cobaltstrike | ca68ad0c74673b8ff792cae8538ec07d5361a7b7b6081b0f0f20a10626ff0934

Analysis

max time kernel
145s
max time network
149s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
02/06/2024, 23:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe
Size 5.9MB
Sample240602-3tkjksbe9x
SHA256 ca68ad0c74673b8ff792cae8538ec07d5361a7b7b6081b0f0f20a10626ff0934
MD5 856df76a2790e7b4926c69dc9a1afe60
SHA1 b84335517e0d452467063a02ed38b327f5bac9ba
SHA512 6fefd1753a2490b6406e617ea01e1d58d44b006d0b05c65ff2b400ae138ef94d1022e886a16f79297ff39af4f8636863b1f23d0b95938512bec85e7d6deccbed
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUW:Q+856utgpPF8u/7W
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral1/files/0x0007000000012120-3.dat	cobalt_reflective_dll
behavioral1/files/0x0030000000016126-6.dat	cobalt_reflective_dll
behavioral1/files/0x00080000000167e8-20.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000016a3a-23.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000016c57-37.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000016c3a-34.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000016c5b-45.dat	cobalt_reflective_dll
behavioral1/files/0x0030000000016228-52.dat	cobalt_reflective_dll
behavioral1/files/0x0009000000016ccd-59.dat	cobalt_reflective_dll
behavioral1/files/0x0008000000016cf2-69.dat	cobalt_reflective_dll
behavioral1/files/0x0006000000016fa9-84.dat	cobalt_reflective_dll
behavioral1/files/0x0006000000016d7d-77.dat	cobalt_reflective_dll
behavioral1/files/0x00060000000171ad-99.dat	cobalt_reflective_dll
behavioral1/files/0x000600000001708c-92.dat	cobalt_reflective_dll
behavioral1/files/0x00060000000173e2-115.dat	cobalt_reflective_dll
behavioral1/files/0x00060000000174ef-130.dat	cobalt_reflective_dll
behavioral1/files/0x0006000000017577-135.dat	cobalt_reflective_dll
behavioral1/files/0x0006000000017436-125.dat	cobalt_reflective_dll
behavioral1/files/0x00060000000173e5-120.dat	cobalt_reflective_dll
behavioral1/files/0x000600000001738e-106.dat	cobalt_reflective_dll
behavioral1/files/0x000600000001738f-110.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral1/memory/1964-2-0x000000013F200000-0x000000013F554000-memory.dmp	xmrig
behavioral1/files/0x0007000000012120-3.dat	xmrig
behavioral1/files/0x0030000000016126-6.dat	xmrig
behavioral1/files/0x00080000000167e8-20.dat	xmrig
behavioral1/memory/2580-22-0x000000013FDB0000-0x0000000140104000-memory.dmp	xmrig
behavioral1/files/0x0007000000016a3a-23.dat	xmrig
behavioral1/memory/2980-21-0x000000013FB70000-0x000000013FEC4000-memory.dmp	xmrig
behavioral1/memory/2972-15-0x000000013F890000-0x000000013FBE4000-memory.dmp	xmrig
behavioral1/memory/2600-30-0x000000013F920000-0x000000013FC74000-memory.dmp	xmrig
behavioral1/files/0x0007000000016c57-37.dat	xmrig
behavioral1/memory/2568-36-0x000000013F280000-0x000000013F5D4000-memory.dmp	xmrig
behavioral1/memory/2636-41-0x000000013F9D0000-0x000000013FD24000-memory.dmp	xmrig
behavioral1/files/0x0007000000016c3a-34.dat	xmrig
behavioral1/memory/1964-39-0x000000013F9D0000-0x000000013FD24000-memory.dmp	xmrig
behavioral1/files/0x0007000000016c5b-45.dat	xmrig
behavioral1/memory/1964-48-0x000000013F200000-0x000000013F554000-memory.dmp	xmrig
behavioral1/memory/2672-51-0x000000013FDE0000-0x0000000140134000-memory.dmp	xmrig
behavioral1/files/0x0030000000016228-52.dat	xmrig
behavioral1/memory/1964-55-0x0000000002330000-0x0000000002684000-memory.dmp	xmrig
behavioral1/memory/2512-58-0x000000013F4F0000-0x000000013F844000-memory.dmp	xmrig
behavioral1/memory/2580-57-0x000000013FDB0000-0x0000000140104000-memory.dmp	xmrig
behavioral1/files/0x0009000000016ccd-59.dat	xmrig
behavioral1/memory/2492-65-0x000000013FD50000-0x00000001400A4000-memory.dmp	xmrig
behavioral1/files/0x0008000000016cf2-69.dat	xmrig
behavioral1/memory/2568-70-0x000000013F280000-0x000000013F5D4000-memory.dmp	xmrig
behavioral1/memory/108-72-0x000000013F400000-0x000000013F754000-memory.dmp	xmrig
behavioral1/files/0x0006000000016fa9-84.dat	xmrig
behavioral1/memory/2548-80-0x000000013FE60000-0x00000001401B4000-memory.dmp	xmrig
behavioral1/memory/2772-89-0x000000013FD70000-0x00000001400C4000-memory.dmp	xmrig
behavioral1/memory/1964-87-0x000000013FD70000-0x00000001400C4000-memory.dmp	xmrig
behavioral1/memory/2636-85-0x000000013F9D0000-0x000000013FD24000-memory.dmp	xmrig
behavioral1/files/0x0006000000016d7d-77.dat	xmrig
behavioral1/files/0x00060000000171ad-99.dat	xmrig
behavioral1/memory/2340-95-0x000000013F650000-0x000000013F9A4000-memory.dmp	xmrig
behavioral1/memory/1896-102-0x000000013FBF0000-0x000000013FF44000-memory.dmp	xmrig
behavioral1/files/0x000600000001708c-92.dat	xmrig
behavioral1/files/0x00060000000173e2-115.dat	xmrig
behavioral1/files/0x00060000000174ef-130.dat	xmrig
behavioral1/files/0x0006000000017577-135.dat	xmrig
behavioral1/files/0x0006000000017436-125.dat	xmrig
behavioral1/files/0x00060000000173e5-120.dat	xmrig
behavioral1/files/0x000600000001738e-106.dat	xmrig
behavioral1/files/0x000600000001738f-110.dat	xmrig
behavioral1/memory/1964-137-0x0000000002330000-0x0000000002684000-memory.dmp	xmrig
behavioral1/memory/2512-138-0x000000013F4F0000-0x000000013F844000-memory.dmp	xmrig
behavioral1/memory/2492-140-0x000000013FD50000-0x00000001400A4000-memory.dmp	xmrig
behavioral1/memory/108-142-0x000000013F400000-0x000000013F754000-memory.dmp	xmrig
behavioral1/memory/2548-144-0x000000013FE60000-0x00000001401B4000-memory.dmp	xmrig
behavioral1/memory/2772-146-0x000000013FD70000-0x00000001400C4000-memory.dmp	xmrig
behavioral1/memory/2340-147-0x000000013F650000-0x000000013F9A4000-memory.dmp	xmrig
behavioral1/memory/2972-148-0x000000013F890000-0x000000013FBE4000-memory.dmp	xmrig
behavioral1/memory/2980-149-0x000000013FB70000-0x000000013FEC4000-memory.dmp	xmrig
behavioral1/memory/2580-150-0x000000013FDB0000-0x0000000140104000-memory.dmp	xmrig
behavioral1/memory/2600-151-0x000000013F920000-0x000000013FC74000-memory.dmp	xmrig
behavioral1/memory/2568-152-0x000000013F280000-0x000000013F5D4000-memory.dmp	xmrig
behavioral1/memory/2636-153-0x000000013F9D0000-0x000000013FD24000-memory.dmp	xmrig
behavioral1/memory/2672-154-0x000000013FDE0000-0x0000000140134000-memory.dmp	xmrig
behavioral1/memory/2512-155-0x000000013F4F0000-0x000000013F844000-memory.dmp	xmrig
behavioral1/memory/2492-156-0x000000013FD50000-0x00000001400A4000-memory.dmp	xmrig
behavioral1/memory/108-157-0x000000013F400000-0x000000013F754000-memory.dmp	xmrig
behavioral1/memory/2548-158-0x000000013FE60000-0x00000001401B4000-memory.dmp	xmrig
behavioral1/memory/2772-159-0x000000013FD70000-0x00000001400C4000-memory.dmp	xmrig
behavioral1/memory/2340-160-0x000000013F650000-0x000000013F9A4000-memory.dmp	xmrig
behavioral1/memory/1896-161-0x000000013FBF0000-0x000000013FF44000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
2972	evbkVVI.exe
2980	dyyenDl.exe
2580	nUDVoOT.exe
2600	rIdNHKH.exe
2568	QyEthMp.exe
2636	mwtlvKu.exe
2672	upjSvXB.exe
2512	OFwCKqe.exe
2492	NbBwEcV.exe
108	RdldtVk.exe
2548	CLeKQod.exe
2772	MIihCBH.exe
2340	BgjYJjg.exe
1896	aHdTxIp.exe
2192	nQhSGRQ.exe
2172	oBATpen.exe
1552	iPpYeEI.exe
112	SFhOyGb.exe
1432	rAWiwuG.exe
1008	JrcJgPB.exe
1308	PSuaCDO.exe

Loads dropped DLL 21 IoCs

pid	Process
1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe
1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe
1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe
1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe
1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe
1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe
1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe
1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe
1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe
1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe
1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe
1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe
1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe
1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe
1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe
1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe
1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe
1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe
1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe
1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe
1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe

UPX packed file 60 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1964-2-0x000000013F200000-0x000000013F554000-memory.dmp	upx
behavioral1/files/0x0007000000012120-3.dat	upx
behavioral1/files/0x0030000000016126-6.dat	upx
behavioral1/files/0x00080000000167e8-20.dat	upx
behavioral1/memory/2580-22-0x000000013FDB0000-0x0000000140104000-memory.dmp	upx
behavioral1/files/0x0007000000016a3a-23.dat	upx
behavioral1/memory/2980-21-0x000000013FB70000-0x000000013FEC4000-memory.dmp	upx
behavioral1/memory/2972-15-0x000000013F890000-0x000000013FBE4000-memory.dmp	upx
behavioral1/memory/2600-30-0x000000013F920000-0x000000013FC74000-memory.dmp	upx
behavioral1/files/0x0007000000016c57-37.dat	upx
behavioral1/memory/2568-36-0x000000013F280000-0x000000013F5D4000-memory.dmp	upx
behavioral1/memory/2636-41-0x000000013F9D0000-0x000000013FD24000-memory.dmp	upx
behavioral1/files/0x0007000000016c3a-34.dat	upx
behavioral1/files/0x0007000000016c5b-45.dat	upx
behavioral1/memory/1964-48-0x000000013F200000-0x000000013F554000-memory.dmp	upx
behavioral1/memory/2672-51-0x000000013FDE0000-0x0000000140134000-memory.dmp	upx
behavioral1/files/0x0030000000016228-52.dat	upx
behavioral1/memory/2512-58-0x000000013F4F0000-0x000000013F844000-memory.dmp	upx
behavioral1/memory/2580-57-0x000000013FDB0000-0x0000000140104000-memory.dmp	upx
behavioral1/files/0x0009000000016ccd-59.dat	upx
behavioral1/memory/2492-65-0x000000013FD50000-0x00000001400A4000-memory.dmp	upx
behavioral1/files/0x0008000000016cf2-69.dat	upx
behavioral1/memory/2568-70-0x000000013F280000-0x000000013F5D4000-memory.dmp	upx
behavioral1/memory/108-72-0x000000013F400000-0x000000013F754000-memory.dmp	upx
behavioral1/files/0x0006000000016fa9-84.dat	upx
behavioral1/memory/2548-80-0x000000013FE60000-0x00000001401B4000-memory.dmp	upx
behavioral1/memory/2772-89-0x000000013FD70000-0x00000001400C4000-memory.dmp	upx
behavioral1/memory/2636-85-0x000000013F9D0000-0x000000013FD24000-memory.dmp	upx
behavioral1/files/0x0006000000016d7d-77.dat	upx
behavioral1/files/0x00060000000171ad-99.dat	upx
behavioral1/memory/2340-95-0x000000013F650000-0x000000013F9A4000-memory.dmp	upx
behavioral1/memory/1896-102-0x000000013FBF0000-0x000000013FF44000-memory.dmp	upx
behavioral1/files/0x000600000001708c-92.dat	upx
behavioral1/files/0x00060000000173e2-115.dat	upx
behavioral1/files/0x00060000000174ef-130.dat	upx
behavioral1/files/0x0006000000017577-135.dat	upx
behavioral1/files/0x0006000000017436-125.dat	upx
behavioral1/files/0x00060000000173e5-120.dat	upx
behavioral1/files/0x000600000001738e-106.dat	upx
behavioral1/files/0x000600000001738f-110.dat	upx
behavioral1/memory/2512-138-0x000000013F4F0000-0x000000013F844000-memory.dmp	upx
behavioral1/memory/2492-140-0x000000013FD50000-0x00000001400A4000-memory.dmp	upx
behavioral1/memory/108-142-0x000000013F400000-0x000000013F754000-memory.dmp	upx
behavioral1/memory/2548-144-0x000000013FE60000-0x00000001401B4000-memory.dmp	upx
behavioral1/memory/2772-146-0x000000013FD70000-0x00000001400C4000-memory.dmp	upx
behavioral1/memory/2340-147-0x000000013F650000-0x000000013F9A4000-memory.dmp	upx
behavioral1/memory/2972-148-0x000000013F890000-0x000000013FBE4000-memory.dmp	upx
behavioral1/memory/2980-149-0x000000013FB70000-0x000000013FEC4000-memory.dmp	upx
behavioral1/memory/2580-150-0x000000013FDB0000-0x0000000140104000-memory.dmp	upx
behavioral1/memory/2600-151-0x000000013F920000-0x000000013FC74000-memory.dmp	upx
behavioral1/memory/2568-152-0x000000013F280000-0x000000013F5D4000-memory.dmp	upx
behavioral1/memory/2636-153-0x000000013F9D0000-0x000000013FD24000-memory.dmp	upx
behavioral1/memory/2672-154-0x000000013FDE0000-0x0000000140134000-memory.dmp	upx
behavioral1/memory/2512-155-0x000000013F4F0000-0x000000013F844000-memory.dmp	upx
behavioral1/memory/2492-156-0x000000013FD50000-0x00000001400A4000-memory.dmp	upx
behavioral1/memory/108-157-0x000000013F400000-0x000000013F754000-memory.dmp	upx
behavioral1/memory/2548-158-0x000000013FE60000-0x00000001401B4000-memory.dmp	upx
behavioral1/memory/2772-159-0x000000013FD70000-0x00000001400C4000-memory.dmp	upx
behavioral1/memory/2340-160-0x000000013F650000-0x000000013F9A4000-memory.dmp	upx
behavioral1/memory/1896-161-0x000000013FBF0000-0x000000013FF44000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\dyyenDl.exe	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe
File created	C:\Windows\System\NbBwEcV.exe	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe
File created	C:\Windows\System\CLeKQod.exe	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe
File created	C:\Windows\System\nQhSGRQ.exe	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe
File created	C:\Windows\System\mwtlvKu.exe	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe
File created	C:\Windows\System\BgjYJjg.exe	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe
File created	C:\Windows\System\JrcJgPB.exe	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe
File created	C:\Windows\System\evbkVVI.exe	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe
File created	C:\Windows\System\QyEthMp.exe	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe
File created	C:\Windows\System\OFwCKqe.exe	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe
File created	C:\Windows\System\RdldtVk.exe	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe
File created	C:\Windows\System\aHdTxIp.exe	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe
File created	C:\Windows\System\oBATpen.exe	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe
File created	C:\Windows\System\iPpYeEI.exe	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe
File created	C:\Windows\System\SFhOyGb.exe	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe
File created	C:\Windows\System\nUDVoOT.exe	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe
File created	C:\Windows\System\rIdNHKH.exe	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe
File created	C:\Windows\System\upjSvXB.exe	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe
File created	C:\Windows\System\MIihCBH.exe	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe
File created	C:\Windows\System\rAWiwuG.exe	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe
File created	C:\Windows\System\PSuaCDO.exe	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2972	1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	29
PID 1964 wrote to memory of 2972	1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	29
PID 1964 wrote to memory of 2972	1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	29
PID 1964 wrote to memory of 2980	1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	30
PID 1964 wrote to memory of 2980	1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	30
PID 1964 wrote to memory of 2980	1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	30
PID 1964 wrote to memory of 2580	1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	31
PID 1964 wrote to memory of 2580	1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	31
PID 1964 wrote to memory of 2580	1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	31
PID 1964 wrote to memory of 2600	1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	32
PID 1964 wrote to memory of 2600	1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	32
PID 1964 wrote to memory of 2600	1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	32
PID 1964 wrote to memory of 2568	1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	33
PID 1964 wrote to memory of 2568	1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	33
PID 1964 wrote to memory of 2568	1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	33
PID 1964 wrote to memory of 2636	1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	34
PID 1964 wrote to memory of 2636	1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	34
PID 1964 wrote to memory of 2636	1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	34
PID 1964 wrote to memory of 2672	1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	35
PID 1964 wrote to memory of 2672	1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	35
PID 1964 wrote to memory of 2672	1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	35
PID 1964 wrote to memory of 2512	1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	36
PID 1964 wrote to memory of 2512	1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	36
PID 1964 wrote to memory of 2512	1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	36
PID 1964 wrote to memory of 2492	1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	37
PID 1964 wrote to memory of 2492	1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	37
PID 1964 wrote to memory of 2492	1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	37
PID 1964 wrote to memory of 108	1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	38
PID 1964 wrote to memory of 108	1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	38
PID 1964 wrote to memory of 108	1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	38
PID 1964 wrote to memory of 2548	1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	39
PID 1964 wrote to memory of 2548	1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	39
PID 1964 wrote to memory of 2548	1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	39
PID 1964 wrote to memory of 2772	1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	40
PID 1964 wrote to memory of 2772	1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	40
PID 1964 wrote to memory of 2772	1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	40
PID 1964 wrote to memory of 2340	1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	41
PID 1964 wrote to memory of 2340	1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	41
PID 1964 wrote to memory of 2340	1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	41
PID 1964 wrote to memory of 1896	1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	42
PID 1964 wrote to memory of 1896	1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	42
PID 1964 wrote to memory of 1896	1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	42
PID 1964 wrote to memory of 2192	1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	43
PID 1964 wrote to memory of 2192	1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	43
PID 1964 wrote to memory of 2192	1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	43
PID 1964 wrote to memory of 2172	1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	44
PID 1964 wrote to memory of 2172	1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	44
PID 1964 wrote to memory of 2172	1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	44
PID 1964 wrote to memory of 1552	1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	45
PID 1964 wrote to memory of 1552	1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	45
PID 1964 wrote to memory of 1552	1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	45
PID 1964 wrote to memory of 112	1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	46
PID 1964 wrote to memory of 112	1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	46
PID 1964 wrote to memory of 112	1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	46
PID 1964 wrote to memory of 1432	1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	47
PID 1964 wrote to memory of 1432	1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	47
PID 1964 wrote to memory of 1432	1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	47
PID 1964 wrote to memory of 1008	1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	48
PID 1964 wrote to memory of 1008	1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	48
PID 1964 wrote to memory of 1008	1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	48
PID 1964 wrote to memory of 1308	1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	49
PID 1964 wrote to memory of 1308	1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	49
PID 1964 wrote to memory of 1308	1964	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	49

C:\Users\Admin\AppData\Local\Temp\856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\System\evbkVVI.exe
  C:\Windows\System\evbkVVI.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\dyyenDl.exe
  C:\Windows\System\dyyenDl.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\nUDVoOT.exe
  C:\Windows\System\nUDVoOT.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\rIdNHKH.exe
  C:\Windows\System\rIdNHKH.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\QyEthMp.exe
  C:\Windows\System\QyEthMp.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\mwtlvKu.exe
  C:\Windows\System\mwtlvKu.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\upjSvXB.exe
  C:\Windows\System\upjSvXB.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\OFwCKqe.exe
  C:\Windows\System\OFwCKqe.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\NbBwEcV.exe
  C:\Windows\System\NbBwEcV.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\RdldtVk.exe
  C:\Windows\System\RdldtVk.exe
  2⤵
  - Executes dropped EXE
  PID:108
- C:\Windows\System\CLeKQod.exe
  C:\Windows\System\CLeKQod.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\MIihCBH.exe
  C:\Windows\System\MIihCBH.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\BgjYJjg.exe
  C:\Windows\System\BgjYJjg.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\aHdTxIp.exe
  C:\Windows\System\aHdTxIp.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\nQhSGRQ.exe
  C:\Windows\System\nQhSGRQ.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\oBATpen.exe
  C:\Windows\System\oBATpen.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\iPpYeEI.exe
  C:\Windows\System\iPpYeEI.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\SFhOyGb.exe
  C:\Windows\System\SFhOyGb.exe
  2⤵
  - Executes dropped EXE
  PID:112
- C:\Windows\System\rAWiwuG.exe
  C:\Windows\System\rAWiwuG.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\JrcJgPB.exe
  C:\Windows\System\JrcJgPB.exe
  2⤵
  - Executes dropped EXE
  PID:1008
- C:\Windows\System\PSuaCDO.exe
  C:\Windows\System\PSuaCDO.exe
  2⤵
  - Executes dropped EXE
  PID:1308

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

BgjYJjg.exe

Path C:\Windows\system\BgjYJjg.exe
Size 5.9MB
SHA256 9b905de7c08384db6ac043dd9c98131aa30efe190528005d0de32fc16705e23b
MD5 038653d68767acfd5318dd209790ea44
SHA1 935436e840b28721cec85a54cde7d5d71f11d090
SHA512 633d6c4c9b509b02f80a92eaf8faf488ad0d71c8e17439fa2e91ff127ea9fd3c0a6b06a1514329a96681e93c042d03dc0bfca077ee3d4321b7d6bf7cc5056f57
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUL:Q+856utgpPF8u/7L
MD5 SHA1 SHA512 SSDEEP

Submit Download

CLeKQod.exe

Path C:\Windows\system\CLeKQod.exe
Size 5.9MB
SHA256 6f01ba76996d671870783e062e08d82cf9c77a8bff2cd35a7b9200713f59de3f
MD5 d7bc8ff9bf6cd14aba381e6782003f1c
SHA1 6fa5217aa08e4f326b5b16e1e7da9dc3eeebc5ca
SHA512 a137210c44afefe27376c7c33178232222b9a946e306abbbdfba94d24a19f737df22ce28a22d583b039331b7616ce08c69fe9dec00742e067a7bd100487fc2cd
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUj:Q+856utgpPF8u/7j
MD5 SHA1 SHA512 SSDEEP

Submit Download

JrcJgPB.exe

Path C:\Windows\system\JrcJgPB.exe
Size 5.9MB
SHA256 69d4a172358f5104b6ad112602a1882f492785c9849bf9aa47df36336c479faa
MD5 96bad9af8ba03754cdf9cd3b0883f548
SHA1 2468dec64587f395186d322e3fc570450cef1bd5
SHA512 a6ef6ffd3e79f831c31b2d2ea7516f69e25b6a5685fd93fceb25e48786eaa9da28e2aff963566875c99cb6071878b309d270a1d8606dc350be1c4778883d673a
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUp:Q+856utgpPF8u/7p
MD5 SHA1 SHA512 SSDEEP

Submit Download

MIihCBH.exe

Path C:\Windows\system\MIihCBH.exe
Size 5.9MB
SHA256 2c82222f9d3c29a5ff14e213193ad7ad11ff207e0eb1d64e8d9b0a40caef9ea7
MD5 75f99319607f2d2c895e12342d14cd53
SHA1 3e0b18754e1614473eb1b506d0729999af860648
SHA512 a18c15fdcb437c1cd5a798a35c0e2f461261704dea4eeaef0675523b9a87862df8c588abdf2788082a61eefaca96b5ba6a7ae4fcab03fb5690dc5224e9b4a139
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUo:Q+856utgpPF8u/7o
MD5 SHA1 SHA512 SSDEEP

Submit Download

PSuaCDO.exe

Path C:\Windows\system\PSuaCDO.exe
Size 5.9MB
SHA256 204c2b6e8a41bfa13590d11cbe8be735781fd1ea01ec25a313c7ad4c76ed948e
MD5 b84bb40e2fde3c3173c4fac64862a082
SHA1 3d62c56e7ef26ab59e5962e461955cd4519999ac
SHA512 d657869338253c47aeb45558b5fcd69aa246dfe39795cd022fc44ef6233c73fb00791117255d861cd8944ae8dac70581be0a8c4c3330f44fa8d9095a2f002235
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUj:Q+856utgpPF8u/7j
MD5 SHA1 SHA512 SSDEEP

Submit Download

QyEthMp.exe

Path C:\Windows\system\QyEthMp.exe
Size 5.9MB
SHA256 805096922f010e49d499cd9c313faedfb7683d66af386eafef5bfbc388eff34d
MD5 34dee0878ec25e390696d09469d7284c
SHA1 7320120b26b4cd9f2dfffa7ef20aca6689ed1f90
SHA512 669ec78795c9a8640b4ad1372ce647e97fbbf8c3b0af7d60abc8d5c1bc2e8ab5fc187021aaf3efdb2945e1ce75b780da30bb4df85fc49ba5de3ed06d8cd2ef7b
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU6:Q+856utgpPF8u/76
MD5 SHA1 SHA512 SSDEEP

Submit Download

RdldtVk.exe

Path C:\Windows\system\RdldtVk.exe
Size 5.9MB
SHA256 6168fc018536e67ff86b27b16edf65bd5bd5d85ba4fabb0367d188bd512d3c3e
MD5 ced0fa773d12733ab742c4bcbe85826c
SHA1 93700d48b60fea4c2dfe36e2be47ff122b36c5c7
SHA512 940c9804f03f0caab0ecfa805c4bb3cc6e227ef40bdaef76b1008eda178ecc81b0b9f7098025b9986549a858615f48f5bd42e20a081deed88fcc7db253f02509
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU+:Q+856utgpPF8u/7+
MD5 SHA1 SHA512 SSDEEP

Submit Download

SFhOyGb.exe

Path C:\Windows\system\SFhOyGb.exe
Size 5.9MB
SHA256 6d4b6d28dc4eb3ad72a5a0c2d2577e7a4a482dc046e38ecc70b341ca163cdb34
MD5 68e0309e9be688025b5bdcfc488ee9ea
SHA1 53ab43db7a0fa9820948c37fc9e39c82cb3eab99
SHA512 0427ae693615e9b37268cb65ba7693a1b08c9032c2754e33307555fef206afe02acef8dcd9008006581c10a77cc9e33821b2cf78e4637f2d635b58d3b2b9c552
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUS:Q+856utgpPF8u/7S
MD5 SHA1 SHA512 SSDEEP

Submit Download

aHdTxIp.exe

Path C:\Windows\system\aHdTxIp.exe
Size 5.9MB
SHA256 7efd42fb363727e0e040a0838d522734f13e91d9ed957d67fc3f3547f2d0d2a7
MD5 8ba542cc976eeb63d610032ff051d246
SHA1 0fa4afbe48f6ad354b00345c00ad4ab420de48a4
SHA512 43e39572deed980f445e462843295df94bb3437c6331f68adcfc711f90ce02e6631b98707e315e41746068bd4e2e2deef7be2ce670d1f455a3d19ce504681f8a
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUG:Q+856utgpPF8u/7G
MD5 SHA1 SHA512 SSDEEP

Submit Download

dyyenDl.exe

Path C:\Windows\system\dyyenDl.exe
Size 5.9MB
SHA256 8c35a019e7dc2ea1fd1238500cfc8a8f9a1edd5734e6565bfab20f1cb5b2f627
MD5 d0d1c0703b94b38bfedbee5fbb106c53
SHA1 0fa0ae65d1d089dbaeeb262bdc02f48730d13cc5
SHA512 f50458b1bf6af6f6353123b96bfe7c08ac32330eb63bad0d980ccd9ced1ce218064f9b93f8687d8c4ac088a4baad4035f21ae8bdcbb93be5462dbba56e3d141b
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU/:Q+856utgpPF8u/7/
MD5 SHA1 SHA512 SSDEEP

Submit Download

iPpYeEI.exe

Path C:\Windows\system\iPpYeEI.exe
Size 5.9MB
SHA256 e3d124058cf28af427bcf89a458d96966741109c30167f82c5bd2e9c11d3f0ec
MD5 cfb12920fd5f2c3a94834e40a620ad75
SHA1 0456b3c404c135d4d7948f6cde68342626842626
SHA512 34ccf6dcddefddd5b105c00731e7afa1a7da5cb884228b9c31627d27358406cc91db1e315c1949170cf5c1f0211f60dec1fc2314caa4359f7bad239e871f18a2
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUf:Q+856utgpPF8u/7f
MD5 SHA1 SHA512 SSDEEP

Submit Download

nQhSGRQ.exe

Path C:\Windows\system\nQhSGRQ.exe
Size 5.9MB
SHA256 92cef55be8ba5976748e880083f11cdc0691b4f19a16f80fc3d95901e14d3e1d
MD5 d3d09d56dfb29a574929d19fe683f252
SHA1 2ffdae2781005dff49260a49c3007970904e9868
SHA512 cf7d33c26e2b269af95885ed62326611a789b379df3db4107106558a3000dd1eb98fd65063d4fa2e72b5ec07e7c67eccfc54d3e8c34e97a0f498c3290cd0ab51
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUU:Q+856utgpPF8u/7U
MD5 SHA1 SHA512 SSDEEP

Submit Download

nUDVoOT.exe

Path C:\Windows\system\nUDVoOT.exe
Size 5.9MB
SHA256 28cea125b694eb342955b70e9191c4fafd369c49eaa308d508dc5600341031e5
MD5 a1936ce44131a3f7d6f205e503193d3e
SHA1 fb82db3dcef69b9bd344d8653f2026e253d4e9dc
SHA512 56798f0c4c247acad9537e80a5e5b0e2dd9bf00e2ebff8ddf5c8f742c31c3a54c402fcd63d7b5e4bb69d23a19917d1e2ac0d9df7de4f02c7cb6af3df7361e09a
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUz:Q+856utgpPF8u/7z
MD5 SHA1 SHA512 SSDEEP

Submit Download

oBATpen.exe

Path C:\Windows\system\oBATpen.exe
Size 5.9MB
SHA256 e7a204776e56dd2719328f408c72dea28aecc4ab11be0ebb28d8c8c3124590e4
MD5 b74d3edfc4e3d4f5af3b12d3c0cf13a6
SHA1 7859d07d9e450ed379ccab3142a7d02dabe4af6f
SHA512 0b699fad46e611b417972c77b65f2753df8097831505cf85fe65b4d11397000d52f302580898f922407e353cfa2eb6edffea9b627a22876980136930c2364b7d
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUH:Q+856utgpPF8u/7H
MD5 SHA1 SHA512 SSDEEP

Submit Download

rAWiwuG.exe

Path C:\Windows\system\rAWiwuG.exe
Size 5.9MB
SHA256 03c3cf4a33d228b11b9082503397900922eccb4a002bf5315d8607eb787318db
MD5 b635a521f15fe85a9b102141c42bc623
SHA1 79a7a4c178d0d9078a9482d85e9a70854159651a
SHA512 7421eddbc3b927705bd23fab10cc5307fde16b3c49579476879b171f36547b45da3fe66877a3599666d439a74d5d41b9e15887906ab4133e651c4b6b4c417525
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUW:Q+856utgpPF8u/7W
MD5 SHA1 SHA512 SSDEEP

Submit Download

NbBwEcV.exe

Path \Windows\system\NbBwEcV.exe
Size 5.9MB
SHA256 c602ae61f8aaa0ebfca6bca03cd901cb0d7697771398c7f6cc495a5f1c96ed6d
MD5 1b4f8147d2f3ea7d3b103ea36008c0ec
SHA1 ee23e4a1a8fda14e20b0a502f69c25f3dad14560
SHA512 c4c9a6f84205952a1256a8d8e196614bcad5f2d99070cdb9c8262d96a8707c205222d656f57223f83b8c007680ca3995e6264189bca6574adb39fa14907e31c1
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUC:Q+856utgpPF8u/7C
MD5 SHA1 SHA512 SSDEEP

Submit Download

OFwCKqe.exe

Path \Windows\system\OFwCKqe.exe
Size 5.9MB
SHA256 b6a064570eff693d2f1ff96cded36d43e10ce401d0fb722067a26d21c0ebd9f5
MD5 24d7a883f95066bf55d53374a2d1b0c6
SHA1 ac3ac307c8b9a0f86f841eb1b8724a4814ddddfe
SHA512 47c9fe37fa590e812bd83d364e4632b10ac391f28511b474b712b94c624800a94d9d7c3e75ccd28a3225833ba001a62c028dfe19627844e1f766c8e2ada05a23
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUr:Q+856utgpPF8u/7r
MD5 SHA1 SHA512 SSDEEP

Submit Download

evbkVVI.exe

Path \Windows\system\evbkVVI.exe
Size 5.9MB
SHA256 6e43da2be76a6c4ef301ae68cba0bcb14f00c1120efe0e5b820bbeb85b04615e
MD5 f266f141b38549f0c71cebc0b4e98fbd
SHA1 4b80ebc2d71b87305f2e542f1cf1ffd59652ddef
SHA512 0c55bb998c500f1298eb3a9ad097e7be09f10fb4b5a436ce3329a660b02a382ca67b6b38f82f2d1c35e519ee6fcb52d17431ecfe0bf0b63eccce2261e5044202
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUr:Q+856utgpPF8u/7r
MD5 SHA1 SHA512 SSDEEP

Submit Download

mwtlvKu.exe

Path \Windows\system\mwtlvKu.exe
Size 5.9MB
SHA256 ab4bd1f43e001b31d0000d002a43a3b5c3281966cc4cabda9edd7ea5ff00af6e
MD5 9fdaeea93b8adf9e034107f34622db51
SHA1 9046c79914325bed8eeb1636eab69eecccf122be
SHA512 e328cfca7403485b88312a832a4c184442b274585ec3a1f518d2e7e5e30eb57776bfbc1c1d2eba7745bc9029d17d1412fedb10488bfc6ba609fbb0693345f61d
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUS:Q+856utgpPF8u/7S
MD5 SHA1 SHA512 SSDEEP

Submit Download

rIdNHKH.exe

Path \Windows\system\rIdNHKH.exe
Size 5.9MB
SHA256 49eb49d3c440dfd7dd71f65b429a9932c9df3da035f26479807784fe9eeff8c8
MD5 5df7b7c654adf96a46f1084ff4034c17
SHA1 c4c331e1b739e8e2f96888a2f2656d7811e8622a
SHA512 0d93544fd040a3ea00f6ad3db5436967c99d4fa1a88a5da0831d052b038351686a044ee925409f3ab24fb6e68cd03f37ecf0f4a580ff47d6fd6d0b18c6630f74
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUx:Q+856utgpPF8u/7x
MD5 SHA1 SHA512 SSDEEP

Submit Download

upjSvXB.exe

Path \Windows\system\upjSvXB.exe
Size 5.9MB
SHA256 fc6c98223c74e94f9c9283dd68d093d4044f75dcfe269b5af5f02dd5bf0f28cf
MD5 2cf67d379a11d5057ad1cfc613fccaf7
SHA1 105a5b6f957be4ab8ec1731854f7df9ed9822d8a
SHA512 69e744edbd68c14c959805a9bf21662c4bcc2ca3bd24ac0ad0ace27fd28b34b98dd9dbf447a5e791c017318cd7e5c64bfeaf3ce30937e0122042f75511362aad
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUT:Q+856utgpPF8u/7T
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/108-157-0x000000013F400000-0x000000013F754000-memory.dmp

Download

memory/108-142-0x000000013F400000-0x000000013F754000-memory.dmp

Download

memory/108-72-0x000000013F400000-0x000000013F754000-memory.dmp

Download

memory/1896-102-0x000000013FBF0000-0x000000013FF44000-memory.dmp

Download

memory/1896-161-0x000000013FBF0000-0x000000013FF44000-memory.dmp

Download

memory/1964-79-0x000000013FE60000-0x00000001401B4000-memory.dmp

Download

memory/1964-25-0x000000013F920000-0x000000013FC74000-memory.dmp

Download

memory/1964-2-0x000000013F200000-0x000000013F554000-memory.dmp

Download

memory/1964-64-0x000000013FD50000-0x00000001400A4000-memory.dmp

Download

memory/1964-10-0x000000013F890000-0x000000013FBE4000-memory.dmp

Download

memory/1964-145-0x000000013FD70000-0x00000001400C4000-memory.dmp

Download

memory/1964-55-0x0000000002330000-0x0000000002684000-memory.dmp

Download

memory/1964-71-0x0000000002330000-0x0000000002684000-memory.dmp

Download

memory/1964-143-0x000000013FE60000-0x00000001401B4000-memory.dmp

Download

memory/1964-141-0x0000000002330000-0x0000000002684000-memory.dmp

Download

memory/1964-139-0x000000013FD50000-0x00000001400A4000-memory.dmp

Download

memory/1964-87-0x000000013FD70000-0x00000001400C4000-memory.dmp

Download

memory/1964-0-0x00000000002F0000-0x0000000000300000-memory.dmp

Download

memory/1964-137-0x0000000002330000-0x0000000002684000-memory.dmp

Download

memory/1964-48-0x000000013F200000-0x000000013F554000-memory.dmp

Download

memory/1964-39-0x000000013F9D0000-0x000000013FD24000-memory.dmp

Download

memory/1964-19-0x000000013FB70000-0x000000013FEC4000-memory.dmp

Download

memory/1964-35-0x0000000002330000-0x0000000002684000-memory.dmp

Download

memory/1964-94-0x000000013F650000-0x000000013F9A4000-memory.dmp

Download

memory/1964-17-0x000000013FDB0000-0x0000000140104000-memory.dmp

Download

memory/2340-147-0x000000013F650000-0x000000013F9A4000-memory.dmp

Download

memory/2340-95-0x000000013F650000-0x000000013F9A4000-memory.dmp

Download

memory/2340-160-0x000000013F650000-0x000000013F9A4000-memory.dmp

Download

memory/2492-65-0x000000013FD50000-0x00000001400A4000-memory.dmp

Download

memory/2492-156-0x000000013FD50000-0x00000001400A4000-memory.dmp

Download

memory/2492-140-0x000000013FD50000-0x00000001400A4000-memory.dmp

Download

memory/2512-58-0x000000013F4F0000-0x000000013F844000-memory.dmp

Download

memory/2512-155-0x000000013F4F0000-0x000000013F844000-memory.dmp

Download

memory/2512-138-0x000000013F4F0000-0x000000013F844000-memory.dmp

Download

memory/2548-144-0x000000013FE60000-0x00000001401B4000-memory.dmp

Download

memory/2548-158-0x000000013FE60000-0x00000001401B4000-memory.dmp

Download

memory/2548-80-0x000000013FE60000-0x00000001401B4000-memory.dmp

Download

memory/2568-70-0x000000013F280000-0x000000013F5D4000-memory.dmp

Download

memory/2568-36-0x000000013F280000-0x000000013F5D4000-memory.dmp

Download

memory/2568-152-0x000000013F280000-0x000000013F5D4000-memory.dmp

Download

memory/2580-22-0x000000013FDB0000-0x0000000140104000-memory.dmp

Download

memory/2580-57-0x000000013FDB0000-0x0000000140104000-memory.dmp

Download

memory/2580-150-0x000000013FDB0000-0x0000000140104000-memory.dmp

Download

memory/2600-30-0x000000013F920000-0x000000013FC74000-memory.dmp

Download

memory/2600-151-0x000000013F920000-0x000000013FC74000-memory.dmp

Download

memory/2636-85-0x000000013F9D0000-0x000000013FD24000-memory.dmp

Download

memory/2636-153-0x000000013F9D0000-0x000000013FD24000-memory.dmp

Download

memory/2636-41-0x000000013F9D0000-0x000000013FD24000-memory.dmp

Download

memory/2672-154-0x000000013FDE0000-0x0000000140134000-memory.dmp

Download

memory/2672-51-0x000000013FDE0000-0x0000000140134000-memory.dmp

Download

memory/2772-146-0x000000013FD70000-0x00000001400C4000-memory.dmp

Download

memory/2772-89-0x000000013FD70000-0x00000001400C4000-memory.dmp

Download

memory/2772-159-0x000000013FD70000-0x00000001400C4000-memory.dmp

Download

memory/2972-148-0x000000013F890000-0x000000013FBE4000-memory.dmp

Download

memory/2972-15-0x000000013F890000-0x000000013FBE4000-memory.dmp

Download

memory/2980-149-0x000000013FB70000-0x000000013FEC4000-memory.dmp

Download

memory/2980-21-0x000000013FB70000-0x000000013FEC4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads