Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
01-06-2024 03:40
Static task
static1
Behavioral task
behavioral1
Sample
8c18e7d6f318e2a0cbe3cf510d29e390_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
8c18e7d6f318e2a0cbe3cf510d29e390_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
General
-
Target
8c18e7d6f318e2a0cbe3cf510d29e390_NeikiAnalytics.exe
-
Size
124KB
-
MD5
8c18e7d6f318e2a0cbe3cf510d29e390
-
SHA1
443811d2825eca8e821bf7fc2751cd0a3e96369e
-
SHA256
8cff56dafbfbb0ea2ddce9064516f64b4cadd620c92c57f5f3dab66016a9ce08
-
SHA512
490db70c8a045e8ed1d4e1fee5d383aebe38eaa9a2a7c8063a0e7bdbc23d984b740bf0cbcd5863b424f6a89b22f7c1e1a6fe48006049ac95d9369a13d2820b74
-
SSDEEP
1536:XkszE5YmESOhRO/N69BH3OoGa+FL9jKceRgrkjSo:0GGYYOhkFoN3Oo1+F92S
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 46 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ddnaer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" goufei.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" toohi.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" xealuv.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" diizeaw.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" qtvuux.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" raihaur.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" yaelei.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" poikat.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" taner.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" soeiha.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" deouxi.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" caiirah.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" zoiutul.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" diavoel.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" rbqol.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" liomiv.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" wauugaq.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 8c18e7d6f318e2a0cbe3cf510d29e390_NeikiAnalytics.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" luaepad.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" caenit.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" deoesan.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" piaakot.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" vtxeh.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" luoliax.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" heoquo.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" taicoez.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ptlif.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" hhteos.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ciowes.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" boiimuw.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" kuadej.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" zooit.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" duarous.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" vgzed.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" puduj.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" fepud.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" liiix.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" qeaic.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" meiih.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" piaexeg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" viivuo.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" roewat.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" goaoqof.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" duuega.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" guisoe.exe -
Executes dropped EXE 45 IoCs
pid Process 2940 soeiha.exe 2820 luaepad.exe 2348 xealuv.exe 2332 deouxi.exe 2776 caiirah.exe 1600 duarous.exe 2420 goaoqof.exe 2512 taicoez.exe 2308 vgzed.exe 2980 ptlif.exe 596 hhteos.exe 1160 caenit.exe 292 zoiutul.exe 1712 fepud.exe 908 deoesan.exe 2928 diavoel.exe 764 rbqol.exe 2492 duuega.exe 2356 liiix.exe 2800 diizeaw.exe 2032 ddnaer.exe 1544 qeaic.exe 1292 piaakot.exe 1060 qtvuux.exe 856 raihaur.exe 1688 yaelei.exe 1832 vtxeh.exe 1660 goufei.exe 2728 poikat.exe 2156 boiimuw.exe 2116 luoliax.exe 472 puduj.exe 2292 meiih.exe 2968 taner.exe 1564 kuadej.exe 356 liomiv.exe 1128 guisoe.exe 1920 heoquo.exe 572 piaexeg.exe 1016 wauugaq.exe 452 viivuo.exe 2852 roewat.exe 2664 zooit.exe 2060 toohi.exe 2084 soakoak.exe -
Loads dropped DLL 64 IoCs
pid Process 2868 8c18e7d6f318e2a0cbe3cf510d29e390_NeikiAnalytics.exe 2868 8c18e7d6f318e2a0cbe3cf510d29e390_NeikiAnalytics.exe 2940 soeiha.exe 2940 soeiha.exe 2820 luaepad.exe 2820 luaepad.exe 2348 xealuv.exe 2348 xealuv.exe 2332 deouxi.exe 2332 deouxi.exe 2776 caiirah.exe 2776 caiirah.exe 1600 duarous.exe 1600 duarous.exe 2420 goaoqof.exe 2420 goaoqof.exe 2512 taicoez.exe 2512 taicoez.exe 2308 vgzed.exe 2308 vgzed.exe 2980 ptlif.exe 2980 ptlif.exe 596 hhteos.exe 596 hhteos.exe 1160 caenit.exe 1160 caenit.exe 292 zoiutul.exe 292 zoiutul.exe 1712 fepud.exe 1712 fepud.exe 908 deoesan.exe 908 deoesan.exe 2928 diavoel.exe 2928 diavoel.exe 764 rbqol.exe 764 rbqol.exe 2492 duuega.exe 2492 duuega.exe 2356 liiix.exe 2356 liiix.exe 2800 diizeaw.exe 2800 diizeaw.exe 2032 ddnaer.exe 2032 ddnaer.exe 1544 qeaic.exe 1544 qeaic.exe 1292 piaakot.exe 1292 piaakot.exe 1060 qtvuux.exe 1060 qtvuux.exe 856 raihaur.exe 856 raihaur.exe 1688 yaelei.exe 1688 yaelei.exe 1832 vtxeh.exe 1832 vtxeh.exe 2584 ciowes.exe 2584 ciowes.exe 2728 poikat.exe 2728 poikat.exe 2156 boiimuw.exe 2156 boiimuw.exe 2116 luoliax.exe 2116 luoliax.exe -
Adds Run key to start application 2 TTPs 46 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\diizeaw = "C:\\Users\\Admin\\diizeaw.exe /r" liiix.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\qeaic = "C:\\Users\\Admin\\qeaic.exe /J" ddnaer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaelei = "C:\\Users\\Admin\\yaelei.exe /b" raihaur.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\ciowes = "C:\\Users\\Admin\\ciowes.exe /F" goufei.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\poikat = "C:\\Users\\Admin\\poikat.exe /l" ciowes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\taner = "C:\\Users\\Admin\\taner.exe /e" meiih.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\luaepad = "C:\\Users\\Admin\\luaepad.exe /Z" soeiha.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\taicoez = "C:\\Users\\Admin\\taicoez.exe /l" goaoqof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\vgzed = "C:\\Users\\Admin\\vgzed.exe /H" taicoez.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\ptlif = "C:\\Users\\Admin\\ptlif.exe /A" vgzed.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\vtxeh = "C:\\Users\\Admin\\vtxeh.exe /i" yaelei.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\luoliax = "C:\\Users\\Admin\\luoliax.exe /W" boiimuw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\roewat = "C:\\Users\\Admin\\roewat.exe /s" viivuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\toohi = "C:\\Users\\Admin\\toohi.exe /x" zooit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\fepud = "C:\\Users\\Admin\\fepud.exe /W" zoiutul.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\liiix = "C:\\Users\\Admin\\liiix.exe /V" duuega.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\heoquo = "C:\\Users\\Admin\\heoquo.exe /D" guisoe.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\caiirah = "C:\\Users\\Admin\\caiirah.exe /D" deouxi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\goaoqof = "C:\\Users\\Admin\\goaoqof.exe /w" duarous.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\caenit = "C:\\Users\\Admin\\caenit.exe /a" hhteos.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\deouxi = "C:\\Users\\Admin\\deouxi.exe /v" xealuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\duarous = "C:\\Users\\Admin\\duarous.exe /C" caiirah.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\viivuo = "C:\\Users\\Admin\\viivuo.exe /v" wauugaq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\zoiutul = "C:\\Users\\Admin\\zoiutul.exe /j" caenit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\piaakot = "C:\\Users\\Admin\\piaakot.exe /f" qeaic.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\qtvuux = "C:\\Users\\Admin\\qtvuux.exe /z" piaakot.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\goufei = "C:\\Users\\Admin\\goufei.exe /l" vtxeh.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\puduj = "C:\\Users\\Admin\\puduj.exe /x" luoliax.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\meiih = "C:\\Users\\Admin\\meiih.exe /u" puduj.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\kuadej = "C:\\Users\\Admin\\kuadej.exe /h" taner.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\wauugaq = "C:\\Users\\Admin\\wauugaq.exe /X" piaexeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\zooit = "C:\\Users\\Admin\\zooit.exe /M" roewat.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\hhteos = "C:\\Users\\Admin\\hhteos.exe /O" ptlif.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\ddnaer = "C:\\Users\\Admin\\ddnaer.exe /h" diizeaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\boiimuw = "C:\\Users\\Admin\\boiimuw.exe /T" poikat.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\guisoe = "C:\\Users\\Admin\\guisoe.exe /H" liomiv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\soakoak = "C:\\Users\\Admin\\soakoak.exe /I" toohi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\soeiha = "C:\\Users\\Admin\\soeiha.exe /b" 8c18e7d6f318e2a0cbe3cf510d29e390_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\xealuv = "C:\\Users\\Admin\\xealuv.exe /k" luaepad.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\deoesan = "C:\\Users\\Admin\\deoesan.exe /H" fepud.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\diavoel = "C:\\Users\\Admin\\diavoel.exe /a" deoesan.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\rbqol = "C:\\Users\\Admin\\rbqol.exe /S" diavoel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\duuega = "C:\\Users\\Admin\\duuega.exe /V" rbqol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\raihaur = "C:\\Users\\Admin\\raihaur.exe /f" qtvuux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\liomiv = "C:\\Users\\Admin\\liomiv.exe /h" kuadej.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\piaexeg = "C:\\Users\\Admin\\piaexeg.exe /E" heoquo.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 45 IoCs
pid Process 2868 8c18e7d6f318e2a0cbe3cf510d29e390_NeikiAnalytics.exe 2940 soeiha.exe 2820 luaepad.exe 2348 xealuv.exe 2332 deouxi.exe 2776 caiirah.exe 1600 duarous.exe 2420 goaoqof.exe 2512 taicoez.exe 2308 vgzed.exe 2980 ptlif.exe 596 hhteos.exe 1160 caenit.exe 292 zoiutul.exe 1712 fepud.exe 908 deoesan.exe 2928 diavoel.exe 764 rbqol.exe 2492 duuega.exe 2356 liiix.exe 2800 diizeaw.exe 2032 ddnaer.exe 1544 qeaic.exe 1292 piaakot.exe 1060 qtvuux.exe 856 raihaur.exe 1688 yaelei.exe 1832 vtxeh.exe 2584 ciowes.exe 2728 poikat.exe 2156 boiimuw.exe 2116 luoliax.exe 472 puduj.exe 2292 meiih.exe 2968 taner.exe 1564 kuadej.exe 356 liomiv.exe 1128 guisoe.exe 1920 heoquo.exe 572 piaexeg.exe 1016 wauugaq.exe 452 viivuo.exe 2852 roewat.exe 2664 zooit.exe 2060 toohi.exe -
Suspicious use of SetWindowsHookEx 46 IoCs
pid Process 2868 8c18e7d6f318e2a0cbe3cf510d29e390_NeikiAnalytics.exe 2940 soeiha.exe 2820 luaepad.exe 2348 xealuv.exe 2332 deouxi.exe 2776 caiirah.exe 1600 duarous.exe 2420 goaoqof.exe 2512 taicoez.exe 2308 vgzed.exe 2980 ptlif.exe 596 hhteos.exe 1160 caenit.exe 292 zoiutul.exe 1712 fepud.exe 908 deoesan.exe 2928 diavoel.exe 764 rbqol.exe 2492 duuega.exe 2356 liiix.exe 2800 diizeaw.exe 2032 ddnaer.exe 1544 qeaic.exe 1292 piaakot.exe 1060 qtvuux.exe 856 raihaur.exe 1688 yaelei.exe 1832 vtxeh.exe 2584 ciowes.exe 2728 poikat.exe 2156 boiimuw.exe 2116 luoliax.exe 472 puduj.exe 2292 meiih.exe 2968 taner.exe 1564 kuadej.exe 356 liomiv.exe 1128 guisoe.exe 1920 heoquo.exe 572 piaexeg.exe 1016 wauugaq.exe 452 viivuo.exe 2852 roewat.exe 2664 zooit.exe 2060 toohi.exe 2084 soakoak.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2868 wrote to memory of 2940 2868 8c18e7d6f318e2a0cbe3cf510d29e390_NeikiAnalytics.exe 28 PID 2868 wrote to memory of 2940 2868 8c18e7d6f318e2a0cbe3cf510d29e390_NeikiAnalytics.exe 28 PID 2868 wrote to memory of 2940 2868 8c18e7d6f318e2a0cbe3cf510d29e390_NeikiAnalytics.exe 28 PID 2868 wrote to memory of 2940 2868 8c18e7d6f318e2a0cbe3cf510d29e390_NeikiAnalytics.exe 28 PID 2940 wrote to memory of 2820 2940 soeiha.exe 29 PID 2940 wrote to memory of 2820 2940 soeiha.exe 29 PID 2940 wrote to memory of 2820 2940 soeiha.exe 29 PID 2940 wrote to memory of 2820 2940 soeiha.exe 29 PID 2820 wrote to memory of 2348 2820 luaepad.exe 30 PID 2820 wrote to memory of 2348 2820 luaepad.exe 30 PID 2820 wrote to memory of 2348 2820 luaepad.exe 30 PID 2820 wrote to memory of 2348 2820 luaepad.exe 30 PID 2348 wrote to memory of 2332 2348 xealuv.exe 31 PID 2348 wrote to memory of 2332 2348 xealuv.exe 31 PID 2348 wrote to memory of 2332 2348 xealuv.exe 31 PID 2348 wrote to memory of 2332 2348 xealuv.exe 31 PID 2332 wrote to memory of 2776 2332 deouxi.exe 32 PID 2332 wrote to memory of 2776 2332 deouxi.exe 32 PID 2332 wrote to memory of 2776 2332 deouxi.exe 32 PID 2332 wrote to memory of 2776 2332 deouxi.exe 32 PID 2776 wrote to memory of 1600 2776 caiirah.exe 33 PID 2776 wrote to memory of 1600 2776 caiirah.exe 33 PID 2776 wrote to memory of 1600 2776 caiirah.exe 33 PID 2776 wrote to memory of 1600 2776 caiirah.exe 33 PID 1600 wrote to memory of 2420 1600 duarous.exe 34 PID 1600 wrote to memory of 2420 1600 duarous.exe 34 PID 1600 wrote to memory of 2420 1600 duarous.exe 34 PID 1600 wrote to memory of 2420 1600 duarous.exe 34 PID 2420 wrote to memory of 2512 2420 goaoqof.exe 35 PID 2420 wrote to memory of 2512 2420 goaoqof.exe 35 PID 2420 wrote to memory of 2512 2420 goaoqof.exe 35 PID 2420 wrote to memory of 2512 2420 goaoqof.exe 35 PID 2512 wrote to memory of 2308 2512 taicoez.exe 36 PID 2512 wrote to memory of 2308 2512 taicoez.exe 36 PID 2512 wrote to memory of 2308 2512 taicoez.exe 36 PID 2512 wrote to memory of 2308 2512 taicoez.exe 36 PID 2308 wrote to memory of 2980 2308 vgzed.exe 37 PID 2308 wrote to memory of 2980 2308 vgzed.exe 37 PID 2308 wrote to memory of 2980 2308 vgzed.exe 37 PID 2308 wrote to memory of 2980 2308 vgzed.exe 37 PID 2980 wrote to memory of 596 2980 ptlif.exe 38 PID 2980 wrote to memory of 596 2980 ptlif.exe 38 PID 2980 wrote to memory of 596 2980 ptlif.exe 38 PID 2980 wrote to memory of 596 2980 ptlif.exe 38 PID 596 wrote to memory of 1160 596 hhteos.exe 39 PID 596 wrote to memory of 1160 596 hhteos.exe 39 PID 596 wrote to memory of 1160 596 hhteos.exe 39 PID 596 wrote to memory of 1160 596 hhteos.exe 39 PID 1160 wrote to memory of 292 1160 caenit.exe 40 PID 1160 wrote to memory of 292 1160 caenit.exe 40 PID 1160 wrote to memory of 292 1160 caenit.exe 40 PID 1160 wrote to memory of 292 1160 caenit.exe 40 PID 292 wrote to memory of 1712 292 zoiutul.exe 41 PID 292 wrote to memory of 1712 292 zoiutul.exe 41 PID 292 wrote to memory of 1712 292 zoiutul.exe 41 PID 292 wrote to memory of 1712 292 zoiutul.exe 41 PID 1712 wrote to memory of 908 1712 fepud.exe 44 PID 1712 wrote to memory of 908 1712 fepud.exe 44 PID 1712 wrote to memory of 908 1712 fepud.exe 44 PID 1712 wrote to memory of 908 1712 fepud.exe 44 PID 908 wrote to memory of 2928 908 deoesan.exe 45 PID 908 wrote to memory of 2928 908 deoesan.exe 45 PID 908 wrote to memory of 2928 908 deoesan.exe 45 PID 908 wrote to memory of 2928 908 deoesan.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\8c18e7d6f318e2a0cbe3cf510d29e390_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\8c18e7d6f318e2a0cbe3cf510d29e390_NeikiAnalytics.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\soeiha.exe"C:\Users\Admin\soeiha.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\luaepad.exe"C:\Users\Admin\luaepad.exe"3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\xealuv.exe"C:\Users\Admin\xealuv.exe"4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Users\Admin\deouxi.exe"C:\Users\Admin\deouxi.exe"5⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Users\Admin\caiirah.exe"C:\Users\Admin\caiirah.exe"6⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\duarous.exe"C:\Users\Admin\duarous.exe"7⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\goaoqof.exe"C:\Users\Admin\goaoqof.exe"8⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\taicoez.exe"C:\Users\Admin\taicoez.exe"9⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\vgzed.exe"C:\Users\Admin\vgzed.exe"10⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\ptlif.exe"C:\Users\Admin\ptlif.exe"11⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\hhteos.exe"C:\Users\Admin\hhteos.exe"12⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:596 -
C:\Users\Admin\caenit.exe"C:\Users\Admin\caenit.exe"13⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Users\Admin\zoiutul.exe"C:\Users\Admin\zoiutul.exe"14⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:292 -
C:\Users\Admin\fepud.exe"C:\Users\Admin\fepud.exe"15⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\deoesan.exe"C:\Users\Admin\deoesan.exe"16⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Users\Admin\diavoel.exe"C:\Users\Admin\diavoel.exe"17⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2928 -
C:\Users\Admin\rbqol.exe"C:\Users\Admin\rbqol.exe"18⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:764 -
C:\Users\Admin\duuega.exe"C:\Users\Admin\duuega.exe"19⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2492 -
C:\Users\Admin\liiix.exe"C:\Users\Admin\liiix.exe"20⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2356 -
C:\Users\Admin\diizeaw.exe"C:\Users\Admin\diizeaw.exe"21⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2800 -
C:\Users\Admin\ddnaer.exe"C:\Users\Admin\ddnaer.exe"22⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2032 -
C:\Users\Admin\qeaic.exe"C:\Users\Admin\qeaic.exe"23⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1544 -
C:\Users\Admin\piaakot.exe"C:\Users\Admin\piaakot.exe"24⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1292 -
C:\Users\Admin\qtvuux.exe"C:\Users\Admin\qtvuux.exe"25⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1060 -
C:\Users\Admin\raihaur.exe"C:\Users\Admin\raihaur.exe"26⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:856 -
C:\Users\Admin\yaelei.exe"C:\Users\Admin\yaelei.exe"27⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1688 -
C:\Users\Admin\vtxeh.exe"C:\Users\Admin\vtxeh.exe"28⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1832 -
C:\Users\Admin\goufei.exe"C:\Users\Admin\goufei.exe"29⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
PID:1660 -
C:\Users\Admin\ciowes.exe"C:\Users\Admin\ciowes.exe"30⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2584 -
C:\Users\Admin\poikat.exe"C:\Users\Admin\poikat.exe"31⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2728 -
C:\Users\Admin\boiimuw.exe"C:\Users\Admin\boiimuw.exe"32⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2156 -
C:\Users\Admin\luoliax.exe"C:\Users\Admin\luoliax.exe"33⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2116 -
C:\Users\Admin\puduj.exe"C:\Users\Admin\puduj.exe"34⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:472 -
C:\Users\Admin\meiih.exe"C:\Users\Admin\meiih.exe"35⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2292 -
C:\Users\Admin\taner.exe"C:\Users\Admin\taner.exe"36⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2968 -
C:\Users\Admin\kuadej.exe"C:\Users\Admin\kuadej.exe"37⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1564 -
C:\Users\Admin\liomiv.exe"C:\Users\Admin\liomiv.exe"38⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:356 -
C:\Users\Admin\guisoe.exe"C:\Users\Admin\guisoe.exe"39⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1128 -
C:\Users\Admin\heoquo.exe"C:\Users\Admin\heoquo.exe"40⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1920 -
C:\Users\Admin\piaexeg.exe"C:\Users\Admin\piaexeg.exe"41⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:572 -
C:\Users\Admin\wauugaq.exe"C:\Users\Admin\wauugaq.exe"42⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1016 -
C:\Users\Admin\viivuo.exe"C:\Users\Admin\viivuo.exe"43⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:452 -
C:\Users\Admin\roewat.exe"C:\Users\Admin\roewat.exe"44⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2852 -
C:\Users\Admin\zooit.exe"C:\Users\Admin\zooit.exe"45⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2664 -
C:\Users\Admin\toohi.exe"C:\Users\Admin\toohi.exe"46⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2060 -
C:\Users\Admin\soakoak.exe"C:\Users\Admin\soakoak.exe"47⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2084 -
C:\Users\Admin\diunais.exe"C:\Users\Admin\diunais.exe"48⤵PID:540
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
124KB
MD5f46701e21159792c9dd026769b186e66
SHA183891f1007d323b7b52740a6de8f3726b33e36c2
SHA256120d0821d85383c9372be1ccd3285b2c7a9ba5839ed1f720043ced3ea70039d3
SHA512964e87dfae63a3e2bbd9154d4e9522b731c8f22a61fe2d4f40b7283028c773dd3a92d1af412c71783e1ada3245dbaa2f19332c28cc57cc85a130bb12d9fd134e
-
Filesize
124KB
MD51bea1131a74e92062e9eeb9b6fc25741
SHA198c031f08e5464dade0e45f6d059971cd60e8838
SHA256a8e2f43e53fe34a174d611e2cbba3ca23b27534f53dca72b9e83694f04bd17eb
SHA512d7da122c7383494ba69be4988fd6d50c867ccf1ca3aadbbc01dc752e341a641c5f16de6417ca9b55e941238967ccd135c7fbd96268b2304468ae2de3cc87bde6
-
Filesize
124KB
MD56a0b45705067327f289531ca74815a32
SHA11a4813430786d6150b9529bb84ebe22dc4cfc0a7
SHA256a2d2e317cd86c450d42880f03d871d2d8fbc8ae71634c412511b1e54fb90a4fd
SHA512a3b7ae56598f6d585b0ec304d6456a06703b74e1408ec728c219fe0db19c1584240391576872a21e86792c2cb140a32ddcb1dc6049d04a95d78fdf274b23a665
-
Filesize
124KB
MD56f838b8c78d1c4b8b70d86ecad612545
SHA13a99b2a1a05e4ac2f78e1a036f62992476db9b86
SHA256466ccfa0e86ddc6bd0fc4302a5ee349ed11cdb91359717a78df13755de98ecb5
SHA512b4676760c2e3dcebfc6b3f6747079ad88f4aba70ebee17c3c3220cbee71195213862684a3d71bcdfec1e3d5ff9aa6c25a75dfdab5f1c2d07f70c922dd341adfc
-
Filesize
124KB
MD5287bd4376814336b207637d4ef6579b2
SHA120644a28e017473a4f59f7ef12c277e58bb24743
SHA256a5da3f858c975eb629567b641c299d188d19fe682e98f0887c064bdb745b31d3
SHA5126cb5ec6986629cbe13f3dfa0540ef4f1bd1f0d394d82e6fe1b31fe7a5513ba02bc4a0a9d700a307fb4c0cc23a7a348b8232e85e6a477c889204d0c29c16c3e18
-
Filesize
124KB
MD578ebaf84288e6bbdda888a1d5796804f
SHA1802b0a92373938752351e50247e8bb76853491fb
SHA256d66bd9f046e475334799b8f40536e3335e3766cb4f69212d7442fbde17dc1048
SHA512c23368910dc05fc9db83a61bbd5c8e51940d4852c999e1d2159091403d148131d371dd97213fe433e22d4d73067d58a1357adebe2dd588561709364bd99f1075
-
Filesize
124KB
MD506fdaec770ce32c320ca3a4d6a2d5d37
SHA1d6ec1c431918dd31aa4b3d58f5052d56c6dcd370
SHA25602642ce879d016d9e91f2b429c38b0983805e9256d5c1634e9143668f8a6eb7f
SHA512f4cf5e5aff31406f4a095ed86d1daa51e5c9a25ed456d3ce57a67898c2db631c914ba922d7aa7abebd61dff1b18cb8eaa92f8c495f3f9fabd351b71ac5aa0f86
-
Filesize
124KB
MD58f56866bc5f63eff70a377b32a42b440
SHA169dbd57bfb4fa3b7eaea32b673fc987aa0e90f4b
SHA256b4fe1971766fc2181160ebbf6605fb87ec8aee294f617cb9d7fe3b91b365d028
SHA512bdeba177629dfc003dea9529f38adcdd6577dd96d3fbd863deb2099a0c825ebf7f8fae969748e0cbb78a400e31e94d20791c496ab8e5cb26b6f851c7b394523a
-
Filesize
124KB
MD5960efa5697ac76a4b4e99c6f3e72ef58
SHA1ac7668c366a2cd7752bee92e6e452df2c828870a
SHA256c7431d6609e20d78a13bca4a1040aa67922a9bc6df0dad05f98c93704bc19b5c
SHA512474891dceb1591a9529c3ebb0062d3548d823b2d01717b5f1a6f90edcdd53e33af1ecca5b69f22a1cebc0560b9a3dee87804200fbb2e713401237892e2d69b51
-
Filesize
124KB
MD57c1eba6aadad653bdd9f67ff6cda7e0f
SHA12199cc11b5315a030e6fa9e36ea550fff794739d
SHA2567e30a9df64cb914bb7a5aafde6cc729296e5c8cd1cf299fb721f2cb3eac0d468
SHA51294c4ed624af1b8914d89ccb70513359eea69e8c33f567ccf218055a67647c4c1476abd972ae04ebcb8acdb5091015c707b61176a2df6cfdfeb8ff5a42da819e9
-
Filesize
124KB
MD54b4d3adaaa63058a6361fb49e8eb8faa
SHA19525e9bc374271dbff24bae59756656d55064124
SHA25618877e4e3bf515267c279bbf7e3fc4bf11b2a98684048e01a6c65345a070fef7
SHA512b3259c92ef14db1ad932509f91d0a9ee6838c32e7906b83fc687933698a649f87ca43ec3b500a8c8d181e8ee4cdf96b16d58c5ebe2f282bee93105556c782677
-
Filesize
124KB
MD5486d5a1dc806df91538fcfc3114827b4
SHA10836487eecc2280dd09822e8fcb8632ac484bef0
SHA256c37edec1eb785eae474866ff994b411068e99e1d1049f59670770a8efff4399a
SHA5125ea3a9bfe992d82584eb754e4ef46947b5630b0a0e9bfae851b7219d787ed36f201e7b8a353f512185eabf5c222b0e8d1ecb404caa9230239ea8da77004ac3ea
-
Filesize
124KB
MD56c8410cb15b115c01b8058865bb2f5e7
SHA109e3ee2fdb83c2394b4d274c148687d2c74e87a0
SHA256d19b01350cd34c10c39da470c3f31212b54869a5783f868e4a4469645ed55a0f
SHA512511e6ea14dd7c05fa5da1a2f8441cdd9d0816cb40690698f52e4ec7f39a5db32696a507d68a6c827d8cbc421a64ed4a82eb807a3228eed8bef32ed907c53a042
-
Filesize
124KB
MD53016c886b1b7a381e30dd12967caf806
SHA16a4486de83237fd912dc51decc7acc033d6b862d
SHA2560304549b17d48841000b9307e2380459be17fdc22b0b64b4b641d85bd5ca9cd2
SHA512fec946822b31932c6ad6d7edd3448777cc2cca9afbcb39678574689ed9e4cd9961250625948ddac28fcbf11c04afb2da56ae7d1aa043ddc33042c39a17bc8f26
-
Filesize
124KB
MD5a90acadec1fdd88f76670b95a29942db
SHA11e0ec53b191440076ae14665674b880cb48746a5
SHA2568a6c3aec0c0c853c7d55fe3955a59f31784f605386249281b3824ef7d5cf8226
SHA5126efe1cbf04a7eff4319f0c98d7ef19f4087e8137cd9665db4deae28f6c8c420901e4d91431f84228d046947d8135d359cfe1f542c54f21cbce8bd4e540874c6e
-
Filesize
124KB
MD57336cb4ae3b35108e474d840d96f0fb6
SHA1b2ea88a44e74bda1780f26104e53809953a8977f
SHA2566e38abf11eb9ddbbabe0123d39b0b4b3152bdebfb4cfb7fdbd353e67eb6ff545
SHA5123cfbff1691c69c7bd1fbf5d7f5fc7dfe2d5e155bd3c2c89365163d2c0126e98a8ec91ee9d9d13dd8c2085041cfc94e43c2a506dad3d450769f2c090fb9d4ee2f