Analysis
- max time kernel
138s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
20/05/2024, 04:51
Behavioral task
behavioral1
Sample
b1bdf788d587e74808c34f12aae47c10_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
b1bdf788d587e74808c34f12aae47c10_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target b1bdf788d587e74808c34f12aae47c10_NeikiAnalytics.exe
- Size 356KB
- Sample240520-fg9avace32
- SHA256 1a4ba8b67870366e94c0de4a860f6952545a6637e4205b1a1c937e64ddd8c62d
- MD5 b1bdf788d587e74808c34f12aae47c10
- SHA1 a3edeb2c7f95ca95ae2eb3e3816474fa755725ff
- SHA512 98ef6ecd030addd6c41680bdf31c9e0819e321aa2e6395ab5f317c6e77707a261e12d25bace5308da7e54e9b1fb0acd6928ee0c3080ce4cfc32356be1cc202fa
- SSDEEP 6144:DdVVSJhwR5qP2LdjKW5EQpui6yYPaIGckjh/xaSfBJKFbhD7sYQpui6yYPaIGckN:BVoJ+zqP2GQpV6yYPMLnfBJKFbhDwBpb
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hecadm32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Meepoc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Foebmn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Goabhl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Fndpmndl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Haaaaeim.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Laiafl32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bkpfjb32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qfjcep32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hqddqj32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jbnopbdl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Qbggmk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Bpedeiff.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Bnbmqjjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Pdmikb32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cnmebblf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Gehice32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eghkjdoa.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Femigg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Eodlad32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ggbmafnm.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jfokff32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Akgcdc32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pphckb32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pdchakoo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gcpaiq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Hflclcle.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Apgqie32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ijmapm32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mfhgcbfo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" b1bdf788d587e74808c34f12aae47c10_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Gclimi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Lnoalehl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nnmojj32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jjdokb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Lhammfci.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Dcalae32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cbfema32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lhiodm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Nkmmbe32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Anncek32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Npognfpo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Bnaffdfc.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fmmmqnaf.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pkhokkel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Klbnajqc.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Edfddl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Hfefdpfe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Nnpjdfpb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Jadgnb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Kcehejic.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Neclpamg.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fagcfc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ffpcbchm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Bjhgke32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Njceqili.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Gknkkmmj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ihceigec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Pghiomqi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Cmmgof32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qomghp32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Glpdjpbj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dhbebj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Fkjmlaac.exe - Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/files/0x000900000002325f-6.dat family_berbew behavioral2/files/0x0007000000023266-14.dat family_berbew behavioral2/files/0x0007000000023268-22.dat family_berbew behavioral2/files/0x000700000002326a-30.dat family_berbew behavioral2/files/0x000700000002326d-38.dat family_berbew behavioral2/files/0x0008000000023263-46.dat family_berbew behavioral2/files/0x0007000000023270-49.dat family_berbew behavioral2/files/0x0007000000023270-54.dat family_berbew behavioral2/files/0x0007000000023272-58.dat family_berbew behavioral2/files/0x0007000000023274-70.dat family_berbew behavioral2/files/0x0007000000023276-78.dat family_berbew behavioral2/files/0x0007000000023278-88.dat family_berbew behavioral2/files/0x000700000002327a-96.dat family_berbew behavioral2/files/0x000700000002327c-101.dat family_berbew behavioral2/files/0x000700000002327e-114.dat family_berbew behavioral2/files/0x0007000000023280-118.dat family_berbew behavioral2/files/0x0007000000023280-123.dat family_berbew behavioral2/files/0x0007000000023282-135.dat family_berbew behavioral2/files/0x0007000000023285-141.dat family_berbew behavioral2/files/0x0007000000023287-153.dat family_berbew behavioral2/files/0x0007000000023289-159.dat family_berbew behavioral2/files/0x000700000002328b-163.dat family_berbew behavioral2/files/0x000700000002328d-177.dat family_berbew behavioral2/files/0x000700000002328f-186.dat family_berbew behavioral2/files/0x0007000000023291-195.dat family_berbew behavioral2/files/0x0007000000023293-204.dat family_berbew behavioral2/files/0x0007000000023295-208.dat family_berbew behavioral2/files/0x0007000000023295-213.dat family_berbew behavioral2/files/0x0007000000023297-223.dat family_berbew behavioral2/files/0x0007000000023299-226.dat family_berbew behavioral2/files/0x0007000000023299-231.dat family_berbew behavioral2/files/0x000700000002329b-240.dat family_berbew behavioral2/files/0x000700000002329d-244.dat family_berbew behavioral2/files/0x000700000002329d-249.dat family_berbew behavioral2/files/0x000700000002329f-259.dat family_berbew behavioral2/files/0x00070000000232a3-279.dat family_berbew behavioral2/files/0x00070000000232a1-268.dat family_berbew behavioral2/files/0x00070000000232bf-371.dat family_berbew behavioral2/files/0x000200000001e32b-399.dat family_berbew behavioral2/files/0x00070000000232d0-435.dat family_berbew behavioral2/files/0x00070000000232d6-456.dat family_berbew behavioral2/files/0x00070000000232f6-568.dat family_berbew behavioral2/files/0x00070000000232fa-581.dat family_berbew behavioral2/files/0x00070000000232fe-595.dat family_berbew behavioral2/files/0x0007000000023302-609.dat family_berbew behavioral2/files/0x000700000002330c-644.dat family_berbew behavioral2/files/0x000700000002331a-693.dat family_berbew behavioral2/files/0x0007000000023320-714.dat family_berbew behavioral2/files/0x0007000000023332-777.dat family_berbew behavioral2/files/0x0007000000023334-785.dat family_berbew behavioral2/files/0x0007000000023345-840.dat family_berbew behavioral2/files/0x0007000000023357-903.dat family_berbew behavioral2/files/0x0007000000023365-952.dat family_berbew behavioral2/files/0x000700000002336f-987.dat family_berbew behavioral2/files/0x0007000000023374-1001.dat family_berbew behavioral2/files/0x0007000000023378-1015.dat family_berbew behavioral2/files/0x000700000002337c-1029.dat family_berbew behavioral2/files/0x0007000000023394-1113.dat family_berbew behavioral2/files/0x000700000002339a-1134.dat family_berbew behavioral2/files/0x00070000000233c5-1274.dat family_berbew behavioral2/files/0x00070000000233db-1348.dat family_berbew behavioral2/files/0x00070000000233e1-1369.dat family_berbew behavioral2/files/0x00070000000233e3-1377.dat family_berbew behavioral2/files/0x00070000000233e7-1389.dat family_berbew - Executes dropped EXE 64 IoCs
pid Process 3964 Nnojho32.exe 4000 Njjdho32.exe 916 Nnhmnn32.exe 4536 Ogcnmc32.exe 4148 Ogekbb32.exe 224 Oclkgccf.exe 3832 Ocohmc32.exe 3564 Ohlqcagj.exe 3984 Pfandnla.exe 2512 Pnkbkk32.exe 1676 Pnmopk32.exe 2220 Pmblagmf.exe 1244 Qpcecb32.exe 1684 Adcjop32.exe 368 Ahaceo32.exe 3804 Aggpfkjj.exe 2508 Akdilipp.exe 4120 Bmeandma.exe 2112 Bgnffj32.exe 2300 Baegibae.exe 3304 Bahdob32.exe 1524 Bkphhgfc.exe 3920 Cgifbhid.exe 1108 Caojpaij.exe 4984 Cpdgqmnb.exe 1712 Cnhgjaml.exe 4784 Dhphmj32.exe 1892 Dhbebj32.exe 1812 Dggbcf32.exe 4548 Dbocfo32.exe 2624 Enfckp32.exe 1748 Eoepebho.exe 1804 Egaejeej.exe 4468 Ebifmm32.exe 3888 Enpfan32.exe 1884 Eghkjdoa.exe 4448 Fqppci32.exe 2620 Fndpmndl.exe 4704 Fijdjfdb.exe 2292 Fnfmbmbi.exe 4264 Fkjmlaac.exe 2172 Fganqbgg.exe 2664 Fajbjh32.exe 3472 Galoohke.exe 4844 Gbkkik32.exe 2796 Gbnhoj32.exe 5092 Gpaihooo.exe 444 Glhimp32.exe 4892 Hnibokbd.exe 4440 Hbihjifh.exe 3324 Hlblcn32.exe 4424 Hejqldci.exe 884 Hppeim32.exe 4352 Haaaaeim.exe 5064 Inebjihf.exe 2368 Ihmfco32.exe 1972 Ibcjqgnm.exe 4940 Ilkoim32.exe 404 Iahgad32.exe 3572 Ipihpkkd.exe 4604 Iajdgcab.exe 1564 Ipkdek32.exe 2284 Jidinqpb.exe 4100 Jpnakk32.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Akkmocjl.exe Aljmal32.exe File created C:\Windows\SysWOW64\Cbpijjbj.dll Nofoki32.exe File created C:\Windows\SysWOW64\Lkppchfi.exe Lmlpjdgo.exe File created C:\Windows\SysWOW64\Eiijfg32.dll Lgfojd32.exe File created C:\Windows\SysWOW64\Pghiomqi.exe Pkaijl32.exe File opened for modification C:\Windows\SysWOW64\Fqppci32.exe Eghkjdoa.exe File created C:\Windows\SysWOW64\Odaodc32.dll Gpaihooo.exe File opened for modification C:\Windows\SysWOW64\Lohqnd32.exe Klggli32.exe File opened for modification C:\Windows\SysWOW64\Iabglnco.exe Hkcbnh32.exe File opened for modification C:\Windows\SysWOW64\Pdlbpldg.exe Pkdngf32.exe File created C:\Windows\SysWOW64\Bdkghg32.exe Bgggockk.exe File opened for modification C:\Windows\SysWOW64\Hlblcn32.exe Hbihjifh.exe File created C:\Windows\SysWOW64\Hokomfqg.dll Ihmfco32.exe File created C:\Windows\SysWOW64\Hohcmjic.exe Hoefgj32.exe File opened for modification C:\Windows\SysWOW64\Aghdco32.exe Aeigilml.exe File opened for modification C:\Windows\SysWOW64\Fajbjh32.exe Fganqbgg.exe File created C:\Windows\SysWOW64\Dheiop32.dll Gheodg32.exe File created C:\Windows\SysWOW64\Maicgdbl.dll Fbeeco32.exe File created C:\Windows\SysWOW64\Ekdpdkkf.dll Hfonfp32.exe File created C:\Windows\SysWOW64\Dlegokbe.exe Dekobaki.exe File opened for modification C:\Windows\SysWOW64\Dedceddg.exe Dgqblp32.exe File created C:\Windows\SysWOW64\Oijgmokc.exe Oihkgo32.exe File created C:\Windows\SysWOW64\Mdfopf32.exe Mcgbfcij.exe File opened for modification C:\Windows\SysWOW64\Ibijbc32.exe Icdmqg32.exe File created C:\Windows\SysWOW64\Mipchg32.exe Mmiccf32.exe File opened for modification C:\Windows\SysWOW64\Qfolkcpb.exe Pmfhbm32.exe File created C:\Windows\SysWOW64\Mnhgglaj.dll Ajaelc32.exe File created C:\Windows\SysWOW64\Oahnhncc.exe Oeamcmmo.exe File created C:\Windows\SysWOW64\Gcggjp32.exe Giacmggo.exe File opened for modification C:\Windows\SysWOW64\Qpcecb32.exe Pmblagmf.exe File created C:\Windows\SysWOW64\Npfnef32.dll Fkiapn32.exe File created C:\Windows\SysWOW64\Kkpdnm32.dll Pmjhlklg.exe File opened for modification C:\Windows\SysWOW64\Jjknakhq.exe Jeneidji.exe File created C:\Windows\SysWOW64\Nmlafe32.dll Cldjkl32.exe File opened for modification C:\Windows\SysWOW64\Ciefek32.exe Cjdfgc32.exe File opened for modification C:\Windows\SysWOW64\Femigg32.exe Fejlbgek.exe File created C:\Windows\SysWOW64\Mmcnap32.exe Mnbnchlb.exe File opened for modification C:\Windows\SysWOW64\Nmaciefp.exe Mqjbddpl.exe File created C:\Windows\SysWOW64\Eepbdodb.dll Ihceigec.exe File opened for modification C:\Windows\SysWOW64\Icdmqg32.exe Ifplgc32.exe File created C:\Windows\SysWOW64\Fdadpk32.exe Ffpcbchm.exe File created C:\Windows\SysWOW64\Fhnichde.exe Flghognq.exe File created C:\Windows\SysWOW64\Dendok32.exe Cnboma32.exe File opened for modification C:\Windows\SysWOW64\Bmeandma.exe Akdilipp.exe File opened for modification C:\Windows\SysWOW64\Nodiqp32.exe Njgqhicg.exe File created C:\Windows\SysWOW64\Niidli32.dll Nbfoeiei.exe File opened for modification C:\Windows\SysWOW64\Mikjmhaq.exe Llgjcd32.exe File opened for modification C:\Windows\SysWOW64\Dncpkjoc.exe Dggkipii.exe File opened for modification C:\Windows\SysWOW64\Opefdo32.exe Omdnbd32.exe File opened for modification C:\Windows\SysWOW64\Giofggia.exe Gmhfbf32.exe File opened for modification C:\Windows\SysWOW64\Dkljka32.exe Deoabj32.exe File created C:\Windows\SysWOW64\Oikjkc32.exe Obnehj32.exe File created C:\Windows\SysWOW64\Hfonfp32.exe Hpeejfjm.exe File opened for modification C:\Windows\SysWOW64\Kdbchp32.exe Kkioojpp.exe File opened for modification C:\Windows\SysWOW64\Ldpoinjq.exe Lhiodm32.exe File created C:\Windows\SysWOW64\Doageg32.exe Dhgoimlo.exe File created C:\Windows\SysWOW64\Cldgnp32.dll Blkdgheg.exe File created C:\Windows\SysWOW64\Ilkoim32.exe Ibcjqgnm.exe File created C:\Windows\SysWOW64\Pnjiffif.dll Ipkdek32.exe File created C:\Windows\SysWOW64\Kboldq32.exe Kifhkkci.exe File opened for modification C:\Windows\SysWOW64\Lhammfci.exe Lfaqcclf.exe File created C:\Windows\SysWOW64\Apobakpn.exe Qckbggad.exe File created C:\Windows\SysWOW64\Anccjp32.exe Apobakpn.exe File created C:\Windows\SysWOW64\Fndinf32.dll Blnoad32.exe - Program crash 1 IoCs
pid pid_target Process procid_target 2160 8176 WerFault.exe 993 - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oflcnqal.dll" Golcak32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ablahjhj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Cnhgjaml.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Fnfmbmbi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Bbcignbo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gjfnca32.dll" Ebcdjc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Peaahmcd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Lhiodm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkffgpdd.dll" Kiphjo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fjohgj32.dll" Klbnajqc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Jhkljfok.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nbaefacb.dll" Nbefolao.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mafnie32.dll" Lofjam32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Odjmdocp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ggajho32.dll" Pkonbamc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ellbmedl.dll" Cbnbhfde.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ccaagm32.dll" Cqinng32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Fmapag32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nghhhc32.dll" Flghognq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ppbepp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Lcpledob.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Fcdbmb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mnoqeq32.dll" Ekngqqol.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifkfgiph.dll" Kfanen32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dlofiddl.dll" Hejqldci.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Mcoljagj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Icgbob32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gldhejgh.dll" Nandhi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dknelf32.dll" Cimhlakl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Agbgom32.dll" Mcmall32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmnafmhi.dll" Odnngclb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Pmblagmf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Nofoki32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Blknpdho.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Fceihh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ocldhqgb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Dggbcf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Oikjkc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Qpfokpoo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Fbiooolb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Bnbmqjjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Jflgfpkc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Lnfngj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Plimpg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Dodjemee.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Malefbkc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Hfniikha.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ajodef32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Dhbebj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Nfknmd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ieknpb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Eapmedef.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Hdlhoefk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Icdjmmdj.dll" Fhgccijm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ddkpoelb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Boldcj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Mqjbddpl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cifiamoa.dll" Mlifnphl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hoffjidl.dll" Gggfme32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Qfilkj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ebcdjc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Chebcmna.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Dljqjjnp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Kejloi32.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4764 wrote to memory of 3964 4764 b1bdf788d587e74808c34f12aae47c10_NeikiAnalytics.exe 91 PID 4764 wrote to memory of 3964 4764 b1bdf788d587e74808c34f12aae47c10_NeikiAnalytics.exe 91 PID 4764 wrote to memory of 3964 4764 b1bdf788d587e74808c34f12aae47c10_NeikiAnalytics.exe 91 PID 3964 wrote to memory of 4000 3964 Nnojho32.exe 92 PID 3964 wrote to memory of 4000 3964 Nnojho32.exe 92 PID 3964 wrote to memory of 4000 3964 Nnojho32.exe 92 PID 4000 wrote to memory of 916 4000 Njjdho32.exe 93 PID 4000 wrote to memory of 916 4000 Njjdho32.exe 93 PID 4000 wrote to memory of 916 4000 Njjdho32.exe 93 PID 916 wrote to memory of 4536 916 Nnhmnn32.exe 94 PID 916 wrote to memory of 4536 916 Nnhmnn32.exe 94 PID 916 wrote to memory of 4536 916 Nnhmnn32.exe 94 PID 4536 wrote to memory of 4148 4536 Ogcnmc32.exe 95 PID 4536 wrote to memory of 4148 4536 Ogcnmc32.exe 95 PID 4536 wrote to memory of 4148 4536 Ogcnmc32.exe 95 PID 4148 wrote to memory of 224 4148 Ogekbb32.exe 96 PID 4148 wrote to memory of 224 4148 Ogekbb32.exe 96 PID 4148 wrote to memory of 224 4148 Ogekbb32.exe 96 PID 224 wrote to memory of 3832 224 Oclkgccf.exe 97 PID 224 wrote to memory of 3832 224 Oclkgccf.exe 97 PID 224 wrote to memory of 3832 224 Oclkgccf.exe 97 PID 3832 wrote to memory of 3564 3832 Ocohmc32.exe 98 PID 3832 wrote to memory of 3564 3832 Ocohmc32.exe 98 PID 3832 wrote to memory of 3564 3832 Ocohmc32.exe 98 PID 3564 wrote to memory of 3984 3564 Ohlqcagj.exe 99 PID 3564 wrote to memory of 3984 3564 Ohlqcagj.exe 99 PID 3564 wrote to memory of 3984 3564 Ohlqcagj.exe 99 PID 3984 wrote to memory of 2512 3984 Pfandnla.exe 100 PID 3984 wrote to memory of 2512 3984 Pfandnla.exe 100 PID 3984 wrote to memory of 2512 3984 Pfandnla.exe 100 PID 2512 wrote to memory of 1676 2512 Pnkbkk32.exe 101 PID 2512 wrote to memory of 1676 2512 Pnkbkk32.exe 101 PID 2512 wrote to memory of 1676 2512 Pnkbkk32.exe 101 PID 1676 wrote to memory of 2220 1676 Pnmopk32.exe 102 PID 1676 wrote to memory of 2220 1676 Pnmopk32.exe 102 PID 1676 wrote to memory of 2220 1676 Pnmopk32.exe 102 PID 2220 wrote to memory of 1244 2220 Pmblagmf.exe 103 PID 2220 wrote to memory of 1244 2220 Pmblagmf.exe 103 PID 2220 wrote to memory of 1244 2220 Pmblagmf.exe 103 PID 1244 wrote to memory of 1684 1244 Qpcecb32.exe 104 PID 1244 wrote to memory of 1684 1244 Qpcecb32.exe 104 PID 1244 wrote to memory of 1684 1244 Qpcecb32.exe 104 PID 1684 wrote to memory of 368 1684 Adcjop32.exe 105 PID 1684 wrote to memory of 368 1684 Adcjop32.exe 105 PID 1684 wrote to memory of 368 1684 Adcjop32.exe 105 PID 368 wrote to memory of 3804 368 Ahaceo32.exe 106 PID 368 wrote to memory of 3804 368 Ahaceo32.exe 106 PID 368 wrote to memory of 3804 368 Ahaceo32.exe 106 PID 3804 wrote to memory of 2508 3804 Aggpfkjj.exe 107 PID 3804 wrote to memory of 2508 3804 Aggpfkjj.exe 107 PID 3804 wrote to memory of 2508 3804 Aggpfkjj.exe 107 PID 2508 wrote to memory of 4120 2508 Akdilipp.exe 108 PID 2508 wrote to memory of 4120 2508 Akdilipp.exe 108 PID 2508 wrote to memory of 4120 2508 Akdilipp.exe 108 PID 4120 wrote to memory of 2112 4120 Bmeandma.exe 109 PID 4120 wrote to memory of 2112 4120 Bmeandma.exe 109 PID 4120 wrote to memory of 2112 4120 Bmeandma.exe 109 PID 2112 wrote to memory of 2300 2112 Bgnffj32.exe 110 PID 2112 wrote to memory of 2300 2112 Bgnffj32.exe 110 PID 2112 wrote to memory of 2300 2112 Bgnffj32.exe 110 PID 2300 wrote to memory of 3304 2300 Baegibae.exe 111 PID 2300 wrote to memory of 3304 2300 Baegibae.exe 111 PID 2300 wrote to memory of 3304 2300 Baegibae.exe 111 PID 3304 wrote to memory of 1524 3304 Bahdob32.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\b1bdf788d587e74808c34f12aae47c10_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\b1bdf788d587e74808c34f12aae47c10_NeikiAnalytics.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Windows\SysWOW64\Nnojho32.exeC:\Windows\system32\Nnojho32.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Windows\SysWOW64\Njjdho32.exeC:\Windows\system32\Njjdho32.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Windows\SysWOW64\Nnhmnn32.exeC:\Windows\system32\Nnhmnn32.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Windows\SysWOW64\Ogcnmc32.exeC:\Windows\system32\Ogcnmc32.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Windows\SysWOW64\Ogekbb32.exeC:\Windows\system32\Ogekbb32.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Windows\SysWOW64\Oclkgccf.exeC:\Windows\system32\Oclkgccf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Windows\SysWOW64\Ocohmc32.exeC:\Windows\system32\Ocohmc32.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Windows\SysWOW64\Ohlqcagj.exeC:\Windows\system32\Ohlqcagj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Windows\SysWOW64\Pfandnla.exeC:\Windows\system32\Pfandnla.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Windows\SysWOW64\Pnkbkk32.exeC:\Windows\system32\Pnkbkk32.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Windows\SysWOW64\Pnmopk32.exeC:\Windows\system32\Pnmopk32.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Windows\SysWOW64\Pmblagmf.exeC:\Windows\system32\Pmblagmf.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Windows\SysWOW64\Qpcecb32.exeC:\Windows\system32\Qpcecb32.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Windows\SysWOW64\Adcjop32.exeC:\Windows\system32\Adcjop32.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Windows\SysWOW64\Ahaceo32.exeC:\Windows\system32\Ahaceo32.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:368 -
C:\Windows\SysWOW64\Aggpfkjj.exeC:\Windows\system32\Aggpfkjj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Windows\SysWOW64\Akdilipp.exeC:\Windows\system32\Akdilipp.exe18⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Windows\SysWOW64\Bmeandma.exeC:\Windows\system32\Bmeandma.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Windows\SysWOW64\Bgnffj32.exeC:\Windows\system32\Bgnffj32.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\SysWOW64\Baegibae.exeC:\Windows\system32\Baegibae.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Windows\SysWOW64\Bahdob32.exeC:\Windows\system32\Bahdob32.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Windows\SysWOW64\Bkphhgfc.exeC:\Windows\system32\Bkphhgfc.exe23⤵
- Executes dropped EXE
PID:1524 -
C:\Windows\SysWOW64\Cgifbhid.exeC:\Windows\system32\Cgifbhid.exe24⤵
- Executes dropped EXE
PID:3920 -
C:\Windows\SysWOW64\Caojpaij.exeC:\Windows\system32\Caojpaij.exe25⤵
- Executes dropped EXE
PID:1108 -
C:\Windows\SysWOW64\Cpdgqmnb.exeC:\Windows\system32\Cpdgqmnb.exe26⤵
- Executes dropped EXE
PID:4984 -
C:\Windows\SysWOW64\Cnhgjaml.exeC:\Windows\system32\Cnhgjaml.exe27⤵
- Executes dropped EXE
- Modifies registry class
PID:1712 -
C:\Windows\SysWOW64\Dhphmj32.exeC:\Windows\system32\Dhphmj32.exe28⤵
- Executes dropped EXE
PID:4784 -
C:\Windows\SysWOW64\Dhbebj32.exeC:\Windows\system32\Dhbebj32.exe29⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:1892 -
C:\Windows\SysWOW64\Dggbcf32.exeC:\Windows\system32\Dggbcf32.exe30⤵
- Executes dropped EXE
- Modifies registry class
PID:1812 -
C:\Windows\SysWOW64\Dbocfo32.exeC:\Windows\system32\Dbocfo32.exe31⤵
- Executes dropped EXE
PID:4548 -
C:\Windows\SysWOW64\Enfckp32.exeC:\Windows\system32\Enfckp32.exe32⤵
- Executes dropped EXE
PID:2624 -
C:\Windows\SysWOW64\Eoepebho.exeC:\Windows\system32\Eoepebho.exe33⤵
- Executes dropped EXE
PID:1748 -
C:\Windows\SysWOW64\Egaejeej.exeC:\Windows\system32\Egaejeej.exe34⤵
- Executes dropped EXE
PID:1804 -
C:\Windows\SysWOW64\Ebifmm32.exeC:\Windows\system32\Ebifmm32.exe35⤵
- Executes dropped EXE
PID:4468 -
C:\Windows\SysWOW64\Enpfan32.exeC:\Windows\system32\Enpfan32.exe36⤵
- Executes dropped EXE
PID:3888 -
C:\Windows\SysWOW64\Eghkjdoa.exeC:\Windows\system32\Eghkjdoa.exe37⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:1884 -
C:\Windows\SysWOW64\Fqppci32.exeC:\Windows\system32\Fqppci32.exe38⤵
- Executes dropped EXE
PID:4448 -
C:\Windows\SysWOW64\Fndpmndl.exeC:\Windows\system32\Fndpmndl.exe39⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2620 -
C:\Windows\SysWOW64\Fijdjfdb.exeC:\Windows\system32\Fijdjfdb.exe40⤵
- Executes dropped EXE
PID:4704 -
C:\Windows\SysWOW64\Fnfmbmbi.exeC:\Windows\system32\Fnfmbmbi.exe41⤵
- Executes dropped EXE
- Modifies registry class
PID:2292 -
C:\Windows\SysWOW64\Fkjmlaac.exeC:\Windows\system32\Fkjmlaac.exe42⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:4264 -
C:\Windows\SysWOW64\Fganqbgg.exeC:\Windows\system32\Fganqbgg.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2172 -
C:\Windows\SysWOW64\Fajbjh32.exeC:\Windows\system32\Fajbjh32.exe44⤵
- Executes dropped EXE
PID:2664 -
C:\Windows\SysWOW64\Galoohke.exeC:\Windows\system32\Galoohke.exe45⤵
- Executes dropped EXE
PID:3472 -
C:\Windows\SysWOW64\Gbkkik32.exeC:\Windows\system32\Gbkkik32.exe46⤵
- Executes dropped EXE
PID:4844 -
C:\Windows\SysWOW64\Gbnhoj32.exeC:\Windows\system32\Gbnhoj32.exe47⤵
- Executes dropped EXE
PID:2796 -
C:\Windows\SysWOW64\Gpaihooo.exeC:\Windows\system32\Gpaihooo.exe48⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5092 -
C:\Windows\SysWOW64\Glhimp32.exeC:\Windows\system32\Glhimp32.exe49⤵
- Executes dropped EXE
PID:444 -
C:\Windows\SysWOW64\Hnibokbd.exeC:\Windows\system32\Hnibokbd.exe50⤵
- Executes dropped EXE
PID:4892 -
C:\Windows\SysWOW64\Hbihjifh.exeC:\Windows\system32\Hbihjifh.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4440 -
C:\Windows\SysWOW64\Hlblcn32.exeC:\Windows\system32\Hlblcn32.exe52⤵
- Executes dropped EXE
PID:3324 -
C:\Windows\SysWOW64\Hejqldci.exeC:\Windows\system32\Hejqldci.exe53⤵
- Executes dropped EXE
- Modifies registry class
PID:4424 -
C:\Windows\SysWOW64\Hppeim32.exeC:\Windows\system32\Hppeim32.exe54⤵
- Executes dropped EXE
PID:884 -
C:\Windows\SysWOW64\Haaaaeim.exeC:\Windows\system32\Haaaaeim.exe55⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:4352 -
C:\Windows\SysWOW64\Inebjihf.exeC:\Windows\system32\Inebjihf.exe56⤵
- Executes dropped EXE
PID:5064 -
C:\Windows\SysWOW64\Ihmfco32.exeC:\Windows\system32\Ihmfco32.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2368 -
C:\Windows\SysWOW64\Ibcjqgnm.exeC:\Windows\system32\Ibcjqgnm.exe58⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1972 -
C:\Windows\SysWOW64\Ilkoim32.exeC:\Windows\system32\Ilkoim32.exe59⤵
- Executes dropped EXE
PID:4940 -
C:\Windows\SysWOW64\Iahgad32.exeC:\Windows\system32\Iahgad32.exe60⤵
- Executes dropped EXE
PID:404 -
C:\Windows\SysWOW64\Ipihpkkd.exeC:\Windows\system32\Ipihpkkd.exe61⤵
- Executes dropped EXE
PID:3572 -
C:\Windows\SysWOW64\Iajdgcab.exeC:\Windows\system32\Iajdgcab.exe62⤵
- Executes dropped EXE
PID:4604 -
C:\Windows\SysWOW64\Ipkdek32.exeC:\Windows\system32\Ipkdek32.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1564 -
C:\Windows\SysWOW64\Jidinqpb.exeC:\Windows\system32\Jidinqpb.exe64⤵
- Executes dropped EXE
PID:2284 -
C:\Windows\SysWOW64\Jpnakk32.exeC:\Windows\system32\Jpnakk32.exe65⤵
- Executes dropped EXE
PID:4100 -
C:\Windows\SysWOW64\Jekjcaef.exeC:\Windows\system32\Jekjcaef.exe66⤵PID:2520
-
C:\Windows\SysWOW64\Jppnpjel.exeC:\Windows\system32\Jppnpjel.exe67⤵PID:2152
-
C:\Windows\SysWOW64\Jaajhb32.exeC:\Windows\system32\Jaajhb32.exe68⤵PID:4672
-
C:\Windows\SysWOW64\Jlgoek32.exeC:\Windows\system32\Jlgoek32.exe69⤵PID:624
-
C:\Windows\SysWOW64\Jadgnb32.exeC:\Windows\system32\Jadgnb32.exe70⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5068 -
C:\Windows\SysWOW64\Jlikkkhn.exeC:\Windows\system32\Jlikkkhn.exe71⤵PID:4664
-
C:\Windows\SysWOW64\Jbccge32.exeC:\Windows\system32\Jbccge32.exe72⤵PID:3424
-
C:\Windows\SysWOW64\Jimldogg.exeC:\Windows\system32\Jimldogg.exe73⤵PID:3584
-
C:\Windows\SysWOW64\Jbepme32.exeC:\Windows\system32\Jbepme32.exe74⤵PID:3872
-
C:\Windows\SysWOW64\Kiphjo32.exeC:\Windows\system32\Kiphjo32.exe75⤵
- Modifies registry class
PID:1976 -
C:\Windows\SysWOW64\Kpiqfima.exeC:\Windows\system32\Kpiqfima.exe76⤵PID:2392
-
C:\Windows\SysWOW64\Kibeoo32.exeC:\Windows\system32\Kibeoo32.exe77⤵PID:1944
-
C:\Windows\SysWOW64\Kcjjhdjb.exeC:\Windows\system32\Kcjjhdjb.exe78⤵PID:4136
-
C:\Windows\SysWOW64\Klbnajqc.exeC:\Windows\system32\Klbnajqc.exe79⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:3916 -
C:\Windows\SysWOW64\Kifojnol.exeC:\Windows\system32\Kifojnol.exe80⤵PID:5060
-
C:\Windows\SysWOW64\Klggli32.exeC:\Windows\system32\Klggli32.exe81⤵
- Drops file in System32 directory
PID:5136 -
C:\Windows\SysWOW64\Lohqnd32.exeC:\Windows\system32\Lohqnd32.exe82⤵PID:5180
-
C:\Windows\SysWOW64\Laiipofp.exeC:\Windows\system32\Laiipofp.exe83⤵PID:5224
-
C:\Windows\SysWOW64\Lakfeodm.exeC:\Windows\system32\Lakfeodm.exe84⤵PID:5268
-
C:\Windows\SysWOW64\Lancko32.exeC:\Windows\system32\Lancko32.exe85⤵PID:5312
-
C:\Windows\SysWOW64\Mcoljagj.exeC:\Windows\system32\Mcoljagj.exe86⤵
- Modifies registry class
PID:5356 -
C:\Windows\SysWOW64\Mcaipa32.exeC:\Windows\system32\Mcaipa32.exe87⤵PID:5404
-
C:\Windows\SysWOW64\Mpeiie32.exeC:\Windows\system32\Mpeiie32.exe88⤵PID:5448
-
C:\Windows\SysWOW64\Mjnnbk32.exeC:\Windows\system32\Mjnnbk32.exe89⤵PID:5488
-
C:\Windows\SysWOW64\Mqhfoebo.exeC:\Windows\system32\Mqhfoebo.exe90⤵PID:5540
-
C:\Windows\SysWOW64\Mfenglqf.exeC:\Windows\system32\Mfenglqf.exe91⤵PID:5584
-
C:\Windows\SysWOW64\Mqjbddpl.exeC:\Windows\system32\Mqjbddpl.exe92⤵
- Drops file in System32 directory
- Modifies registry class
PID:5628 -
C:\Windows\SysWOW64\Nmaciefp.exeC:\Windows\system32\Nmaciefp.exe93⤵PID:5676
-
C:\Windows\SysWOW64\Nhhdnf32.exeC:\Windows\system32\Nhhdnf32.exe94⤵PID:5720
-
C:\Windows\SysWOW64\Njgqhicg.exeC:\Windows\system32\Njgqhicg.exe95⤵
- Drops file in System32 directory
PID:5780 -
C:\Windows\SysWOW64\Nodiqp32.exeC:\Windows\system32\Nodiqp32.exe96⤵PID:5852
-
C:\Windows\SysWOW64\Niojoeel.exeC:\Windows\system32\Niojoeel.exe97⤵PID:5896
-
C:\Windows\SysWOW64\Ookoaokf.exeC:\Windows\system32\Ookoaokf.exe98⤵PID:5944
-
C:\Windows\SysWOW64\Oblhcj32.exeC:\Windows\system32\Oblhcj32.exe99⤵PID:5992
-
C:\Windows\SysWOW64\Obnehj32.exeC:\Windows\system32\Obnehj32.exe100⤵
- Drops file in System32 directory
PID:6036 -
C:\Windows\SysWOW64\Oikjkc32.exeC:\Windows\system32\Oikjkc32.exe101⤵
- Modifies registry class
PID:6080 -
C:\Windows\SysWOW64\Pjjfdfbb.exeC:\Windows\system32\Pjjfdfbb.exe102⤵PID:6140
-
C:\Windows\SysWOW64\Pcbkml32.exeC:\Windows\system32\Pcbkml32.exe103⤵PID:5164
-
C:\Windows\SysWOW64\Pmkofa32.exeC:\Windows\system32\Pmkofa32.exe104⤵PID:5264
-
C:\Windows\SysWOW64\Pjoppf32.exeC:\Windows\system32\Pjoppf32.exe105⤵PID:5344
-
C:\Windows\SysWOW64\Pmphaaln.exeC:\Windows\system32\Pmphaaln.exe106⤵PID:5412
-
C:\Windows\SysWOW64\Qppaclio.exeC:\Windows\system32\Qppaclio.exe107⤵PID:5504
-
C:\Windows\SysWOW64\Qiiflaoo.exeC:\Windows\system32\Qiiflaoo.exe108⤵PID:5620
-
C:\Windows\SysWOW64\Qfmfefni.exeC:\Windows\system32\Qfmfefni.exe109⤵PID:5692
-
C:\Windows\SysWOW64\Amikgpcc.exeC:\Windows\system32\Amikgpcc.exe110⤵PID:5788
-
C:\Windows\SysWOW64\Abfdpfaj.exeC:\Windows\system32\Abfdpfaj.exe111⤵PID:5880
-
C:\Windows\SysWOW64\Aagdnn32.exeC:\Windows\system32\Aagdnn32.exe112⤵PID:5976
-
C:\Windows\SysWOW64\Abhqefpg.exeC:\Windows\system32\Abhqefpg.exe113⤵PID:6068
-
C:\Windows\SysWOW64\Amnebo32.exeC:\Windows\system32\Amnebo32.exe114⤵PID:5212
-
C:\Windows\SysWOW64\Ajaelc32.exeC:\Windows\system32\Ajaelc32.exe115⤵
- Drops file in System32 directory
PID:5320 -
C:\Windows\SysWOW64\Apnndj32.exeC:\Windows\system32\Apnndj32.exe116⤵PID:5476
-
C:\Windows\SysWOW64\Ajdbac32.exeC:\Windows\system32\Ajdbac32.exe117⤵PID:5612
-
C:\Windows\SysWOW64\Bfkbfd32.exeC:\Windows\system32\Bfkbfd32.exe118⤵PID:5704
-
C:\Windows\SysWOW64\Bapgdm32.exeC:\Windows\system32\Bapgdm32.exe119⤵PID:5844
-
C:\Windows\SysWOW64\Bjhkmbho.exeC:\Windows\system32\Bjhkmbho.exe120⤵PID:6064
-
C:\Windows\SysWOW64\Bpedeiff.exeC:\Windows\system32\Bpedeiff.exe121⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5156
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-