Analysis
-
max time kernel
117s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
04-06-2024 08:11
Behavioral task
behavioral1
Sample
4293ac6188831232844bd1ee97ce6870_NeikiAnalytics.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
4293ac6188831232844bd1ee97ce6870_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
4293ac6188831232844bd1ee97ce6870_NeikiAnalytics.exe
-
Size
565KB
-
MD5
4293ac6188831232844bd1ee97ce6870
-
SHA1
6555cab827a63d259a43254047133aeca0044848
-
SHA256
ac704bcc55b04f5ce907e2ca8e1787a96e4050c6a933fe0d37273e783ef05de9
-
SHA512
083ab9f053ac4b3e6c8200f3bf59f7b9eb99c55eea282c68a846da412f1c88145feb2a45f234197a2237f549fba4feee9d71df907e0344c7fb5ab71493b1734e
-
SSDEEP
12288:KPNItuFjAh//+zrWAIAqWim/+zrWAI5KF8OX:KytuFjAh/mvFimm09OX
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Dnlidb32.exeNhdlkdkg.exePiphee32.exeEeqdep32.exeCclkfdnc.exeDpbheh32.exeDjklnnaj.exeHcplhi32.exeJbgbni32.exeAefeijle.exeCpkbdiqb.exeJoifam32.exeIdhopq32.exePimkpfeh.exeCafecmlj.exe4293ac6188831232844bd1ee97ce6870_NeikiAnalytics.exeBfcampgf.exeLpbefoai.exePqkmjh32.exeKmopod32.exeOnmdoioa.exeDliijipn.exeMdpjlajk.exeIcbimi32.exeJofiln32.exeBioqclil.exeGlaoalkh.exeMggpgmof.exePnajilng.exeKahojc32.exeLliflp32.exeBlbfjg32.exeJbjochdi.exeMlmlecec.exePbfpik32.exeLfjqnjkh.exeOobjaqaj.exeEqijej32.exeFidoim32.exeIoijbj32.exeNgnbgplj.exePnlqnl32.exeDnoomqbg.exeFejgko32.exeNoqamn32.exeOclilp32.exeDfffnn32.exeDdagfm32.exeMpfkqb32.exeQmfgjh32.exeDgjclbdi.exeIgihbknb.exeKihqkagp.exeQfokbnip.exeDlnbeh32.exeEgjpkffe.exeKgnnln32.exeCkoilb32.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dnlidb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Nhdlkdkg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Piphee32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Eeqdep32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Cclkfdnc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dpbheh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Djklnnaj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hcplhi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jbgbni32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Aefeijle.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cpkbdiqb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Joifam32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Djklnnaj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Idhopq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Idhopq32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pimkpfeh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Cafecmlj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" 4293ac6188831232844bd1ee97ce6870_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bfcampgf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Lpbefoai.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pqkmjh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kmopod32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Onmdoioa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Dliijipn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Mdpjlajk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nhdlkdkg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Icbimi32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jofiln32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bioqclil.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Glaoalkh.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mggpgmof.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pnajilng.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kahojc32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lliflp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Blbfjg32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jbjochdi.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mlmlecec.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pbfpik32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Lfjqnjkh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Oobjaqaj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eqijej32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Fidoim32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ioijbj32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ngnbgplj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pnlqnl32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dnoomqbg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dliijipn.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fejgko32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Noqamn32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oclilp32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dfffnn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kahojc32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ddagfm32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mpfkqb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qmfgjh32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dgjclbdi.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Igihbknb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kihqkagp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Qfokbnip.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aefeijle.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dlnbeh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Egjpkffe.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kgnnln32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ckoilb32.exe -
Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule behavioral1/memory/2008-0-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew behavioral1/memory/2008-6-0x0000000000310000-0x0000000000354000-memory.dmp family_berbew \Windows\SysWOW64\Cciemedf.exe family_berbew C:\Windows\SysWOW64\Claifkkf.exe family_berbew behavioral1/memory/2968-31-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew behavioral1/memory/2776-34-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew \Windows\SysWOW64\Copfbfjj.exe family_berbew behavioral1/memory/2316-42-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew \Windows\SysWOW64\Ddagfm32.exe family_berbew behavioral1/memory/2452-56-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew \Windows\SysWOW64\Ddcdkl32.exe family_berbew behavioral1/memory/2452-64-0x0000000000250000-0x0000000000294000-memory.dmp family_berbew behavioral1/memory/2572-70-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew C:\Windows\SysWOW64\Dnlidb32.exe family_berbew behavioral1/memory/2420-84-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew \Windows\SysWOW64\Dcknbh32.exe family_berbew behavioral1/memory/2756-98-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew \Windows\SysWOW64\Dfijnd32.exe family_berbew behavioral1/memory/1884-112-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew \Windows\SysWOW64\Eeqdep32.exe family_berbew behavioral1/memory/1884-124-0x0000000000250000-0x0000000000294000-memory.dmp family_berbew behavioral1/memory/1520-127-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew C:\Windows\SysWOW64\Ekklaj32.exe family_berbew behavioral1/memory/2504-141-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew \Windows\SysWOW64\Ebinic32.exe family_berbew behavioral1/memory/2504-149-0x0000000000320000-0x0000000000364000-memory.dmp family_berbew \Windows\SysWOW64\Fejgko32.exe family_berbew behavioral1/memory/2088-168-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew \Windows\SysWOW64\Fhkpmjln.exe family_berbew behavioral1/memory/2088-176-0x0000000000300000-0x0000000000344000-memory.dmp family_berbew behavioral1/memory/2244-186-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew \Windows\SysWOW64\Facdeo32.exe family_berbew behavioral1/memory/692-195-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew \Windows\SysWOW64\Feeiob32.exe family_berbew behavioral1/memory/1580-209-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew \Windows\SysWOW64\Glaoalkh.exe family_berbew behavioral1/memory/1164-222-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew C:\Windows\SysWOW64\Gieojq32.exe family_berbew behavioral1/memory/1732-233-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew C:\Windows\SysWOW64\Gelppaof.exe family_berbew behavioral1/memory/1040-244-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew behavioral1/memory/1732-243-0x0000000000290000-0x00000000002D4000-memory.dmp family_berbew C:\Windows\SysWOW64\Gmgdddmq.exe family_berbew behavioral1/memory/1308-266-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew C:\Windows\SysWOW64\Geolea32.exe family_berbew behavioral1/memory/352-260-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew C:\Windows\SysWOW64\Gaemjbcg.exe family_berbew behavioral1/memory/292-277-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew C:\Windows\SysWOW64\Hahjpbad.exe family_berbew behavioral1/memory/2940-288-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew behavioral1/memory/292-286-0x0000000000280000-0x00000000002C4000-memory.dmp family_berbew C:\Windows\SysWOW64\Hpkjko32.exe family_berbew behavioral1/memory/1700-299-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew C:\Windows\SysWOW64\Hnojdcfi.exe family_berbew behavioral1/memory/704-312-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew C:\Windows\SysWOW64\Hckcmjep.exe family_berbew behavioral1/memory/1904-326-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew C:\Windows\SysWOW64\Hobcak32.exe family_berbew behavioral1/memory/3032-331-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew C:\Windows\SysWOW64\Hellne32.exe family_berbew behavioral1/memory/2544-347-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew C:\Windows\SysWOW64\Hcplhi32.exe family_berbew behavioral1/memory/2604-354-0x0000000000400000-0x0000000000444000-memory.dmp family_berbew C:\Windows\SysWOW64\Icbimi32.exe family_berbew -
Executes dropped EXE 64 IoCs
Processes:
Cciemedf.exeClaifkkf.exeCopfbfjj.exeDdagfm32.exeDdcdkl32.exeDnlidb32.exeDcknbh32.exeDfijnd32.exeEeqdep32.exeEkklaj32.exeEbinic32.exeFejgko32.exeFhkpmjln.exeFacdeo32.exeFeeiob32.exeGlaoalkh.exeGieojq32.exeGelppaof.exeGmgdddmq.exeGeolea32.exeGaemjbcg.exeHahjpbad.exeHpkjko32.exeHnojdcfi.exeHckcmjep.exeHobcak32.exeHellne32.exeHcplhi32.exeIcbimi32.exeIeqeidnl.exeIoijbj32.exeIfcbodli.exeInngcfid.exeIdhopq32.exeIkbgmj32.exeIgihbknb.exeIdmhkpml.exeIgkdgk32.exeJofiln32.exeJoifam32.exeJbgbni32.exeJkpgfn32.exeJbjochdi.exeJehkodcm.exeJkbcln32.exeJbllihbf.exeJejhecaj.exeJoplbl32.exeJbnhng32.exeKihqkagp.exeKkgmgmfd.exeKeoapb32.exeKgnnln32.exeKcdnao32.exeKahojc32.exeKgbggnhc.exeKmopod32.exeKblhgk32.exeLldlqakb.exeLfjqnjkh.exeLpbefoai.exeLoeebl32.exeLflmci32.exeLliflp32.exepid process 2968 Cciemedf.exe 2776 Claifkkf.exe 2316 Copfbfjj.exe 2452 Ddagfm32.exe 2572 Ddcdkl32.exe 2420 Dnlidb32.exe 2756 Dcknbh32.exe 1884 Dfijnd32.exe 1520 Eeqdep32.exe 2504 Ekklaj32.exe 1560 Ebinic32.exe 2088 Fejgko32.exe 2244 Fhkpmjln.exe 692 Facdeo32.exe 1580 Feeiob32.exe 1164 Glaoalkh.exe 1732 Gieojq32.exe 1040 Gelppaof.exe 352 Gmgdddmq.exe 1308 Geolea32.exe 292 Gaemjbcg.exe 2940 Hahjpbad.exe 1700 Hpkjko32.exe 704 Hnojdcfi.exe 1904 Hckcmjep.exe 3032 Hobcak32.exe 2544 Hellne32.exe 2604 Hcplhi32.exe 2696 Icbimi32.exe 2408 Ieqeidnl.exe 2948 Ioijbj32.exe 2712 Ifcbodli.exe 2848 Inngcfid.exe 2860 Idhopq32.exe 2380 Ikbgmj32.exe 2356 Igihbknb.exe 812 Idmhkpml.exe 1200 Igkdgk32.exe 1640 Jofiln32.exe 1876 Joifam32.exe 2268 Jbgbni32.exe 1076 Jkpgfn32.exe 1616 Jbjochdi.exe 3056 Jehkodcm.exe 2224 Jkbcln32.exe 1896 Jbllihbf.exe 472 Jejhecaj.exe 636 Joplbl32.exe 2780 Jbnhng32.exe 1092 Kihqkagp.exe 1440 Kkgmgmfd.exe 2588 Keoapb32.exe 2564 Kgnnln32.exe 2428 Kcdnao32.exe 2468 Kahojc32.exe 2456 Kgbggnhc.exe 2748 Kmopod32.exe 2896 Kblhgk32.exe 2908 Lldlqakb.exe 1912 Lfjqnjkh.exe 560 Lpbefoai.exe 1464 Loeebl32.exe 2032 Lflmci32.exe 2012 Lliflp32.exe -
Loads dropped DLL 64 IoCs
Processes:
4293ac6188831232844bd1ee97ce6870_NeikiAnalytics.exeCciemedf.exeClaifkkf.exeCopfbfjj.exeDdagfm32.exeDdcdkl32.exeDnlidb32.exeDcknbh32.exeDfijnd32.exeEeqdep32.exeEkklaj32.exeEbinic32.exeFejgko32.exeFhkpmjln.exeFacdeo32.exeFeeiob32.exeGlaoalkh.exeGieojq32.exeGelppaof.exeGmgdddmq.exeGeolea32.exeGaemjbcg.exeHahjpbad.exeHpkjko32.exeHnojdcfi.exeHckcmjep.exeHobcak32.exeHellne32.exeHcplhi32.exeIcbimi32.exeIeqeidnl.exeIoijbj32.exepid process 2008 4293ac6188831232844bd1ee97ce6870_NeikiAnalytics.exe 2008 4293ac6188831232844bd1ee97ce6870_NeikiAnalytics.exe 2968 Cciemedf.exe 2968 Cciemedf.exe 2776 Claifkkf.exe 2776 Claifkkf.exe 2316 Copfbfjj.exe 2316 Copfbfjj.exe 2452 Ddagfm32.exe 2452 Ddagfm32.exe 2572 Ddcdkl32.exe 2572 Ddcdkl32.exe 2420 Dnlidb32.exe 2420 Dnlidb32.exe 2756 Dcknbh32.exe 2756 Dcknbh32.exe 1884 Dfijnd32.exe 1884 Dfijnd32.exe 1520 Eeqdep32.exe 1520 Eeqdep32.exe 2504 Ekklaj32.exe 2504 Ekklaj32.exe 1560 Ebinic32.exe 1560 Ebinic32.exe 2088 Fejgko32.exe 2088 Fejgko32.exe 2244 Fhkpmjln.exe 2244 Fhkpmjln.exe 692 Facdeo32.exe 692 Facdeo32.exe 1580 Feeiob32.exe 1580 Feeiob32.exe 1164 Glaoalkh.exe 1164 Glaoalkh.exe 1732 Gieojq32.exe 1732 Gieojq32.exe 1040 Gelppaof.exe 1040 Gelppaof.exe 352 Gmgdddmq.exe 352 Gmgdddmq.exe 1308 Geolea32.exe 1308 Geolea32.exe 292 Gaemjbcg.exe 292 Gaemjbcg.exe 2940 Hahjpbad.exe 2940 Hahjpbad.exe 1700 Hpkjko32.exe 1700 Hpkjko32.exe 704 Hnojdcfi.exe 704 Hnojdcfi.exe 1904 Hckcmjep.exe 1904 Hckcmjep.exe 3032 Hobcak32.exe 3032 Hobcak32.exe 2544 Hellne32.exe 2544 Hellne32.exe 2604 Hcplhi32.exe 2604 Hcplhi32.exe 2696 Icbimi32.exe 2696 Icbimi32.exe 2408 Ieqeidnl.exe 2408 Ieqeidnl.exe 2948 Ioijbj32.exe 2948 Ioijbj32.exe -
Drops file in System32 directory 64 IoCs
Processes:
Ddagfm32.exeLfjqnjkh.exeQmfgjh32.exeBfcampgf.exeIoijbj32.exeCldooj32.exeDpbheh32.exeEjkima32.exePjcabmga.exeBppoqeja.exeFacdeo32.exeHellne32.exeJoplbl32.exeMmhodf32.exeOobjaqaj.exeAlbjlcao.exeCpkbdiqb.exeNcgdbmmp.exeIgkdgk32.exeDjmicm32.exeEdkcojga.exeKihqkagp.exeMeccii32.exePfjbgnme.exeQpecfc32.exeAmfcikek.exeKeoapb32.exeLkncmmle.exePiphee32.exeDfmdho32.exeDfffnn32.exeDookgcij.exeEcejkf32.exeEqijej32.exeGelppaof.exeHnojdcfi.exeKcdnao32.exeLhpfqama.exeMpfkqb32.exeDknekeef.exeJkpgfn32.exeOoeggp32.exeKblhgk32.exeLeajdfnm.exeOnmdoioa.exeAmkpegnj.exeDbhnhp32.exeBaakhm32.exeCpnojioo.exeFhkpmjln.exeIcbimi32.exeQcbllb32.exeBlpjegfm.exeBehnnm32.exeEbodiofk.exe4293ac6188831232844bd1ee97ce6870_NeikiAnalytics.exeDnlidb32.exedescription ioc process File created C:\Windows\SysWOW64\Ddcdkl32.exe Ddagfm32.exe File created C:\Windows\SysWOW64\Lpbefoai.exe Lfjqnjkh.exe File created C:\Windows\SysWOW64\Idnhde32.dll Qmfgjh32.exe File created C:\Windows\SysWOW64\Fnnkng32.dll Bfcampgf.exe File opened for modification C:\Windows\SysWOW64\Ifcbodli.exe Ioijbj32.exe File created C:\Windows\SysWOW64\Dgjclbdi.exe Cldooj32.exe File created C:\Windows\SysWOW64\Dcadac32.exe Dpbheh32.exe File opened for modification C:\Windows\SysWOW64\Eccmffjf.exe Ejkima32.exe File opened for modification C:\Windows\SysWOW64\Pclfkc32.exe Pjcabmga.exe File created C:\Windows\SysWOW64\Baakhm32.exe Bppoqeja.exe File created C:\Windows\SysWOW64\Kifjcn32.dll Facdeo32.exe File created C:\Windows\SysWOW64\Hcplhi32.exe Hellne32.exe File created C:\Windows\SysWOW64\Jbnhng32.exe Joplbl32.exe File opened for modification C:\Windows\SysWOW64\Mpfkqb32.exe Mmhodf32.exe File created C:\Windows\SysWOW64\Obafnlpn.exe Oobjaqaj.exe File created C:\Windows\SysWOW64\Kfommp32.dll Pjcabmga.exe File created C:\Windows\SysWOW64\Ccnnibig.dll Albjlcao.exe File opened for modification C:\Windows\SysWOW64\Chbjffad.exe Cpkbdiqb.exe File created C:\Windows\SysWOW64\Onmddnil.dll Ncgdbmmp.exe File created C:\Windows\SysWOW64\Ndpaod32.dll Igkdgk32.exe File opened for modification C:\Windows\SysWOW64\Dknekeef.exe Djmicm32.exe File created C:\Windows\SysWOW64\Egjpkffe.exe Edkcojga.exe File created C:\Windows\SysWOW64\Kjjndgdk.dll Kihqkagp.exe File created C:\Windows\SysWOW64\Mlmlecec.exe Meccii32.exe File created C:\Windows\SysWOW64\Cmicaonb.dll Pfjbgnme.exe File opened for modification C:\Windows\SysWOW64\Qfokbnip.exe Qpecfc32.exe File created C:\Windows\SysWOW64\Oglegn32.dll Amfcikek.exe File created C:\Windows\SysWOW64\Kgnnln32.exe Keoapb32.exe File created C:\Windows\SysWOW64\Lbeknj32.exe Lkncmmle.exe File created C:\Windows\SysWOW64\Kndcpj32.dll Piphee32.exe File created C:\Windows\SysWOW64\Joliff32.dll Dfmdho32.exe File created C:\Windows\SysWOW64\Cbcodmih.dll Dfffnn32.exe File created C:\Windows\SysWOW64\Gogcek32.dll Dookgcij.exe File created C:\Windows\SysWOW64\Ekgednng.dll Ecejkf32.exe File created C:\Windows\SysWOW64\Echfaf32.exe Eqijej32.exe File created C:\Windows\SysWOW64\Febhomkh.dll Gelppaof.exe File opened for modification C:\Windows\SysWOW64\Hckcmjep.exe Hnojdcfi.exe File created C:\Windows\SysWOW64\Kahojc32.exe Kcdnao32.exe File created C:\Windows\SysWOW64\Lkncmmle.exe Lhpfqama.exe File created C:\Windows\SysWOW64\Meccii32.exe Mpfkqb32.exe File created C:\Windows\SysWOW64\Dbhnhp32.exe Dknekeef.exe File opened for modification C:\Windows\SysWOW64\Edkcojga.exe Dookgcij.exe File created C:\Windows\SysWOW64\Ifcbodli.exe Ioijbj32.exe File opened for modification C:\Windows\SysWOW64\Jbjochdi.exe Jkpgfn32.exe File created C:\Windows\SysWOW64\Bgmefakc.dll Ooeggp32.exe File opened for modification C:\Windows\SysWOW64\Jbnhng32.exe Joplbl32.exe File created C:\Windows\SysWOW64\Agpgbgpe.dll Kblhgk32.exe File opened for modification C:\Windows\SysWOW64\Lhpfqama.exe Leajdfnm.exe File opened for modification C:\Windows\SysWOW64\Olpdjf32.exe Onmdoioa.exe File opened for modification C:\Windows\SysWOW64\Aefeijle.exe Amkpegnj.exe File created C:\Windows\SysWOW64\Chbjffad.exe Cpkbdiqb.exe File opened for modification C:\Windows\SysWOW64\Dhbfdjdp.exe Dbhnhp32.exe File created C:\Windows\SysWOW64\Abqjpn32.dll Jkpgfn32.exe File created C:\Windows\SysWOW64\Gokkjm32.dll Lkncmmle.exe File created C:\Windows\SysWOW64\Bhkdeggl.exe Baakhm32.exe File opened for modification C:\Windows\SysWOW64\Cclkfdnc.exe Cpnojioo.exe File opened for modification C:\Windows\SysWOW64\Facdeo32.exe Fhkpmjln.exe File created C:\Windows\SysWOW64\Nfmjcmjd.dll Icbimi32.exe File opened for modification C:\Windows\SysWOW64\Amkpegnj.exe Qcbllb32.exe File created C:\Windows\SysWOW64\Mclgfa32.dll Blpjegfm.exe File created C:\Windows\SysWOW64\Blbfjg32.exe Behnnm32.exe File created C:\Windows\SysWOW64\Bpbbfi32.dll Ebodiofk.exe File created C:\Windows\SysWOW64\Cciemedf.exe 4293ac6188831232844bd1ee97ce6870_NeikiAnalytics.exe File created C:\Windows\SysWOW64\Dcknbh32.exe Dnlidb32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3248 3224 WerFault.exe Fkckeh32.exe -
Modifies registry class 64 IoCs
Processes:
Blbfjg32.exeCjfccn32.exeEeqdep32.exeHckcmjep.exeJkbcln32.exeOclilp32.exeAbmbhn32.exeBfcampgf.exeCkoilb32.exeCldooj32.exeClaifkkf.exeIgihbknb.exeNgpolo32.exeDbhnhp32.exeEdkcojga.exeDbfabp32.exeEfaibbij.exe4293ac6188831232844bd1ee97ce6870_NeikiAnalytics.exeGmgdddmq.exeNkiogn32.exeKkgmgmfd.exeLeajdfnm.exeNpdjje32.exeAaaoij32.exeEbinic32.exeJejhecaj.exeEjkima32.exeAoepcn32.exeCpkbdiqb.exeMmceigep.exeAmkpegnj.exeCdbdjhmp.exeBmmiij32.exeIoijbj32.exePnlqnl32.exePfjbgnme.exeDfmdho32.exeDjklnnaj.exeNglfapnl.exeBhkdeggl.exeLflmci32.exePclfkc32.exeBpnbkeld.exeIgkdgk32.exeLhpfqama.exeNgnbgplj.exeOobjaqaj.exeDcadac32.exeEchfaf32.exeJbjochdi.exeLfjqnjkh.exeLliflp32.exeMgljbm32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Blbfjg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Cjfccn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Eeqdep32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Hckcmjep.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fdmahkol.dll" Jkbcln32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Oclilp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Abmbhn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Bfcampgf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ckoilb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qbgpffch.dll" Cldooj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Claifkkf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Igihbknb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Acahnedo.dll" Ngpolo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Cldooj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Dbhnhp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Edkcojga.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Dbfabp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Efaibbij.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 4293ac6188831232844bd1ee97ce6870_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Gmgdddmq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lcoich32.dll" Nkiogn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Kkgmgmfd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Leajdfnm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Npdjje32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnhijl32.dll" Aaaoij32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oehfcmhd.dll" Cjfccn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nejeco32.dll" 4293ac6188831232844bd1ee97ce6870_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qdcbfq32.dll" Ebinic32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Jejhecaj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Imehcohk.dll" Ejkima32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Jkbcln32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ncdbcl32.dll" Aoepcn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Cpkbdiqb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odifab32.dll" Dbfabp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Mmceigep.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Amkpegnj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Cdbdjhmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Bmmiij32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dcpdmj32.dll" Ioijbj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Objbcm32.dll" Pnlqnl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cmicaonb.dll" Pfjbgnme.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Dfmdho32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Djklnnaj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nokeef32.dll" Hckcmjep.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Nglfapnl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Bhkdeggl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Aaaoij32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bnpanefm.dll" Kkgmgmfd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Lflmci32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Pclfkc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Oclilp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Bpnbkeld.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Igkdgk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Lhpfqama.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ngnbgplj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Nkiogn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nchnel32.dll" Oobjaqaj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Dcadac32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Echfaf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eeoliecf.dll" Jbjochdi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Lfjqnjkh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfjoqjhi.dll" Lliflp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Mgljbm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Npdjje32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
4293ac6188831232844bd1ee97ce6870_NeikiAnalytics.exeCciemedf.exeClaifkkf.exeCopfbfjj.exeDdagfm32.exeDdcdkl32.exeDnlidb32.exeDcknbh32.exeDfijnd32.exeEeqdep32.exeEkklaj32.exeEbinic32.exeFejgko32.exeFhkpmjln.exeFacdeo32.exeFeeiob32.exedescription pid process target process PID 2008 wrote to memory of 2968 2008 4293ac6188831232844bd1ee97ce6870_NeikiAnalytics.exe Cciemedf.exe PID 2008 wrote to memory of 2968 2008 4293ac6188831232844bd1ee97ce6870_NeikiAnalytics.exe Cciemedf.exe PID 2008 wrote to memory of 2968 2008 4293ac6188831232844bd1ee97ce6870_NeikiAnalytics.exe Cciemedf.exe PID 2008 wrote to memory of 2968 2008 4293ac6188831232844bd1ee97ce6870_NeikiAnalytics.exe Cciemedf.exe PID 2968 wrote to memory of 2776 2968 Cciemedf.exe Claifkkf.exe PID 2968 wrote to memory of 2776 2968 Cciemedf.exe Claifkkf.exe PID 2968 wrote to memory of 2776 2968 Cciemedf.exe Claifkkf.exe PID 2968 wrote to memory of 2776 2968 Cciemedf.exe Claifkkf.exe PID 2776 wrote to memory of 2316 2776 Claifkkf.exe Copfbfjj.exe PID 2776 wrote to memory of 2316 2776 Claifkkf.exe Copfbfjj.exe PID 2776 wrote to memory of 2316 2776 Claifkkf.exe Copfbfjj.exe PID 2776 wrote to memory of 2316 2776 Claifkkf.exe Copfbfjj.exe PID 2316 wrote to memory of 2452 2316 Copfbfjj.exe Ddagfm32.exe PID 2316 wrote to memory of 2452 2316 Copfbfjj.exe Ddagfm32.exe PID 2316 wrote to memory of 2452 2316 Copfbfjj.exe Ddagfm32.exe PID 2316 wrote to memory of 2452 2316 Copfbfjj.exe Ddagfm32.exe PID 2452 wrote to memory of 2572 2452 Ddagfm32.exe Ddcdkl32.exe PID 2452 wrote to memory of 2572 2452 Ddagfm32.exe Ddcdkl32.exe PID 2452 wrote to memory of 2572 2452 Ddagfm32.exe Ddcdkl32.exe PID 2452 wrote to memory of 2572 2452 Ddagfm32.exe Ddcdkl32.exe PID 2572 wrote to memory of 2420 2572 Ddcdkl32.exe Dnlidb32.exe PID 2572 wrote to memory of 2420 2572 Ddcdkl32.exe Dnlidb32.exe PID 2572 wrote to memory of 2420 2572 Ddcdkl32.exe Dnlidb32.exe PID 2572 wrote to memory of 2420 2572 Ddcdkl32.exe Dnlidb32.exe PID 2420 wrote to memory of 2756 2420 Dnlidb32.exe Dcknbh32.exe PID 2420 wrote to memory of 2756 2420 Dnlidb32.exe Dcknbh32.exe PID 2420 wrote to memory of 2756 2420 Dnlidb32.exe Dcknbh32.exe PID 2420 wrote to memory of 2756 2420 Dnlidb32.exe Dcknbh32.exe PID 2756 wrote to memory of 1884 2756 Dcknbh32.exe Dfijnd32.exe PID 2756 wrote to memory of 1884 2756 Dcknbh32.exe Dfijnd32.exe PID 2756 wrote to memory of 1884 2756 Dcknbh32.exe Dfijnd32.exe PID 2756 wrote to memory of 1884 2756 Dcknbh32.exe Dfijnd32.exe PID 1884 wrote to memory of 1520 1884 Dfijnd32.exe Eeqdep32.exe PID 1884 wrote to memory of 1520 1884 Dfijnd32.exe Eeqdep32.exe PID 1884 wrote to memory of 1520 1884 Dfijnd32.exe Eeqdep32.exe PID 1884 wrote to memory of 1520 1884 Dfijnd32.exe Eeqdep32.exe PID 1520 wrote to memory of 2504 1520 Eeqdep32.exe Ekklaj32.exe PID 1520 wrote to memory of 2504 1520 Eeqdep32.exe Ekklaj32.exe PID 1520 wrote to memory of 2504 1520 Eeqdep32.exe Ekklaj32.exe PID 1520 wrote to memory of 2504 1520 Eeqdep32.exe Ekklaj32.exe PID 2504 wrote to memory of 1560 2504 Ekklaj32.exe Ebinic32.exe PID 2504 wrote to memory of 1560 2504 Ekklaj32.exe Ebinic32.exe PID 2504 wrote to memory of 1560 2504 Ekklaj32.exe Ebinic32.exe PID 2504 wrote to memory of 1560 2504 Ekklaj32.exe Ebinic32.exe PID 1560 wrote to memory of 2088 1560 Ebinic32.exe Fejgko32.exe PID 1560 wrote to memory of 2088 1560 Ebinic32.exe Fejgko32.exe PID 1560 wrote to memory of 2088 1560 Ebinic32.exe Fejgko32.exe PID 1560 wrote to memory of 2088 1560 Ebinic32.exe Fejgko32.exe PID 2088 wrote to memory of 2244 2088 Fejgko32.exe Fhkpmjln.exe PID 2088 wrote to memory of 2244 2088 Fejgko32.exe Fhkpmjln.exe PID 2088 wrote to memory of 2244 2088 Fejgko32.exe Fhkpmjln.exe PID 2088 wrote to memory of 2244 2088 Fejgko32.exe Fhkpmjln.exe PID 2244 wrote to memory of 692 2244 Fhkpmjln.exe Facdeo32.exe PID 2244 wrote to memory of 692 2244 Fhkpmjln.exe Facdeo32.exe PID 2244 wrote to memory of 692 2244 Fhkpmjln.exe Facdeo32.exe PID 2244 wrote to memory of 692 2244 Fhkpmjln.exe Facdeo32.exe PID 692 wrote to memory of 1580 692 Facdeo32.exe Feeiob32.exe PID 692 wrote to memory of 1580 692 Facdeo32.exe Feeiob32.exe PID 692 wrote to memory of 1580 692 Facdeo32.exe Feeiob32.exe PID 692 wrote to memory of 1580 692 Facdeo32.exe Feeiob32.exe PID 1580 wrote to memory of 1164 1580 Feeiob32.exe Glaoalkh.exe PID 1580 wrote to memory of 1164 1580 Feeiob32.exe Glaoalkh.exe PID 1580 wrote to memory of 1164 1580 Feeiob32.exe Glaoalkh.exe PID 1580 wrote to memory of 1164 1580 Feeiob32.exe Glaoalkh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4293ac6188831232844bd1ee97ce6870_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4293ac6188831232844bd1ee97ce6870_NeikiAnalytics.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\SysWOW64\Cciemedf.exeC:\Windows\system32\Cciemedf.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Windows\SysWOW64\Claifkkf.exeC:\Windows\system32\Claifkkf.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\SysWOW64\Copfbfjj.exeC:\Windows\system32\Copfbfjj.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Windows\SysWOW64\Ddagfm32.exeC:\Windows\system32\Ddagfm32.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Windows\SysWOW64\Ddcdkl32.exeC:\Windows\system32\Ddcdkl32.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Windows\SysWOW64\Dnlidb32.exeC:\Windows\system32\Dnlidb32.exe7⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Windows\SysWOW64\Dcknbh32.exeC:\Windows\system32\Dcknbh32.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Windows\SysWOW64\Dfijnd32.exeC:\Windows\system32\Dfijnd32.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Windows\SysWOW64\Eeqdep32.exeC:\Windows\system32\Eeqdep32.exe10⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Windows\SysWOW64\Ekklaj32.exeC:\Windows\system32\Ekklaj32.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Windows\SysWOW64\Ebinic32.exeC:\Windows\system32\Ebinic32.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Windows\SysWOW64\Fejgko32.exeC:\Windows\system32\Fejgko32.exe13⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Windows\SysWOW64\Fhkpmjln.exeC:\Windows\system32\Fhkpmjln.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Windows\SysWOW64\Facdeo32.exeC:\Windows\system32\Facdeo32.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:692 -
C:\Windows\SysWOW64\Feeiob32.exeC:\Windows\system32\Feeiob32.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Windows\SysWOW64\Glaoalkh.exeC:\Windows\system32\Glaoalkh.exe17⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:1164 -
C:\Windows\SysWOW64\Gieojq32.exeC:\Windows\system32\Gieojq32.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1732 -
C:\Windows\SysWOW64\Gelppaof.exeC:\Windows\system32\Gelppaof.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1040 -
C:\Windows\SysWOW64\Gmgdddmq.exeC:\Windows\system32\Gmgdddmq.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:352 -
C:\Windows\SysWOW64\Geolea32.exeC:\Windows\system32\Geolea32.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1308 -
C:\Windows\SysWOW64\Gaemjbcg.exeC:\Windows\system32\Gaemjbcg.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:292 -
C:\Windows\SysWOW64\Hahjpbad.exeC:\Windows\system32\Hahjpbad.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2940 -
C:\Windows\SysWOW64\Hpkjko32.exeC:\Windows\system32\Hpkjko32.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1700 -
C:\Windows\SysWOW64\Hnojdcfi.exeC:\Windows\system32\Hnojdcfi.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:704 -
C:\Windows\SysWOW64\Hckcmjep.exeC:\Windows\system32\Hckcmjep.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:1904 -
C:\Windows\SysWOW64\Hobcak32.exeC:\Windows\system32\Hobcak32.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3032 -
C:\Windows\SysWOW64\Hellne32.exeC:\Windows\system32\Hellne32.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2544 -
C:\Windows\SysWOW64\Hcplhi32.exeC:\Windows\system32\Hcplhi32.exe29⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:2604 -
C:\Windows\SysWOW64\Icbimi32.exeC:\Windows\system32\Icbimi32.exe30⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2696 -
C:\Windows\SysWOW64\Ieqeidnl.exeC:\Windows\system32\Ieqeidnl.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2408 -
C:\Windows\SysWOW64\Ioijbj32.exeC:\Windows\system32\Ioijbj32.exe32⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:2948 -
C:\Windows\SysWOW64\Ifcbodli.exeC:\Windows\system32\Ifcbodli.exe33⤵
- Executes dropped EXE
PID:2712 -
C:\Windows\SysWOW64\Inngcfid.exeC:\Windows\system32\Inngcfid.exe34⤵
- Executes dropped EXE
PID:2848 -
C:\Windows\SysWOW64\Idhopq32.exeC:\Windows\system32\Idhopq32.exe35⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2860 -
C:\Windows\SysWOW64\Ikbgmj32.exeC:\Windows\system32\Ikbgmj32.exe36⤵
- Executes dropped EXE
PID:2380 -
C:\Windows\SysWOW64\Igihbknb.exeC:\Windows\system32\Igihbknb.exe37⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:2356 -
C:\Windows\SysWOW64\Idmhkpml.exeC:\Windows\system32\Idmhkpml.exe38⤵
- Executes dropped EXE
PID:812 -
C:\Windows\SysWOW64\Igkdgk32.exeC:\Windows\system32\Igkdgk32.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:1200 -
C:\Windows\SysWOW64\Jofiln32.exeC:\Windows\system32\Jofiln32.exe40⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1640 -
C:\Windows\SysWOW64\Joifam32.exeC:\Windows\system32\Joifam32.exe41⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1876 -
C:\Windows\SysWOW64\Jbgbni32.exeC:\Windows\system32\Jbgbni32.exe42⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2268 -
C:\Windows\SysWOW64\Jkpgfn32.exeC:\Windows\system32\Jkpgfn32.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1076 -
C:\Windows\SysWOW64\Jbjochdi.exeC:\Windows\system32\Jbjochdi.exe44⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:1616 -
C:\Windows\SysWOW64\Jehkodcm.exeC:\Windows\system32\Jehkodcm.exe45⤵
- Executes dropped EXE
PID:3056 -
C:\Windows\SysWOW64\Jkbcln32.exeC:\Windows\system32\Jkbcln32.exe46⤵
- Executes dropped EXE
- Modifies registry class
PID:2224 -
C:\Windows\SysWOW64\Jbllihbf.exeC:\Windows\system32\Jbllihbf.exe47⤵
- Executes dropped EXE
PID:1896 -
C:\Windows\SysWOW64\Jejhecaj.exeC:\Windows\system32\Jejhecaj.exe48⤵
- Executes dropped EXE
- Modifies registry class
PID:472 -
C:\Windows\SysWOW64\Joplbl32.exeC:\Windows\system32\Joplbl32.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:636 -
C:\Windows\SysWOW64\Jbnhng32.exeC:\Windows\system32\Jbnhng32.exe50⤵
- Executes dropped EXE
PID:2780 -
C:\Windows\SysWOW64\Kihqkagp.exeC:\Windows\system32\Kihqkagp.exe51⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:1092 -
C:\Windows\SysWOW64\Kkgmgmfd.exeC:\Windows\system32\Kkgmgmfd.exe52⤵
- Executes dropped EXE
- Modifies registry class
PID:1440 -
C:\Windows\SysWOW64\Keoapb32.exeC:\Windows\system32\Keoapb32.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2588 -
C:\Windows\SysWOW64\Kgnnln32.exeC:\Windows\system32\Kgnnln32.exe54⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2564 -
C:\Windows\SysWOW64\Kcdnao32.exeC:\Windows\system32\Kcdnao32.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2428 -
C:\Windows\SysWOW64\Kahojc32.exeC:\Windows\system32\Kahojc32.exe56⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2468 -
C:\Windows\SysWOW64\Kgbggnhc.exeC:\Windows\system32\Kgbggnhc.exe57⤵
- Executes dropped EXE
PID:2456 -
C:\Windows\SysWOW64\Kmopod32.exeC:\Windows\system32\Kmopod32.exe58⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2748 -
C:\Windows\SysWOW64\Kblhgk32.exeC:\Windows\system32\Kblhgk32.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2896 -
C:\Windows\SysWOW64\Lldlqakb.exeC:\Windows\system32\Lldlqakb.exe60⤵
- Executes dropped EXE
PID:2908 -
C:\Windows\SysWOW64\Lfjqnjkh.exeC:\Windows\system32\Lfjqnjkh.exe61⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:1912 -
C:\Windows\SysWOW64\Lpbefoai.exeC:\Windows\system32\Lpbefoai.exe62⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:560 -
C:\Windows\SysWOW64\Loeebl32.exeC:\Windows\system32\Loeebl32.exe63⤵
- Executes dropped EXE
PID:1464 -
C:\Windows\SysWOW64\Lflmci32.exeC:\Windows\system32\Lflmci32.exe64⤵
- Executes dropped EXE
- Modifies registry class
PID:2032 -
C:\Windows\SysWOW64\Lliflp32.exeC:\Windows\system32\Lliflp32.exe65⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:2012 -
C:\Windows\SysWOW64\Leajdfnm.exeC:\Windows\system32\Leajdfnm.exe66⤵
- Drops file in System32 directory
- Modifies registry class
PID:2492 -
C:\Windows\SysWOW64\Lhpfqama.exeC:\Windows\system32\Lhpfqama.exe67⤵
- Drops file in System32 directory
- Modifies registry class
PID:2444 -
C:\Windows\SysWOW64\Lkncmmle.exeC:\Windows\system32\Lkncmmle.exe68⤵
- Drops file in System32 directory
PID:1120 -
C:\Windows\SysWOW64\Lbeknj32.exeC:\Windows\system32\Lbeknj32.exe69⤵PID:924
-
C:\Windows\SysWOW64\Lecgje32.exeC:\Windows\system32\Lecgje32.exe70⤵PID:1600
-
C:\Windows\SysWOW64\Lollckbk.exeC:\Windows\system32\Lollckbk.exe71⤵PID:1756
-
C:\Windows\SysWOW64\Lmolnh32.exeC:\Windows\system32\Lmolnh32.exe72⤵PID:652
-
C:\Windows\SysWOW64\Mggpgmof.exeC:\Windows\system32\Mggpgmof.exe73⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1196 -
C:\Windows\SysWOW64\Mmahdggc.exeC:\Windows\system32\Mmahdggc.exe74⤵PID:2204
-
C:\Windows\SysWOW64\Mdkqqa32.exeC:\Windows\system32\Mdkqqa32.exe75⤵PID:2736
-
C:\Windows\SysWOW64\Mmceigep.exeC:\Windows\system32\Mmceigep.exe76⤵
- Modifies registry class
PID:2156 -
C:\Windows\SysWOW64\Mpbaebdd.exeC:\Windows\system32\Mpbaebdd.exe77⤵PID:2476
-
C:\Windows\SysWOW64\Mgljbm32.exeC:\Windows\system32\Mgljbm32.exe78⤵
- Modifies registry class
PID:2448 -
C:\Windows\SysWOW64\Mpdnkb32.exeC:\Windows\system32\Mpdnkb32.exe79⤵PID:1948
-
C:\Windows\SysWOW64\Mdpjlajk.exeC:\Windows\system32\Mdpjlajk.exe80⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:288 -
C:\Windows\SysWOW64\Mmhodf32.exeC:\Windows\system32\Mmhodf32.exe81⤵
- Drops file in System32 directory
PID:2240 -
C:\Windows\SysWOW64\Mpfkqb32.exeC:\Windows\system32\Mpfkqb32.exe82⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:2644 -
C:\Windows\SysWOW64\Meccii32.exeC:\Windows\system32\Meccii32.exe83⤵
- Drops file in System32 directory
PID:2108 -
C:\Windows\SysWOW64\Mlmlecec.exeC:\Windows\system32\Mlmlecec.exe84⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1480 -
C:\Windows\SysWOW64\Ncgdbmmp.exeC:\Windows\system32\Ncgdbmmp.exe85⤵
- Drops file in System32 directory
PID:3004 -
C:\Windows\SysWOW64\Nhdlkdkg.exeC:\Windows\system32\Nhdlkdkg.exe86⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1612 -
C:\Windows\SysWOW64\Namqci32.exeC:\Windows\system32\Namqci32.exe87⤵PID:1596
-
C:\Windows\SysWOW64\Ndkmpe32.exeC:\Windows\system32\Ndkmpe32.exe88⤵PID:2136
-
C:\Windows\SysWOW64\Noqamn32.exeC:\Windows\system32\Noqamn32.exe89⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2496 -
C:\Windows\SysWOW64\Nejiih32.exeC:\Windows\system32\Nejiih32.exe90⤵PID:1536
-
C:\Windows\SysWOW64\Nglfapnl.exeC:\Windows\system32\Nglfapnl.exe91⤵
- Modifies registry class
PID:2684 -
C:\Windows\SysWOW64\Npdjje32.exeC:\Windows\system32\Npdjje32.exe92⤵
- Modifies registry class
PID:2424 -
C:\Windows\SysWOW64\Ngnbgplj.exeC:\Windows\system32\Ngnbgplj.exe93⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:1944 -
C:\Windows\SysWOW64\Nkiogn32.exeC:\Windows\system32\Nkiogn32.exe94⤵
- Modifies registry class
PID:2856 -
C:\Windows\SysWOW64\Npfgpe32.exeC:\Windows\system32\Npfgpe32.exe95⤵PID:752
-
C:\Windows\SysWOW64\Ngpolo32.exeC:\Windows\system32\Ngpolo32.exe96⤵
- Modifies registry class
PID:1620 -
C:\Windows\SysWOW64\Olmhdf32.exeC:\Windows\system32\Olmhdf32.exe97⤵PID:2052
-
C:\Windows\SysWOW64\Oddpfc32.exeC:\Windows\system32\Oddpfc32.exe98⤵PID:1428
-
C:\Windows\SysWOW64\Onmdoioa.exeC:\Windows\system32\Onmdoioa.exe99⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:544 -
C:\Windows\SysWOW64\Olpdjf32.exeC:\Windows\system32\Olpdjf32.exe100⤵PID:604
-
C:\Windows\SysWOW64\Ogeigofa.exeC:\Windows\system32\Ogeigofa.exe101⤵PID:3024
-
C:\Windows\SysWOW64\Ombapedi.exeC:\Windows\system32\Ombapedi.exe102⤵PID:1604
-
C:\Windows\SysWOW64\Oclilp32.exeC:\Windows\system32\Oclilp32.exe103⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:1740 -
C:\Windows\SysWOW64\Ojfaijcc.exeC:\Windows\system32\Ojfaijcc.exe104⤵PID:1444
-
C:\Windows\SysWOW64\Oobjaqaj.exeC:\Windows\system32\Oobjaqaj.exe105⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:2608 -
C:\Windows\SysWOW64\Obafnlpn.exeC:\Windows\system32\Obafnlpn.exe106⤵PID:2412
-
C:\Windows\SysWOW64\Oikojfgk.exeC:\Windows\system32\Oikojfgk.exe107⤵PID:1892
-
C:\Windows\SysWOW64\Ooeggp32.exeC:\Windows\system32\Ooeggp32.exe108⤵
- Drops file in System32 directory
PID:2672 -
C:\Windows\SysWOW64\Obcccl32.exeC:\Windows\system32\Obcccl32.exe109⤵PID:2616
-
C:\Windows\SysWOW64\Pimkpfeh.exeC:\Windows\system32\Pimkpfeh.exe110⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2900 -
C:\Windows\SysWOW64\Pklhlael.exeC:\Windows\system32\Pklhlael.exe111⤵PID:2292
-
C:\Windows\SysWOW64\Pbfpik32.exeC:\Windows\system32\Pbfpik32.exe112⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1656 -
C:\Windows\SysWOW64\Piphee32.exeC:\Windows\system32\Piphee32.exe113⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:332 -
C:\Windows\SysWOW64\Pkndaa32.exeC:\Windows\system32\Pkndaa32.exe114⤵PID:772
-
C:\Windows\SysWOW64\Pnlqnl32.exeC:\Windows\system32\Pnlqnl32.exe115⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:2800 -
C:\Windows\SysWOW64\Pqkmjh32.exeC:\Windows\system32\Pqkmjh32.exe116⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2996 -
C:\Windows\SysWOW64\Pkpagq32.exeC:\Windows\system32\Pkpagq32.exe117⤵PID:2824
-
C:\Windows\SysWOW64\Pjcabmga.exeC:\Windows\system32\Pjcabmga.exe118⤵
- Drops file in System32 directory
PID:2508 -
C:\Windows\SysWOW64\Pclfkc32.exeC:\Windows\system32\Pclfkc32.exe119⤵
- Modifies registry class
PID:2528 -
C:\Windows\SysWOW64\Pfjbgnme.exeC:\Windows\system32\Pfjbgnme.exe120⤵
- Drops file in System32 directory
- Modifies registry class
PID:2668 -
C:\Windows\SysWOW64\Pnajilng.exeC:\Windows\system32\Pnajilng.exe121⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2740 -
C:\Windows\SysWOW64\Pcnbablo.exeC:\Windows\system32\Pcnbablo.exe122⤵PID:1032
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-