Malware Analysis Report

2025-01-06 09:05

Sample ID 240601-ffslpsba77
Target 8e17babe7a5c317e6d08d7caf1400820_NeikiAnalytics.exe
SHA256 a601df1c099e2a4abb75d0b0d56042e05e52780b9bb3e77b26f5a85d6992ceba
Tags
evasion persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a601df1c099e2a4abb75d0b0d56042e05e52780b9bb3e77b26f5a85d6992ceba

Threat Level: Known bad

The file 8e17babe7a5c317e6d08d7caf1400820_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

evasion persistence trojan

Windows security bypass

Modifies Installed Components in the registry

Sets file execution options in registry

Loads dropped DLL

Windows security modification

Executes dropped EXE

Modifies WinLogon

Drops file in System32 directory

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-01 04:49

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-01 04:49

Reported

2024-06-01 04:51

Platform

win7-20240221-en

Max time kernel

149s

Max time network

123s

Command Line

winlogon.exe

Signatures

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" C:\Windows\SysWOW64\ognoteac.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" C:\Windows\SysWOW64\ognoteac.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" C:\Windows\SysWOW64\ognoteac.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" C:\Windows\SysWOW64\ognoteac.exe N/A

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{51475451-5a54-5245-5147-54515A545245} C:\Windows\SysWOW64\ognoteac.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{51475451-5a54-5245-5147-54515A545245}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" C:\Windows\SysWOW64\ognoteac.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{51475451-5a54-5245-5147-54515A545245}\IsInstalled = "1" C:\Windows\SysWOW64\ognoteac.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{51475451-5a54-5245-5147-54515A545245}\StubPath = "C:\\Windows\\system32\\ulfinoar-dix.exe" C:\Windows\SysWOW64\ognoteac.exe N/A

Sets file execution options in registry

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe C:\Windows\SysWOW64\ognoteac.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" C:\Windows\SysWOW64\ognoteac.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\ogfuneap-ovoot.exe" C:\Windows\SysWOW64\ognoteac.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" C:\Windows\SysWOW64\ognoteac.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" C:\Windows\SysWOW64\ognoteac.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" C:\Windows\SysWOW64\ognoteac.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" C:\Windows\SysWOW64\ognoteac.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" C:\Windows\SysWOW64\ognoteac.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} C:\Windows\SysWOW64\ognoteac.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify C:\Windows\SysWOW64\ognoteac.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" C:\Windows\SysWOW64\ognoteac.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\arbocim.dll" C:\Windows\SysWOW64\ognoteac.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\ognoteac.exe C:\Windows\SysWOW64\ognoteac.exe N/A
File opened for modification C:\Windows\SysWOW64\ognoteac.exe C:\Users\Admin\AppData\Local\Temp\8e17babe7a5c317e6d08d7caf1400820_NeikiAnalytics.exe N/A
File created C:\Windows\SysWOW64\ognoteac.exe C:\Users\Admin\AppData\Local\Temp\8e17babe7a5c317e6d08d7caf1400820_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\ogfuneap-ovoot.exe C:\Windows\SysWOW64\ognoteac.exe N/A
File created C:\Windows\SysWOW64\ogfuneap-ovoot.exe C:\Windows\SysWOW64\ognoteac.exe N/A
File opened for modification C:\Windows\SysWOW64\ulfinoar-dix.exe C:\Windows\SysWOW64\ognoteac.exe N/A
File created C:\Windows\SysWOW64\ulfinoar-dix.exe C:\Windows\SysWOW64\ognoteac.exe N/A
File created C:\Windows\SysWOW64\arbocim.dll C:\Windows\SysWOW64\ognoteac.exe N/A
File opened for modification C:\Windows\SysWOW64\arbocim.dll C:\Windows\SysWOW64\ognoteac.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8e17babe7a5c317e6d08d7caf1400820_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ognoteac.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2872 wrote to memory of 1908 N/A C:\Users\Admin\AppData\Local\Temp\8e17babe7a5c317e6d08d7caf1400820_NeikiAnalytics.exe C:\Windows\SysWOW64\ognoteac.exe
PID 2872 wrote to memory of 1908 N/A C:\Users\Admin\AppData\Local\Temp\8e17babe7a5c317e6d08d7caf1400820_NeikiAnalytics.exe C:\Windows\SysWOW64\ognoteac.exe
PID 2872 wrote to memory of 1908 N/A C:\Users\Admin\AppData\Local\Temp\8e17babe7a5c317e6d08d7caf1400820_NeikiAnalytics.exe C:\Windows\SysWOW64\ognoteac.exe
PID 2872 wrote to memory of 1908 N/A C:\Users\Admin\AppData\Local\Temp\8e17babe7a5c317e6d08d7caf1400820_NeikiAnalytics.exe C:\Windows\SysWOW64\ognoteac.exe
PID 1908 wrote to memory of 432 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\system32\winlogon.exe
PID 1908 wrote to memory of 1200 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 1908 wrote to memory of 1200 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 1908 wrote to memory of 2144 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\SysWOW64\ognoteac.exe
PID 1908 wrote to memory of 2144 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\SysWOW64\ognoteac.exe
PID 1908 wrote to memory of 2144 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\SysWOW64\ognoteac.exe
PID 1908 wrote to memory of 2144 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\SysWOW64\ognoteac.exe
PID 1908 wrote to memory of 1200 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 1908 wrote to memory of 1200 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 1908 wrote to memory of 1200 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 1908 wrote to memory of 1200 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 1908 wrote to memory of 1200 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 1908 wrote to memory of 1200 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 1908 wrote to memory of 1200 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 1908 wrote to memory of 1200 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 1908 wrote to memory of 1200 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 1908 wrote to memory of 1200 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 1908 wrote to memory of 1200 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 1908 wrote to memory of 1200 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 1908 wrote to memory of 1200 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 1908 wrote to memory of 1200 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 1908 wrote to memory of 1200 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 1908 wrote to memory of 1200 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 1908 wrote to memory of 1200 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 1908 wrote to memory of 1200 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 1908 wrote to memory of 1200 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 1908 wrote to memory of 1200 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 1908 wrote to memory of 1200 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 1908 wrote to memory of 1200 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 1908 wrote to memory of 1200 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 1908 wrote to memory of 1200 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 1908 wrote to memory of 1200 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 1908 wrote to memory of 1200 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 1908 wrote to memory of 1200 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 1908 wrote to memory of 1200 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 1908 wrote to memory of 1200 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 1908 wrote to memory of 1200 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 1908 wrote to memory of 1200 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 1908 wrote to memory of 1200 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 1908 wrote to memory of 1200 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 1908 wrote to memory of 1200 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 1908 wrote to memory of 1200 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 1908 wrote to memory of 1200 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 1908 wrote to memory of 1200 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 1908 wrote to memory of 1200 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 1908 wrote to memory of 1200 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 1908 wrote to memory of 1200 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 1908 wrote to memory of 1200 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 1908 wrote to memory of 1200 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 1908 wrote to memory of 1200 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 1908 wrote to memory of 1200 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 1908 wrote to memory of 1200 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 1908 wrote to memory of 1200 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 1908 wrote to memory of 1200 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 1908 wrote to memory of 1200 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 1908 wrote to memory of 1200 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 1908 wrote to memory of 1200 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 1908 wrote to memory of 1200 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 1908 wrote to memory of 1200 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 1908 wrote to memory of 1200 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\system32\winlogon.exe

winlogon.exe

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\8e17babe7a5c317e6d08d7caf1400820_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\8e17babe7a5c317e6d08d7caf1400820_NeikiAnalytics.exe"

C:\Windows\SysWOW64\ognoteac.exe

"C:\Windows\system32\ognoteac.exe"

C:\Windows\SysWOW64\ognoteac.exe

--k33p

Network

Country Destination Domain Proto
US 8.8.8.8:53 jcfqz.cm udp
US 8.8.8.8:53 jcfqz.cm udp

Files

\Windows\SysWOW64\ognoteac.exe

MD5 8e17babe7a5c317e6d08d7caf1400820
SHA1 934a4d41000996fb1c35b8ab41eda6ba5e8c62be
SHA256 a601df1c099e2a4abb75d0b0d56042e05e52780b9bb3e77b26f5a85d6992ceba
SHA512 64be5c1fced2840c5dd895a78f739033b402c4717ad482b81d85621a8d0cbd6b36ae9beed10d3b65b166b088b7cfe5c6a892881f9427e7bdd1dd76d4623ef537

memory/2872-9-0x0000000000400000-0x0000000000414000-memory.dmp

C:\Windows\SysWOW64\arbocim.dll

MD5 f37b21c00fd81bd93c89ce741a88f183
SHA1 b2796500597c68e2f5638e1101b46eaf32676c1c
SHA256 76cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
SHA512 252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4

C:\Windows\SysWOW64\ogfuneap-ovoot.exe

MD5 6bc7c3e9485e2ed37b89867cd940f5b1
SHA1 4c826b0e485f431ad15d8788d588077e34ec384e
SHA256 0f0daba505dd9993b3d1525a0fb34d44b8712b40ee63e854c7b58057259dded1
SHA512 15c365cf87a9720fe0d9fcc27bd90d1fc0b8c9bbc21ceb0d8d492fb5ac992c8c7b032fed0baee2a50a86a0333e68b2070617f7284c06b12558ba1ca19c551231

C:\Windows\SysWOW64\ulfinoar-dix.exe

MD5 27a642765cf0a23e5a08fe5a06d233b4
SHA1 46eae0d474608b6b9c207ac631de7c63cff6db6d
SHA256 dfd25495cbb163ef85f2e61e4ccae99f7c7ecce2d28e62d787bb16cdbd40e015
SHA512 a17d42cddfc2a1054752a2faf163a74b70ecdffe925b2f7890dccc00d4222da62c0a424524abc5d5d2700fbff8059132a3f891b71f6e0f7149032b4f518a7ceb

memory/1908-55-0x0000000000400000-0x0000000000414000-memory.dmp

memory/2144-56-0x0000000000400000-0x0000000000414000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-01 04:49

Reported

2024-06-01 04:51

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

135s

Command Line

winlogon.exe

Signatures

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" C:\Windows\SysWOW64\ognoteac.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" C:\Windows\SysWOW64\ognoteac.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" C:\Windows\SysWOW64\ognoteac.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" C:\Windows\SysWOW64\ognoteac.exe N/A

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4256524B-4950-5453-4256-524B49505453}\StubPath = "C:\\Windows\\system32\\ulfinoar-dix.exe" C:\Windows\SysWOW64\ognoteac.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4256524B-4950-5453-4256-524B49505453} C:\Windows\SysWOW64\ognoteac.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4256524B-4950-5453-4256-524B49505453}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" C:\Windows\SysWOW64\ognoteac.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4256524B-4950-5453-4256-524B49505453}\IsInstalled = "1" C:\Windows\SysWOW64\ognoteac.exe N/A

Sets file execution options in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\ogfuneap-ovoot.exe" C:\Windows\SysWOW64\ognoteac.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe C:\Windows\SysWOW64\ognoteac.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" C:\Windows\SysWOW64\ognoteac.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" C:\Windows\SysWOW64\ognoteac.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" C:\Windows\SysWOW64\ognoteac.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" C:\Windows\SysWOW64\ognoteac.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" C:\Windows\SysWOW64\ognoteac.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} C:\Windows\SysWOW64\ognoteac.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify C:\Windows\SysWOW64\ognoteac.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" C:\Windows\SysWOW64\ognoteac.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\arbocim.dll" C:\Windows\SysWOW64\ognoteac.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" C:\Windows\SysWOW64\ognoteac.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\ogfuneap-ovoot.exe C:\Windows\SysWOW64\ognoteac.exe N/A
File opened for modification C:\Windows\SysWOW64\ulfinoar-dix.exe C:\Windows\SysWOW64\ognoteac.exe N/A
File opened for modification C:\Windows\SysWOW64\arbocim.dll C:\Windows\SysWOW64\ognoteac.exe N/A
File opened for modification C:\Windows\SysWOW64\ognoteac.exe C:\Windows\SysWOW64\ognoteac.exe N/A
File opened for modification C:\Windows\SysWOW64\ognoteac.exe C:\Users\Admin\AppData\Local\Temp\8e17babe7a5c317e6d08d7caf1400820_NeikiAnalytics.exe N/A
File created C:\Windows\SysWOW64\ognoteac.exe C:\Users\Admin\AppData\Local\Temp\8e17babe7a5c317e6d08d7caf1400820_NeikiAnalytics.exe N/A
File created C:\Windows\SysWOW64\ogfuneap-ovoot.exe C:\Windows\SysWOW64\ognoteac.exe N/A
File created C:\Windows\SysWOW64\ulfinoar-dix.exe C:\Windows\SysWOW64\ognoteac.exe N/A
File created C:\Windows\SysWOW64\arbocim.dll C:\Windows\SysWOW64\ognoteac.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A
N/A N/A C:\Windows\SysWOW64\ognoteac.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8e17babe7a5c317e6d08d7caf1400820_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ognoteac.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4936 wrote to memory of 940 N/A C:\Users\Admin\AppData\Local\Temp\8e17babe7a5c317e6d08d7caf1400820_NeikiAnalytics.exe C:\Windows\SysWOW64\ognoteac.exe
PID 4936 wrote to memory of 940 N/A C:\Users\Admin\AppData\Local\Temp\8e17babe7a5c317e6d08d7caf1400820_NeikiAnalytics.exe C:\Windows\SysWOW64\ognoteac.exe
PID 4936 wrote to memory of 940 N/A C:\Users\Admin\AppData\Local\Temp\8e17babe7a5c317e6d08d7caf1400820_NeikiAnalytics.exe C:\Windows\SysWOW64\ognoteac.exe
PID 940 wrote to memory of 616 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\system32\winlogon.exe
PID 940 wrote to memory of 3580 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 940 wrote to memory of 3580 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 940 wrote to memory of 1704 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\SysWOW64\ognoteac.exe
PID 940 wrote to memory of 1704 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\SysWOW64\ognoteac.exe
PID 940 wrote to memory of 1704 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\SysWOW64\ognoteac.exe
PID 940 wrote to memory of 3580 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 940 wrote to memory of 3580 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 940 wrote to memory of 3580 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 940 wrote to memory of 3580 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 940 wrote to memory of 3580 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 940 wrote to memory of 3580 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 940 wrote to memory of 3580 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 940 wrote to memory of 3580 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 940 wrote to memory of 3580 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 940 wrote to memory of 3580 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 940 wrote to memory of 3580 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 940 wrote to memory of 3580 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 940 wrote to memory of 3580 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 940 wrote to memory of 3580 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 940 wrote to memory of 3580 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 940 wrote to memory of 3580 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 940 wrote to memory of 3580 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 940 wrote to memory of 3580 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 940 wrote to memory of 3580 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 940 wrote to memory of 3580 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 940 wrote to memory of 3580 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 940 wrote to memory of 3580 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 940 wrote to memory of 3580 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 940 wrote to memory of 3580 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 940 wrote to memory of 3580 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 940 wrote to memory of 3580 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 940 wrote to memory of 3580 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 940 wrote to memory of 3580 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 940 wrote to memory of 3580 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 940 wrote to memory of 3580 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 940 wrote to memory of 3580 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 940 wrote to memory of 3580 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 940 wrote to memory of 3580 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 940 wrote to memory of 3580 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 940 wrote to memory of 3580 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 940 wrote to memory of 3580 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 940 wrote to memory of 3580 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 940 wrote to memory of 3580 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 940 wrote to memory of 3580 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 940 wrote to memory of 3580 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 940 wrote to memory of 3580 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 940 wrote to memory of 3580 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 940 wrote to memory of 3580 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 940 wrote to memory of 3580 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 940 wrote to memory of 3580 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 940 wrote to memory of 3580 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 940 wrote to memory of 3580 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 940 wrote to memory of 3580 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 940 wrote to memory of 3580 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 940 wrote to memory of 3580 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 940 wrote to memory of 3580 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 940 wrote to memory of 3580 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 940 wrote to memory of 3580 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 940 wrote to memory of 3580 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE
PID 940 wrote to memory of 3580 N/A C:\Windows\SysWOW64\ognoteac.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\system32\winlogon.exe

winlogon.exe

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\8e17babe7a5c317e6d08d7caf1400820_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\8e17babe7a5c317e6d08d7caf1400820_NeikiAnalytics.exe"

C:\Windows\SysWOW64\ognoteac.exe

"C:\Windows\system32\ognoteac.exe"

C:\Windows\SysWOW64\ognoteac.exe

--k33p

Network

Country Destination Domain Proto
US 8.8.8.8:53 ymyhwow.vg udp
DE 88.198.29.97:80 ymyhwow.vg tcp
US 8.8.8.8:53 utbidet-ugeas.biz udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 97.29.198.88.in-addr.arpa udp
N/A 127.0.0.1:80 tcp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 utbidet-ugeas.biz udp
US 34.193.97.35:80 utbidet-ugeas.biz tcp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 35.97.193.34.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 80.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp

Files

memory/4936-6-0x0000000000400000-0x0000000000414000-memory.dmp

C:\Windows\SysWOW64\ognoteac.exe

MD5 8e17babe7a5c317e6d08d7caf1400820
SHA1 934a4d41000996fb1c35b8ab41eda6ba5e8c62be
SHA256 a601df1c099e2a4abb75d0b0d56042e05e52780b9bb3e77b26f5a85d6992ceba
SHA512 64be5c1fced2840c5dd895a78f739033b402c4717ad482b81d85621a8d0cbd6b36ae9beed10d3b65b166b088b7cfe5c6a892881f9427e7bdd1dd76d4623ef537

C:\Windows\SysWOW64\ulfinoar-dix.exe

MD5 bdaac0b3a778c7e4a879ed658b49c76f
SHA1 f96ea950ff3a846319f9530dba038723011cd1f0
SHA256 031c8cb4c897863c19b6fbfe779c0b20b50af572cb861b686a841219b7ad8c88
SHA512 5ae38ee20c20920ae1a4bc139c61944b62813d6720b71d7c605fcacf925b2b1bb7df54548f09763103e1ad82f58128cb1cd9df8ac815bfebffdf298f1cae4256

C:\Windows\SysWOW64\arbocim.dll

MD5 f37b21c00fd81bd93c89ce741a88f183
SHA1 b2796500597c68e2f5638e1101b46eaf32676c1c
SHA256 76cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
SHA512 252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4

C:\Windows\SysWOW64\ogfuneap-ovoot.exe

MD5 1c7374324c2c6f29e445371de77a589f
SHA1 0d1fe487b80f2e10e70c3b682d106e3fb5802eab
SHA256 4a4ca0fd57f52151a3e53606b4628b57840bad60c5efa2d11c6912fc43458d38
SHA512 8ec0fc8d3f4ee9211e5f2ffc4db4bfcf77cc9e3f37ec8549fe67f0f78aa450631409dc6cb36fb5e5738516545d3bed2a95c93d78d4b5d37645211d1df15b1b35

memory/940-49-0x0000000000400000-0x0000000000414000-memory.dmp

memory/1704-50-0x0000000000400000-0x0000000000414000-memory.dmp