Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
04-06-2024 08:21
Behavioral task
behavioral1
Sample
43b446cc8ee431f3e2217f8f8a12b0d0_NeikiAnalytics.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
43b446cc8ee431f3e2217f8f8a12b0d0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
43b446cc8ee431f3e2217f8f8a12b0d0_NeikiAnalytics.exe
-
Size
304KB
-
MD5
43b446cc8ee431f3e2217f8f8a12b0d0
-
SHA1
21df1e064bfbba57e6b198cbdc58f5a45be34111
-
SHA256
6a3c4c4cb36f54e69617a40900abd7bea5c23784b39f5ea24dff7408c1d1dae6
-
SHA512
e631e036ab6c01684f4ebff7b10864a6e4c6d18f13df0444b17e640fc4c8bb1d3ab1be6e725c7f9a670361756760f5befeb98afc0b6488b5969053c49f0652d8
-
SSDEEP
6144:8nHomjMLJc42dDcH/NGNxunXe8yhrtMsQBvli+RQFdq:8nHFI1cNScvAO8qRMsrOQF
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Jpaghf32.exeHfljmdjc.exeAlfkbc32.exeHbmcbime.exeKbpbed32.exeHpomcp32.exeHdmein32.exeJmpngk32.exeAeklkchg.exeMmlpoqpg.exePcicklnn.exeNhpiafnm.exeFckhdk32.exeNhbolp32.exeNjqmepik.exeFpeafcfa.exeLgikfn32.exeMpolqa32.exeAfhohlbj.exeKeakgpko.exeOlmeci32.exeGochjpho.exeGaadfkgc.exeHoadkn32.exeJnfcia32.exeMnnkgl32.exeNbgcih32.exeFdnjgmle.exeKdinljnk.exeDdpeoafg.exeAbponp32.exeJmbklj32.exeCecbmf32.exeGinnfgop.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jpaghf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Hfljmdjc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Alfkbc32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Hbmcbime.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Kbpbed32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Hpomcp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Hdmein32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jmpngk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Aeklkchg.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Mmlpoqpg.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pcicklnn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Nhpiafnm.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Fckhdk32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nhbolp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Njqmepik.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fpeafcfa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Lgikfn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Mpolqa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Afhohlbj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Keakgpko.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Olmeci32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Gochjpho.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Gaadfkgc.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hoadkn32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jnfcia32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mnnkgl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Nbgcih32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Fdnjgmle.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kdinljnk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ddpeoafg.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Abponp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Jmbklj32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cecbmf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ginnfgop.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad -
Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule C:\Windows\SysWOW64\Doccaall.exe family_berbew C:\Windows\SysWOW64\Dabpnlkp.exe family_berbew C:\Windows\SysWOW64\Diihojkb.exe family_berbew C:\Windows\SysWOW64\Dlgdkeje.exe family_berbew C:\Windows\SysWOW64\Dofpgqji.exe family_berbew C:\Windows\SysWOW64\Dcdimopp.exe family_berbew C:\Windows\SysWOW64\Debeijoc.exe family_berbew C:\Windows\SysWOW64\Dhqaefng.exe family_berbew C:\Windows\SysWOW64\Dpemacql.exe family_berbew C:\Windows\SysWOW64\Dcfebonm.exe family_berbew C:\Windows\SysWOW64\Dlojkddn.exe family_berbew C:\Windows\SysWOW64\Dchbhn32.exe family_berbew C:\Windows\SysWOW64\Dchbhn32.exe family_berbew C:\Windows\SysWOW64\Epmcab32.exe family_berbew C:\Windows\SysWOW64\Ebnoikqb.exe family_berbew C:\Windows\SysWOW64\Ehekqe32.exe family_berbew C:\Windows\SysWOW64\Elccfc32.exe family_berbew C:\Windows\SysWOW64\Eflhoigi.exe family_berbew C:\Windows\SysWOW64\Eqalmafo.exe family_berbew C:\Windows\SysWOW64\Eqalmafo.exe family_berbew C:\Windows\SysWOW64\Elccfc32.exe family_berbew C:\Windows\SysWOW64\Ehlaaddj.exe family_berbew C:\Windows\SysWOW64\Ecbenm32.exe family_berbew C:\Windows\SysWOW64\Eqciba32.exe family_berbew C:\Windows\SysWOW64\Emjjgbjp.exe family_berbew C:\Windows\SysWOW64\Ecdbdl32.exe family_berbew C:\Windows\SysWOW64\Fjnjqfij.exe family_berbew C:\Windows\SysWOW64\Fmmfmbhn.exe family_berbew C:\Windows\SysWOW64\Ffekegon.exe family_berbew C:\Windows\SysWOW64\Fjqgff32.exe family_berbew C:\Windows\SysWOW64\Fcikolnh.exe family_berbew C:\Windows\SysWOW64\Fckhdk32.exe family_berbew C:\Windows\SysWOW64\Fjepaecb.exe family_berbew C:\Windows\SysWOW64\Fqmlhpla.exe family_berbew C:\Windows\SysWOW64\Fifdgblo.exe family_berbew C:\Windows\SysWOW64\Habnjm32.exe family_berbew C:\Windows\SysWOW64\Hpihai32.exe family_berbew C:\Windows\SysWOW64\Hbhdmd32.exe family_berbew C:\Windows\SysWOW64\Iannfk32.exe family_berbew C:\Windows\SysWOW64\Jmnaakne.exe family_berbew C:\Windows\SysWOW64\Kbdmpqcb.exe family_berbew C:\Windows\SysWOW64\Kpjjod32.exe family_berbew C:\Windows\SysWOW64\Kckbqpnj.exe family_berbew C:\Windows\SysWOW64\Lknjmkdo.exe family_berbew C:\Windows\SysWOW64\Nqiogp32.exe family_berbew C:\Windows\SysWOW64\Nbhkac32.exe family_berbew C:\Windows\SysWOW64\Njfmke32.exe family_berbew C:\Windows\SysWOW64\Ojhiqefo.exe family_berbew C:\Windows\SysWOW64\Ocqnij32.exe family_berbew C:\Windows\SysWOW64\Odgqdlnj.exe family_berbew C:\Windows\SysWOW64\Pghieg32.exe family_berbew C:\Windows\SysWOW64\Pbmncp32.exe family_berbew C:\Windows\SysWOW64\Pkjlge32.exe family_berbew C:\Windows\SysWOW64\Aanjpk32.exe family_berbew C:\Windows\SysWOW64\Anbkio32.exe family_berbew C:\Windows\SysWOW64\Aealah32.exe family_berbew C:\Windows\SysWOW64\Bjghpn32.exe family_berbew C:\Windows\SysWOW64\Chmeobkq.exe family_berbew C:\Windows\SysWOW64\Chpada32.exe family_berbew C:\Windows\SysWOW64\Chbnia32.exe family_berbew C:\Windows\SysWOW64\Clpgpp32.exe family_berbew C:\Windows\SysWOW64\Doqpak32.exe family_berbew C:\Windows\SysWOW64\Dldpkoil.exe family_berbew C:\Windows\SysWOW64\Deoaid32.exe family_berbew -
Executes dropped EXE 64 IoCs
Processes:
Doccaall.exeDabpnlkp.exeDiihojkb.exeDlgdkeje.exeDofpgqji.exeDpemacql.exeDcdimopp.exeDebeijoc.exeDhqaefng.exeDcfebonm.exeDlojkddn.exeDchbhn32.exeEhekqe32.exeEpmcab32.exeEbnoikqb.exeElccfc32.exeEflhoigi.exeEqalmafo.exeEhlaaddj.exeEqciba32.exeEcbenm32.exeEmjjgbjp.exeEcdbdl32.exeFjnjqfij.exeFmmfmbhn.exeFfekegon.exeFjqgff32.exeFcikolnh.exeFifdgblo.exeFqmlhpla.exeFckhdk32.exeFjepaecb.exeFqohnp32.exeFflaff32.exeFmficqpc.exeGcpapkgp.exeGfnnlffc.exeGimjhafg.exeGqdbiofi.exeGcbnejem.exeGjlfbd32.exeGqfooodg.exeGcekkjcj.exeGfcgge32.exeGjocgdkg.exeGqikdn32.exeGcggpj32.exeGjapmdid.exeGmoliohh.exeGpnhekgl.exeGfhqbe32.exeGameonno.exeGppekj32.exeHfjmgdlf.exeHmdedo32.exeHpbaqj32.exeHfljmdjc.exeHikfip32.exeHabnjm32.exeHbckbepg.exeHfofbd32.exeHmioonpn.exeHpgkkioa.exeHfachc32.exepid process 1256 Doccaall.exe 1612 Dabpnlkp.exe 1460 Diihojkb.exe 3564 Dlgdkeje.exe 3748 Dofpgqji.exe 1040 Dpemacql.exe 2432 Dcdimopp.exe 2408 Debeijoc.exe 1964 Dhqaefng.exe 2436 Dcfebonm.exe 2616 Dlojkddn.exe 2600 Dchbhn32.exe 4872 Ehekqe32.exe 808 Epmcab32.exe 4124 Ebnoikqb.exe 4100 Elccfc32.exe 1508 Eflhoigi.exe 4136 Eqalmafo.exe 5072 Ehlaaddj.exe 1128 Eqciba32.exe 2024 Ecbenm32.exe 984 Emjjgbjp.exe 4444 Ecdbdl32.exe 3940 Fjnjqfij.exe 832 Fmmfmbhn.exe 392 Ffekegon.exe 4440 Fjqgff32.exe 4068 Fcikolnh.exe 1620 Fifdgblo.exe 3456 Fqmlhpla.exe 3868 Fckhdk32.exe 2948 Fjepaecb.exe 4572 Fqohnp32.exe 4020 Fflaff32.exe 1932 Fmficqpc.exe 1008 Gcpapkgp.exe 4424 Gfnnlffc.exe 2488 Gimjhafg.exe 4756 Gqdbiofi.exe 3060 Gcbnejem.exe 2916 Gjlfbd32.exe 3688 Gqfooodg.exe 1476 Gcekkjcj.exe 3160 Gfcgge32.exe 4956 Gjocgdkg.exe 1968 Gqikdn32.exe 3240 Gcggpj32.exe 636 Gjapmdid.exe 2220 Gmoliohh.exe 3044 Gpnhekgl.exe 1404 Gfhqbe32.exe 1240 Gameonno.exe 1584 Gppekj32.exe 460 Hfjmgdlf.exe 5116 Hmdedo32.exe 3324 Hpbaqj32.exe 4232 Hfljmdjc.exe 1896 Hikfip32.exe 2900 Habnjm32.exe 3008 Hbckbepg.exe 2476 Hfofbd32.exe 2640 Hmioonpn.exe 428 Hpgkkioa.exe 4428 Hfachc32.exe -
Drops file in System32 directory 64 IoCs
Processes:
Aaiimadl.exeDpnbog32.exeFhflnpoi.exeJkaicd32.exeJfnbdecg.exeBiogppeg.exeLldfjh32.exeAlkdnboj.exeBmngqdpj.exeBebblb32.exeNpgabc32.exeEhcfaboo.exeAcjclpcf.exeDafbne32.exeOqfdnhfk.exeQcgffqei.exeLlhikacp.exeLcdegnep.exeMkpgck32.exeGgnlobej.exeJnkcogno.exeEflhoigi.exeMnfipekh.exeBahmfj32.exeGicinj32.exeHijooifk.exeHoadkn32.exeDpemacql.exeHbhdmd32.exeDobfld32.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Aeddnp32.exe Aaiimadl.exe File opened for modification C:\Windows\SysWOW64\Jlhljhbg.exe File created C:\Windows\SysWOW64\Dgejpd32.exe Dpnbog32.exe File created C:\Windows\SysWOW64\Gkdhjknm.exe Fhflnpoi.exe File created C:\Windows\SysWOW64\Loolpf32.dll Jkaicd32.exe File created C:\Windows\SysWOW64\Bjqlnnkp.dll File created C:\Windows\SysWOW64\Jilnqqbj.exe Jfnbdecg.exe File created C:\Windows\SysWOW64\Gilmfhhk.dll Biogppeg.exe File opened for modification C:\Windows\SysWOW64\Locbfd32.exe Lldfjh32.exe File created C:\Windows\SysWOW64\Gimqajgh.exe File opened for modification C:\Windows\SysWOW64\Hpkknmgd.exe File opened for modification C:\Windows\SysWOW64\Piapkbeg.exe File created C:\Windows\SysWOW64\Habmmpbg.dll Alkdnboj.exe File created C:\Windows\SysWOW64\Beeoaapl.exe Bmngqdpj.exe File created C:\Windows\SysWOW64\Hkbmqb32.exe File created C:\Windows\SysWOW64\Albpkc32.exe File created C:\Windows\SysWOW64\Lqppgj32.dll File created C:\Windows\SysWOW64\Eoepebho.exe File created C:\Windows\SysWOW64\Bganhm32.exe Bebblb32.exe File opened for modification C:\Windows\SysWOW64\Ncfmno32.exe Npgabc32.exe File created C:\Windows\SysWOW64\Alnfpcag.exe File created C:\Windows\SysWOW64\Bhpopokm.dll File created C:\Windows\SysWOW64\Mokmdh32.exe File opened for modification C:\Windows\SysWOW64\Ncchae32.exe File created C:\Windows\SysWOW64\Lacaea32.dll File created C:\Windows\SysWOW64\Eqncnj32.exe File opened for modification C:\Windows\SysWOW64\Eidbij32.exe Ehcfaboo.exe File created C:\Windows\SysWOW64\Kdflmg32.dll File created C:\Windows\SysWOW64\Ppdbgncl.exe File created C:\Windows\SysWOW64\Kckqbj32.exe File created C:\Windows\SysWOW64\Afhohlbj.exe Acjclpcf.exe File opened for modification C:\Windows\SysWOW64\Cioilg32.exe File created C:\Windows\SysWOW64\Hjqaij32.dll Dafbne32.exe File opened for modification C:\Windows\SysWOW64\Odapnf32.exe Oqfdnhfk.exe File created C:\Windows\SysWOW64\Aoqimi32.dll Qcgffqei.exe File created C:\Windows\SysWOW64\Mngegmbc.exe Llhikacp.exe File opened for modification C:\Windows\SysWOW64\Hkbmqb32.exe File created C:\Windows\SysWOW64\Fniihmpf.exe File created C:\Windows\SysWOW64\Lgpagm32.exe Lcdegnep.exe File created C:\Windows\SysWOW64\Mnocof32.exe Mkpgck32.exe File opened for modification C:\Windows\SysWOW64\Goedpofl.exe Ggnlobej.exe File opened for modification C:\Windows\SysWOW64\Jeekkafl.exe Jnkcogno.exe File created C:\Windows\SysWOW64\Gmiadfmi.dll File created C:\Windows\SysWOW64\Ggmmlamj.exe File created C:\Windows\SysWOW64\Bejnmepn.dll Eflhoigi.exe File created C:\Windows\SysWOW64\Maaepd32.exe Mnfipekh.exe File created C:\Windows\SysWOW64\Fabibb32.dll File created C:\Windows\SysWOW64\Jgbjbp32.exe File created C:\Windows\SysWOW64\Lpghll32.dll File created C:\Windows\SysWOW64\Pjbcplpe.exe File created C:\Windows\SysWOW64\Bjpaooda.exe Bahmfj32.exe File created C:\Windows\SysWOW64\Kpihae32.dll Gicinj32.exe File opened for modification C:\Windows\SysWOW64\Hcpclbfa.exe Hijooifk.exe File opened for modification C:\Windows\SysWOW64\Hfklhhcl.exe Hoadkn32.exe File opened for modification C:\Windows\SysWOW64\Gkkgpc32.exe File created C:\Windows\SysWOW64\Gingkqkd.exe File opened for modification C:\Windows\SysWOW64\Ahbjoe32.exe File created C:\Windows\SysWOW64\Mkfoeejd.dll File created C:\Windows\SysWOW64\Jehocmdp.dll Dpemacql.exe File opened for modification C:\Windows\SysWOW64\Hibljoco.exe Hbhdmd32.exe File created C:\Windows\SysWOW64\Cpfmlghd.exe File created C:\Windows\SysWOW64\Mnokmd32.dll File opened for modification C:\Windows\SysWOW64\Daqbip32.exe Dobfld32.exe File created C:\Windows\SysWOW64\Jfhepbll.dll -
Program crash 1 IoCs
Processes:
pid pid_target process target process 6344 6912 -
Modifies registry class 64 IoCs
Processes:
Jqdoem32.exeQhngolpo.exeNqiogp32.exeJianff32.exePcbmka32.exeFamjkl32.exeGmoliohh.exeGhlcnk32.exeOcffempp.exeAaiimadl.exeQeemej32.exeHopnqdan.exePjgebf32.exeAkoqpg32.exeNpjebj32.exeLlpmoiof.exeEjpfhnpe.exeEoolbinc.exeEeidoc32.exeLbkkgl32.exeEcbenm32.exeHbdjchgn.exeGgnedlao.exeHkeaqi32.exeJpppnp32.exeLmbmibhb.exeNafjjf32.exePolppg32.exeFjepaecb.exeMpaifalo.exeChmeobkq.exeBebblb32.exeNojjcj32.exeIfjfnb32.exeKnflpoqf.exeBqilgmdg.exeDpnbog32.exeKibgmdcn.exePfgogh32.exeFpmggb32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Jqdoem32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Qhngolpo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Nqiogp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjbedgde.dll" Jianff32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Pcbmka32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fjmkqm32.dll" Famjkl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bfllfd32.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lpacnb32.dll" Gmoliohh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hikhen32.dll" Ghlcnk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ocffempp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pigqjdgo.dll" Aaiimadl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ppelifin.dll" Qeemej32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lejfpelg.dll" Hopnqdan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bkhakafh.dll" Pjgebf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Klobfk32.dll" Akoqpg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Npjebj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Llpmoiof.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ejpfhnpe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ijilflah.dll" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Eoolbinc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Eeidoc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Naagioah.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Lbkkgl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ecbenm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jndamj32.dll" Hbdjchgn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ggnedlao.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ganmcc32.dll" Hkeaqi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eanmnefk.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oendmdab.dll" Jpppnp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Lmbmibhb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Nafjjf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Polppg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Fjepaecb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hhapkbgi.dll" Mpaifalo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gohibf32.dll" Chmeobkq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Bebblb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Nojjcj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekmihm32.dll" Ifjfnb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Knflpoqf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Bqilgmdg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aplpihjd.dll" Dpnbog32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcoong32.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dakipgan.dll" Kibgmdcn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Pfgogh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mqnbqh32.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Fpmggb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
43b446cc8ee431f3e2217f8f8a12b0d0_NeikiAnalytics.exeDoccaall.exeDabpnlkp.exeDiihojkb.exeDlgdkeje.exeDofpgqji.exeDpemacql.exeDcdimopp.exeDebeijoc.exeDhqaefng.exeDcfebonm.exeDlojkddn.exeDchbhn32.exeEhekqe32.exeEpmcab32.exeEbnoikqb.exeElccfc32.exeEflhoigi.exeEqalmafo.exeEhlaaddj.exeEqciba32.exeEcbenm32.exedescription pid process target process PID 1940 wrote to memory of 1256 1940 43b446cc8ee431f3e2217f8f8a12b0d0_NeikiAnalytics.exe Doccaall.exe PID 1940 wrote to memory of 1256 1940 43b446cc8ee431f3e2217f8f8a12b0d0_NeikiAnalytics.exe Doccaall.exe PID 1940 wrote to memory of 1256 1940 43b446cc8ee431f3e2217f8f8a12b0d0_NeikiAnalytics.exe Doccaall.exe PID 1256 wrote to memory of 1612 1256 Doccaall.exe Dabpnlkp.exe PID 1256 wrote to memory of 1612 1256 Doccaall.exe Dabpnlkp.exe PID 1256 wrote to memory of 1612 1256 Doccaall.exe Dabpnlkp.exe PID 1612 wrote to memory of 1460 1612 Dabpnlkp.exe Diihojkb.exe PID 1612 wrote to memory of 1460 1612 Dabpnlkp.exe Diihojkb.exe PID 1612 wrote to memory of 1460 1612 Dabpnlkp.exe Diihojkb.exe PID 1460 wrote to memory of 3564 1460 Diihojkb.exe Dlgdkeje.exe PID 1460 wrote to memory of 3564 1460 Diihojkb.exe Dlgdkeje.exe PID 1460 wrote to memory of 3564 1460 Diihojkb.exe Dlgdkeje.exe PID 3564 wrote to memory of 3748 3564 Dlgdkeje.exe Dofpgqji.exe PID 3564 wrote to memory of 3748 3564 Dlgdkeje.exe Dofpgqji.exe PID 3564 wrote to memory of 3748 3564 Dlgdkeje.exe Dofpgqji.exe PID 3748 wrote to memory of 1040 3748 Dofpgqji.exe Dpemacql.exe PID 3748 wrote to memory of 1040 3748 Dofpgqji.exe Dpemacql.exe PID 3748 wrote to memory of 1040 3748 Dofpgqji.exe Dpemacql.exe PID 1040 wrote to memory of 2432 1040 Dpemacql.exe Dcdimopp.exe PID 1040 wrote to memory of 2432 1040 Dpemacql.exe Dcdimopp.exe PID 1040 wrote to memory of 2432 1040 Dpemacql.exe Dcdimopp.exe PID 2432 wrote to memory of 2408 2432 Dcdimopp.exe Debeijoc.exe PID 2432 wrote to memory of 2408 2432 Dcdimopp.exe Debeijoc.exe PID 2432 wrote to memory of 2408 2432 Dcdimopp.exe Debeijoc.exe PID 2408 wrote to memory of 1964 2408 Debeijoc.exe Dhqaefng.exe PID 2408 wrote to memory of 1964 2408 Debeijoc.exe Dhqaefng.exe PID 2408 wrote to memory of 1964 2408 Debeijoc.exe Dhqaefng.exe PID 1964 wrote to memory of 2436 1964 Dhqaefng.exe Dcfebonm.exe PID 1964 wrote to memory of 2436 1964 Dhqaefng.exe Dcfebonm.exe PID 1964 wrote to memory of 2436 1964 Dhqaefng.exe Dcfebonm.exe PID 2436 wrote to memory of 2616 2436 Dcfebonm.exe Dlojkddn.exe PID 2436 wrote to memory of 2616 2436 Dcfebonm.exe Dlojkddn.exe PID 2436 wrote to memory of 2616 2436 Dcfebonm.exe Dlojkddn.exe PID 2616 wrote to memory of 2600 2616 Dlojkddn.exe Dchbhn32.exe PID 2616 wrote to memory of 2600 2616 Dlojkddn.exe Dchbhn32.exe PID 2616 wrote to memory of 2600 2616 Dlojkddn.exe Dchbhn32.exe PID 2600 wrote to memory of 4872 2600 Dchbhn32.exe Ehekqe32.exe PID 2600 wrote to memory of 4872 2600 Dchbhn32.exe Ehekqe32.exe PID 2600 wrote to memory of 4872 2600 Dchbhn32.exe Ehekqe32.exe PID 4872 wrote to memory of 808 4872 Ehekqe32.exe Epmcab32.exe PID 4872 wrote to memory of 808 4872 Ehekqe32.exe Epmcab32.exe PID 4872 wrote to memory of 808 4872 Ehekqe32.exe Epmcab32.exe PID 808 wrote to memory of 4124 808 Epmcab32.exe Ebnoikqb.exe PID 808 wrote to memory of 4124 808 Epmcab32.exe Ebnoikqb.exe PID 808 wrote to memory of 4124 808 Epmcab32.exe Ebnoikqb.exe PID 4124 wrote to memory of 4100 4124 Ebnoikqb.exe Elccfc32.exe PID 4124 wrote to memory of 4100 4124 Ebnoikqb.exe Elccfc32.exe PID 4124 wrote to memory of 4100 4124 Ebnoikqb.exe Elccfc32.exe PID 4100 wrote to memory of 1508 4100 Elccfc32.exe Eflhoigi.exe PID 4100 wrote to memory of 1508 4100 Elccfc32.exe Eflhoigi.exe PID 4100 wrote to memory of 1508 4100 Elccfc32.exe Eflhoigi.exe PID 1508 wrote to memory of 4136 1508 Eflhoigi.exe Eqalmafo.exe PID 1508 wrote to memory of 4136 1508 Eflhoigi.exe Eqalmafo.exe PID 1508 wrote to memory of 4136 1508 Eflhoigi.exe Eqalmafo.exe PID 4136 wrote to memory of 5072 4136 Eqalmafo.exe Ehlaaddj.exe PID 4136 wrote to memory of 5072 4136 Eqalmafo.exe Ehlaaddj.exe PID 4136 wrote to memory of 5072 4136 Eqalmafo.exe Ehlaaddj.exe PID 5072 wrote to memory of 1128 5072 Ehlaaddj.exe Eqciba32.exe PID 5072 wrote to memory of 1128 5072 Ehlaaddj.exe Eqciba32.exe PID 5072 wrote to memory of 1128 5072 Ehlaaddj.exe Eqciba32.exe PID 1128 wrote to memory of 2024 1128 Eqciba32.exe Ecbenm32.exe PID 1128 wrote to memory of 2024 1128 Eqciba32.exe Ecbenm32.exe PID 1128 wrote to memory of 2024 1128 Eqciba32.exe Ecbenm32.exe PID 2024 wrote to memory of 984 2024 Ecbenm32.exe Emjjgbjp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\43b446cc8ee431f3e2217f8f8a12b0d0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\43b446cc8ee431f3e2217f8f8a12b0d0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\SysWOW64\Doccaall.exeC:\Windows\system32\Doccaall.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Windows\SysWOW64\Dabpnlkp.exeC:\Windows\system32\Dabpnlkp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Windows\SysWOW64\Diihojkb.exeC:\Windows\system32\Diihojkb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Windows\SysWOW64\Dlgdkeje.exeC:\Windows\system32\Dlgdkeje.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Windows\SysWOW64\Dofpgqji.exeC:\Windows\system32\Dofpgqji.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Windows\SysWOW64\Dpemacql.exeC:\Windows\system32\Dpemacql.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Windows\SysWOW64\Dcdimopp.exeC:\Windows\system32\Dcdimopp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Windows\SysWOW64\Debeijoc.exeC:\Windows\system32\Debeijoc.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\SysWOW64\Dhqaefng.exeC:\Windows\system32\Dhqaefng.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Windows\SysWOW64\Dcfebonm.exeC:\Windows\system32\Dcfebonm.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Windows\SysWOW64\Dlojkddn.exeC:\Windows\system32\Dlojkddn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\SysWOW64\Dchbhn32.exeC:\Windows\system32\Dchbhn32.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Windows\SysWOW64\Ehekqe32.exeC:\Windows\system32\Ehekqe32.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Windows\SysWOW64\Epmcab32.exeC:\Windows\system32\Epmcab32.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Windows\SysWOW64\Ebnoikqb.exeC:\Windows\system32\Ebnoikqb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Windows\SysWOW64\Elccfc32.exeC:\Windows\system32\Elccfc32.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Windows\SysWOW64\Eflhoigi.exeC:\Windows\system32\Eflhoigi.exe18⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Windows\SysWOW64\Eqalmafo.exeC:\Windows\system32\Eqalmafo.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Windows\SysWOW64\Ehlaaddj.exeC:\Windows\system32\Ehlaaddj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Windows\SysWOW64\Eqciba32.exeC:\Windows\system32\Eqciba32.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Windows\SysWOW64\Ecbenm32.exeC:\Windows\system32\Ecbenm32.exe22⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\SysWOW64\Emjjgbjp.exeC:\Windows\system32\Emjjgbjp.exe23⤵
- Executes dropped EXE
PID:984 -
C:\Windows\SysWOW64\Ecdbdl32.exeC:\Windows\system32\Ecdbdl32.exe24⤵
- Executes dropped EXE
PID:4444 -
C:\Windows\SysWOW64\Fjnjqfij.exeC:\Windows\system32\Fjnjqfij.exe25⤵
- Executes dropped EXE
PID:3940 -
C:\Windows\SysWOW64\Fmmfmbhn.exeC:\Windows\system32\Fmmfmbhn.exe26⤵
- Executes dropped EXE
PID:832 -
C:\Windows\SysWOW64\Ffekegon.exeC:\Windows\system32\Ffekegon.exe27⤵
- Executes dropped EXE
PID:392 -
C:\Windows\SysWOW64\Fjqgff32.exeC:\Windows\system32\Fjqgff32.exe28⤵
- Executes dropped EXE
PID:4440 -
C:\Windows\SysWOW64\Fcikolnh.exeC:\Windows\system32\Fcikolnh.exe29⤵
- Executes dropped EXE
PID:4068 -
C:\Windows\SysWOW64\Fifdgblo.exeC:\Windows\system32\Fifdgblo.exe30⤵
- Executes dropped EXE
PID:1620 -
C:\Windows\SysWOW64\Fqmlhpla.exeC:\Windows\system32\Fqmlhpla.exe31⤵
- Executes dropped EXE
PID:3456 -
C:\Windows\SysWOW64\Fckhdk32.exeC:\Windows\system32\Fckhdk32.exe32⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:3868 -
C:\Windows\SysWOW64\Fjepaecb.exeC:\Windows\system32\Fjepaecb.exe33⤵
- Executes dropped EXE
- Modifies registry class
PID:2948 -
C:\Windows\SysWOW64\Fqohnp32.exeC:\Windows\system32\Fqohnp32.exe34⤵
- Executes dropped EXE
PID:4572 -
C:\Windows\SysWOW64\Fflaff32.exeC:\Windows\system32\Fflaff32.exe35⤵
- Executes dropped EXE
PID:4020 -
C:\Windows\SysWOW64\Fmficqpc.exeC:\Windows\system32\Fmficqpc.exe36⤵
- Executes dropped EXE
PID:1932 -
C:\Windows\SysWOW64\Gcpapkgp.exeC:\Windows\system32\Gcpapkgp.exe37⤵
- Executes dropped EXE
PID:1008 -
C:\Windows\SysWOW64\Gfnnlffc.exeC:\Windows\system32\Gfnnlffc.exe38⤵
- Executes dropped EXE
PID:4424 -
C:\Windows\SysWOW64\Gimjhafg.exeC:\Windows\system32\Gimjhafg.exe39⤵
- Executes dropped EXE
PID:2488 -
C:\Windows\SysWOW64\Gqdbiofi.exeC:\Windows\system32\Gqdbiofi.exe40⤵
- Executes dropped EXE
PID:4756 -
C:\Windows\SysWOW64\Gcbnejem.exeC:\Windows\system32\Gcbnejem.exe41⤵
- Executes dropped EXE
PID:3060 -
C:\Windows\SysWOW64\Gjlfbd32.exeC:\Windows\system32\Gjlfbd32.exe42⤵
- Executes dropped EXE
PID:2916 -
C:\Windows\SysWOW64\Gqfooodg.exeC:\Windows\system32\Gqfooodg.exe43⤵
- Executes dropped EXE
PID:3688 -
C:\Windows\SysWOW64\Gcekkjcj.exeC:\Windows\system32\Gcekkjcj.exe44⤵
- Executes dropped EXE
PID:1476 -
C:\Windows\SysWOW64\Gfcgge32.exeC:\Windows\system32\Gfcgge32.exe45⤵
- Executes dropped EXE
PID:3160 -
C:\Windows\SysWOW64\Gjocgdkg.exeC:\Windows\system32\Gjocgdkg.exe46⤵
- Executes dropped EXE
PID:4956 -
C:\Windows\SysWOW64\Gqikdn32.exeC:\Windows\system32\Gqikdn32.exe47⤵
- Executes dropped EXE
PID:1968 -
C:\Windows\SysWOW64\Gcggpj32.exeC:\Windows\system32\Gcggpj32.exe48⤵
- Executes dropped EXE
PID:3240 -
C:\Windows\SysWOW64\Gjapmdid.exeC:\Windows\system32\Gjapmdid.exe49⤵
- Executes dropped EXE
PID:636 -
C:\Windows\SysWOW64\Gmoliohh.exeC:\Windows\system32\Gmoliohh.exe50⤵
- Executes dropped EXE
- Modifies registry class
PID:2220 -
C:\Windows\SysWOW64\Gpnhekgl.exeC:\Windows\system32\Gpnhekgl.exe51⤵
- Executes dropped EXE
PID:3044 -
C:\Windows\SysWOW64\Gfhqbe32.exeC:\Windows\system32\Gfhqbe32.exe52⤵
- Executes dropped EXE
PID:1404 -
C:\Windows\SysWOW64\Gameonno.exeC:\Windows\system32\Gameonno.exe53⤵
- Executes dropped EXE
PID:1240 -
C:\Windows\SysWOW64\Gppekj32.exeC:\Windows\system32\Gppekj32.exe54⤵
- Executes dropped EXE
PID:1584 -
C:\Windows\SysWOW64\Hfjmgdlf.exeC:\Windows\system32\Hfjmgdlf.exe55⤵
- Executes dropped EXE
PID:460 -
C:\Windows\SysWOW64\Hmdedo32.exeC:\Windows\system32\Hmdedo32.exe56⤵
- Executes dropped EXE
PID:5116 -
C:\Windows\SysWOW64\Hpbaqj32.exeC:\Windows\system32\Hpbaqj32.exe57⤵
- Executes dropped EXE
PID:3324 -
C:\Windows\SysWOW64\Hfljmdjc.exeC:\Windows\system32\Hfljmdjc.exe58⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:4232 -
C:\Windows\SysWOW64\Hikfip32.exeC:\Windows\system32\Hikfip32.exe59⤵
- Executes dropped EXE
PID:1896 -
C:\Windows\SysWOW64\Habnjm32.exeC:\Windows\system32\Habnjm32.exe60⤵
- Executes dropped EXE
PID:2900 -
C:\Windows\SysWOW64\Hbckbepg.exeC:\Windows\system32\Hbckbepg.exe61⤵
- Executes dropped EXE
PID:3008 -
C:\Windows\SysWOW64\Hfofbd32.exeC:\Windows\system32\Hfofbd32.exe62⤵
- Executes dropped EXE
PID:2476 -
C:\Windows\SysWOW64\Hmioonpn.exeC:\Windows\system32\Hmioonpn.exe63⤵
- Executes dropped EXE
PID:2640 -
C:\Windows\SysWOW64\Hpgkkioa.exeC:\Windows\system32\Hpgkkioa.exe64⤵
- Executes dropped EXE
PID:428 -
C:\Windows\SysWOW64\Hfachc32.exeC:\Windows\system32\Hfachc32.exe65⤵
- Executes dropped EXE
PID:4428 -
C:\Windows\SysWOW64\Hippdo32.exeC:\Windows\system32\Hippdo32.exe66⤵PID:2504
-
C:\Windows\SysWOW64\Hpihai32.exeC:\Windows\system32\Hpihai32.exe67⤵PID:1580
-
C:\Windows\SysWOW64\Hbhdmd32.exeC:\Windows\system32\Hbhdmd32.exe68⤵
- Drops file in System32 directory
PID:528 -
C:\Windows\SysWOW64\Hibljoco.exeC:\Windows\system32\Hibljoco.exe69⤵PID:4828
-
C:\Windows\SysWOW64\Ipldfi32.exeC:\Windows\system32\Ipldfi32.exe70⤵PID:4048
-
C:\Windows\SysWOW64\Ibjqcd32.exeC:\Windows\system32\Ibjqcd32.exe71⤵PID:4396
-
C:\Windows\SysWOW64\Ijaida32.exeC:\Windows\system32\Ijaida32.exe72⤵PID:3996
-
C:\Windows\SysWOW64\Impepm32.exeC:\Windows\system32\Impepm32.exe73⤵PID:3664
-
C:\Windows\SysWOW64\Ifhiib32.exeC:\Windows\system32\Ifhiib32.exe74⤵PID:4580
-
C:\Windows\SysWOW64\Iannfk32.exeC:\Windows\system32\Iannfk32.exe75⤵PID:4944
-
C:\Windows\SysWOW64\Ifjfnb32.exeC:\Windows\system32\Ifjfnb32.exe76⤵
- Modifies registry class
PID:1132 -
C:\Windows\SysWOW64\Imdnklfp.exeC:\Windows\system32\Imdnklfp.exe77⤵PID:4404
-
C:\Windows\SysWOW64\Idofhfmm.exeC:\Windows\system32\Idofhfmm.exe78⤵PID:4700
-
C:\Windows\SysWOW64\Iabgaklg.exeC:\Windows\system32\Iabgaklg.exe79⤵PID:3260
-
C:\Windows\SysWOW64\Idacmfkj.exeC:\Windows\system32\Idacmfkj.exe80⤵PID:4632
-
C:\Windows\SysWOW64\Ijkljp32.exeC:\Windows\system32\Ijkljp32.exe81⤵PID:3224
-
C:\Windows\SysWOW64\Jaedgjjd.exeC:\Windows\system32\Jaedgjjd.exe82⤵PID:2056
-
C:\Windows\SysWOW64\Jfaloa32.exeC:\Windows\system32\Jfaloa32.exe83⤵PID:4920
-
C:\Windows\SysWOW64\Jagqlj32.exeC:\Windows\system32\Jagqlj32.exe84⤵PID:4476
-
C:\Windows\SysWOW64\Jbhmdbnp.exeC:\Windows\system32\Jbhmdbnp.exe85⤵PID:836
-
C:\Windows\SysWOW64\Jmnaakne.exeC:\Windows\system32\Jmnaakne.exe86⤵PID:1376
-
C:\Windows\SysWOW64\Jdhine32.exeC:\Windows\system32\Jdhine32.exe87⤵PID:2124
-
C:\Windows\SysWOW64\Jmpngk32.exeC:\Windows\system32\Jmpngk32.exe88⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4880 -
C:\Windows\SysWOW64\Jdjfcecp.exeC:\Windows\system32\Jdjfcecp.exe89⤵PID:2036
-
C:\Windows\SysWOW64\Jkdnpo32.exeC:\Windows\system32\Jkdnpo32.exe90⤵PID:4332
-
C:\Windows\SysWOW64\Jmbklj32.exeC:\Windows\system32\Jmbklj32.exe91⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3232 -
C:\Windows\SysWOW64\Jpaghf32.exeC:\Windows\system32\Jpaghf32.exe92⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:920 -
C:\Windows\SysWOW64\Jdmcidam.exeC:\Windows\system32\Jdmcidam.exe93⤵PID:3508
-
C:\Windows\SysWOW64\Jkfkfohj.exeC:\Windows\system32\Jkfkfohj.exe94⤵PID:3080
-
C:\Windows\SysWOW64\Jiikak32.exeC:\Windows\system32\Jiikak32.exe95⤵PID:4876
-
C:\Windows\SysWOW64\Kpccnefa.exeC:\Windows\system32\Kpccnefa.exe96⤵PID:4636
-
C:\Windows\SysWOW64\Kbapjafe.exeC:\Windows\system32\Kbapjafe.exe97⤵PID:1472
-
C:\Windows\SysWOW64\Kkihknfg.exeC:\Windows\system32\Kkihknfg.exe98⤵PID:3660
-
C:\Windows\SysWOW64\Kmgdgjek.exeC:\Windows\system32\Kmgdgjek.exe99⤵PID:4652
-
C:\Windows\SysWOW64\Kpepcedo.exeC:\Windows\system32\Kpepcedo.exe100⤵PID:3416
-
C:\Windows\SysWOW64\Kbdmpqcb.exeC:\Windows\system32\Kbdmpqcb.exe101⤵PID:1248
-
C:\Windows\SysWOW64\Kmjqmi32.exeC:\Windows\system32\Kmjqmi32.exe102⤵PID:800
-
C:\Windows\SysWOW64\Kphmie32.exeC:\Windows\system32\Kphmie32.exe103⤵PID:5184
-
C:\Windows\SysWOW64\Kgbefoji.exeC:\Windows\system32\Kgbefoji.exe104⤵PID:5236
-
C:\Windows\SysWOW64\Kipabjil.exeC:\Windows\system32\Kipabjil.exe105⤵PID:5280
-
C:\Windows\SysWOW64\Kpjjod32.exeC:\Windows\system32\Kpjjod32.exe106⤵PID:5324
-
C:\Windows\SysWOW64\Kgdbkohf.exeC:\Windows\system32\Kgdbkohf.exe107⤵PID:5368
-
C:\Windows\SysWOW64\Kmnjhioc.exeC:\Windows\system32\Kmnjhioc.exe108⤵PID:5408
-
C:\Windows\SysWOW64\Kpmfddnf.exeC:\Windows\system32\Kpmfddnf.exe109⤵PID:5448
-
C:\Windows\SysWOW64\Kckbqpnj.exeC:\Windows\system32\Kckbqpnj.exe110⤵PID:5496
-
C:\Windows\SysWOW64\Lgikfn32.exeC:\Windows\system32\Lgikfn32.exe111⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5540 -
C:\Windows\SysWOW64\Liggbi32.exeC:\Windows\system32\Liggbi32.exe112⤵PID:5580
-
C:\Windows\SysWOW64\Laopdgcg.exeC:\Windows\system32\Laopdgcg.exe113⤵PID:5620
-
C:\Windows\SysWOW64\Ldmlpbbj.exeC:\Windows\system32\Ldmlpbbj.exe114⤵PID:5664
-
C:\Windows\SysWOW64\Lkgdml32.exeC:\Windows\system32\Lkgdml32.exe115⤵PID:5708
-
C:\Windows\SysWOW64\Laalifad.exeC:\Windows\system32\Laalifad.exe116⤵PID:5752
-
C:\Windows\SysWOW64\Ldohebqh.exeC:\Windows\system32\Ldohebqh.exe117⤵PID:5796
-
C:\Windows\SysWOW64\Lkiqbl32.exeC:\Windows\system32\Lkiqbl32.exe118⤵PID:5836
-
C:\Windows\SysWOW64\Laciofpa.exeC:\Windows\system32\Laciofpa.exe119⤵PID:5884
-
C:\Windows\SysWOW64\Lcdegnep.exeC:\Windows\system32\Lcdegnep.exe120⤵
- Drops file in System32 directory
PID:5924 -
C:\Windows\SysWOW64\Lgpagm32.exeC:\Windows\system32\Lgpagm32.exe121⤵PID:5964
-
C:\Windows\SysWOW64\Lnjjdgee.exeC:\Windows\system32\Lnjjdgee.exe122⤵PID:6004
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-