e1f8a7e15385279472c0b74702d99ed2f437baefa35fb118966013c066e700d1

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
07/06/2024, 14:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c8a85993c1e64ef2fddfa13aabe438c0_NeikiAnalytics.exe
Size 130KB
Sample240607-sagngaaa6v
SHA256 e1f8a7e15385279472c0b74702d99ed2f437baefa35fb118966013c066e700d1
MD5 c8a85993c1e64ef2fddfa13aabe438c0
SHA1 f9d7360f829e795cfe109944d9c2841ea8833940
SHA512 179fcf4c0d0550d5f1476e66e419ab2119404961d50c6401883bae13547860405f419534ee2ec6c8c4daceace45eae3b4269f72261615ddeffd02700c6a1de22
SSDEEP 3072:EGfAUbd5CR4Up+UPO0ksS7KoD1f2CfUpHzk2r0O:X1b/UJO0m7Ko5fvfo3R
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\OUD4E7P.{645FF040-5081-101B-9F08-00AA002F954E}\\XQW7J4P.exe\""	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\OUD4E7P.{645FF040-5081-101B-9F08-00AA002F954E}\\XQW7J4P.exe\""	lsass.exe

Modifies visibility of file extensions in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	system.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	lsass.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	system.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	lsass.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Sets file execution options in registry 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\debugger = "C:\\Windows\\notepad.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\debugger = "C:\\Windows\\notepad.exe"	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\debugger = "C:\\Windows\\notepad.exe"	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\debugger = "C:\\Windows\\OUD4E7P.{645FF040-5081-101B-9F08-00AA002F954E}\\regedit.cmd"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\debugger = "C:\\Windows\\notepad.exe"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	system.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\debugger = "C:\\Windows\\OUD4E7P.{645FF040-5081-101B-9F08-00AA002F954E}\\regedit.cmd"	system.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	system.exe

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0007000000023486-147.dat	acprotect

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	c8a85993c1e64ef2fddfa13aabe438c0_NeikiAnalytics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	lsass.exe

Executes dropped EXE 5 IoCs

pid	Process
2352	service.exe
4472	smss.exe
3564	system.exe
704	winlogon.exe
4984	lsass.exe

Loads dropped DLL 1 IoCs

pid	Process
3564	system.exe

Modifies system executable filetype association 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	lsass.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0007000000023486-147.dat	upx
behavioral2/memory/3564-322-0x0000000010000000-0x0000000010075000-memory.dmp	upx
behavioral2/memory/3564-337-0x0000000010000000-0x0000000010075000-memory.dmp	upx

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sUD8O1T0 = "C:\\Windows\\system32\\CUT4D0VWDM2I2H.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\0J4PDM = "C:\\Windows\\RTG8O1T.exe"	lsass.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sUD8O1T0 = "C:\\Windows\\system32\\CUT4D0VWDM2I2H.exe"	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\0J4PDM = "C:\\Windows\\RTG8O1T.exe"	system.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	service.exe
File opened (read-only)	\??\N:	service.exe
File opened (read-only)	\??\W:	service.exe
File opened (read-only)	\??\S:	service.exe
File opened (read-only)	\??\T:	service.exe
File opened (read-only)	\??\I:	service.exe
File opened (read-only)	\??\K:	service.exe
File opened (read-only)	\??\O:	service.exe
File opened (read-only)	\??\P:	service.exe
File opened (read-only)	\??\Q:	service.exe
File opened (read-only)	\??\Y:	service.exe
File opened (read-only)	\??\G:	service.exe
File opened (read-only)	\??\M:	service.exe
File opened (read-only)	\??\U:	service.exe
File opened (read-only)	\??\V:	service.exe
File opened (read-only)	\??\X:	service.exe
File opened (read-only)	\??\E:	service.exe
File opened (read-only)	\??\H:	service.exe
File opened (read-only)	\??\J:	service.exe
File opened (read-only)	\??\R:	service.exe
File opened (read-only)	\??\Z:	service.exe

Drops file in System32 directory 42 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\SKL8O0Y\CUT4D0V.cmd	smss.exe
File opened for modification	C:\Windows\SysWOW64\SKL8O0Y	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	smss.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	system.exe
File opened for modification	C:\Windows\SysWOW64\SKL8O0Y	c8a85993c1e64ef2fddfa13aabe438c0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	system.exe
File opened for modification	C:\Windows\SysWOW64\SKL8O0Y\CUT4D0V.cmd	service.exe
File opened for modification	C:\Windows\SysWOW64\JIL8Q7E.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\SKL8O0Y	lsass.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	lsass.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	lsass.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	c8a85993c1e64ef2fddfa13aabe438c0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	service.exe
File opened for modification	C:\Windows\SysWOW64\JIL8Q7E.exe	lsass.exe
File opened for modification	C:\Windows\SysWOW64\SKL8O0Y\CUT4D0V.cmd	lsass.exe
File opened for modification	C:\Windows\SysWOW64\CUT4D0VWDM2I2H.exe	lsass.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	smss.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	system.exe
File opened for modification	C:\Windows\SysWOW64\CUT4D0VWDM2I2H.exe	service.exe
File opened for modification	C:\Windows\SysWOW64\SKL8O0Y\CUT4D0V.cmd	system.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	c8a85993c1e64ef2fddfa13aabe438c0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	c8a85993c1e64ef2fddfa13aabe438c0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	service.exe
File opened for modification	C:\Windows\SysWOW64\JIL8Q7E.exe	service.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	service.exe
File opened for modification	C:\Windows\SysWOW64\SKL8O0Y\CUT4D0V.cmd	c8a85993c1e64ef2fddfa13aabe438c0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\SKL8O0Y	service.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\SKL8O0Y\CUT4D0V.cmd	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\CUT4D0VWDM2I2H.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\JIL8Q7E.exe	system.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\SKL8O0Y	smss.exe
File opened for modification	C:\Windows\SysWOW64\SKL8O0Y	system.exe
File opened for modification	C:\Windows\SysWOW64\CUT4D0VWDM2I2H.exe	system.exe
File opened for modification	C:\Windows\SysWOW64\CUT4D0VWDM2I2H.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\JIL8Q7E.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	lsass.exe
File opened for modification	C:\Windows\SysWOW64\CUT4D0VWDM2I2H.exe	c8a85993c1e64ef2fddfa13aabe438c0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\JIL8Q7E.exe	c8a85993c1e64ef2fddfa13aabe438c0_NeikiAnalytics.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\OUD4E7P.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe	system.exe
File opened for modification	C:\Windows\WDM2I2H.exe	system.exe
File opened for modification	C:\Windows\onceinabluemoon.mid	service.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	service.exe
File opened for modification	C:\Windows\cypreg.dll	system.exe
File opened for modification	C:\Windows\moonlight.dll	system.exe
File opened for modification	C:\Windows\OUD4E7P.{645FF040-5081-101B-9F08-00AA002F954E}\regedit.cmd	winlogon.exe
File opened for modification	C:\Windows\WDM2I2H.exe	winlogon.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	lsass.exe
File opened for modification	C:\Windows\OUD4E7P.{645FF040-5081-101B-9F08-00AA002F954E}\winlogon.exe	lsass.exe
File opened for modification	C:\Windows\moonlight.dll	c8a85993c1e64ef2fddfa13aabe438c0_NeikiAnalytics.exe
File opened for modification	C:\Windows\cypreg.dll	c8a85993c1e64ef2fddfa13aabe438c0_NeikiAnalytics.exe
File opened for modification	C:\Windows\OUD4E7P.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe	c8a85993c1e64ef2fddfa13aabe438c0_NeikiAnalytics.exe
File opened for modification	C:\Windows\lsass.exe	lsass.exe
File opened for modification	C:\Windows\WDM2I2H.exe	lsass.exe
File opened for modification	C:\Windows\64enc.en	system.exe
File opened for modification	C:\Windows\OUD4E7P.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe	system.exe
File opened for modification	C:\Windows\RTG8O1T.exe	service.exe
File opened for modification	C:\Windows\WDM2I2H.exe	service.exe
File opened for modification	C:\Windows\OUD4E7P.{645FF040-5081-101B-9F08-00AA002F954E}\NRN8R6K.com	lsass.exe
File opened for modification	C:\Windows\OUD4E7P.{645FF040-5081-101B-9F08-00AA002F954E}\XQW7J4P.exe	lsass.exe
File created	C:\Windows\OUD4E7P.{645FF040-5081-101B-9F08-00AA002F954E}\MYpIC.zip	system.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	c8a85993c1e64ef2fddfa13aabe438c0_NeikiAnalytics.exe
File opened for modification	C:\Windows\OUD4E7P.{645FF040-5081-101B-9F08-00AA002F954E}	winlogon.exe
File opened for modification	C:\Windows\OUD4E7P.{645FF040-5081-101B-9F08-00AA002F954E}\NRN8R6K.com	system.exe
File opened for modification	C:\Windows\moonlight.dll	lsass.exe
File opened for modification	C:\Windows\onceinabluemoon.mid	lsass.exe
File opened for modification	C:\Windows\cypreg.dll	lsass.exe
File opened for modification	C:\Windows\OUD4E7P.{645FF040-5081-101B-9F08-00AA002F954E}\winlogon.exe	c8a85993c1e64ef2fddfa13aabe438c0_NeikiAnalytics.exe
File opened for modification	C:\Windows\onceinabluemoon.mid	system.exe
File opened for modification	C:\Windows\OUD4E7P.{645FF040-5081-101B-9F08-00AA002F954E}\winlogon.exe	smss.exe
File opened for modification	C:\Windows\cypreg.dll	service.exe
File opened for modification	C:\Windows\RTG8O1T.exe	system.exe
File opened for modification	C:\Windows\OUD4E7P.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe	smss.exe
File opened for modification	C:\Windows\RTG8O1T.exe	winlogon.exe
File opened for modification	C:\Windows\WDM2I2H.exe	c8a85993c1e64ef2fddfa13aabe438c0_NeikiAnalytics.exe
File opened for modification	C:\Windows\OUD4E7P.{645FF040-5081-101B-9F08-00AA002F954E}	service.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	smss.exe
File opened for modification	C:\Windows\cypreg.dll	smss.exe
File created	C:\Windows\OUD4E7P.{645FF040-5081-101B-9F08-00AA002F954E}\zia04744	system.exe
File opened for modification	C:\Windows\OUD4E7P.{645FF040-5081-101B-9F08-00AA002F954E}\regedit.cmd	c8a85993c1e64ef2fddfa13aabe438c0_NeikiAnalytics.exe
File opened for modification	C:\Windows\OUD4E7P.{645FF040-5081-101B-9F08-00AA002F954E}\NRN8R6K.com	c8a85993c1e64ef2fddfa13aabe438c0_NeikiAnalytics.exe
File opened for modification	C:\Windows\OUD4E7P.{645FF040-5081-101B-9F08-00AA002F954E}\XQW7J4P.exe	service.exe
File opened for modification	C:\Windows\moonlight.dll	smss.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	winlogon.exe
File opened for modification	C:\Windows\OUD4E7P.{645FF040-5081-101B-9F08-00AA002F954E}	system.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	system.exe
File opened for modification	C:\Windows\moonlight.dll	winlogon.exe
File opened for modification	C:\Windows\lsass.exe	system.exe
File opened for modification	C:\Windows\onceinabluemoon.mid	c8a85993c1e64ef2fddfa13aabe438c0_NeikiAnalytics.exe
File opened for modification	C:\Windows\OUD4E7P.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe	c8a85993c1e64ef2fddfa13aabe438c0_NeikiAnalytics.exe
File opened for modification	C:\Windows\OUD4E7P.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe	c8a85993c1e64ef2fddfa13aabe438c0_NeikiAnalytics.exe
File opened for modification	C:\Windows\onceinabluemoon.mid	winlogon.exe
File opened for modification	C:\Windows\OUD4E7P.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe	service.exe
File opened for modification	C:\Windows\OUD4E7P.{645FF040-5081-101B-9F08-00AA002F954E}\NRN8R6K.com	smss.exe
File opened for modification	C:\Windows\cypreg.dll	winlogon.exe
File opened for modification	C:\Windows\OUD4E7P.{645FF040-5081-101B-9F08-00AA002F954E}\NRN8R6K.com	winlogon.exe
File opened for modification	C:\Windows\RTG8O1T.exe	c8a85993c1e64ef2fddfa13aabe438c0_NeikiAnalytics.exe
File opened for modification	C:\Windows\OUD4E7P.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe	system.exe
File opened for modification	C:\Windows\OUD4E7P.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe	smss.exe
File opened for modification	C:\Windows\OUD4E7P.{645FF040-5081-101B-9F08-00AA002F954E}\regedit.cmd	lsass.exe
File opened for modification	C:\Windows\OUD4E7P.{645FF040-5081-101B-9F08-00AA002F954E}\XQW7J4P.exe	smss.exe
File opened for modification	C:\Windows\OUD4E7P.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe	lsass.exe
File opened for modification	C:\Windows\RTG8O1T.exe	lsass.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "File Folder"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	c8a85993c1e64ef2fddfa13aabe438c0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	system.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "File Folder"	system.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	lsass.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeBackupPrivilege	3564	system.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3256	c8a85993c1e64ef2fddfa13aabe438c0_NeikiAnalytics.exe
2352	service.exe
4472	smss.exe
3564	system.exe
704	winlogon.exe
4984	lsass.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3256 wrote to memory of 2352	3256	c8a85993c1e64ef2fddfa13aabe438c0_NeikiAnalytics.exe	82
PID 3256 wrote to memory of 2352	3256	c8a85993c1e64ef2fddfa13aabe438c0_NeikiAnalytics.exe	82
PID 3256 wrote to memory of 2352	3256	c8a85993c1e64ef2fddfa13aabe438c0_NeikiAnalytics.exe	82
PID 3256 wrote to memory of 4472	3256	c8a85993c1e64ef2fddfa13aabe438c0_NeikiAnalytics.exe	83
PID 3256 wrote to memory of 4472	3256	c8a85993c1e64ef2fddfa13aabe438c0_NeikiAnalytics.exe	83
PID 3256 wrote to memory of 4472	3256	c8a85993c1e64ef2fddfa13aabe438c0_NeikiAnalytics.exe	83
PID 3256 wrote to memory of 3564	3256	c8a85993c1e64ef2fddfa13aabe438c0_NeikiAnalytics.exe	84
PID 3256 wrote to memory of 3564	3256	c8a85993c1e64ef2fddfa13aabe438c0_NeikiAnalytics.exe	84
PID 3256 wrote to memory of 3564	3256	c8a85993c1e64ef2fddfa13aabe438c0_NeikiAnalytics.exe	84
PID 3256 wrote to memory of 704	3256	c8a85993c1e64ef2fddfa13aabe438c0_NeikiAnalytics.exe	85
PID 3256 wrote to memory of 704	3256	c8a85993c1e64ef2fddfa13aabe438c0_NeikiAnalytics.exe	85
PID 3256 wrote to memory of 704	3256	c8a85993c1e64ef2fddfa13aabe438c0_NeikiAnalytics.exe	85
PID 3256 wrote to memory of 4984	3256	c8a85993c1e64ef2fddfa13aabe438c0_NeikiAnalytics.exe	86
PID 3256 wrote to memory of 4984	3256	c8a85993c1e64ef2fddfa13aabe438c0_NeikiAnalytics.exe	86
PID 3256 wrote to memory of 4984	3256	c8a85993c1e64ef2fddfa13aabe438c0_NeikiAnalytics.exe	86

C:\Users\Admin\AppData\Local\Temp\c8a85993c1e64ef2fddfa13aabe438c0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\c8a85993c1e64ef2fddfa13aabe438c0_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3256
- C:\Windows\OUD4E7P.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe
  "C:\Windows\OUD4E7P.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:2352
- C:\Windows\OUD4E7P.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe
  "C:\Windows\OUD4E7P.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:4472
- C:\Windows\OUD4E7P.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe
  "C:\Windows\OUD4E7P.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Sets file execution options in registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies system executable filetype association
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3564
- C:\Windows\OUD4E7P.{645FF040-5081-101B-9F08-00AA002F954E}\winlogon.exe
  "C:\Windows\OUD4E7P.{645FF040-5081-101B-9F08-00AA002F954E}\winlogon.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:704
- C:\Windows\lsass.exe
  "C:\Windows\lsass.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Sets file execution options in registry
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:4984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

NRN8R6K.com

Path C:\Windows\OUD4E7P.{645FF040-5081-101B-9F08-00AA002F954E}\NRN8R6K.com
Size 130KB
SHA256 ac018d4bddec680bdf4b7d1d764affe803a7bd0fd36bf09fe4bf40e13aee4b20
MD5 80020257d10f170e851461401cb4c1fe
SHA1 9dc787963aa86958722232b07ec191934c7536e5
SHA512 7b22b1870ccd263bc271120fe759947e25fee7ca58867170d5f392c97a7d0cebe97ebcb757e50db0eb7eb4e363d54b5352fdafc030f9f25aca7de85d91160b43
SSDEEP 3072:UGfAUbd5CR4Up+UPO0ksS7KoD1f2CfUpHzk2r0O:H1b/UJO0m7Ko5fvfo3R
MD5 SHA1 SHA512 SSDEEP

Submit Download

NRN8R6K.com

Path C:\Windows\OUD4E7P.{645FF040-5081-101B-9F08-00AA002F954E}\NRN8R6K.com
Size 130KB
SHA256 948f323b2558696fea89de32f3242dc8af5590ebd166ed0f760498b9fa10e340
MD5 e5120d6141e22efee2f96599c823d12d
SHA1 3bd9446141cd292d8e32f73c4887ef73715ea9ad
SHA512 b0e657033236c4330698799e1510b2feadd52ef00002f0965a88bc40d6ec396f6abafe3667ad82a01e9eecede33faa49704c83eeb99b3360bbd0a29bd2b322fd
SSDEEP 3072:XGfAUbd5CR4Up+UPO0ksS7KoD1f2CfUpHzk2r0O:c1b/UJO0m7Ko5fvfo3R
MD5 SHA1 SHA512 SSDEEP

Submit Download

XQW7J4P.exe

Path C:\Windows\OUD4E7P.{645FF040-5081-101B-9F08-00AA002F954E}\XQW7J4P.exe
Size 130KB
SHA256 c73e10d9c2fdbfd3fcab1f1cedb7000c56a7b8c2ea2d90b667222d0ba602b5e2
MD5 719fa460c2d1009f1fe517cf4d24f1d9
SHA1 c6be67493395963244f3cc2e2fe4ca60991604f8
SHA512 75e11ef337d3313c6553e90bcc2bf094122068fbcb41abbba4062173595505c10e83200ded2f30604b9c955916675a139cd7d7e522caa8f5daa62a411be24c0e
SSDEEP 3072:LGfAUbd5CR4Up+UPO0ksS7KoD1f2CfUpHzk2r0O:I1b/UJO0m7Ko5fvfo3R
MD5 SHA1 SHA512 SSDEEP

Submit Download

XQW7J4P.exe

Path C:\Windows\OUD4E7P.{645FF040-5081-101B-9F08-00AA002F954E}\XQW7J4P.exe
Size 130KB
SHA256 9f08ce1c8e2de75f642f7516149b9132b492ee560530edd0774153e6c11aa545
MD5 cecef4c97978f993554f41077fcf8738
SHA1 c32788606269c16953bf7352c04be0e8caf5ab2d
SHA512 5078f6d3432daf27e919e8f41d87e0c02e603c9d770d7812cace1da975c8a1d0f5219f572fa14ea1cc222e8ea435b7620cb8408030ef84068c78baf0ae868157
SSDEEP 3072:QGfAUbd5CR4Up+UPO0ksS7KoD1f2CfUpHzk2r0O:71b/UJO0m7Ko5fvfo3R
MD5 SHA1 SHA512 SSDEEP

Submit Download

XQW7J4P.exe

Path C:\Windows\OUD4E7P.{645FF040-5081-101B-9F08-00AA002F954E}\XQW7J4P.exe
Size 130KB
SHA256 2a1a9203edb32c305a58a80734039164acf9833df2437fb56580704cae59bc9e
MD5 038cc894c2c5c59894673fefeffb5e80
SHA1 67b45a17522351e4104bd1b97bb5777e905acb62
SHA512 4c750880931f4cc7b5a6c8778bb8587958e37e2125ee306d3c8c8e4b8c5e3c86193c74482b87838e3e8a7e47cfacb56ce85155cbd06b67c6964b2f3b3a5fcdbe
SSDEEP 3072:tGfAUbd5CR4Up+UPO0ksS7KoD1f2CfUpHzk2r0O:61b/UJO0m7Ko5fvfo3R
MD5 SHA1 SHA512 SSDEEP

Submit Download

regedit.cmd

Path C:\Windows\OUD4E7P.{645FF040-5081-101B-9F08-00AA002F954E}\regedit.cmd
Size 130KB
SHA256 e1f8a7e15385279472c0b74702d99ed2f437baefa35fb118966013c066e700d1
MD5 c8a85993c1e64ef2fddfa13aabe438c0
SHA1 f9d7360f829e795cfe109944d9c2841ea8833940
SHA512 179fcf4c0d0550d5f1476e66e419ab2119404961d50c6401883bae13547860405f419534ee2ec6c8c4daceace45eae3b4269f72261615ddeffd02700c6a1de22
SSDEEP 3072:EGfAUbd5CR4Up+UPO0ksS7KoD1f2CfUpHzk2r0O:X1b/UJO0m7Ko5fvfo3R
MD5 SHA1 SHA512 SSDEEP

Submit Download

service.exe

Path C:\Windows\OUD4E7P.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe
Size 130KB
SHA256 a0514bd7fa4739fd2b582c950aaf5b2aaece54208d3c6571f3ef7976954fc155
MD5 ea4ba1c5a2e97edf00744a9334082716
SHA1 6b64a0dedc11e89375b90fcf64d6556377e04116
SHA512 8364f987f9410164180b0cbd3f0b917d7289b1aa90763a4fc02ee83d051ede1e8cb15e88f541ce9012097164c3b37b0271206af9448e8edc99c78df22dc52a15
SSDEEP 3072:dGfAUbd5CR4Up+UPO0ksS7KoD1f2CfUpHzk2r0O:K1b/UJO0m7Ko5fvfo3R
MD5 SHA1 SHA512 SSDEEP

Submit Download

smss.exe

Path C:\Windows\OUD4E7P.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe
Size 130KB
SHA256 70f4e75ca4fe5b4cff0dfd753eef0d6064b7ca4529955a247700d4852e31209a
MD5 439dc783495adcc31337fc348444be38
SHA1 f8e7c8d8cf9d8a6746ddb3b92888442c94d4bb4c
SHA512 f2965e7e0064f34f071d49585d503867eb5e75ecb415e26cb6f458fb32d37424a7e83170a3e289d83585c5d8c76cd827c699dc1e8d9a447b9e91074c8db48156
SSDEEP 3072:xGfAUbd5CR4Up+UPO0ksS7KoD1f2CfUpHzk2r0O:m1b/UJO0m7Ko5fvfo3R
MD5 SHA1 SHA512 SSDEEP

Submit Download

system.exe

Path C:\Windows\OUD4E7P.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe
Size 130KB
SHA256 ebb56bc43c9c073e5081fce641258b57574b917ea21ec4a4cbdff29ce511d3d3
MD5 6fc52e59d4b5c2feaf31b2655085d3c0
SHA1 9934ce0e47f67dd470e3680d9552f00ae0ed3b5e
SHA512 40d43764f2ece2a9f9d00f33d63e26542a48411e2d4f9858a57e80ecbd1f9c4ba4c95eacdfc1f21981c1a2630060fc914d100acd35d63e0dee1deadc3b71147d
SSDEEP 3072:oGfAUbd5CR4Up+UPO0ksS7KoD1f2CfUpHzk2r0O:T1b/UJO0m7Ko5fvfo3R
MD5 SHA1 SHA512 SSDEEP

Submit Download

winlogon.exe

Path C:\Windows\OUD4E7P.{645FF040-5081-101B-9F08-00AA002F954E}\winlogon.exe
Size 130KB
SHA256 c49649783044c4668849a2631d87af361a02ab8b1800fb8bbf87dd3fdfc6153f
MD5 84b2b88090ac249be865ba4c4c50ea20
SHA1 a17f7f8b825dce91a411041c3f6d0c6607bf1e38
SHA512 2f957d3458b7dc545ac2fc80e7c4f1ec524828066f196a715f2e3c65c9c0b2cd377266bd5f2c3d52753f57f2456114dea8f2ac3007337750f9112c7f93886723
SSDEEP 3072:lGfAUbd5CR4Up+UPO0ksS7KoD1f2CfUpHzk2r0O:y1b/UJO0m7Ko5fvfo3R
MD5 SHA1 SHA512 SSDEEP

Submit Download

RTG8O1T.exe

Path C:\Windows\RTG8O1T.exe
Size 130KB
SHA256 716821e24c5579b050e8deae3a3658ae8f8b85750dffccf115bd14ac561a67de
MD5 efe1579d6bcbc2a9bdc1fcdd6545c40d
SHA1 2e3d02c8bfc60452b9db179cb2b04cb14e827031
SHA512 419e4d7a8be3f097001816c8c84db4134ae4efeb4077a7bf81fd6d57204c58acf0172a27b61a1367ca3c1257206b610c0e04abaa38d5464516aa143a9d4d5a9b
SSDEEP 3072:WGfAUbd5CR4Up+UPO0ksS7KoD1f2CfUpHzk2r0O:h1b/UJO0m7Ko5fvfo3R
MD5 SHA1 SHA512 SSDEEP

Submit Download

CUT4D0VWDM2I2H.exe

Path C:\Windows\SysWOW64\CUT4D0VWDM2I2H.exe
Size 130KB
SHA256 cafcbcf59d7d4c1401306f8b607bfab59a8ac4d2dfc133382c362dbe068be32b
MD5 6c9e772f2c3565a5d51124a33d8bd0fd
SHA1 514edd132ca3f66fc45c444b2f751122dc1d03dc
SHA512 642ba1488aa05b4175b32859e6624146cc8077147b382d01e429970eda3fc997bf062298cf3c9b06ecab3620ffef3eb4defc0e7e3a23bc91f34668e7db74e1f6
SSDEEP 3072:qGfAUbd5CR4Up+UPO0ksS7KoD1f2CfUpHzk2r0O:91b/UJO0m7Ko5fvfo3R
MD5 SHA1 SHA512 SSDEEP

Submit Download

CUT4D0VWDM2I2H.exe

Path C:\Windows\SysWOW64\CUT4D0VWDM2I2H.exe
Size 130KB
SHA256 4c64410308e468b37ee29af48cc6b5826a49c293d7cf0623a0b81eca468c71cd
MD5 c0c52b030fafe942fbfd61a67d943d4b
SHA1 b64bec80b2e8daba0f3bd85712d9b067596019f9
SHA512 380f0f9f12b5471153d822162eedd9d497f9964d747102d1826a6618474bab3cc5d940f8d29ef62be8d445ffd081d6dc20aaf7ca844ebe0084f30cc32c6e7fac
SSDEEP 3072:jGfAUbd5CR4Up+UPO0ksS7KoD1f2CfUpHzk2r0O:g1b/UJO0m7Ko5fvfo3R
MD5 SHA1 SHA512 SSDEEP

Submit Download

CUT4D0VWDM2I2H.exe

Path C:\Windows\SysWOW64\CUT4D0VWDM2I2H.exe
Size 130KB
SHA256 9fb264851d149b3baacaeded3b52f701e0411a914a8b88ad26b15ce3c13b82f2
MD5 1f8e5169bc1779b21a8139a86cce1e0f
SHA1 2f276168b9fc87fd662392c47e2346ec51bff91d
SHA512 a2a2c599b4d882f705993948cf63d9826ed0e9260944c922dc44110486f9feb79e1ae07f4b7baa59fbddfae14d22c9cc322021603784b575e0e27abc3adbde15
SSDEEP 3072:nGfAUbd5CR4Up+UPO0ksS7KoD1f2CfUpHzk2r0O:M1b/UJO0m7Ko5fvfo3R
MD5 SHA1 SHA512 SSDEEP

Submit Download

JIL8Q7E.exe

Path C:\Windows\SysWOW64\JIL8Q7E.exe
Size 130KB
SHA256 1f9f1584e4a9a307e5fbe26084b5c1ebf05934450694f49893d7baacfa3e0f21
MD5 013ee05db0992656b316227ba3abcd4c
SHA1 be928ab114f8de01ad66923ce458a28e8cda8a87
SHA512 b9f2c7ca15d0749665b23378e6017dd5ccb36968b3069cad02fa25e35b8b4945925e107d01b780620b75f6989f50e5d6396ffecdc0fd235c857beb16a046fd87
SSDEEP 3072:CGfAUbd5CR4Up+UPO0ksS7KoD1f2CfUpHzk2r0O:11b/UJO0m7Ko5fvfo3R
MD5 SHA1 SHA512 SSDEEP

Submit Download

CUT4D0V.cmd

Path C:\Windows\SysWOW64\SKL8O0Y\CUT4D0V.cmd
Size 130KB
SHA256 b1d7dfa946f2f6a281a6c3feac61b287a70e975a005f20a35cdbecd77ee01484
MD5 ccfcf6efa2f1ec92cffcdf30f7e1187c
SHA1 a358e4afe6c70963493c8b21860380ccabac4d52
SHA512 4efa28642d44fe544d9a2628ac12b40869c1af22b3f1216048e3be5e00fa74aa16ee68c0d241900acd1ffccbc7e1b520c2fee9d1ad79def5eafc01593ce112a2
SSDEEP 3072:SGfAUbd5CR4Up+UPO0ksS7KoD1f2CfUpHzk2r0O:l1b/UJO0m7Ko5fvfo3R
MD5 SHA1 SHA512 SSDEEP

Submit Download

systear.dll

Path C:\Windows\SysWOW64\systear.dll
Size 127B
SHA256 e8361f01f22f9f83ed75cddb87795ce9386239241547ae721df4d3c047e65adb
MD5 ac901854d404dfe51ddb1e3b21f5ec54
SHA1 2c9d379c32727fc0e7860f0725242e107c61397e
SHA512 bb5cc1a2e8995dd723d381e604bf54854b3d6e9b8551c2e1175966337e4ce2c2771a41a4147ba32d8aa63633dfc5611999f7fd91b42e2170da5ec645c7bae7fb
MD5 SHA1 SHA512

Submit Download

systear.dll

Path C:\Windows\SysWOW64\systear.dll
Size 141B
SHA256 133492ac608e4ef046a02519378c83c7b561fe1921e675eed83c00d804cf687b
MD5 028cdf0623c605a475057f7011c7d650
SHA1 2551f7c98a45d0369f2ac027b375bff44f6a3396
SHA512 c61499a35ff15d35cdad60dac02fb1bd71c4a2f80c7c7c2f44a7d64b3c8e4f3997615f0af0fc28e4e9e2a9d2d3c920c3bb44c5aae2a751221c863eaaf053e305
MD5 SHA1 SHA512

Submit Download

cypreg.dll

Path C:\Windows\cypreg.dll
Size 361KB
SHA256 ed6cdafd3b8f026f7b564a46e608f49332d8499187dcbfe5e7f4f105a31e8c4c
MD5 cad01ce988370f1f7ba6d1b366b67350
SHA1 456ee670f051bc6dc0f6ac660c202da6cf08ca2c
SHA512 dc133d6c905391a99b2989217d1cb5879bfea710f90a3f013fa3e62e55399edbfee7a167360fde9d33f87016f82a7707da40e4892c0ab72a441e57a13b664821
SSDEEP 6144:w8sKRApdUu4oMD/AMv2KBiKQRZ66z+n4VZbd8g79pgrXNgRnVLjyzhbkidNN2:bsIOdYD9+KnQRZ66z24VZbdrpgrXN2LS
MD5 SHA1 SHA512 SSDEEP

Submit Download

cypreg.dll

Path C:\Windows\cypreg.dll
Size 361KB
SHA256 b73e8cf25db9683d28cca18b3db91fefa1f8c1f6c06bcb0ff1855c9ca3e498f3
MD5 c5c7392dc94c13ef23f98cb3729bf711
SHA1 404d820f4b62462eb932275e3b58a1be42896e7c
SHA512 7153bfab3578b60732b0f86fef10bbb722e978124b1d71c58373e8dfbf3a989983314ab63b40ef99722c42d12da2a28955c770d0f1223993145fd9246ff0cc43
SSDEEP 6144:S8sKRApdUu4oMD/AMv2KBiKQRZ66z+n4VZbd8g79pgrXNgRnVLjyzhbkidNN2:9sIOdYD9+KnQRZ66z24VZbdrpgrXN2LS
MD5 SHA1 SHA512 SSDEEP

Submit Download

cypreg.dll

Path C:\Windows\cypreg.dll
Size 361KB
SHA256 7abb33f7c8b31a0d47e0633d982be7bb3c3cf4182b6f9c44f20571117d919a96
MD5 a122aeb21d8fea84eecb80ce782daf51
SHA1 cd2c45a895c7e365606777a8dacaea7f01955f44
SHA512 a34c9871782f57132b8f9ef1fc26c8fae561e052ccbd2fea753598a298c8dad4bfb07f379bc6f3a6729251289e6fa76d30b5f1855b08b504b781a1068b09a063
SSDEEP 6144:C8sKRApdUu4oMD/AMv2KBiKQRZ66z+n4VZbd8g79pgrXNgRnVLjyzhbkidNN2:NsIOdYD9+KnQRZ66z24VZbdrpgrXN2LS
MD5 SHA1 SHA512 SSDEEP

Submit Download

lsass.exe

Path C:\Windows\lsass.exe
Size 130KB
SHA256 84d7b45cd13a95e1d5c70d970a002f2f0449ae98ddfaf1d19991a8eb1f41eb36
MD5 3becbcb0f43575cbd1f7c9e6ea93f952
SHA1 adde2b1fb3f036d017b0623c78800d639f2c8f89
SHA512 afccc36a75f83777f46f2b699fc965bd76263c04ac0b301f78ca55e2ea3759b8a54de5b43e7000135f55d759163df1e5028da5fb31747370aacdbf444c29e582
SSDEEP 3072:YGfAUbd5CR4Up+UPO0ksS7KoD1f2CfUpHzk2r0O:j1b/UJO0m7Ko5fvfo3R
MD5 SHA1 SHA512 SSDEEP

Submit Download

lsass.exe

Path C:\Windows\lsass.exe
Size 130KB
SHA256 dcfc98520eee6ea6cb575b5d24447e920a00d861477fecbb948621856734ee15
MD5 058e7e7cc85f65d3183ccbf9545246c1
SHA1 b2291803d81e5fd098f9b5ca99bda11590a35433
SHA512 77bd69534b4ca237f12deae3d217b10a6015838f90dcd664ba12b9d68b2b9ee6658ca66cc1ff81d471fa148368ba2fbac8124eb3fe9ca17e60a8d8475bf65082
SSDEEP 3072:hGfAUbd5CR4Up+UPO0ksS7KoD1f2CfUpHzk2r0O:21b/UJO0m7Ko5fvfo3R
MD5 SHA1 SHA512 SSDEEP

Submit Download

moonlight.dll

Path C:\Windows\moonlight.dll
Size 65KB
SHA256 4cbbe69bcd0a2debae6a584e1fa49f8d4a27f90d9cd364255bbbd930ca0a38bc
MD5 c55534452c57efa04f4109310f71ccca
SHA1 b97a3d9e2c1ad9314562b7d0d77b2a4b34e77d61
SHA512 ad324f1f1bfde9c9b6057d5526ae62155b3b897d27225ed74fdb867a2c6d5f21cebfb63e3dc68bd807993b0f4c72fb3ce880696b9c3358b3b982204d60c7161a
SSDEEP 1536:i3C8wUcw1dwm8qlwn4iEv72oIY6bGkPwTufpXeTVZR3AWgCuNjC2WL2Ro:o0UXEfhEYbzPCTVZR3AWijGLMo
MD5 SHA1 SHA512 SSDEEP

Submit Download

onceinabluemoon.mid

Path C:\Windows\onceinabluemoon.mid
Size 8KB
SHA256 c8aa5c023bf32f1c1e27b8136cf4d622101e58a80417d97271d3c0ba44528cae
MD5 0e528d000aad58b255c1cf8fd0bb1089
SHA1 2445d2cc0921aea9ae53b8920d048d6537940ec6
SHA512 89ff6a1f1bf364925704a83ab4d222e2335e6486e0b90641f0133236b5f6b0fede1e9f17b577d6d069537e737b761f745d1fde4a9d0b43cb59143edf2d9c2116
SSDEEP 192:aw5g2v7GlPpvri75iBj2hE0E7D8B+QUTvjkf:aw59Dytri75iBSLAQ7UTvIf
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvbvm60.dll

Path C:\Windows\system\msvbvm60.dll
Size 1.4MB
SHA256 fed61ef395ee1ecf2cf0b7f0c7c954171f7d4b23c7152d472c45d57b2db06743
MD5 9e453b7ea22dc49f143180ecf4ead7d6
SHA1 57ce539a801faa8164b7ce4b5fac66093bae2b73
SHA512 ec9f399cf584bacb6aa1944bd25bde867a994673277a6912a847af594ed4f1800148628edf87fcc241b9739c2c2517cd8892de6222d39a1e18e26136ad1f3763
SSDEEP 24576:vNqrWz23mmOittiMQVZb2NOTGTZg2REA7qc+vM597KXNWU8fSV2z3PNGvCQSIjuT:vNQimtzbQVB2PpEVa2XNWUISV20AIq
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvbvm60.dll

Path C:\Windows\system\msvbvm60.dll
Size 1.4MB
SHA256 2160e45f6bb10d3e3a8765ffc01b42dd6a68159abf14c1a8dea2602365bb002d
MD5 d93921be0a8cc54b2914d59edda504ff
SHA1 61699b7bf5b7b3903ed8a99623367054f57a934a
SHA512 6dc0088e685920d63b7898a413d1351b37c5c431d02ffd04c3db42527ec09178641a94abefdaa2dd2a70792240d1caf25f943fe04ca4eb9556a52f9ed17e4a36
SSDEEP 24576:KNqrWz23mmOittiMQVZb2NOTGTZg2REA7qc+vM597KXNWU8fSV2z3PNGvCQSIjuT:KNQimtzbQVB2PpEVa2XNWUISV20AIq
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/704-357-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/704-363-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/704-395-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/704-389-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/704-383-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/704-339-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/704-377-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/704-345-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/704-371-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/704-315-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/704-338-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/704-124-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/704-351-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2352-312-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2352-63-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/3256-291-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/3256-0-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/3564-375-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/3564-337-0x0000000010000000-0x0000000010075000-memory.dmp

Download

memory/3564-393-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/3564-349-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/3564-89-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/3564-333-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/3564-322-0x0000000010000000-0x0000000010075000-memory.dmp

Download

memory/3564-361-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/3564-314-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4472-75-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4472-313-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4984-340-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4984-352-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4984-311-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4984-346-0x0000000000400000-0x0000000000477000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads