a6dbd1b1f5eca687c9af18928d64a7fbae846e02ba7083c3cb9fafa951f50911

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 15:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f3437aac724affad150afa1050dec160_NeikiAnalytics.exe
Size 161KB
Sample240531-sll3bscc31
SHA256 a6dbd1b1f5eca687c9af18928d64a7fbae846e02ba7083c3cb9fafa951f50911
MD5 f3437aac724affad150afa1050dec160
SHA1 c493daea7ea5f78ce670499e13e21f43bbd2ac9c
SHA512 2814ecd07bbe51a1ca2cf4374dce04ffe99b3e70015567d11ad37f435c08fa1d1e4f91db62539dbc2c26bc25d171915ae489d1a45218277d78c9b1a914727633
SSDEEP 3072:6ZdAv/Dsot1/7oXofkyVwtCJXeex7rrIRZK8K8/kvV:6ZSvbZ1/DfkyVwtmeetrIyRV
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

backdoor dropper persistence trojan

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 32 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcpebmkb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqklmpdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mpaifalo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mcpebmkb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgnnhk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nceonl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ncldnkae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	f3437aac724affad150afa1050dec160_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Maaepd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nceonl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ndidbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mgnnhk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njljefql.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nkncdifl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncldnkae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mjjmog32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqiogp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncihikcg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndidbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Njljefql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ncihikcg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nbkhfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nbkhfc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	f3437aac724affad150afa1050dec160_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjjmog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Njogjfoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nkncdifl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nqklmpdd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpaifalo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Maaepd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njogjfoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nqiogp32.exe

Malware Dropper & Backdoor - Berbew 16 IoCs

Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.

backdoor trojan dropper

resource	yara_rule
behavioral2/files/0x0006000000023270-6.dat	family_berbew
behavioral2/files/0x00070000000233c1-14.dat	family_berbew
behavioral2/files/0x00070000000233c4-23.dat	family_berbew
behavioral2/files/0x00070000000233c6-30.dat	family_berbew
behavioral2/files/0x00070000000233c8-39.dat	family_berbew
behavioral2/files/0x00070000000233ca-46.dat	family_berbew
behavioral2/files/0x00070000000233cc-54.dat	family_berbew
behavioral2/files/0x00070000000233ce-62.dat	family_berbew
behavioral2/files/0x00070000000233d0-70.dat	family_berbew
behavioral2/files/0x00070000000233d2-78.dat	family_berbew
behavioral2/files/0x00070000000233d4-86.dat	family_berbew
behavioral2/files/0x00070000000233d6-95.dat	family_berbew
behavioral2/files/0x00070000000233d8-104.dat	family_berbew
behavioral2/files/0x00070000000233da-113.dat	family_berbew
behavioral2/files/0x00070000000233dc-122.dat	family_berbew
behavioral2/files/0x00070000000233de-131.dat	family_berbew

Executes dropped EXE 16 IoCs

pid	Process
3860	Mpaifalo.exe
3888	Mcpebmkb.exe
3364	Mjjmog32.exe
3504	Maaepd32.exe
4428	Mgnnhk32.exe
2936	Njljefql.exe
4280	Nceonl32.exe
4784	Njogjfoj.exe
1964	Nqiogp32.exe
1228	Nkncdifl.exe
4384	Nqklmpdd.exe
5020	Ncihikcg.exe
4776	Nbkhfc32.exe
244	Ndidbn32.exe
5080	Ncldnkae.exe
2108	Nkcmohbg.exe

Drops file in System32 directory 48 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Fcdjjo32.dll	Njljefql.exe
File created	C:\Windows\SysWOW64\Jkeang32.dll	Nqiogp32.exe
File created	C:\Windows\SysWOW64\Mjjmog32.exe	Mcpebmkb.exe
File created	C:\Windows\SysWOW64\Hnfmbf32.dll	Maaepd32.exe
File created	C:\Windows\SysWOW64\Njljefql.exe	Mgnnhk32.exe
File created	C:\Windows\SysWOW64\Kcbibebo.dll	Mgnnhk32.exe
File opened for modification	C:\Windows\SysWOW64\Nceonl32.exe	Njljefql.exe
File opened for modification	C:\Windows\SysWOW64\Mpaifalo.exe	f3437aac724affad150afa1050dec160_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\Maaepd32.exe	Mjjmog32.exe
File created	C:\Windows\SysWOW64\Njogjfoj.exe	Nceonl32.exe
File created	C:\Windows\SysWOW64\Lkfbjdpq.dll	Ncihikcg.exe
File opened for modification	C:\Windows\SysWOW64\Ncihikcg.exe	Nqklmpdd.exe
File created	C:\Windows\SysWOW64\Ncldnkae.exe	Ndidbn32.exe
File created	C:\Windows\SysWOW64\Hnibdpde.dll	Ncldnkae.exe
File created	C:\Windows\SysWOW64\Mpaifalo.exe	f3437aac724affad150afa1050dec160_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\Fnelfilp.dll	f3437aac724affad150afa1050dec160_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\Mcpebmkb.exe	Mpaifalo.exe
File opened for modification	C:\Windows\SysWOW64\Mjjmog32.exe	Mcpebmkb.exe
File opened for modification	C:\Windows\SysWOW64\Nqklmpdd.exe	Nkncdifl.exe
File created	C:\Windows\SysWOW64\Hhapkbgi.dll	Mpaifalo.exe
File created	C:\Windows\SysWOW64\Bebboiqi.dll	Mjjmog32.exe
File opened for modification	C:\Windows\SysWOW64\Mgnnhk32.exe	Maaepd32.exe
File created	C:\Windows\SysWOW64\Nceonl32.exe	Njljefql.exe
File created	C:\Windows\SysWOW64\Lfcbokki.dll	Nceonl32.exe
File created	C:\Windows\SysWOW64\Nqklmpdd.exe	Nkncdifl.exe
File created	C:\Windows\SysWOW64\Ncihikcg.exe	Nqklmpdd.exe
File opened for modification	C:\Windows\SysWOW64\Ncldnkae.exe	Ndidbn32.exe
File created	C:\Windows\SysWOW64\Geegicjl.dll	Mcpebmkb.exe
File opened for modification	C:\Windows\SysWOW64\Maaepd32.exe	Mjjmog32.exe
File created	C:\Windows\SysWOW64\Mgnnhk32.exe	Maaepd32.exe
File opened for modification	C:\Windows\SysWOW64\Njljefql.exe	Mgnnhk32.exe
File created	C:\Windows\SysWOW64\Nqiogp32.exe	Njogjfoj.exe
File opened for modification	C:\Windows\SysWOW64\Nkcmohbg.exe	Ncldnkae.exe
File opened for modification	C:\Windows\SysWOW64\Njogjfoj.exe	Nceonl32.exe
File opened for modification	C:\Windows\SysWOW64\Nbkhfc32.exe	Ncihikcg.exe
File opened for modification	C:\Windows\SysWOW64\Ndidbn32.exe	Nbkhfc32.exe
File created	C:\Windows\SysWOW64\Nkcmohbg.exe	Ncldnkae.exe
File opened for modification	C:\Windows\SysWOW64\Mcpebmkb.exe	Mpaifalo.exe
File created	C:\Windows\SysWOW64\Ljfemn32.dll	Nkncdifl.exe
File created	C:\Windows\SysWOW64\Dlddhggk.dll	Ndidbn32.exe
File created	C:\Windows\SysWOW64\Nbkhfc32.exe	Ncihikcg.exe
File created	C:\Windows\SysWOW64\Ndidbn32.exe	Nbkhfc32.exe
File created	C:\Windows\SysWOW64\Opbnic32.dll	Nbkhfc32.exe
File opened for modification	C:\Windows\SysWOW64\Nqiogp32.exe	Njogjfoj.exe
File created	C:\Windows\SysWOW64\Pponmema.dll	Njogjfoj.exe
File created	C:\Windows\SysWOW64\Nkncdifl.exe	Nqiogp32.exe
File opened for modification	C:\Windows\SysWOW64\Nkncdifl.exe	Nqiogp32.exe
File created	C:\Windows\SysWOW64\Pkckjila.dll	Nqklmpdd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1420	2108	WerFault.exe	96

Modifies registry class 51 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}	f3437aac724affad150afa1050dec160_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Njljefql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nceonl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Njljefql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkckjila.dll"	Nqklmpdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dlddhggk.dll"	Ndidbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ncldnkae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pponmema.dll"	Njogjfoj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ndidbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mcpebmkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bebboiqi.dll"	Mjjmog32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Njogjfoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mjjmog32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	f3437aac724affad150afa1050dec160_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kcbibebo.dll"	Mgnnhk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jkeang32.dll"	Nqiogp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ljfemn32.dll"	Nkncdifl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lkfbjdpq.dll"	Ncihikcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Opbnic32.dll"	Nbkhfc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	f3437aac724affad150afa1050dec160_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mjjmog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfcbokki.dll"	Nceonl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ncihikcg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	f3437aac724affad150afa1050dec160_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	f3437aac724affad150afa1050dec160_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hhapkbgi.dll"	Mpaifalo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Maaepd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nbkhfc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mpaifalo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Geegicjl.dll"	Mcpebmkb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Maaepd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nqiogp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fnelfilp.dll"	f3437aac724affad150afa1050dec160_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nkncdifl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nkncdifl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ndidbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mpaifalo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnfmbf32.dll"	Maaepd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mgnnhk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mcpebmkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fcdjjo32.dll"	Njljefql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nbkhfc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nceonl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Njogjfoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nqklmpdd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ncihikcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnibdpde.dll"	Ncldnkae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mgnnhk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nqiogp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nqklmpdd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ncldnkae.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 4840 wrote to memory of 3860	4840	f3437aac724affad150afa1050dec160_NeikiAnalytics.exe	81
PID 4840 wrote to memory of 3860	4840	f3437aac724affad150afa1050dec160_NeikiAnalytics.exe	81
PID 4840 wrote to memory of 3860	4840	f3437aac724affad150afa1050dec160_NeikiAnalytics.exe	81
PID 3860 wrote to memory of 3888	3860	Mpaifalo.exe	82
PID 3860 wrote to memory of 3888	3860	Mpaifalo.exe	82
PID 3860 wrote to memory of 3888	3860	Mpaifalo.exe	82
PID 3888 wrote to memory of 3364	3888	Mcpebmkb.exe	83
PID 3888 wrote to memory of 3364	3888	Mcpebmkb.exe	83
PID 3888 wrote to memory of 3364	3888	Mcpebmkb.exe	83
PID 3364 wrote to memory of 3504	3364	Mjjmog32.exe	84
PID 3364 wrote to memory of 3504	3364	Mjjmog32.exe	84
PID 3364 wrote to memory of 3504	3364	Mjjmog32.exe	84
PID 3504 wrote to memory of 4428	3504	Maaepd32.exe	85
PID 3504 wrote to memory of 4428	3504	Maaepd32.exe	85
PID 3504 wrote to memory of 4428	3504	Maaepd32.exe	85
PID 4428 wrote to memory of 2936	4428	Mgnnhk32.exe	86
PID 4428 wrote to memory of 2936	4428	Mgnnhk32.exe	86
PID 4428 wrote to memory of 2936	4428	Mgnnhk32.exe	86
PID 2936 wrote to memory of 4280	2936	Njljefql.exe	87
PID 2936 wrote to memory of 4280	2936	Njljefql.exe	87
PID 2936 wrote to memory of 4280	2936	Njljefql.exe	87
PID 4280 wrote to memory of 4784	4280	Nceonl32.exe	88
PID 4280 wrote to memory of 4784	4280	Nceonl32.exe	88
PID 4280 wrote to memory of 4784	4280	Nceonl32.exe	88
PID 4784 wrote to memory of 1964	4784	Njogjfoj.exe	89
PID 4784 wrote to memory of 1964	4784	Njogjfoj.exe	89
PID 4784 wrote to memory of 1964	4784	Njogjfoj.exe	89
PID 1964 wrote to memory of 1228	1964	Nqiogp32.exe	90
PID 1964 wrote to memory of 1228	1964	Nqiogp32.exe	90
PID 1964 wrote to memory of 1228	1964	Nqiogp32.exe	90
PID 1228 wrote to memory of 4384	1228	Nkncdifl.exe	91
PID 1228 wrote to memory of 4384	1228	Nkncdifl.exe	91
PID 1228 wrote to memory of 4384	1228	Nkncdifl.exe	91
PID 4384 wrote to memory of 5020	4384	Nqklmpdd.exe	92
PID 4384 wrote to memory of 5020	4384	Nqklmpdd.exe	92
PID 4384 wrote to memory of 5020	4384	Nqklmpdd.exe	92
PID 5020 wrote to memory of 4776	5020	Ncihikcg.exe	93
PID 5020 wrote to memory of 4776	5020	Ncihikcg.exe	93
PID 5020 wrote to memory of 4776	5020	Ncihikcg.exe	93
PID 4776 wrote to memory of 244	4776	Nbkhfc32.exe	94
PID 4776 wrote to memory of 244	4776	Nbkhfc32.exe	94
PID 4776 wrote to memory of 244	4776	Nbkhfc32.exe	94
PID 244 wrote to memory of 5080	244	Ndidbn32.exe	95
PID 244 wrote to memory of 5080	244	Ndidbn32.exe	95
PID 244 wrote to memory of 5080	244	Ndidbn32.exe	95
PID 5080 wrote to memory of 2108	5080	Ncldnkae.exe	96
PID 5080 wrote to memory of 2108	5080	Ncldnkae.exe	96
PID 5080 wrote to memory of 2108	5080	Ncldnkae.exe	96

C:\Users\Admin\AppData\Local\Temp\f3437aac724affad150afa1050dec160_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\f3437aac724affad150afa1050dec160_NeikiAnalytics.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Windows\SysWOW64\Mpaifalo.exe
  C:\Windows\system32\Mpaifalo.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3860
- - C:\Windows\SysWOW64\Mcpebmkb.exe
    C:\Windows\system32\Mcpebmkb.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3888
  - - C:\Windows\SysWOW64\Mjjmog32.exe
      C:\Windows\system32\Mjjmog32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3364
    - - C:\Windows\SysWOW64\Maaepd32.exe
        
        C:\Windows\system32\Maaepd32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3504
      - C:\Windows\SysWOW64\Mgnnhk32.exe
        
        C:\Windows\system32\Mgnnhk32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4428
        
        C:\Windows\SysWOW64\Njljefql.exe
        
        C:\Windows\system32\Njljefql.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2936
        
        C:\Windows\SysWOW64\Nceonl32.exe
        
        C:\Windows\system32\Nceonl32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4280
        
        C:\Windows\SysWOW64\Njogjfoj.exe
        
        C:\Windows\system32\Njogjfoj.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4784
        
        C:\Windows\SysWOW64\Nqiogp32.exe
        
        C:\Windows\system32\Nqiogp32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1964
        
        C:\Windows\SysWOW64\Nkncdifl.exe
        
        C:\Windows\system32\Nkncdifl.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1228
        
        C:\Windows\SysWOW64\Nqklmpdd.exe
        
        C:\Windows\system32\Nqklmpdd.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4384
        
        C:\Windows\SysWOW64\Ncihikcg.exe
        
        C:\Windows\system32\Ncihikcg.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5020
        
        C:\Windows\SysWOW64\Nbkhfc32.exe
        
        C:\Windows\system32\Nbkhfc32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4776
        
        C:\Windows\SysWOW64\Ndidbn32.exe
        
        C:\Windows\system32\Ndidbn32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:244
        
        C:\Windows\SysWOW64\Ncldnkae.exe
        
        C:\Windows\system32\Ncldnkae.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5080
        
        C:\Windows\SysWOW64\Nkcmohbg.exe
        
        C:\Windows\system32\Nkcmohbg.exe
        17⤵
        Executes dropped EXE
        
        PID:2108
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2108 -s 412
        18⤵
        Program crash
        
        PID:1420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2108 -ip 2108
1⤵
PID:2904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Hnfmbf32.dll

Path C:\Windows\SysWOW64\Hnfmbf32.dll
Size 7KB
SHA256 0063fd86f9bd07bc1e0cba60f0db2a1445589768eedeb103627457d218e6ff31
MD5 946a64fa7221d2b02bb7accb05e36d34
SHA1 aa51a7415c2a0791b337f5cd39c5ea1f67a388c0
SHA512 4c8c23f9d6ac01da01abf030e797a8dd5f006bcc8b88bd926637c8b335567c4170d036d179a6f3257bc5c8c486e0837b2425da8474899d39dbbf2a5cb22bda39
SSDEEP 48:66ay5YVO3EVkApc2wp8hH1NZn5EquglQ067YbPWsbABbgL3q9J5S2hmc:b3EVkApcX4Hiv0hbPaq3qX5S2hV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Maaepd32.exe

Path C:\Windows\SysWOW64\Maaepd32.exe
Size 161KB
SHA256 2cf527c5e663b4996ac68ba764590411a15760591ccfe4380af3d6a988ad047a
MD5 8f43f30314660a828ad3395557b76333
SHA1 68af2fcc64b384e0a8fe7959fabf435a4e73fcad
SHA512 c12ff6fa89f203ce4439c216c6f98be20e93a47dab21a90fcbf97c2c2353e1a0f226ccf7bd50ff1155181d05b876f7cbb270de0b5225862daa4149159b9de354
SSDEEP 3072:ePdCi5CxrLp9SU4qUkOVwtCJXeex7rrIRZK8K8/kvV:0O99SUykOVwtmeetrIyRV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mcpebmkb.exe

Path C:\Windows\SysWOW64\Mcpebmkb.exe
Size 161KB
SHA256 c97a86d2981d7d705d25dba8ed1bd4adbb033e54ed18a78aa6ce4031135e9914
MD5 3415185221e0620237fb6000f44d4d36
SHA1 2419ed956cfd901ecdf6d32afc3823aa8782284d
SHA512 89cdd3097f5eb1a79a8ed9905f2b42c12ad9b58534347d402167b667c45b3401db1bee914675023c6597b703281f09b65a3438c9260c2a4aa11c0154fff5f6ec
SSDEEP 3072:Me5QnzpzcEmS+1LEkzVwtCJXeex7rrIRZK8K8/kvV:T5Qnzd+BEkzVwtmeetrIyRV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mgnnhk32.exe

Path C:\Windows\SysWOW64\Mgnnhk32.exe
Size 161KB
SHA256 94e2a3590cad90cd6a4303701ccd3009799b1c125629621d180ab460ee6e942e
MD5 f1d7d99aac6dd0fba07dd3a8c3d385ea
SHA1 90444b53580b5c873a6d9c8a10d9951005189fce
SHA512 50f2fa5952ea6af38d4d2a9abad5613dea0abe43b36363343ff833ab013e77f3e5b6a9cfbabfd55fa7a30799aeb3e0c2e590e9ee11e66ed555a6a39c14b7cb00
SSDEEP 3072:RzIDNMa0XEP5q3N5Xk8VwtCJXeex7rrIRZK8K8/kvV:dIRMPERank8VwtmeetrIyRV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mjjmog32.exe

Path C:\Windows\SysWOW64\Mjjmog32.exe
Size 161KB
SHA256 439542166b13d2a2630ced7c7a5857f93e5d07783a9543a09c4d2cbf4d80ab29
MD5 d8e0956392057b710425f57d1e9f48b0
SHA1 bd1c0e7122170479a4105d4e052778601d547c8a
SHA512 15f81e57e75e0f8d3399374b1034c3dba08b769cf887f1c0df62271dc5ea7eb0f0a1155ee6a32675c46366a14569641a0752534ca0f1ee19148e38a48ddcd25b
SSDEEP 3072:ULZbRKOD0rFGABunWeJkeVwtCJXeex7rrIRZK8K8/kvV:ULZnWFnADkeVwtmeetrIyRV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mpaifalo.exe

Path C:\Windows\SysWOW64\Mpaifalo.exe
Size 161KB
SHA256 b8a1d2fa2ef67d3083c06c8ea278303e34ece48181d30d48df8e0763dfc592dd
MD5 e1e7a7c4dae15b6db6aef7b6125fb985
SHA1 8e8d262ebdc8adfb4feef552b7699c18168b4884
SHA512 22cf9a1010b00473d048cdae2a3de0b502e0b7e29f230db106b2d407d4eed283f7dbf1232102153db7c6b8fc18b08cbf14c4f59b609fe96b220d4cd706c8cd88
SSDEEP 3072:wsBhngZK8sY3fGC6kBVwtCJXeex7rrIRZK8K8/kvV:wKgxskBVwtmeetrIyRV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nbkhfc32.exe

Path C:\Windows\SysWOW64\Nbkhfc32.exe
Size 161KB
SHA256 3cd76bbf89f2d07fff2c9902414d2ff0fc3f232e49619aa0535d60a2ad68354d
MD5 ebb43f97fe34a5dae51c6558ad1bb2d1
SHA1 51c8641517994ef4eff0ff8e46313c43ffb22fb7
SHA512 f58dbdcf41ea8952dcb3aeb49740a10ac0a70554d126ccb730c251e1332f2583da21bc5a3f8062472f7953edd23aa17c6d1fef217deaca3929b29e95707e76b0
SSDEEP 3072:soYA4fsOioWIJCF0J910tGt55t98KDwCk/VwtCJXeex7rrIRZK8K8/kvV:soaszoWIJ0yR8Ck/VwtmeetrIyRV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nceonl32.exe

Path C:\Windows\SysWOW64\Nceonl32.exe
Size 161KB
SHA256 8061a8129662df708b0b90f65d55bb9a4320b853d5fdd0d213c56379b76830b5
MD5 70a332e14bf4a351dcadcc68d02c3189
SHA1 49e42d249a8782acb86e5fa053c57fab800bae24
SHA512 1a365adbe2f0310de02e41ae503c0ab8e31085f2e55a8ecc35b932f029dd9224bdb6075c100f01a68880506b671e282c41d51de4d0e92fc4018ccfc01660427e
SSDEEP 3072:D87Xnugt28qtKwCezyR+2rvfwk9VwtCJXeex7rrIRZK8K8/kvV:Q7Xnug4xtK7euM2rQk9VwtmeetrIyRV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ncihikcg.exe

Path C:\Windows\SysWOW64\Ncihikcg.exe
Size 161KB
SHA256 56c0d0d447e851480739a1b1adccf69c5c67f8cbf75449ca24ad515034a16000
MD5 a19e13ac32460253f209cbedc0af4523
SHA1 724902a686cb3e1b673ffdd684c07e2ee5736250
SHA512 51b262ef3f5b13228badde0f0307c17e0a9aeb3979020fd5b451d7b059fb2aff985e44000e387e3d206af8a3e1af73bfa44d08ef01aaa6386c65e63e49fca854
SSDEEP 3072:EwASyZNHfTigyAg7zfSgQRnkyVwtCJXeex7rrIRZK8K8/kvV:VASCN/TirAezfSgOkyVwtmeetrIyRV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ncldnkae.exe

Path C:\Windows\SysWOW64\Ncldnkae.exe
Size 161KB
SHA256 9e607baf2a8874aad3875ba241f8f451eabd7474cac2721f87f829a52583cee0
MD5 ed5a2243573d3b822abce0dc1bbbc9e4
SHA1 a5f4838f31170593f57c092ead2dc7c2cff3ae3f
SHA512 c78c64d5df5226af135e403431939976bbd24a98bf39a102b1ca070784eaba5d2f7f16b9be7d9de4aca38a505693626aaed455892e5ab8638bddb3b8c7f89688
SSDEEP 3072:FWrgn2ZzOYv2g58FlLkOVwtCJXeex7rrIRZK8K8/kvV:FW/NOYv2vLkOVwtmeetrIyRV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ndidbn32.exe

Path C:\Windows\SysWOW64\Ndidbn32.exe
Size 161KB
SHA256 1d27a4016463779e4f7623bebb9e4ecab83482f20777f18e8b66ad7218ffb9ba
MD5 846a0cce4c23562ca8dcb1f9ca7474ba
SHA1 0cb32cd3e29ba003187b200919430f79831cc546
SHA512 e15e58bbe9e3611a51cd635fd88b047fd1e06ac67eaac5a9c2bcfd46b5d85dcbbc1ddf09503c66dcaa88395e28f0ac6a0ff1332a59c5199fbe1700cc19775e9e
SSDEEP 3072:vU4/nJlSEOX7surBnm8kvVwtCJXeex7rrIRZK8K8/kvV:s0/SZX7sq9kvVwtmeetrIyRV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Njljefql.exe

Path C:\Windows\SysWOW64\Njljefql.exe
Size 161KB
SHA256 03a7b0c340fb06674f8578fa8ff93f5144e7363dd5f0bfb9ff672e083e94a2f1
MD5 2ee97debad2ac7f5c1f0470e4dd5e8e1
SHA1 c5497e900aed83fcd1e35f9e12f5b3a65f87a1a7
SHA512 6c8f666d4d9bbb532a59bcd17691ab05fd8a20e1e096a6753de43757935bd50421bfef1978e7a3bf672b15f22ac84d5a56100bb3363b41c6308d6924763152da
SSDEEP 3072:RdCkBjfSVH9DiiBFVSjgkdVwtCJXeex7rrIRZK8K8/kvV:eFt0iBFVS0kdVwtmeetrIyRV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Njogjfoj.exe

Path C:\Windows\SysWOW64\Njogjfoj.exe
Size 161KB
SHA256 0460e9c2d1f1195695fcf4c5190be74c295e163c09b2b23a30382cbbb8fb1660
MD5 06d2662c9718cb50e2ac9e4c4515118c
SHA1 d545e63ebe98b58c5fa999f372202d6c50b6b4db
SHA512 a5ca8cc9126ac9dbdcf3dbed4783cad5337e1c22dcc0841a286b9b4bbe2805ccc12be027c57cdb8db5e48038056286a2b335580b34fda8a07ec1dbffef8f4930
SSDEEP 3072:JF54cYD/Q9odiRgk5VwtCJXeex7rrIRZK8K8/kvV:JFmN/Frk5VwtmeetrIyRV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nkcmohbg.exe

Path C:\Windows\SysWOW64\Nkcmohbg.exe
Size 161KB
SHA256 ecb9a491df656dfe2cb22f8a4544c5f2b162426dbc9b2727c4417fd902210625
MD5 b151672a2ff330bc7d183c5836574b0d
SHA1 4433f4f7c9cbec8ffa908063cfb0a931b9e189aa
SHA512 ece16258f12b68436510423c4756fa7bfd3cb1997484c22d97be6259c8957cf9bb654ad4c34fd0135c768025496224457c0624ddfb892393f496a5ca37ce353c
SSDEEP 3072:r9eLt8k+5cJI+/rlv0ibkSVwtCJXeex7rrIRZK8K8/kvV:YLC9d+/hvbkSVwtmeetrIyRV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nkncdifl.exe

Path C:\Windows\SysWOW64\Nkncdifl.exe
Size 161KB
SHA256 db66ad064648d20cd6775203e5713246023504707fabc7536f2ed423b85722de
MD5 0a2b507e3e1022e60b7fe4e8dc4ca8ca
SHA1 1064d210e382791fccbe463cb1898dfdcf75283d
SHA512 9f73e5e2d7d7d600ef10a79f8d51a44384ce635a8819be48e8709b7184d756c464338556032eb5fd13b911345071d3d9e757e50eaa1eb866cf5b3b2602b245ad
SSDEEP 3072:BTjTRTX4tMXsiuFE8QiYk0VwtCJXeex7rrIRZK8K8/kvV:5XxX4+XsiuFFQiYk0VwtmeetrIyRV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nqiogp32.exe

Path C:\Windows\SysWOW64\Nqiogp32.exe
Size 161KB
SHA256 c8080d35bec4282a05d67f1396fc4e5f6b4f47796b2f8d3d17b1616603b3e12e
MD5 6a8f9f4accbc7353acd9944c3922f9a8
SHA1 aeb533e9c71d18006d622f0c8671090263b08cf6
SHA512 03916f05a5bab1b221fcf55859a1eddf8f6dc32c4d4e333c2981b2b7c3bbfe8f8627c64d13fc26d8744a95b520572ac6c32cd3bf3893db86ed394303ed7cfeb7
SSDEEP 3072:speweXtSnLaGLqhqV0hpkyVwtCJXeex7rrIRZK8K8/kvV:dSLaGLqh00hpkyVwtmeetrIyRV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nqklmpdd.exe

Path C:\Windows\SysWOW64\Nqklmpdd.exe
Size 161KB
SHA256 5aae47790e75c919c0908d6e2a2f3b8ffa6fdee5356e507c282a7fb895dc79f1
MD5 c7c79210c917aa93021c9b2d043509e5
SHA1 a2e4ed628539ca1d9a25487ce2f754153fed84c6
SHA512 9b19b3e1d4b4922870da469aa68193d7b97b9c86872f305434e07a1a4a802c7937d58c182f197c54719c39a4404591653c96014b4592bbd9fa0f3ccc814a9b3a
SSDEEP 3072:NDGaBd6DMoMCQfuberXhBntTkOVwtCJXeex7rrIRZK8K8/kvV:Nld6DgCQ7hTkOVwtmeetrIyRV
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/244-121-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/1228-140-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/1228-79-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/1964-139-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/1964-71-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2108-134-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2936-48-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2936-133-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3364-24-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3364-120-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3504-36-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3504-124-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3860-97-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3860-12-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3888-20-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3888-106-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4280-142-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4280-55-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4384-138-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4384-89-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4428-47-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4776-107-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4776-136-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4784-141-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4784-63-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4840-0-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4840-88-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/5020-137-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/5020-98-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/5080-125-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/5080-135-0x0000000000400000-0x000000000043F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads