b1e3982a22e6cd006cdebe1cedb4b29483540d064fb8bb9610137d731d9fa025

Analysis

max time kernel
79s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 01:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
990d6a0fdc373b19d61c718004d85020_NeikiAnalytics.exe
Size 101KB
Sample240614-cb23ss1cmf
SHA256 b1e3982a22e6cd006cdebe1cedb4b29483540d064fb8bb9610137d731d9fa025
MD5 990d6a0fdc373b19d61c718004d85020
SHA1 8d7a7349e286f9b46b84eb119ec0e0db71dad65c
SHA512 1daf4aedc208d6c9b5a4dea103396d0a2cb3a1ada3d040612f978c0b0c606072364c08e57c0f82c0f5961e65f0de8d394420ece55ebbe0d322fd6f7c8e88e65d
SSDEEP 3072:Qtbh6hToD1duXqbyu0sY7q5AnrHY4vDX:q16hsy853Anr44vDX
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndbnboqb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngcgcjnc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqklmpdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nqmhbpba.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncldnkae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ndbnboqb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ngpjnkpf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njogjfoj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqmhbpba.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	990d6a0fdc373b19d61c718004d85020_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	990d6a0fdc373b19d61c718004d85020_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqiogp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nkncdifl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nqklmpdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njcpee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ngedij32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njcpee32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngpjnkpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njogjfoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nqiogp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ngcgcjnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nkncdifl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngedij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ncldnkae.exe

Executes dropped EXE 12 IoCs

pid	Process
436	Ndbnboqb.exe
2024	Ngpjnkpf.exe
2184	Njogjfoj.exe
1272	Nqiogp32.exe
4684	Ngcgcjnc.exe
3940	Nkncdifl.exe
2896	Nqklmpdd.exe
1704	Ngedij32.exe
1144	Njcpee32.exe
656	Nqmhbpba.exe
3616	Ncldnkae.exe
2760	Nkcmohbg.exe

Drops file in System32 directory 36 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Lfcbokki.dll	Ngpjnkpf.exe
File opened for modification	C:\Windows\SysWOW64\Nqiogp32.exe	Njogjfoj.exe
File opened for modification	C:\Windows\SysWOW64\Ngcgcjnc.exe	Nqiogp32.exe
File created	C:\Windows\SysWOW64\Njcpee32.exe	Ngedij32.exe
File created	C:\Windows\SysWOW64\Ljfemn32.dll	Nkncdifl.exe
File created	C:\Windows\SysWOW64\Ngedij32.exe	Nqklmpdd.exe
File created	C:\Windows\SysWOW64\Ddpfgd32.dll	Ngedij32.exe
File created	C:\Windows\SysWOW64\Ndbnboqb.exe	990d6a0fdc373b19d61c718004d85020_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\Ndbnboqb.exe	990d6a0fdc373b19d61c718004d85020_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\Njogjfoj.exe	Ngpjnkpf.exe
File created	C:\Windows\SysWOW64\Ngcgcjnc.exe	Nqiogp32.exe
File created	C:\Windows\SysWOW64\Nkncdifl.exe	Ngcgcjnc.exe
File opened for modification	C:\Windows\SysWOW64\Nqmhbpba.exe	Njcpee32.exe
File created	C:\Windows\SysWOW64\Bghhihab.dll	Njcpee32.exe
File created	C:\Windows\SysWOW64\Mlhblb32.dll	Ndbnboqb.exe
File created	C:\Windows\SysWOW64\Ncldnkae.exe	Nqmhbpba.exe
File opened for modification	C:\Windows\SysWOW64\Ncldnkae.exe	Nqmhbpba.exe
File created	C:\Windows\SysWOW64\Ngpjnkpf.exe	Ndbnboqb.exe
File opened for modification	C:\Windows\SysWOW64\Ngpjnkpf.exe	Ndbnboqb.exe
File opened for modification	C:\Windows\SysWOW64\Njogjfoj.exe	Ngpjnkpf.exe
File opened for modification	C:\Windows\SysWOW64\Ngedij32.exe	Nqklmpdd.exe
File created	C:\Windows\SysWOW64\Pponmema.dll	Njogjfoj.exe
File created	C:\Windows\SysWOW64\Majknlkd.dll	Nqiogp32.exe
File opened for modification	C:\Windows\SysWOW64\Nkncdifl.exe	Ngcgcjnc.exe
File created	C:\Windows\SysWOW64\Jkeang32.dll	Ngcgcjnc.exe
File created	C:\Windows\SysWOW64\Hnibdpde.dll	Ncldnkae.exe
File created	C:\Windows\SysWOW64\Nqklmpdd.exe	Nkncdifl.exe
File opened for modification	C:\Windows\SysWOW64\Nqklmpdd.exe	Nkncdifl.exe
File created	C:\Windows\SysWOW64\Paadnmaq.dll	Nqklmpdd.exe
File created	C:\Windows\SysWOW64\Dlddhggk.dll	Nqmhbpba.exe
File opened for modification	C:\Windows\SysWOW64\Nkcmohbg.exe	Ncldnkae.exe
File created	C:\Windows\SysWOW64\Dihcoe32.dll	990d6a0fdc373b19d61c718004d85020_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\Nqiogp32.exe	Njogjfoj.exe
File created	C:\Windows\SysWOW64\Nkcmohbg.exe	Ncldnkae.exe
File opened for modification	C:\Windows\SysWOW64\Njcpee32.exe	Ngedij32.exe
File created	C:\Windows\SysWOW64\Nqmhbpba.exe	Njcpee32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4344	2760	WerFault.exe	95

Modifies registry class 39 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	990d6a0fdc373b19d61c718004d85020_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfcbokki.dll"	Ngpjnkpf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Njogjfoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nqiogp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	990d6a0fdc373b19d61c718004d85020_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ngpjnkpf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nkncdifl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ngedij32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	990d6a0fdc373b19d61c718004d85020_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dihcoe32.dll"	990d6a0fdc373b19d61c718004d85020_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ndbnboqb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Majknlkd.dll"	Nqiogp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ncldnkae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnibdpde.dll"	Ncldnkae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	990d6a0fdc373b19d61c718004d85020_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ndbnboqb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mlhblb32.dll"	Ndbnboqb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ngcgcjnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Paadnmaq.dll"	Nqklmpdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Njcpee32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nqmhbpba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nkncdifl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nqklmpdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ncldnkae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nqiogp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jkeang32.dll"	Ngcgcjnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ngedij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bghhihab.dll"	Njcpee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dlddhggk.dll"	Nqmhbpba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ljfemn32.dll"	Nkncdifl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ddpfgd32.dll"	Ngedij32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Njcpee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nqmhbpba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	990d6a0fdc373b19d61c718004d85020_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ngpjnkpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pponmema.dll"	Njogjfoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Njogjfoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ngcgcjnc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nqklmpdd.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 3124 wrote to memory of 436	3124	990d6a0fdc373b19d61c718004d85020_NeikiAnalytics.exe	82
PID 3124 wrote to memory of 436	3124	990d6a0fdc373b19d61c718004d85020_NeikiAnalytics.exe	82
PID 3124 wrote to memory of 436	3124	990d6a0fdc373b19d61c718004d85020_NeikiAnalytics.exe	82
PID 436 wrote to memory of 2024	436	Ndbnboqb.exe	83
PID 436 wrote to memory of 2024	436	Ndbnboqb.exe	83
PID 436 wrote to memory of 2024	436	Ndbnboqb.exe	83
PID 2024 wrote to memory of 2184	2024	Ngpjnkpf.exe	84
PID 2024 wrote to memory of 2184	2024	Ngpjnkpf.exe	84
PID 2024 wrote to memory of 2184	2024	Ngpjnkpf.exe	84
PID 2184 wrote to memory of 1272	2184	Njogjfoj.exe	85
PID 2184 wrote to memory of 1272	2184	Njogjfoj.exe	85
PID 2184 wrote to memory of 1272	2184	Njogjfoj.exe	85
PID 1272 wrote to memory of 4684	1272	Nqiogp32.exe	86
PID 1272 wrote to memory of 4684	1272	Nqiogp32.exe	86
PID 1272 wrote to memory of 4684	1272	Nqiogp32.exe	86
PID 4684 wrote to memory of 3940	4684	Ngcgcjnc.exe	88
PID 4684 wrote to memory of 3940	4684	Ngcgcjnc.exe	88
PID 4684 wrote to memory of 3940	4684	Ngcgcjnc.exe	88
PID 3940 wrote to memory of 2896	3940	Nkncdifl.exe	89
PID 3940 wrote to memory of 2896	3940	Nkncdifl.exe	89
PID 3940 wrote to memory of 2896	3940	Nkncdifl.exe	89
PID 2896 wrote to memory of 1704	2896	Nqklmpdd.exe	91
PID 2896 wrote to memory of 1704	2896	Nqklmpdd.exe	91
PID 2896 wrote to memory of 1704	2896	Nqklmpdd.exe	91
PID 1704 wrote to memory of 1144	1704	Ngedij32.exe	92
PID 1704 wrote to memory of 1144	1704	Ngedij32.exe	92
PID 1704 wrote to memory of 1144	1704	Ngedij32.exe	92
PID 1144 wrote to memory of 656	1144	Njcpee32.exe	93
PID 1144 wrote to memory of 656	1144	Njcpee32.exe	93
PID 1144 wrote to memory of 656	1144	Njcpee32.exe	93
PID 656 wrote to memory of 3616	656	Nqmhbpba.exe	94
PID 656 wrote to memory of 3616	656	Nqmhbpba.exe	94
PID 656 wrote to memory of 3616	656	Nqmhbpba.exe	94
PID 3616 wrote to memory of 2760	3616	Ncldnkae.exe	95
PID 3616 wrote to memory of 2760	3616	Ncldnkae.exe	95
PID 3616 wrote to memory of 2760	3616	Ncldnkae.exe	95

C:\Users\Admin\AppData\Local\Temp\990d6a0fdc373b19d61c718004d85020_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\990d6a0fdc373b19d61c718004d85020_NeikiAnalytics.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3124
- C:\Windows\SysWOW64\Ndbnboqb.exe
  C:\Windows\system32\Ndbnboqb.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:436
- - C:\Windows\SysWOW64\Ngpjnkpf.exe
    C:\Windows\system32\Ngpjnkpf.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2024
  - - C:\Windows\SysWOW64\Njogjfoj.exe
      C:\Windows\system32\Njogjfoj.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2184
    - - C:\Windows\SysWOW64\Nqiogp32.exe
        
        C:\Windows\system32\Nqiogp32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1272
      - C:\Windows\SysWOW64\Ngcgcjnc.exe
        
        C:\Windows\system32\Ngcgcjnc.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4684
        
        C:\Windows\SysWOW64\Nkncdifl.exe
        
        C:\Windows\system32\Nkncdifl.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3940
        
        C:\Windows\SysWOW64\Nqklmpdd.exe
        
        C:\Windows\system32\Nqklmpdd.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2896
        
        C:\Windows\SysWOW64\Ngedij32.exe
        
        C:\Windows\system32\Ngedij32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1704
        
        C:\Windows\SysWOW64\Njcpee32.exe
        
        C:\Windows\system32\Njcpee32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1144
        
        C:\Windows\SysWOW64\Nqmhbpba.exe
        
        C:\Windows\system32\Nqmhbpba.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:656
        
        C:\Windows\SysWOW64\Ncldnkae.exe
        
        C:\Windows\system32\Ncldnkae.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3616
        
        C:\Windows\SysWOW64\Nkcmohbg.exe
        
        C:\Windows\system32\Nkcmohbg.exe
        13⤵
        Executes dropped EXE
        
        PID:2760
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2760 -s 408
        14⤵
        Program crash
        
        PID:4344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2760 -ip 2760
1⤵
PID:4880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Ncldnkae.exe

Path C:\Windows\SysWOW64\Ncldnkae.exe
Size 101KB
SHA256 2431f0a582194e3f68d1a568801985a6fdd5e23ce9485ab7b3d5844da078a893
MD5 cb9fddebb129f4314f29e4dbb7521bc4
SHA1 e33ec7098d906ce920f5cea4b99f49ab8e88a01c
SHA512 d09e3979c2dee9c9bdd2bf74300f9923ef6c535025fd52d5c55cf5f4f82c3029b9360f78acfea14ede1682fcaacc022703032916d02688d5ff6b14bc9aac458f
SSDEEP 3072:SbSQuJaiAE15xy/duXqbyu0sY7q5AnrHY4vDX:SeFa2Vys853Anr44vDX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ndbnboqb.exe

Path C:\Windows\SysWOW64\Ndbnboqb.exe
Size 101KB
SHA256 ed13732515139a7889ce3466490581334ac8ee5ac92ad1e4f6d97aad8df7f002
MD5 3235bcf729aac895209e7691b1f9f6e2
SHA1 46cf128561d7b1bed393c008f8438b18ecd701a2
SHA512 c02a239cf3a4de5ca9989624e35c1a10d6ecbea5c3cc4db801934af6bff9dea55f48d4eb1618151344a9e05fcff03458b39c4227791a38821bc42818f63b6481
SSDEEP 3072:zPDRIeKFboduXqbyu0sY7q5AnrHY4vDX:zLR/KFb853Anr44vDX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ngcgcjnc.exe

Path C:\Windows\SysWOW64\Ngcgcjnc.exe
Size 101KB
SHA256 5bf5b262166452075a63c3d1037c18e023986d323b888c8924a7b17d11e54e2d
MD5 72313af41eea4c548917cad4ce294ea6
SHA1 7a8ead1853da00ff7f32b8af1c6c48eede517975
SHA512 ab62d238939f59fe11273cb94424bf4f5c9ea5bde90069990547974641f6d2df471219994500fcda765493be518541f03b8520d3187de674dd54a4b0d7b416f8
SSDEEP 3072:bUnvapQxfvzduXqbyu0sY7q5AnrHY4vDX:In7vY853Anr44vDX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ngedij32.exe

Path C:\Windows\SysWOW64\Ngedij32.exe
Size 101KB
SHA256 2867fc2ef34e60ddaca109d866ecd2fe64a6d8ea957006a9ef0a5cf9cf0103d4
MD5 805a65247fe899d0cd3c2bffd59ba978
SHA1 08b70a1634ebafa4daf155f0ea7b6a91685c00a1
SHA512 bc86048b0dd30483bd76f9e4b260a42f7d2d629d7316d45618fee4b692a8720215f28802f54228d85ee35447f807e8e41980dd2a5cb15f3b177b6432b8ef6049
SSDEEP 3072:dIV7WNwyScOZnvB8duXqbyu0sY7q5AnrHY4vDX:87WuyZOxvB7853Anr44vDX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ngpjnkpf.exe

Path C:\Windows\SysWOW64\Ngpjnkpf.exe
Size 101KB
SHA256 4edfe1ae2e7fa09ad985ca851c7751cd8e553cd1cce1edaa25f116d911a11f6a
MD5 92e8e4f58c998db533fff587dd9a8127
SHA1 62dc3fb59889c616e219976ef5f4460faed9b9d9
SHA512 723f3e40a0d1cdcda7e8fd23d73e8389fe29e010793ddf1f0d2d980341baeac00a8f2b7a5fe9e42faa8504c1d4624e05dabe5dd8d6105844b261413f0d68dd89
SSDEEP 3072:ckpdkFGic/TwMduXqbyu0sY7q5AnrHY4vDX:heGiWkr853Anr44vDX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Njcpee32.exe

Path C:\Windows\SysWOW64\Njcpee32.exe
Size 101KB
SHA256 e87a456a821555f2085eacf17e7774a6353f3fb6665ec5403864af023fc9bac4
MD5 61fe5acfa76b322ec8ab600e4d8c6f58
SHA1 05a14e35a816494d75b3bbf07736d44454817396
SHA512 828bcfcf084c575f1f63fe1c8b8c0c60a45d9a182146a87510dc72b06ed135440afb2654ba73017ec9e9e8fdca452c78966a1cb0543c520987ec3cb705912ce5
SSDEEP 3072:9hrmKRCR50F0A4pOK168GImtJ4sruBLRduXqbyu0sY7q5AnrHY4vDX:P6Jp68Gf+sitG853Anr44vDX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Njogjfoj.exe

Path C:\Windows\SysWOW64\Njogjfoj.exe
Size 101KB
SHA256 576f5bbf9fcb332122870ab450dcb5ab2835fce82baf393b146f91a475865aad
MD5 9aa024dd483108b5a7a1009a5b8dddf9
SHA1 ec6b4dedf8d074168518b18d703df956d5223f8c
SHA512 eae8a434be424895b4502cb493f16bbe937e6ea5e6af4388bf5399479525a880bb746c0d1c03d5910d5be209a7597c5795d8f2391c7f03432e471f06f4ad2b5d
SSDEEP 3072:JRwDzwa6B1zduXqbyu0sY7q5AnrHY4vDX:YF6LY853Anr44vDX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nkcmohbg.exe

Path C:\Windows\SysWOW64\Nkcmohbg.exe
Size 101KB
SHA256 9efd369442793e05775c29f323187f3f2f59d73829e1e663245a0eb0cea9fb2a
MD5 c7abe20ae49dca2ef59ac40cbf5111e3
SHA1 1a9d167943e10b158b2224df7e1b8a2b93443bf4
SHA512 240edd7f6b2eba80b7d2681c5de448fce6af8690e869befa72b855754945b9e2dea5e60665e5101ad7e956082c7457b1920b85fbe9cefb55532c843d6c626e0e
SSDEEP 1536:Wwios1L+W+CqAwlzXtuXqbyNXrg0sZS7qlDABU8B9HYcJvDX:WwihLnejlduXqbyu0sY7q5AnrHY4vDX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nkncdifl.exe

Path C:\Windows\SysWOW64\Nkncdifl.exe
Size 101KB
SHA256 1e61ccf2f57c72fdfbaf427225175fd020eeceb8617510af8eb83300ff00f76a
MD5 bd5db126df89dc274ed38392c139e2e5
SHA1 6d51998c7cdbaebd554c83b1be772ecbe7296b57
SHA512 cc67a988d39f30f049ebdf5b1dd9dcda73262dbb8350443036eef69ee5bb98de259f0e782aba68d4c23d39e06b6af41d9f166eaaf527c176c1ad719b74635674
SSDEEP 3072:OFtfFxGUuNs5BduXqbyu0sY7q5AnrHY4vDX:MxGU+eW853Anr44vDX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nqiogp32.exe

Path C:\Windows\SysWOW64\Nqiogp32.exe
Size 101KB
SHA256 0dfb3c654198c7d23def31f49ddf680773a1d9aef9c743d2cb08f11887e05e43
MD5 6d9a3696ea67e0cee125d1ab573cee12
SHA1 651d21289c0a6d93720838089cf15e9ba9ed25ec
SHA512 fbf5857f5a36f296de3a706be07de9dd29a42268c88ad4cf929649f0aa1b84cfd49fe4eaee57dc34d7374e68fcf60b77a3aa8d3de483a4a169e1d234a17c420b
SSDEEP 3072:CM+MfiiyeN6sduXqbyu0sY7q5AnrHY4vDX:CM+MKBW6L853Anr44vDX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nqklmpdd.exe

Path C:\Windows\SysWOW64\Nqklmpdd.exe
Size 101KB
SHA256 c04fafc51b053d9ad541f9193c392b6fddde03f85752ac2aed869a7a39527ef4
MD5 9fd8c8da356523f07a13c56d99021cef
SHA1 d7453b22f67fcec9ff205e2545339d8770058cd1
SHA512 89d020fc268740ba5d5d18c32b00cf4c79d81536b5dd88e6640e33a2d5872d0debb00fccb897303d6602a0a4387431313496f1e8d6e20ea127a2bc458d123b37
SSDEEP 3072:JJMav/qX0j4m/ShFTnduXqbyu0sY7q5AnrHY4vDX:I/m/GFT0853Anr44vDX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nqmhbpba.exe

Path C:\Windows\SysWOW64\Nqmhbpba.exe
Size 101KB
SHA256 48e109d5eb70ed1d1708fdbc9d357f0ee49465afe4f2831a59e35eb9c48e04d7
MD5 44183558c760935a0935a34c89a06c36
SHA1 ee028cff21a5f7717b21fe24ac9be2c9cebe9943
SHA512 fd113aec6a063768e796e58ddfd7e2f82d763117c3a53a9eef778761e8f7142143bae8b571f50b9c179a07c9cddd5f2d2e2d0f3f0ad6c2a0121cd6f1f4ba28ea
SSDEEP 3072:IS+/ayQmoe/bduXqbyu0sY7q5AnrHY4vDX:ISibA853Anr44vDX
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/436-118-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/436-11-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/656-103-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/656-79-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1144-104-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1144-72-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1272-32-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1272-112-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1704-64-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1704-106-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2024-16-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2024-116-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2184-24-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2184-114-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2760-98-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2760-96-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2896-60-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3124-120-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3124-0-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3616-100-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3616-87-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3940-109-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3940-51-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4684-110-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4684-40-0x0000000000400000-0x000000000042F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads