Malware Analysis Report

2025-01-06 09:16

Sample ID 240601-f3apeabc7z
Target 8f15d7c2b1018580fbaa2ab0c8709b40_NeikiAnalytics.exe
SHA256 3b7c8c7761d7470e3030a83893acbf0aa5461919ef8422e590ac6f1cd99b602b
Tags
evasion persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

3b7c8c7761d7470e3030a83893acbf0aa5461919ef8422e590ac6f1cd99b602b

Threat Level: Known bad

The file 8f15d7c2b1018580fbaa2ab0c8709b40_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

evasion persistence trojan

Windows security bypass

Modifies Installed Components in the registry

Sets file execution options in registry

Executes dropped EXE

Windows security modification

Loads dropped DLL

Modifies WinLogon

Drops file in System32 directory

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-01 05:23

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-01 05:23

Reported

2024-06-01 05:26

Platform

win10v2004-20240226-en

Max time kernel

157s

Max time network

160s

Command Line

winlogon.exe

Signatures

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" C:\Windows\SysWOW64\anputen.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" C:\Windows\SysWOW64\anputen.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" C:\Windows\SysWOW64\anputen.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" C:\Windows\SysWOW64\anputen.exe N/A

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F41494C-5643-4e59-4F41-494C56434e59}\StubPath = "C:\\Windows\\system32\\umboaroad-ucid.exe" C:\Windows\SysWOW64\anputen.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F41494C-5643-4e59-4F41-494C56434e59} C:\Windows\SysWOW64\anputen.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F41494C-5643-4e59-4F41-494C56434e59}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" C:\Windows\SysWOW64\anputen.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F41494C-5643-4e59-4F41-494C56434e59}\IsInstalled = "1" C:\Windows\SysWOW64\anputen.exe N/A

Sets file execution options in registry

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe C:\Windows\SysWOW64\anputen.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" C:\Windows\SysWOW64\anputen.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\udvugom-exum.exe" C:\Windows\SysWOW64\anputen.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" C:\Windows\SysWOW64\anputen.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" C:\Windows\SysWOW64\anputen.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" C:\Windows\SysWOW64\anputen.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" C:\Windows\SysWOW64\anputen.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} C:\Windows\SysWOW64\anputen.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify C:\Windows\SysWOW64\anputen.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" C:\Windows\SysWOW64\anputen.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\eacmoacop-atum.dll" C:\Windows\SysWOW64\anputen.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" C:\Windows\SysWOW64\anputen.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\udvugom-exum.exe C:\Windows\SysWOW64\anputen.exe N/A
File opened for modification C:\Windows\SysWOW64\anputen.exe C:\Windows\SysWOW64\anputen.exe N/A
File opened for modification C:\Windows\SysWOW64\anputen.exe C:\Users\Admin\AppData\Local\Temp\8f15d7c2b1018580fbaa2ab0c8709b40_NeikiAnalytics.exe N/A
File created C:\Windows\SysWOW64\anputen.exe C:\Users\Admin\AppData\Local\Temp\8f15d7c2b1018580fbaa2ab0c8709b40_NeikiAnalytics.exe N/A
File created C:\Windows\SysWOW64\udvugom-exum.exe C:\Windows\SysWOW64\anputen.exe N/A
File opened for modification C:\Windows\SysWOW64\umboaroad-ucid.exe C:\Windows\SysWOW64\anputen.exe N/A
File created C:\Windows\SysWOW64\umboaroad-ucid.exe C:\Windows\SysWOW64\anputen.exe N/A
File opened for modification C:\Windows\SysWOW64\eacmoacop-atum.dll C:\Windows\SysWOW64\anputen.exe N/A
File created C:\Windows\SysWOW64\eacmoacop-atum.dll C:\Windows\SysWOW64\anputen.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\anputen.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4752 wrote to memory of 3712 N/A C:\Users\Admin\AppData\Local\Temp\8f15d7c2b1018580fbaa2ab0c8709b40_NeikiAnalytics.exe C:\Windows\SysWOW64\anputen.exe
PID 4752 wrote to memory of 3712 N/A C:\Users\Admin\AppData\Local\Temp\8f15d7c2b1018580fbaa2ab0c8709b40_NeikiAnalytics.exe C:\Windows\SysWOW64\anputen.exe
PID 4752 wrote to memory of 3712 N/A C:\Users\Admin\AppData\Local\Temp\8f15d7c2b1018580fbaa2ab0c8709b40_NeikiAnalytics.exe C:\Windows\SysWOW64\anputen.exe
PID 3712 wrote to memory of 5036 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\SysWOW64\anputen.exe
PID 3712 wrote to memory of 5036 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\SysWOW64\anputen.exe
PID 3712 wrote to memory of 5036 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\SysWOW64\anputen.exe
PID 3712 wrote to memory of 632 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\system32\winlogon.exe
PID 3712 wrote to memory of 3188 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 3712 wrote to memory of 3188 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 3712 wrote to memory of 3188 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 3712 wrote to memory of 3188 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 3712 wrote to memory of 3188 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 3712 wrote to memory of 3188 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 3712 wrote to memory of 3188 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 3712 wrote to memory of 3188 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 3712 wrote to memory of 3188 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 3712 wrote to memory of 3188 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 3712 wrote to memory of 3188 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 3712 wrote to memory of 3188 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 3712 wrote to memory of 3188 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 3712 wrote to memory of 3188 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 3712 wrote to memory of 3188 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 3712 wrote to memory of 3188 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 3712 wrote to memory of 3188 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 3712 wrote to memory of 3188 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 3712 wrote to memory of 3188 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 3712 wrote to memory of 3188 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 3712 wrote to memory of 3188 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 3712 wrote to memory of 3188 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 3712 wrote to memory of 3188 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 3712 wrote to memory of 3188 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 3712 wrote to memory of 3188 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 3712 wrote to memory of 3188 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 3712 wrote to memory of 3188 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 3712 wrote to memory of 3188 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 3712 wrote to memory of 3188 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 3712 wrote to memory of 3188 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 3712 wrote to memory of 3188 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 3712 wrote to memory of 3188 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 3712 wrote to memory of 3188 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 3712 wrote to memory of 3188 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 3712 wrote to memory of 3188 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 3712 wrote to memory of 3188 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 3712 wrote to memory of 3188 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 3712 wrote to memory of 3188 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 3712 wrote to memory of 3188 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 3712 wrote to memory of 3188 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 3712 wrote to memory of 3188 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 3712 wrote to memory of 3188 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 3712 wrote to memory of 3188 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 3712 wrote to memory of 3188 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 3712 wrote to memory of 3188 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 3712 wrote to memory of 3188 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 3712 wrote to memory of 3188 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 3712 wrote to memory of 3188 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 3712 wrote to memory of 3188 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 3712 wrote to memory of 3188 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 3712 wrote to memory of 3188 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 3712 wrote to memory of 3188 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 3712 wrote to memory of 3188 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 3712 wrote to memory of 3188 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 3712 wrote to memory of 3188 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 3712 wrote to memory of 3188 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 3712 wrote to memory of 3188 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\system32\winlogon.exe

winlogon.exe

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\8f15d7c2b1018580fbaa2ab0c8709b40_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\8f15d7c2b1018580fbaa2ab0c8709b40_NeikiAnalytics.exe"

C:\Windows\SysWOW64\anputen.exe

"C:\Windows\SysWOW64\anputen.exe"

C:\Windows\SysWOW64\anputen.exe

--k33p

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3812 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 swemqqsig.mp udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 swemqqsig.mp udp
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
GB 23.44.234.16:80 tcp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 13.107.253.64:443 tcp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 164.189.21.2.in-addr.arpa udp
NL 52.142.223.178:80 tcp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 201.201.50.20.in-addr.arpa udp

Files

C:\Windows\SysWOW64\anputen.exe

MD5 4e169fcb14b60351212df9543ab836dc
SHA1 d9119f58cda7417f202939cbf70d240ce45e32a1
SHA256 94eb9f7713ac8b75da73e4d3692314c70463116073fa4a247f9dc8aee1ca6373
SHA512 b27c4067866aaadcba7329417cee3b1762074b765a85b359f43490cf38e61bb315b5eb43e5f9d22e877d08b53bdcc90a8ef2dba9026310d319987bf79b694895

memory/4752-3-0x0000000000400000-0x0000000000403000-memory.dmp

C:\Windows\SysWOW64\umboaroad-ucid.exe

MD5 077aa7af6bff64b5dc1353d0c75d6aa4
SHA1 b5096205a7bac88464803d49841176fd75e94e26
SHA256 e1a370687b3557fd5a6241e159173904890e38469e368692a83311022e428dfb
SHA512 d5f6b47d5649cb6af3d26599c4373d278e722131947f6eef2e271abd4edca0d8e7afe203a9d6b19e137881e9d1a776a65eab90445c2400100e19c22489dd8b01

C:\Windows\SysWOW64\eacmoacop-atum.dll

MD5 f37b21c00fd81bd93c89ce741a88f183
SHA1 b2796500597c68e2f5638e1101b46eaf32676c1c
SHA256 76cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
SHA512 252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4

C:\Windows\SysWOW64\udvugom-exum.exe

MD5 d60b92bedec2685e7bf7d964ddef3ce7
SHA1 8a46656a7311ea08d1b0a82d0290e58b3ee9c9d8
SHA256 bd495a488d1a7804ba7275150db4d9174e032edc2006f901e64254a2a213c996
SHA512 bf7131d1d91c52236f9634c8a0c1badef4bb03508d60fc1d898826156e5f0370ada43d573e7d6a1084b13585e052a09319c3194805b6348b56e342cc746dbc09

memory/3712-38-0x0000000000400000-0x0000000000414000-memory.dmp

memory/5036-45-0x0000000000400000-0x0000000000414000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-01 05:23

Reported

2024-06-01 05:25

Platform

win7-20240221-en

Max time kernel

150s

Max time network

146s

Command Line

winlogon.exe

Signatures

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" C:\Windows\SysWOW64\anputen.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" C:\Windows\SysWOW64\anputen.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" C:\Windows\SysWOW64\anputen.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" C:\Windows\SysWOW64\anputen.exe N/A

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4B584950-5043-4b46-4B58-495050434b46} C:\Windows\SysWOW64\anputen.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4B584950-5043-4b46-4B58-495050434b46}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" C:\Windows\SysWOW64\anputen.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4B584950-5043-4b46-4B58-495050434b46}\IsInstalled = "1" C:\Windows\SysWOW64\anputen.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4B584950-5043-4b46-4B58-495050434b46}\StubPath = "C:\\Windows\\system32\\umboaroad-ucid.exe" C:\Windows\SysWOW64\anputen.exe N/A

Sets file execution options in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" C:\Windows\SysWOW64\anputen.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\udvugom-exum.exe" C:\Windows\SysWOW64\anputen.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe C:\Windows\SysWOW64\anputen.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" C:\Windows\SysWOW64\anputen.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" C:\Windows\SysWOW64\anputen.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" C:\Windows\SysWOW64\anputen.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" C:\Windows\SysWOW64\anputen.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} C:\Windows\SysWOW64\anputen.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify C:\Windows\SysWOW64\anputen.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" C:\Windows\SysWOW64\anputen.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\eacmoacop-atum.dll" C:\Windows\SysWOW64\anputen.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" C:\Windows\SysWOW64\anputen.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\umboaroad-ucid.exe C:\Windows\SysWOW64\anputen.exe N/A
File created C:\Windows\SysWOW64\eacmoacop-atum.dll C:\Windows\SysWOW64\anputen.exe N/A
File opened for modification C:\Windows\SysWOW64\anputen.exe C:\Windows\SysWOW64\anputen.exe N/A
File opened for modification C:\Windows\SysWOW64\umboaroad-ucid.exe C:\Windows\SysWOW64\anputen.exe N/A
File created C:\Windows\SysWOW64\anputen.exe C:\Users\Admin\AppData\Local\Temp\8f15d7c2b1018580fbaa2ab0c8709b40_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\udvugom-exum.exe C:\Windows\SysWOW64\anputen.exe N/A
File created C:\Windows\SysWOW64\udvugom-exum.exe C:\Windows\SysWOW64\anputen.exe N/A
File opened for modification C:\Windows\SysWOW64\eacmoacop-atum.dll C:\Windows\SysWOW64\anputen.exe N/A
File opened for modification C:\Windows\SysWOW64\anputen.exe C:\Users\Admin\AppData\Local\Temp\8f15d7c2b1018580fbaa2ab0c8709b40_NeikiAnalytics.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A
N/A N/A C:\Windows\SysWOW64\anputen.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\anputen.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2460 wrote to memory of 1624 N/A C:\Users\Admin\AppData\Local\Temp\8f15d7c2b1018580fbaa2ab0c8709b40_NeikiAnalytics.exe C:\Windows\SysWOW64\anputen.exe
PID 2460 wrote to memory of 1624 N/A C:\Users\Admin\AppData\Local\Temp\8f15d7c2b1018580fbaa2ab0c8709b40_NeikiAnalytics.exe C:\Windows\SysWOW64\anputen.exe
PID 2460 wrote to memory of 1624 N/A C:\Users\Admin\AppData\Local\Temp\8f15d7c2b1018580fbaa2ab0c8709b40_NeikiAnalytics.exe C:\Windows\SysWOW64\anputen.exe
PID 2460 wrote to memory of 1624 N/A C:\Users\Admin\AppData\Local\Temp\8f15d7c2b1018580fbaa2ab0c8709b40_NeikiAnalytics.exe C:\Windows\SysWOW64\anputen.exe
PID 1624 wrote to memory of 424 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\system32\winlogon.exe
PID 1624 wrote to memory of 1204 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 1624 wrote to memory of 1204 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 1624 wrote to memory of 2884 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\SysWOW64\anputen.exe
PID 1624 wrote to memory of 2884 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\SysWOW64\anputen.exe
PID 1624 wrote to memory of 2884 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\SysWOW64\anputen.exe
PID 1624 wrote to memory of 2884 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\SysWOW64\anputen.exe
PID 1624 wrote to memory of 1204 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 1624 wrote to memory of 1204 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 1624 wrote to memory of 1204 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 1624 wrote to memory of 1204 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 1624 wrote to memory of 1204 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 1624 wrote to memory of 1204 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 1624 wrote to memory of 1204 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 1624 wrote to memory of 1204 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 1624 wrote to memory of 1204 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 1624 wrote to memory of 1204 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 1624 wrote to memory of 1204 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 1624 wrote to memory of 1204 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 1624 wrote to memory of 1204 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 1624 wrote to memory of 1204 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 1624 wrote to memory of 1204 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 1624 wrote to memory of 1204 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 1624 wrote to memory of 1204 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 1624 wrote to memory of 1204 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 1624 wrote to memory of 1204 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 1624 wrote to memory of 1204 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 1624 wrote to memory of 1204 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 1624 wrote to memory of 1204 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 1624 wrote to memory of 1204 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 1624 wrote to memory of 1204 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 1624 wrote to memory of 1204 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 1624 wrote to memory of 1204 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 1624 wrote to memory of 1204 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 1624 wrote to memory of 1204 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 1624 wrote to memory of 1204 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 1624 wrote to memory of 1204 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 1624 wrote to memory of 1204 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 1624 wrote to memory of 1204 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 1624 wrote to memory of 1204 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 1624 wrote to memory of 1204 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 1624 wrote to memory of 1204 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 1624 wrote to memory of 1204 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 1624 wrote to memory of 1204 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 1624 wrote to memory of 1204 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 1624 wrote to memory of 1204 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 1624 wrote to memory of 1204 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 1624 wrote to memory of 1204 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 1624 wrote to memory of 1204 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 1624 wrote to memory of 1204 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 1624 wrote to memory of 1204 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 1624 wrote to memory of 1204 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 1624 wrote to memory of 1204 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 1624 wrote to memory of 1204 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 1624 wrote to memory of 1204 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 1624 wrote to memory of 1204 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 1624 wrote to memory of 1204 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 1624 wrote to memory of 1204 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 1624 wrote to memory of 1204 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE
PID 1624 wrote to memory of 1204 N/A C:\Windows\SysWOW64\anputen.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\system32\winlogon.exe

winlogon.exe

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\8f15d7c2b1018580fbaa2ab0c8709b40_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\8f15d7c2b1018580fbaa2ab0c8709b40_NeikiAnalytics.exe"

C:\Windows\SysWOW64\anputen.exe

"C:\Windows\SysWOW64\anputen.exe"

C:\Windows\SysWOW64\anputen.exe

--k33p

Network

Country Destination Domain Proto
US 8.8.8.8:53 uwufivoccm.ph udp
US 45.79.222.138:80 uwufivoccm.ph tcp
US 8.8.8.8:53 utbidet-ugeas.biz udp
N/A 127.0.0.1:80 tcp
US 8.8.8.8:53 utbidet-ugeas.biz udp
N/A 127.0.0.1:80 tcp
US 44.208.124.139:80 utbidet-ugeas.biz tcp

Files

\Windows\SysWOW64\anputen.exe

MD5 4e169fcb14b60351212df9543ab836dc
SHA1 d9119f58cda7417f202939cbf70d240ce45e32a1
SHA256 94eb9f7713ac8b75da73e4d3692314c70463116073fa4a247f9dc8aee1ca6373
SHA512 b27c4067866aaadcba7329417cee3b1762074b765a85b359f43490cf38e61bb315b5eb43e5f9d22e877d08b53bdcc90a8ef2dba9026310d319987bf79b694895

memory/2460-7-0x0000000000400000-0x0000000000403000-memory.dmp

C:\Windows\SysWOW64\umboaroad-ucid.exe

MD5 0b6d8a913f84108e1ff8cfd8519c9420
SHA1 deff9a8f20f6aaa9b54d7ac190c26528df45ba54
SHA256 30657c4e343740837854dc9037ef3ad64aff0e736a1c45ba249aba53886d91ac
SHA512 4789ed816ef2b081afb31cee2b3dcbe86ba6742223a45b368111b33d999cb2e6dac38832f1ff3287653099f50a36af78e434b150f730b6c44e30c28f4c0d5bf0

C:\Windows\SysWOW64\eacmoacop-atum.dll

MD5 f37b21c00fd81bd93c89ce741a88f183
SHA1 b2796500597c68e2f5638e1101b46eaf32676c1c
SHA256 76cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
SHA512 252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4

C:\Windows\SysWOW64\udvugom-exum.exe

MD5 ea6d84ba6eae349ebc41df04f02fe2c5
SHA1 2f24a394fa2b6a4eb9f779d6c786f91461b22e6e
SHA256 12a9be01c2877097b0a59af4c16bf7460742c9e8ec6ca0e63ce27077e8bff4d7
SHA512 3c92aa54ecc0be55b09864e2d001ef5d83e8f6a9f2e7ef3420dcea70d60bb83272bd025257a8e6f7a0975d3eb23358c2bc76358297bdd445e52bd07577c3f665

memory/1624-50-0x0000000000400000-0x0000000000414000-memory.dmp

memory/2884-51-0x0000000000400000-0x0000000000414000-memory.dmp