Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
20/05/2024, 04:33
Static task
static1
Behavioral task
behavioral1
Sample
ade14dacb4f69ba39a54d046ca911290_NeikiAnalytics.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
ade14dacb4f69ba39a54d046ca911290_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
ade14dacb4f69ba39a54d046ca911290_NeikiAnalytics.exe
-
Size
124KB
-
MD5
ade14dacb4f69ba39a54d046ca911290
-
SHA1
641c1573c9dc186e219f8d07eb1ebef34673b37f
-
SHA256
5aac6feeca4f7ea8a0621d8de5d6759eeb47c0953ead1f74cb4519d026058f63
-
SHA512
04c094bc66ee5151f3a035023216d5a1b8e00f39ee3a239116577075c70c35368c11319e5265bcb173e95488a1b7fc96a67e7ff578aa9d34fb6b67eb0e3b24ba
-
SSDEEP
1536:SQsz45Y9ihRO/N69BH3OoGa+FL9jKceRgrkjSo:FGKY8hkFoN3Oo1+F92S
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 47 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" viauk.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" qiierut.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" suewou.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" leuxi.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" peuveq.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" jeuyuoc.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" buiom.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" deoqueb.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" jeoyooy.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" guirer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ysqiy.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" meoizaw.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" zaobif.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" guadev.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" noeeve.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" coare.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ade14dacb4f69ba39a54d046ca911290_NeikiAnalytics.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" nuofo.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" zuuupen.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" beufo.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" rooafoj.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" piowib.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" dsfuz.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" goueg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" boioli.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" xsgul.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" zeeaf.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" xiajioh.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" foehoe.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" bhdob.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" hiaete.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" brxeux.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" biaehu.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" qieuyi.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" nuirij.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" baanoi.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" keolaa.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" baqum.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" zoled.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" tuize.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" liuiz.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" lauow.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" yeiqes.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" hiuuz.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" roaukad.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" duari.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" gueyaas.exe -
Executes dropped EXE 46 IoCs
pid Process 1304 ysqiy.exe 2892 viauk.exe 2800 brxeux.exe 2484 qiierut.exe 2792 suewou.exe 2940 xsgul.exe 1436 biaehu.exe 2540 lauow.exe 1556 zeeaf.exe 2260 yeiqes.exe 608 buiom.exe 3020 qieuyi.exe 2268 nuofo.exe 1912 zuuupen.exe 2204 meoizaw.exe 1248 beufo.exe 1800 piowib.exe 2604 zaobif.exe 2984 nuirij.exe 2844 baanoi.exe 1788 baqum.exe 2788 zoled.exe 1528 tuize.exe 2916 hiuuz.exe 1644 roaukad.exe 1776 noeeve.exe 972 guadev.exe 1724 leuxi.exe 2592 peuveq.exe 2784 xiajioh.exe 2352 duari.exe 2496 keolaa.exe 2776 foehoe.exe 2688 liuiz.exe 1000 deoqueb.exe 1040 bhdob.exe 1804 hiaete.exe 2492 coare.exe 2056 jeoyooy.exe 1692 dsfuz.exe 688 boioli.exe 1484 gueyaas.exe 2188 jeuyuoc.exe 1520 guirer.exe 1580 goueg.exe 552 woeve.exe -
Loads dropped DLL 64 IoCs
pid Process 2028 ade14dacb4f69ba39a54d046ca911290_NeikiAnalytics.exe 2028 ade14dacb4f69ba39a54d046ca911290_NeikiAnalytics.exe 1304 ysqiy.exe 1304 ysqiy.exe 2892 viauk.exe 2892 viauk.exe 2800 brxeux.exe 2800 brxeux.exe 2484 qiierut.exe 2484 qiierut.exe 2792 suewou.exe 2792 suewou.exe 2940 xsgul.exe 2940 xsgul.exe 1436 biaehu.exe 1436 biaehu.exe 2540 lauow.exe 2540 lauow.exe 1556 zeeaf.exe 1556 zeeaf.exe 2260 yeiqes.exe 2260 yeiqes.exe 608 buiom.exe 608 buiom.exe 3020 qieuyi.exe 3020 qieuyi.exe 2268 nuofo.exe 2268 nuofo.exe 1912 zuuupen.exe 1912 zuuupen.exe 2204 meoizaw.exe 2204 meoizaw.exe 1880 rooafoj.exe 1880 rooafoj.exe 1800 piowib.exe 1800 piowib.exe 2604 zaobif.exe 2604 zaobif.exe 2984 nuirij.exe 2984 nuirij.exe 2844 baanoi.exe 2844 baanoi.exe 1788 baqum.exe 1788 baqum.exe 2788 zoled.exe 2788 zoled.exe 1528 tuize.exe 1528 tuize.exe 2916 hiuuz.exe 2916 hiuuz.exe 1644 roaukad.exe 1644 roaukad.exe 1776 noeeve.exe 1776 noeeve.exe 972 guadev.exe 972 guadev.exe 1724 leuxi.exe 1724 leuxi.exe 2592 peuveq.exe 2592 peuveq.exe 2784 xiajioh.exe 2784 xiajioh.exe 2352 duari.exe 2352 duari.exe -
Adds Run key to start application 2 TTPs 47 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\zoled = "C:\\Users\\Admin\\zoled.exe /F" baqum.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\peuveq = "C:\\Users\\Admin\\peuveq.exe /q" leuxi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\foehoe = "C:\\Users\\Admin\\foehoe.exe /e" keolaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\dsfuz = "C:\\Users\\Admin\\dsfuz.exe /l" jeoyooy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\jeuyuoc = "C:\\Users\\Admin\\jeuyuoc.exe /U" gueyaas.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\suewou = "C:\\Users\\Admin\\suewou.exe /t" qiierut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\biaehu = "C:\\Users\\Admin\\biaehu.exe /J" xsgul.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\beufo = "C:\\Users\\Admin\\beufo.exe /h" meoizaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\ysqiy = "C:\\Users\\Admin\\ysqiy.exe /b" ade14dacb4f69ba39a54d046ca911290_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuofo = "C:\\Users\\Admin\\nuofo.exe /d" qieuyi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\piowib = "C:\\Users\\Admin\\piowib.exe /j" rooafoj.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\baqum = "C:\\Users\\Admin\\baqum.exe /n" baanoi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\keolaa = "C:\\Users\\Admin\\keolaa.exe /y" duari.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\liuiz = "C:\\Users\\Admin\\liuiz.exe /P" foehoe.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\viauk = "C:\\Users\\Admin\\viauk.exe /F" ysqiy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\qiierut = "C:\\Users\\Admin\\qiierut.exe /k" brxeux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\buiom = "C:\\Users\\Admin\\buiom.exe /Y" yeiqes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\noeeve = "C:\\Users\\Admin\\noeeve.exe /R" roaukad.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\deoqueb = "C:\\Users\\Admin\\deoqueb.exe /X" liuiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\bhdob = "C:\\Users\\Admin\\bhdob.exe /O" deoqueb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\gueyaas = "C:\\Users\\Admin\\gueyaas.exe /p" boioli.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\zuuupen = "C:\\Users\\Admin\\zuuupen.exe /u" nuofo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiuuz = "C:\\Users\\Admin\\hiuuz.exe /K" tuize.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\roaukad = "C:\\Users\\Admin\\roaukad.exe /N" hiuuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\zaobif = "C:\\Users\\Admin\\zaobif.exe /T" piowib.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuirij = "C:\\Users\\Admin\\nuirij.exe /K" zaobif.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\baanoi = "C:\\Users\\Admin\\baanoi.exe /h" nuirij.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\leuxi = "C:\\Users\\Admin\\leuxi.exe /b" guadev.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiajioh = "C:\\Users\\Admin\\xiajioh.exe /o" peuveq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\brxeux = "C:\\Users\\Admin\\brxeux.exe /r" viauk.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\qieuyi = "C:\\Users\\Admin\\qieuyi.exe /T" buiom.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\meoizaw = "C:\\Users\\Admin\\meoizaw.exe /x" zuuupen.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\goueg = "C:\\Users\\Admin\\goueg.exe /h" guirer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\duari = "C:\\Users\\Admin\\duari.exe /N" xiajioh.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiaete = "C:\\Users\\Admin\\hiaete.exe /D" bhdob.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\jeoyooy = "C:\\Users\\Admin\\jeoyooy.exe /R" coare.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeeaf = "C:\\Users\\Admin\\zeeaf.exe /g" lauow.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\tuize = "C:\\Users\\Admin\\tuize.exe /T" zoled.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\boioli = "C:\\Users\\Admin\\boioli.exe /I" dsfuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeiqes = "C:\\Users\\Admin\\yeiqes.exe /g" zeeaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\guadev = "C:\\Users\\Admin\\guadev.exe /k" noeeve.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\coare = "C:\\Users\\Admin\\coare.exe /b" hiaete.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\guirer = "C:\\Users\\Admin\\guirer.exe /G" jeuyuoc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\woeve = "C:\\Users\\Admin\\woeve.exe /x" goueg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\xsgul = "C:\\Users\\Admin\\xsgul.exe /a" suewou.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\lauow = "C:\\Users\\Admin\\lauow.exe /A" biaehu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\rooafoj = "C:\\Users\\Admin\\rooafoj.exe /a" beufo.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 46 IoCs
pid Process 2028 ade14dacb4f69ba39a54d046ca911290_NeikiAnalytics.exe 1304 ysqiy.exe 2892 viauk.exe 2800 brxeux.exe 2484 qiierut.exe 2792 suewou.exe 2940 xsgul.exe 1436 biaehu.exe 2540 lauow.exe 1556 zeeaf.exe 2260 yeiqes.exe 608 buiom.exe 3020 qieuyi.exe 2268 nuofo.exe 1912 zuuupen.exe 2204 meoizaw.exe 1880 rooafoj.exe 1800 piowib.exe 2604 zaobif.exe 2984 nuirij.exe 2844 baanoi.exe 1788 baqum.exe 2788 zoled.exe 1528 tuize.exe 2916 hiuuz.exe 1644 roaukad.exe 1776 noeeve.exe 972 guadev.exe 1724 leuxi.exe 2592 peuveq.exe 2784 xiajioh.exe 2352 duari.exe 2496 keolaa.exe 2776 foehoe.exe 2688 liuiz.exe 1000 deoqueb.exe 1040 bhdob.exe 1804 hiaete.exe 2492 coare.exe 2056 jeoyooy.exe 1692 dsfuz.exe 688 boioli.exe 1484 gueyaas.exe 2188 jeuyuoc.exe 1520 guirer.exe 1580 goueg.exe -
Suspicious use of SetWindowsHookEx 47 IoCs
pid Process 2028 ade14dacb4f69ba39a54d046ca911290_NeikiAnalytics.exe 1304 ysqiy.exe 2892 viauk.exe 2800 brxeux.exe 2484 qiierut.exe 2792 suewou.exe 2940 xsgul.exe 1436 biaehu.exe 2540 lauow.exe 1556 zeeaf.exe 2260 yeiqes.exe 608 buiom.exe 3020 qieuyi.exe 2268 nuofo.exe 1912 zuuupen.exe 2204 meoizaw.exe 1880 rooafoj.exe 1800 piowib.exe 2604 zaobif.exe 2984 nuirij.exe 2844 baanoi.exe 1788 baqum.exe 2788 zoled.exe 1528 tuize.exe 2916 hiuuz.exe 1644 roaukad.exe 1776 noeeve.exe 972 guadev.exe 1724 leuxi.exe 2592 peuveq.exe 2784 xiajioh.exe 2352 duari.exe 2496 keolaa.exe 2776 foehoe.exe 2688 liuiz.exe 1000 deoqueb.exe 1040 bhdob.exe 1804 hiaete.exe 2492 coare.exe 2056 jeoyooy.exe 1692 dsfuz.exe 688 boioli.exe 1484 gueyaas.exe 2188 jeuyuoc.exe 1520 guirer.exe 1580 goueg.exe 552 woeve.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2028 wrote to memory of 1304 2028 ade14dacb4f69ba39a54d046ca911290_NeikiAnalytics.exe 28 PID 2028 wrote to memory of 1304 2028 ade14dacb4f69ba39a54d046ca911290_NeikiAnalytics.exe 28 PID 2028 wrote to memory of 1304 2028 ade14dacb4f69ba39a54d046ca911290_NeikiAnalytics.exe 28 PID 2028 wrote to memory of 1304 2028 ade14dacb4f69ba39a54d046ca911290_NeikiAnalytics.exe 28 PID 1304 wrote to memory of 2892 1304 ysqiy.exe 29 PID 1304 wrote to memory of 2892 1304 ysqiy.exe 29 PID 1304 wrote to memory of 2892 1304 ysqiy.exe 29 PID 1304 wrote to memory of 2892 1304 ysqiy.exe 29 PID 2892 wrote to memory of 2800 2892 viauk.exe 30 PID 2892 wrote to memory of 2800 2892 viauk.exe 30 PID 2892 wrote to memory of 2800 2892 viauk.exe 30 PID 2892 wrote to memory of 2800 2892 viauk.exe 30 PID 2800 wrote to memory of 2484 2800 brxeux.exe 31 PID 2800 wrote to memory of 2484 2800 brxeux.exe 31 PID 2800 wrote to memory of 2484 2800 brxeux.exe 31 PID 2800 wrote to memory of 2484 2800 brxeux.exe 31 PID 2484 wrote to memory of 2792 2484 qiierut.exe 32 PID 2484 wrote to memory of 2792 2484 qiierut.exe 32 PID 2484 wrote to memory of 2792 2484 qiierut.exe 32 PID 2484 wrote to memory of 2792 2484 qiierut.exe 32 PID 2792 wrote to memory of 2940 2792 suewou.exe 33 PID 2792 wrote to memory of 2940 2792 suewou.exe 33 PID 2792 wrote to memory of 2940 2792 suewou.exe 33 PID 2792 wrote to memory of 2940 2792 suewou.exe 33 PID 2940 wrote to memory of 1436 2940 xsgul.exe 34 PID 2940 wrote to memory of 1436 2940 xsgul.exe 34 PID 2940 wrote to memory of 1436 2940 xsgul.exe 34 PID 2940 wrote to memory of 1436 2940 xsgul.exe 34 PID 1436 wrote to memory of 2540 1436 biaehu.exe 35 PID 1436 wrote to memory of 2540 1436 biaehu.exe 35 PID 1436 wrote to memory of 2540 1436 biaehu.exe 35 PID 1436 wrote to memory of 2540 1436 biaehu.exe 35 PID 2540 wrote to memory of 1556 2540 lauow.exe 36 PID 2540 wrote to memory of 1556 2540 lauow.exe 36 PID 2540 wrote to memory of 1556 2540 lauow.exe 36 PID 2540 wrote to memory of 1556 2540 lauow.exe 36 PID 1556 wrote to memory of 2260 1556 zeeaf.exe 37 PID 1556 wrote to memory of 2260 1556 zeeaf.exe 37 PID 1556 wrote to memory of 2260 1556 zeeaf.exe 37 PID 1556 wrote to memory of 2260 1556 zeeaf.exe 37 PID 2260 wrote to memory of 608 2260 yeiqes.exe 38 PID 2260 wrote to memory of 608 2260 yeiqes.exe 38 PID 2260 wrote to memory of 608 2260 yeiqes.exe 38 PID 2260 wrote to memory of 608 2260 yeiqes.exe 38 PID 608 wrote to memory of 3020 608 buiom.exe 39 PID 608 wrote to memory of 3020 608 buiom.exe 39 PID 608 wrote to memory of 3020 608 buiom.exe 39 PID 608 wrote to memory of 3020 608 buiom.exe 39 PID 3020 wrote to memory of 2268 3020 qieuyi.exe 40 PID 3020 wrote to memory of 2268 3020 qieuyi.exe 40 PID 3020 wrote to memory of 2268 3020 qieuyi.exe 40 PID 3020 wrote to memory of 2268 3020 qieuyi.exe 40 PID 2268 wrote to memory of 1912 2268 nuofo.exe 41 PID 2268 wrote to memory of 1912 2268 nuofo.exe 41 PID 2268 wrote to memory of 1912 2268 nuofo.exe 41 PID 2268 wrote to memory of 1912 2268 nuofo.exe 41 PID 1912 wrote to memory of 2204 1912 zuuupen.exe 42 PID 1912 wrote to memory of 2204 1912 zuuupen.exe 42 PID 1912 wrote to memory of 2204 1912 zuuupen.exe 42 PID 1912 wrote to memory of 2204 1912 zuuupen.exe 42 PID 2204 wrote to memory of 1248 2204 meoizaw.exe 45 PID 2204 wrote to memory of 1248 2204 meoizaw.exe 45 PID 2204 wrote to memory of 1248 2204 meoizaw.exe 45 PID 2204 wrote to memory of 1248 2204 meoizaw.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\ade14dacb4f69ba39a54d046ca911290_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\ade14dacb4f69ba39a54d046ca911290_NeikiAnalytics.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Users\Admin\ysqiy.exe"C:\Users\Admin\ysqiy.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Users\Admin\viauk.exe"C:\Users\Admin\viauk.exe"3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\brxeux.exe"C:\Users\Admin\brxeux.exe"4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\qiierut.exe"C:\Users\Admin\qiierut.exe"5⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\suewou.exe"C:\Users\Admin\suewou.exe"6⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\xsgul.exe"C:\Users\Admin\xsgul.exe"7⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\biaehu.exe"C:\Users\Admin\biaehu.exe"8⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Users\Admin\lauow.exe"C:\Users\Admin\lauow.exe"9⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\zeeaf.exe"C:\Users\Admin\zeeaf.exe"10⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Users\Admin\yeiqes.exe"C:\Users\Admin\yeiqes.exe"11⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Users\Admin\buiom.exe"C:\Users\Admin\buiom.exe"12⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:608 -
C:\Users\Admin\qieuyi.exe"C:\Users\Admin\qieuyi.exe"13⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\nuofo.exe"C:\Users\Admin\nuofo.exe"14⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\zuuupen.exe"C:\Users\Admin\zuuupen.exe"15⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Users\Admin\meoizaw.exe"C:\Users\Admin\meoizaw.exe"16⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Users\Admin\beufo.exe"C:\Users\Admin\beufo.exe"17⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
PID:1248 -
C:\Users\Admin\rooafoj.exe"C:\Users\Admin\rooafoj.exe"18⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1880 -
C:\Users\Admin\piowib.exe"C:\Users\Admin\piowib.exe"19⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1800 -
C:\Users\Admin\zaobif.exe"C:\Users\Admin\zaobif.exe"20⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2604 -
C:\Users\Admin\nuirij.exe"C:\Users\Admin\nuirij.exe"21⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2984 -
C:\Users\Admin\baanoi.exe"C:\Users\Admin\baanoi.exe"22⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2844 -
C:\Users\Admin\baqum.exe"C:\Users\Admin\baqum.exe"23⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1788 -
C:\Users\Admin\zoled.exe"C:\Users\Admin\zoled.exe"24⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2788 -
C:\Users\Admin\tuize.exe"C:\Users\Admin\tuize.exe"25⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1528 -
C:\Users\Admin\hiuuz.exe"C:\Users\Admin\hiuuz.exe"26⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2916 -
C:\Users\Admin\roaukad.exe"C:\Users\Admin\roaukad.exe"27⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1644 -
C:\Users\Admin\noeeve.exe"C:\Users\Admin\noeeve.exe"28⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1776 -
C:\Users\Admin\guadev.exe"C:\Users\Admin\guadev.exe"29⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:972 -
C:\Users\Admin\leuxi.exe"C:\Users\Admin\leuxi.exe"30⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1724 -
C:\Users\Admin\peuveq.exe"C:\Users\Admin\peuveq.exe"31⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2592 -
C:\Users\Admin\xiajioh.exe"C:\Users\Admin\xiajioh.exe"32⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2784 -
C:\Users\Admin\duari.exe"C:\Users\Admin\duari.exe"33⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2352 -
C:\Users\Admin\keolaa.exe"C:\Users\Admin\keolaa.exe"34⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2496 -
C:\Users\Admin\foehoe.exe"C:\Users\Admin\foehoe.exe"35⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2776 -
C:\Users\Admin\liuiz.exe"C:\Users\Admin\liuiz.exe"36⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2688 -
C:\Users\Admin\deoqueb.exe"C:\Users\Admin\deoqueb.exe"37⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1000 -
C:\Users\Admin\bhdob.exe"C:\Users\Admin\bhdob.exe"38⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1040 -
C:\Users\Admin\hiaete.exe"C:\Users\Admin\hiaete.exe"39⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1804 -
C:\Users\Admin\coare.exe"C:\Users\Admin\coare.exe"40⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2492 -
C:\Users\Admin\jeoyooy.exe"C:\Users\Admin\jeoyooy.exe"41⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2056 -
C:\Users\Admin\dsfuz.exe"C:\Users\Admin\dsfuz.exe"42⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1692 -
C:\Users\Admin\boioli.exe"C:\Users\Admin\boioli.exe"43⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:688 -
C:\Users\Admin\gueyaas.exe"C:\Users\Admin\gueyaas.exe"44⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1484 -
C:\Users\Admin\jeuyuoc.exe"C:\Users\Admin\jeuyuoc.exe"45⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2188 -
C:\Users\Admin\guirer.exe"C:\Users\Admin\guirer.exe"46⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1520 -
C:\Users\Admin\goueg.exe"C:\Users\Admin\goueg.exe"47⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1580 -
C:\Users\Admin\woeve.exe"C:\Users\Admin\woeve.exe"48⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:552
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
124KB
MD54b46a808d1157af7ded1e4b033cc5c5e
SHA1372b20e6f74b459e4a4bba83c38b29eb7e01f56c
SHA256434c90f9ddc782f82054e2a3047d2b6421a25b0e80cf3a3200276340e25c9816
SHA5127b6a646582bfa0d887504693eaf12dbdc229074b842f0866b70e2b891908f7d7346d0182a4e38fe25b0f98e6769ffa6d53f600c4a8627599501b8292fea50879
-
Filesize
124KB
MD5f64a681e8a3d90672d832bee3ed91ea7
SHA1e3fb8394444ebbaecf35191f9b2dd7fbb560347a
SHA2562931ad8e6596740e7112900ad92aff693dfd132d2c6ecc9964c2cb8d839ad8ab
SHA512dd671769dc27c43465432adb5c4f5c276ef6b94bcc957569b8bdbc021e24abc2b69e1ff11f005543d0067189f834b30bbf971d9275f5b0131d07c020e183cf61
-
Filesize
124KB
MD5b5b6e810569d81ef8ba51952b647f77c
SHA10ecc0ff187e97d8d84c6c7c78c5ae8092219bc3c
SHA256fd50bec28ee8d1bb332d3d1a87b8e8a538f91f27c8cbcb92b8840f0a63a74f13
SHA5123adb906f30aa29b1aaddd96d16245cf0264a387be72ca339bc57d401395e0b8a2c3382d967cf2e4467ac38f5c71c60f62c00aecca31efdaa0bb1c20358c41afb
-
Filesize
124KB
MD5ba2614855a3ec4635d933bfbc44fdbad
SHA136f262175781b41efed4b16f1789840002d156a9
SHA256f89a356f8383d42841fbec9f7ed383ff82c54685dbfb90b2e87e009d0e6e6503
SHA512a64a574ee86a718e1e467e8f62ba2d3572a4ddc2f8aa144623ebf06df97b6d894d6773fd34de574ff553512b761ed435ba61536d0a62f1210fa30aa35ce1cce5
-
Filesize
124KB
MD584c14c7d9fb12ab1113a7f3dd5acf96f
SHA1b435dc1585706972a5dde7fa3d5b313d948bb1dc
SHA25623a33aadf3f2766abed9aa470ff44527b3804608f63e02128a87a5e95a93cfdd
SHA512ed8ec5e4950db0bcb158b65a71284419596e09b783a3441886b254c146aa88e634cf49e2ead0223700f65e8a6464521e21af71a25a55939d1cf3f89ea6fbf5c4
-
Filesize
124KB
MD5ffa33035d0ce60c5ba7f22e21abd8c68
SHA15aee2df8fd258144ffc5c944b62b04945ca76f2a
SHA25663991c322c1115ba34dae7033362ca60cc30d5d85bb6041acda061d3a9fbace9
SHA51238b542b11341c6463b172a8000c5a0258ec35dfab023be23609f3cbff28d22e76232c49c162ef37e925f52e7cdff20ed9e5f7412a09b1a207d2dae14f3145479
-
Filesize
124KB
MD50b13232fc82c0ff889074f9aaccb366a
SHA1a500cc293c08f19a7add46aff9242304aa04d101
SHA25632786856fdfef6b700113b816f67633f528d49726bc898750be971a1c3c226b5
SHA51230715eaaf4e0f6899a7837443e103966fef755076b8408d372ab8a4185b723311f8bbcd5ff422bdbd1fb76ef47c2ce979e12aba146051be3532fd43d69568df4
-
Filesize
124KB
MD516776f76855c8ae1ca27dcae89d50834
SHA1a7d75775d0af9c0f28a08082ec42a743fd1c42bd
SHA256aaba473af3b12e5539c2d44a8caedb6f4ca64ad31bc4d5f0942c92c1e0a6e4ee
SHA512557aedac4f5761f8de24b347abc03cc85cafb72e7253c93e11b707640c19d016f408bca6b532798fab4c1a396a118803006e795ba1c0bab9c05eb1b269d4c9b0
-
Filesize
124KB
MD582aa4e452d8d14fa8db2ee069b087729
SHA164f85204f34cc907d34c9b5ef6e2729574632e3b
SHA2567677a33ccedce40038dae9d1d24dd5026c4d7534f069a8b0d1e2f936de3be5b2
SHA512ea4f2b3a49de2dfdb99fc42c39b04100d4184bfde078404ad33731ed578fc8b4642554f8a1304abbd37a3813027caaeb99aa8816771d586352827f4404a60036
-
Filesize
124KB
MD5a65444d3af08ebe083de2a5828dc2ebb
SHA1422cdbde7627cfa424fb681fc692879cf7d9d908
SHA256c47272bbebfc05bd75fed5514f82eb0b74bca91b68f27993f6467a0018015a47
SHA51235afdc9d8a99d715eadf691169095c82721681ca7f4a5d954a5e865490f1e6d56b237361b54a76b23b90782a81095a44732e6d79b9973a02fcef87cb0c808417
-
Filesize
124KB
MD50595c75e273b924238a22eaf329db24c
SHA1890321ce6484f86f2c06c9daeedf5edbaf78e2ad
SHA256b56dfbe15b0a83bc8d7c75c8e1da3e22f62de35be10f7df0fcfc0b534a13199a
SHA51281e82653ff5bb2dc4247aaaacd6386b5c4709a771cd91001df865192bfd3f00f4b47d936fa91031ba852c6b4eba2d0fa9fb37e5a8a1ab00ad487c6d4e207c0f6
-
Filesize
124KB
MD56dc0097e253abc71956f48a7e1126a8e
SHA1ea0a42755670f2550117489b317d20cf8a32115b
SHA256d45bbc8eedd300343607d8506c1d6b9ac6c03806086b1ffb71efaff31a61af73
SHA51282aeb4ee41cfd1ee82b15e3980514ef3794fd7f66a4a360e9cbea3d4abf45047b2a657e92ec7ef7a90a4724adcbee407ccc0eb3184561623722b1b80481112b0
-
Filesize
124KB
MD581e0eeb5a3df8662bdc231aaf6e5b3e6
SHA1417926276b75067a6d247018171d786a82a01332
SHA256a901997edba4bcc162d3433fdf351bd4532b84355ff444124c543f13422c7e9f
SHA512d946b62caf0d10e7b68de92c6adceeeebc602ac6bbe9cd2bfed260164d49ec6c866a07f422277604f1020489a56b27f8959bcfa7c1bf40793ffea729c5052937
-
Filesize
124KB
MD5578ca70bd84c116691e007a449077677
SHA11d5e756150767911e0a30de6211011cb19d1386d
SHA256b9da06ebe262c267d5343697c2e6c8fb111ffdf9313225af07be8aec0c3f118b
SHA5124198a7b5d94ee097bdd89717b32712ae47e8744ec7b2190f5907a419a19aafd0766d53c4936634fa1820f049c628490ddc923b53924052010777033d0a09013e
-
Filesize
124KB
MD5c78a866cd43fe91583e7133afc6aae01
SHA18229f7e71e70f18431c7e634d0389c3e813a2cc9
SHA2561b226362b93ab0772c129bf1ba75e4da409e5485588c19bfab744e7368dde936
SHA512c3594cf9498c71534a48436d9ae2102a55ba14c28ef3db9b0a44c374ceb634292f9087b797cbafa23a2f149538bb2bcea810b28b047d16d9e62b9ba080cdc264
-
Filesize
124KB
MD5fbe67e28157dbe80e69ccd435940ddd0
SHA1ed99c14a00bfd42d482c93498c4ffbf0d276d74e
SHA256147a9406e022ff03aade1abfcac03569e80ee8a8d759ab8b323aa0aba194ac1e
SHA51227563b5825b32d0a0b7a145e920249722073b7538418ba45cae2bcfc1105e30cde7f291ae38bb35b88311e972cb5c0817c728193b334c75a398ab05d95ed7bc3
-
Filesize
124KB
MD5182c2ea8e01dc638ecd0c0129d266b5f
SHA1c5316cb3b7f18334b894b6112191ddb42fa9a5af
SHA25660ed438eb5f1a301d1b00b0d5bc2d57329d70f4cd0f7c2d23977b5298c398914
SHA5121c0993e9233ad944eff77f6f5e5d97d0c5da415adbf3033c2fedf2c7835bf380097f31dc73c2f4460d00428db2803948bbf2406972f9b65be37ee6e8f1563547