c19e9dde363797fdffe09c8d7e26b698bee6d5db6ad3912faeef2541fc7234fb

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 09:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6fc05fcc1a3e10ee334acf378da64910_NeikiAnalytics.exe
Size 80KB
Sample240613-k677aswepl
SHA256 c19e9dde363797fdffe09c8d7e26b698bee6d5db6ad3912faeef2541fc7234fb
MD5 6fc05fcc1a3e10ee334acf378da64910
SHA1 257d6155e5ad2d1c3821c5677f291f8d0686622a
SHA512 f2cb11e65ac49451b46fd92f8bc843031db8a94939c1af291ae92c927d3ee9f4c1e31f285303d264e91e51164c0a11ad710be020f5653f37e9a1ac24a261acf6
SSDEEP 1536:hmOK7Offln7XCS/Vpgfx4vpvYWyLw2LRaIZTJ+7LhkiB0:bKKpXC4VpEx4vpvmRaMU7ui
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 18 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncldnkae.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nbhkac32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncihikcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njcpee32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nbkhfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	6fc05fcc1a3e10ee334acf378da64910_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqiogp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	6fc05fcc1a3e10ee334acf378da64910_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncgkcl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ncgkcl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nkncdifl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njcpee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nbkhfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ncldnkae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nqiogp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nkncdifl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nbhkac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ncihikcg.exe

Executes dropped EXE 9 IoCs

pid	Process
1528	Nqiogp32.exe
2276	Ncgkcl32.exe
2504	Nkncdifl.exe
4760	Nbhkac32.exe
2884	Ncihikcg.exe
2144	Njcpee32.exe
3528	Nbkhfc32.exe
4160	Ncldnkae.exe
4208	Nkcmohbg.exe

Drops file in System32 directory 27 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Ncgkcl32.exe	Nqiogp32.exe
File created	C:\Windows\SysWOW64\Pipfna32.dll	Nqiogp32.exe
File opened for modification	C:\Windows\SysWOW64\Nkncdifl.exe	Ncgkcl32.exe
File created	C:\Windows\SysWOW64\Ddpfgd32.dll	Ncihikcg.exe
File created	C:\Windows\SysWOW64\Dlddhggk.dll	Nbkhfc32.exe
File created	C:\Windows\SysWOW64\Pponmema.dll	6fc05fcc1a3e10ee334acf378da64910_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\Nbhkac32.exe	Nkncdifl.exe
File created	C:\Windows\SysWOW64\Nbkhfc32.exe	Njcpee32.exe
File opened for modification	C:\Windows\SysWOW64\Nqiogp32.exe	6fc05fcc1a3e10ee334acf378da64910_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\Ncgkcl32.exe	Nqiogp32.exe
File opened for modification	C:\Windows\SysWOW64\Njcpee32.exe	Ncihikcg.exe
File opened for modification	C:\Windows\SysWOW64\Nbkhfc32.exe	Njcpee32.exe
File created	C:\Windows\SysWOW64\Nqiogp32.exe	6fc05fcc1a3e10ee334acf378da64910_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\Nkncdifl.exe	Ncgkcl32.exe
File created	C:\Windows\SysWOW64\Ncihikcg.exe	Nbhkac32.exe
File opened for modification	C:\Windows\SysWOW64\Nkcmohbg.exe	Ncldnkae.exe
File created	C:\Windows\SysWOW64\Hnibdpde.dll	Ncldnkae.exe
File created	C:\Windows\SysWOW64\Njcpee32.exe	Ncihikcg.exe
File created	C:\Windows\SysWOW64\Nkcmohbg.exe	Ncldnkae.exe
File created	C:\Windows\SysWOW64\Nbhkac32.exe	Nkncdifl.exe
File created	C:\Windows\SysWOW64\Pkckjila.dll	Nbhkac32.exe
File created	C:\Windows\SysWOW64\Jkeang32.dll	Ncgkcl32.exe
File created	C:\Windows\SysWOW64\Ipkobd32.dll	Nkncdifl.exe
File opened for modification	C:\Windows\SysWOW64\Ncihikcg.exe	Nbhkac32.exe
File created	C:\Windows\SysWOW64\Lkfbjdpq.dll	Njcpee32.exe
File created	C:\Windows\SysWOW64\Ncldnkae.exe	Nbkhfc32.exe
File opened for modification	C:\Windows\SysWOW64\Ncldnkae.exe	Nbkhfc32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4952	4208	WerFault.exe	92

Modifies registry class 30 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ncgkcl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nkncdifl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nkncdifl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ipkobd32.dll"	Nkncdifl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dlddhggk.dll"	Nbkhfc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ncldnkae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnibdpde.dll"	Ncldnkae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pponmema.dll"	6fc05fcc1a3e10ee334acf378da64910_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nbhkac32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	6fc05fcc1a3e10ee334acf378da64910_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nbhkac32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nbkhfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ncgkcl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkckjila.dll"	Nbhkac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ncihikcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lkfbjdpq.dll"	Njcpee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Njcpee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nbkhfc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	6fc05fcc1a3e10ee334acf378da64910_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	6fc05fcc1a3e10ee334acf378da64910_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	6fc05fcc1a3e10ee334acf378da64910_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ncihikcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ddpfgd32.dll"	Ncihikcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pipfna32.dll"	Nqiogp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nqiogp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jkeang32.dll"	Ncgkcl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ncldnkae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	6fc05fcc1a3e10ee334acf378da64910_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nqiogp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Njcpee32.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 5084 wrote to memory of 1528	5084	6fc05fcc1a3e10ee334acf378da64910_NeikiAnalytics.exe	83
PID 5084 wrote to memory of 1528	5084	6fc05fcc1a3e10ee334acf378da64910_NeikiAnalytics.exe	83
PID 5084 wrote to memory of 1528	5084	6fc05fcc1a3e10ee334acf378da64910_NeikiAnalytics.exe	83
PID 1528 wrote to memory of 2276	1528	Nqiogp32.exe	84
PID 1528 wrote to memory of 2276	1528	Nqiogp32.exe	84
PID 1528 wrote to memory of 2276	1528	Nqiogp32.exe	84
PID 2276 wrote to memory of 2504	2276	Ncgkcl32.exe	85
PID 2276 wrote to memory of 2504	2276	Ncgkcl32.exe	85
PID 2276 wrote to memory of 2504	2276	Ncgkcl32.exe	85
PID 2504 wrote to memory of 4760	2504	Nkncdifl.exe	86
PID 2504 wrote to memory of 4760	2504	Nkncdifl.exe	86
PID 2504 wrote to memory of 4760	2504	Nkncdifl.exe	86
PID 4760 wrote to memory of 2884	4760	Nbhkac32.exe	87
PID 4760 wrote to memory of 2884	4760	Nbhkac32.exe	87
PID 4760 wrote to memory of 2884	4760	Nbhkac32.exe	87
PID 2884 wrote to memory of 2144	2884	Ncihikcg.exe	88
PID 2884 wrote to memory of 2144	2884	Ncihikcg.exe	88
PID 2884 wrote to memory of 2144	2884	Ncihikcg.exe	88
PID 2144 wrote to memory of 3528	2144	Njcpee32.exe	89
PID 2144 wrote to memory of 3528	2144	Njcpee32.exe	89
PID 2144 wrote to memory of 3528	2144	Njcpee32.exe	89
PID 3528 wrote to memory of 4160	3528	Nbkhfc32.exe	90
PID 3528 wrote to memory of 4160	3528	Nbkhfc32.exe	90
PID 3528 wrote to memory of 4160	3528	Nbkhfc32.exe	90
PID 4160 wrote to memory of 4208	4160	Ncldnkae.exe	92
PID 4160 wrote to memory of 4208	4160	Ncldnkae.exe	92
PID 4160 wrote to memory of 4208	4160	Ncldnkae.exe	92

C:\Users\Admin\AppData\Local\Temp\6fc05fcc1a3e10ee334acf378da64910_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6fc05fcc1a3e10ee334acf378da64910_NeikiAnalytics.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Windows\SysWOW64\Nqiogp32.exe
  C:\Windows\system32\Nqiogp32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1528
- - C:\Windows\SysWOW64\Ncgkcl32.exe
    C:\Windows\system32\Ncgkcl32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2276
  - - C:\Windows\SysWOW64\Nkncdifl.exe
      C:\Windows\system32\Nkncdifl.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2504
    - - C:\Windows\SysWOW64\Nbhkac32.exe
        
        C:\Windows\system32\Nbhkac32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4760
      - C:\Windows\SysWOW64\Ncihikcg.exe
        
        C:\Windows\system32\Ncihikcg.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2884
        
        C:\Windows\SysWOW64\Njcpee32.exe
        
        C:\Windows\system32\Njcpee32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2144
        
        C:\Windows\SysWOW64\Nbkhfc32.exe
        
        C:\Windows\system32\Nbkhfc32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3528
        
        C:\Windows\SysWOW64\Ncldnkae.exe
        
        C:\Windows\system32\Ncldnkae.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4160
        
        C:\Windows\SysWOW64\Nkcmohbg.exe
        
        C:\Windows\system32\Nkcmohbg.exe
        10⤵
        Executes dropped EXE
        
        PID:4208
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4208 -s 392
        11⤵
        Program crash
        
        PID:4952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4208 -ip 4208
1⤵
PID:5004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Nbhkac32.exe

Path C:\Windows\SysWOW64\Nbhkac32.exe
Size 80KB
SHA256 a60e031ed288576e17d0e0a244ac16865fba44639e76013656ab14451d04fa67
MD5 cd0e53d279075ac63b3842618f610be6
SHA1 62444cab59fa2f8b638326a6cdfad2c542f61e7b
SHA512 ec34dcdb387cccc14071e9b934d3884a86836c9d581c4bcc8a577d41a0212c226a00b660b6381bf9f703cec009f5a7c0e803af8327c6c523e29e559fb55a56a9
SSDEEP 768:3Az7Iqoxl47zcZ9V2El4qZgpXzLVC5mIOd5Q2p/1H5YPXdnhwB+bH7ahkTJ+7Lhi:m427wfVW9vQ2L4aIZTJ+7LhkiB0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nbkhfc32.exe

Path C:\Windows\SysWOW64\Nbkhfc32.exe
Size 80KB
SHA256 7035b7a757d005edb6324db48357e7b683f6515147d355a24d60dba84acdf9ec
MD5 e785ad844b575af70769df8920f03acd
SHA1 933bc0e17c55857b1706460f7d5f9f198a85bf4f
SHA512 c6e9d3b462e6cbc6df21f21ac343f412fe3b3ed1cd7fe72400a563869c7939ab74b1c32e99eae0b00ef472c677672d911a49cf769db24386d6c83d1c2858ba22
SSDEEP 1536:Ca2lyfivawM5TvwqRy132L0aIZTJ+7LhkiB0:tnivReE1c0aMU7ui
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ncgkcl32.exe

Path C:\Windows\SysWOW64\Ncgkcl32.exe
Size 80KB
SHA256 197bbf91dc4db8ab57008be9f875c02d36995cb3877d030df2b62690c797ec5d
MD5 04bc72ab0582e7b544aa1c7d78f83c9a
SHA1 3646ef6c8bcc9b3a90fc6c0529fe8091841ad134
SHA512 78e4a8afc0001d9ede55bc0398a5d12950da6bb1144c405ce3452a2c4832cdedc774094296ef774f50415f544debb2e26ee3e1057e2b2b2ad458d484359086f5
SSDEEP 1536:gGGgY11fXJEBsdGNdRoL/2LFaIZTJ+7LhkiB0:g8Y11fXJKss/NFaMU7ui
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ncihikcg.exe

Path C:\Windows\SysWOW64\Ncihikcg.exe
Size 80KB
SHA256 564aceee8eb56acba17119f0a92d677ac8e45b847276b9025481ca5a25d2e514
MD5 2999ed39c0dd2706c4ed527b8972d052
SHA1 472ddff11f4987960999caaa0d4d9c42caaf09f3
SHA512 1a62b2fe57d9623e8318fae06bba7caf99675afd4ffd27245bb4505604a1a94b39f86968a38ef1c58252f64df7335b0e6676730c5c1a5a00778f73d4546c7dc1
SSDEEP 1536:lyQO97ft+rpe51MDjU5SeRhf2LeaIZTJ+7LhkiB0:lhO97FGVjkSjeaMU7ui
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ncldnkae.exe

Path C:\Windows\SysWOW64\Ncldnkae.exe
Size 80KB
SHA256 0cfcc8552e8d2d1fcb56d93e9a22c5df0a85206ae5328011f946e68203b70b42
MD5 93ec0c053e46c4e9bf74987f7189a26a
SHA1 b944f665a304a74423b8db2b37320edcadd748c3
SHA512 16fc21d2cd80c8b9d6f6331079ea850acac3a8a3134c3b6899f9e1733b9420b6ab43a278f970b9c5b5b131cb89829b9cc9a93ee475464240feebf98f6cbafa81
SSDEEP 1536:I4KMjN5kMUAIOuWZgB+GTLe5iDiI2LdaIZTJ+7LhkiB0:I4ZjNOLOFZ0FXe5iDiZdaMU7ui
MD5 SHA1 SHA512 SSDEEP

Submit Download

Njcpee32.exe

Path C:\Windows\SysWOW64\Njcpee32.exe
Size 80KB
SHA256 32f5dcb892bffcce3e213768c422acf6810835bc7249a1cf76e85910c0f2196d
MD5 475e9b85c1b2da3d653d6bc57a8793ba
SHA1 c639793d29ac6b26875b8b7364ec4c6b03851dea
SHA512 0c353551215f23a0fa1d06c42e444821ad8f6aa9e478a8f04291e0c4466bc21505f2ef08e732d3eed1012d920a6b0570bbb79bf5b7193ec58cb2072110ba98f6
SSDEEP 1536:NXPVQfJiisFN1FE3V32Bh3Qc9ga8dMiAnXCyQHffJffffffffffffff0fffffff9:NXPVeJii4N1FwBKh3Qc9ntfnsHffJffF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nkcmohbg.exe

Path C:\Windows\SysWOW64\Nkcmohbg.exe
Size 80KB
SHA256 cd0422e9261d09088f25335bd8250fc1e7cbab3ef37d0554893bf15285cb7fc7
MD5 85047f1c360cf9925bf3b3df39a3f5cc
SHA1 a7eadffdc007c8542ae833906ed78c549f0d4785
SHA512 7bafbea949423d9a51045fe66a74b185d01b8e03f3c2362e7128b535bab67d96ef838bd557201d0c05d4247201d0a28869ad19c071ec33ebcd4befb2960997c7
SSDEEP 1536:I+o/nCbRJbgQTVXxoJgU19rbdkVjBj2LjaIZTJ+7LhkiB0:I+o/CbXbgQRMgU5sOjaMU7ui
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nkncdifl.exe

Path C:\Windows\SysWOW64\Nkncdifl.exe
Size 80KB
SHA256 751b0878b40a6785b64adeb879795c47db7155d8fa871a0d9f6658eed88b3617
MD5 5a9f548a000d991780e0cb5ae6f8f27a
SHA1 564f53dbb739a7afff7cbd06a3ef8c6faddf4937
SHA512 4c5b74064e27b63fd62151ea5f9954a623fc9c31a11993a5aab407462058dc90af086a48203563c178658300dc9cbb494ab8c1e6c9b24edd885cf845e7f37968
SSDEEP 1536:avvpvVXVSJZjgqyk2nbV7nBU/6ku2LnaIZTJ+7LhkiB0:YrFSD8qykebV7neSkznaMU7ui
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nqiogp32.exe

Path C:\Windows\SysWOW64\Nqiogp32.exe
Size 80KB
SHA256 c6800048757b16ce2b660c0ef8f659da5c3d823de57acd8e987df8ef679837df
MD5 7a8ae65ecaba0b9340d764e4fbab4b69
SHA1 6c3a5244b0ae312886d59e0a42d7c245e6ae9ca7
SHA512 4b8387b2a7623dfca71f6e95d06d8816a57feb4544509c04a4eb8c1533095ab7725ba844832462cafef2185208b72f396e7e6fde7632b7dde7c5c8dad6dad701
SSDEEP 1536:u1W7LO7qjUvHoA09ldTWC339Wo8r2LyaIZTJ+7LhkiB0:u16UvHIdqmZyaMU7ui
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1528-8-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1528-81-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/2144-78-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/2144-48-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/2276-21-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/2276-80-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/2504-25-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/2504-79-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/2884-76-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/2884-41-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/3528-75-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/3528-57-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/4160-64-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/4160-74-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/4208-73-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/4760-33-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/4760-77-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/5084-82-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/5084-5-0x0000000000431000-0x0000000000432000-memory.dmp

Download

memory/5084-4-0x0000000000400000-0x000000000043C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads