcol.exe	Ngpjnkpf.exe
File created	C:\Windows\SysWOW64\Jcoegc32.dll	Ngpjnkpf.exe
File opened for modification	C:\Windows\SysWOW64\Nnmopdep.exe	Ncgkcl32.exe
File created	C:\Windows\SysWOW64\Bdknoa32.dll	Nnmopdep.exe
File opened for modification	C:\Windows\SysWOW64\Ndbnboqb.exe	d56ae449f4d827da561687487e4ebbd0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\Ncgkcl32.exe	Nafokcol.exe
File opened for modification	C:\Windows\SysWOW64\Ncgkcl32.exe	Nafokcol.exe
File created	C:\Windows\SysWOW64\Ndghmo32.exe	Nnmopdep.exe
File created	C:\Windows\SysWOW64\Nkcmohbg.exe	Ncldnkae.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4152	3648	WerFault.exe	90

Modifies registry class 30 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ndbnboqb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ngpjnkpf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ncgkcl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dihcoe32.dll"	d56ae449f4d827da561687487e4ebbd0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogpnaafp.dll"	Ndghmo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}	d56ae449f4d827da561687487e4ebbd0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcoegc32.dll"	Ngpjnkpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pipfna32.dll"	Nafokcol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dlddhggk.dll"	Nkqpjidj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnibdpde.dll"	Ncldnkae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	d56ae449f4d827da561687487e4ebbd0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ndghmo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nkqpjidj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ncldnkae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	d56ae449f4d827da561687487e4ebbd0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cgfgaq32.dll"	Ncgkcl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ncgkcl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ndghmo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ngpjnkpf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	d56ae449f4d827da561687487e4ebbd0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nafokcol.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nnmopdep.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nkqpjidj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ndbnboqb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mlhblb32.dll"	Ndbnboqb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nafokcol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bdknoa32.dll"	Nnmopdep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nnmopdep.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ncldnkae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	d56ae449f4d827da561687487e4ebbd0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 2068	2748	d56ae449f4d827da561687487e4ebbd0_NeikiAnalytics.exe	82
PID 2748 wrote to memory of 2068	2748	d56ae449f4d827da561687487e4ebbd0_NeikiAnalytics.exe	82
PID 2748 wrote to memory of 2068	2748	d56ae449f4d827da561687487e4ebbd0_NeikiAnalytics.exe	82
PID 2068 wrote to memory of 3448	2068	Ndbnboqb.exe	83
PID 2068 wrote to memory of 3448	2068	Ndbnboqb.exe	83
PID 2068 wrote to memory of 3448	2068	Ndbnboqb.exe	83
PID 3448 wrote to memory of 468	3448	Ngpjnkpf.exe	84
PID 3448 wrote to memory of 468	3448	Ngpjnkpf.exe	84
PID 3448 wrote to memory of 468	3448	Ngpjnkpf.exe	84
PID 468 wrote to memory of 1692	468	Nafokcol.exe	85
PID 468 wrote to memory of 1692	468	Nafokcol.exe	85
PID 468 wrote to memory of 1692	468	Nafokcol.exe	85
PID 1692 wrote to memory of 320	1692	Ncgkcl32.exe	86
PID 1692 wrote to memory of 320	1692	Ncgkcl32.exe	86
PID 1692 wrote to memory of 320	1692	Ncgkcl32.exe	86
PID 320 wrote to memory of 2932	320	Nnmopdep.exe	87
PID 320 wrote to memory of 2932	320	Nnmopdep.exe	87
PID 320 wrote to memory of 2932	320	Nnmopdep.exe	87
PID 2932 wrote to memory of 1468	2932	Ndghmo32.exe	88
PID 2932 wrote to memory of 1468	2932	Ndghmo32.exe	88
PID 2932 wrote to memory of 1468	2932	Ndghmo32.exe	88
PID 1468 wrote to memory of 4988	1468	Nkqpjidj.exe	89
PID 1468 wrote to memory of 4988	1468	Nkqpjidj.exe	89
PID 1468 wrote to memory of 4988	1468	Nkqpjidj.exe	89
PID 4988 wrote to memory of 3648	4988	Ncldnkae.exe	90
PID 4988 wrote to memory of 3648	4988	Ncldnkae.exe	90
PID 4988 wrote to memory of 3648	4988	Ncldnkae.exe	90

C:\Users\Admin\AppData\Local\Temp\d56ae449f4d827da561687487e4ebbd0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\d56ae449f4d827da561687487e4ebbd0_NeikiAnalytics.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Windows\SysWOW64\Ndbnboqb.exe
  C:\Windows\system32\Ndbnboqb.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2068
- - C:\Windows\SysWOW64\Ngpjnkpf.exe
    C:\Windows\system32\Ngpjnkpf.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3448
  - - C:\Windows\SysWOW64\Nafokcol.exe
      C:\Windows\system32\Nafokcol.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:468
    - - C:\Windows\SysWOW64\Ncgkcl32.exe
        
        C:\Windows\system32\Ncgkcl32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1692
      - C:\Windows\SysWOW64\Nnmopdep.exe
        
        C:\Windows\system32\Nnmopdep.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:320
        
        C:\Windows\SysWOW64\Ndghmo32.exe
        
        C:\Windows\system32\Ndghmo32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2932
        
        C:\Windows\SysWOW64\Nkqpjidj.exe
        
        C:\Windows\system32\Nkqpjidj.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1468
        
        C:\Windows\SysWOW64\Ncldnkae.exe
        
        C:\Windows\system32\Ncldnkae.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4988
        
        C:\Windows\SysWOW64\Nkcmohbg.exe
        
        C:\Windows\system32\Nkcmohbg.exe
        10⤵
        Executes dropped EXE
        
        PID:3648
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3648 -s 412
        11⤵
        Program crash
        
        PID:4152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3648 -ip 3648
1⤵
PID:4108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Cgfgaq32.dll

Path C:\Windows\SysWOW64\Cgfgaq32.dll
Size 7KB
SHA256 5a6ba350e62d5c06fa0a1c51b2b5bf620b59c79cc13f3f532188ad3d63c88c34
MD5 d8a5e3ef0966db47e07671e0b767c0e5
SHA1 4b94797bdc80c390820cf61764fb182f09c9e047
SHA512 b0940df9e477fad1d8af740d9eb05484dd9af4da398d23b0c700010b846e48be402794c4e7d65bf34a8820295ebc38216305979a7f72897df8efe8b4bb42f6dd
SSDEEP 48:66ay5YVO3EVkApc2wp8hH1NZn5EquglQ067YbPWBbABbgL3q9J5S2hmc:b3EVkApcX4Hiv0hbPbq3qX5S2hV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nafokcol.exe

Path C:\Windows\SysWOW64\Nafokcol.exe
Size 164KB
SHA256 85adb784803a273cfb26ee6a509f395010c612e727ee878ced5e515129ed045e
MD5 765082956fcea7f26883c7ee78c63a31
SHA1 a80868eb53eddf0ae3c7366e7c4356a9724f5b56
SHA512 ae8a8c66901e5a55800da6f05ce71c27fcce8f1507888f44626a1875d31f3a7bbf5e840554dd0367344bf1227f1887e8e73df2df2f1f5284219da46f31380517
SSDEEP 3072:uXKDTVlG1f2dvKMIngmWVa08uFafmHURHAVgnvedh6DRyU:jDTimvSgpa08uF8YU8gnve7GR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ncgkcl32.exe

Path C:\Windows\SysWOW64\Ncgkcl32.exe
Size 164KB
SHA256 8b5a474829f15a57a7214963673c498760e55c2c24aef3f345155f4258ae5515
MD5 19a18fe124fb886accd4e02b148686d0
SHA1 3bf3497244c2c1736770b419f2a84d7104fffb9a
SHA512 073387f59b4ea5b1c753560986c327ad28dae3edb9deea30199c1f35fd865da03ef2ce49408307473df0eba232a3f215a4b6e44493973914424e2511b57bb456
SSDEEP 3072:SG9sNdlbU3Gyj3r665P8w508uFafmHURHAVgnvedh6DRyU:X9lj3r665P1508uF8YU8gnve7GR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ncldnkae.exe

Path C:\Windows\SysWOW64\Ncldnkae.exe
Size 164KB
SHA256 b7477dac04f2246cd26685251525d73b3878fc1ef832e006e059fa92eb02307d
MD5 3862e15e3c3f692740240a179137c46e
SHA1 8efc06a803e9c67b9fdeb833de723a0f8054ffbe
SHA512 14aa91de00c27b61aee08bfb570255fc37bae0e03c4513dabb9c52bc3d639eb52cacc4ed943150d259468506c2833cf85bd6562c81af2eda6b54a46de3ab0f0b
SSDEEP 3072:DWrgn2ZzOYv2g58FlXi08uFafmHURHAVgnvedh6DRyU:DW/NOYv2vXi08uF8YU8gnve7GR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ndbnboqb.exe

Path C:\Windows\SysWOW64\Ndbnboqb.exe
Size 164KB
SHA256 074882c6003c6831c9ec30af197855925e0f4e90790feb3179f4f6c3efa9c8e9
MD5 6e8a023899148164baedcea3b2491dea
SHA1 a1e47f47abb6420d74e3b75ecd74e74d02e27a97
SHA512 ed867ed3dc14f11484007b8816817d39f9c576199484d81b06299fafe31929c34f495cbb2d718959adfae50bda960d8c1d98aa6ff7bf98b87d2b6cf26fad866a
SSDEEP 3072:jvxgVTaZ/hQ23xtlZknNEFbAZyV2208uFafmHURHAVgnvedh6DRyU:jZgVaZ/hQ2T8ngcEVV08uF8YU8gnve7w
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ndghmo32.exe

Path C:\Windows\SysWOW64\Ndghmo32.exe
Size 164KB
SHA256 552735d2b44322fc369b771f084d968c2d0b3f0bfedd1028402c97926b2d48c1
MD5 856f98b58aa9cdcfad942449b66705e4
SHA1 32b9e4ba41c16d33e29d0a4ae8604514eac5020a
SHA512 1b7a57596ca9dea91b4634a0f7e6595ce342961c722cd8ca43428e9adea88d57085eac040feb5ab870011e3f248158961de7efb693cf24af99b9a29125ff08ce
SSDEEP 3072:e+aDk1+M7Vx1I1YcOnJxJu08uFafmHURHAVgnvedh6DRyU:T71+M7VfgUxJu08uF8YU8gnve7GR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ngpjnkpf.exe

Path C:\Windows\SysWOW64\Ngpjnkpf.exe
Size 164KB
SHA256 9f4d946108c57c90d0efbd79dbfd05c5dba05833340d8aad0373bf676c22bfd9
MD5 adc8b0af8e07136bd0550a1f32f02387
SHA1 276d3b76c5e73d6e61125ec1d1ef0992fe9b3ba4
SHA512 fd801bdf9a6839277d47af1e66bfb3d562c13275e02b264cbf0a599b4a9705756f068f7a1c6fd2fc36b61a2df478be5ef04511e79869de2d7e16461de2566f6e
SSDEEP 3072:KQBLggq2oDjn4gFlRUo0cgd08uFafmHURHAVgnvedh6DRyU:KQJggLQjn4gFlR0bd08uF8YU8gnve7GR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nkcmohbg.exe

Path C:\Windows\SysWOW64\Nkcmohbg.exe
Size 164KB
SHA256 cd3b5cbd9cc58d05ae4cfd36e78f494cb086cea2b9a6837f2f29a8263271877b
MD5 39ba0390fd2fc724e54efdac3cd23d48
SHA1 69bf8c7a0cb96979db0b92f8b52b549bb71004be
SHA512 262d715264bda51552129607414a2d37ee748ca4941a0ce51d8b4fb5c57384b70f1cf3a1a4893e1b4432d3e3e5c37fdf8182788807c78250cc1b99480ebcbb1d
SSDEEP 3072:V9eLt8k+5cJI+/rlv0iHW08uFafmHURHAVgnvedh6DRyU:OLC9d+/hvHW08uF8YU8gnve7GR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nkqpjidj.exe

Path C:\Windows\SysWOW64\Nkqpjidj.exe
Size 164KB
SHA256 e697600ba21025bdff22e0e24baad31256bc54f00dee623ecb83eadeef17e406
MD5 25bc8808bbcfdf7d828b0fd6a283caf4
SHA1 4c45e1d7331ff83f3e76604884a9b9497640d70c
SHA512 3d5416ff09dbd4d2762d356bb0cb0122d3070b7ad28aa8c237da7cfabce8af1bb0c93404f9bd43c8a336d5c10fed4b7bd5904a2ef986f898951026f8c4436f27
SSDEEP 3072:K4cjHb8txRAYZbwe5c7A/J2645+pqecHk08uFafmHURHAVgnvedh6DRyU:K4cjKZbwLHk08uF8YU8gnve7GR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nnmopdep.exe

Path C:\Windows\SysWOW64\Nnmopdep.exe
Size 164KB
SHA256 5f295e55af906ffb5408763ecd8a0e54021a02cbb52b032e86949b9cc97771eb
MD5 d168742152ed9ed6db3970097e0526cb
SHA1 e3ca7ba5fa12f7712cf81824921649b89aa0a11a
SHA512 321f65cdfdf4025206b18bde697ea67c1763e37b35ba1b8431d2513033f833dbf04a10a7a5b73d9ae05e5190646b6d6761223be8698c48fbe8c3de08fa689f77
SSDEEP 3072:wiiPfEDwqfEtIAihuIEZTpadP08uFafmHURHAVgnvedh6DRyU:NNw+k2KadP08uF8YU8gnve7GR
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/320-44-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/320-76-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/468-28-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/1468-75-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/1468-55-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/1692-36-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/2068-79-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/2068-12-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/2748-0-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/2748-80-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/2932-52-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/2932-77-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/3448-16-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/3448-78-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/3648-73-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/3648-72-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/4988-74-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/4988-64-0x0000000000400000-0x0000000000445000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads