Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
01/07/2024, 02:49
Static task
static1
Behavioral task
behavioral1
Sample
2fc8a89db62a4d4d421ae83d83b1f0f371eb9a1bfcf0b06ddd2671f56cadd503_NeikiAnalytics.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
2fc8a89db62a4d4d421ae83d83b1f0f371eb9a1bfcf0b06ddd2671f56cadd503_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
General
-
Target
2fc8a89db62a4d4d421ae83d83b1f0f371eb9a1bfcf0b06ddd2671f56cadd503_NeikiAnalytics.exe
-
Size
217KB
-
MD5
41de1cb36778004653511524b12fc330
-
SHA1
483e514fb7e253d5b8600892c6d57b0180d71f0a
-
SHA256
2fc8a89db62a4d4d421ae83d83b1f0f371eb9a1bfcf0b06ddd2671f56cadd503
-
SHA512
8faea0f5496ae10ae2091d24dcaa7840d3901de999328b47cb4bb9f6a983a25cb74a08aa7acabace6a9a4e2b2379785c062629df2c1be5a8092bc008dce327cc
-
SSDEEP
3072:xs0G+jtN7F6R6CIHaaf8XpfeS5pAgYIqGvJ6887lbyMGjXF1kqaholmtbCQVD:GYJNRxCITspfdZMGXF5ahdt3
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 22 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ldqegd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ldqegd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Mpolmdkg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Mlelaeqk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lmgmjjdn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Lmgmjjdn.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lchnnp32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mpolmdkg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mlelaeqk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mhlmgf32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad 2fc8a89db62a4d4d421ae83d83b1f0f371eb9a1bfcf0b06ddd2671f56cadd503_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lekhfgfc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lbfahp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Lbfahp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Lchnnp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Mhlmgf32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mdcnlglc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Mdcnlglc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" 2fc8a89db62a4d4d421ae83d83b1f0f371eb9a1bfcf0b06ddd2671f56cadd503_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Limmokib.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Lekhfgfc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Limmokib.exe -
Executes dropped EXE 11 IoCs
pid Process 1676 Lekhfgfc.exe 2680 Lmgmjjdn.exe 2756 Ldqegd32.exe 2508 Limmokib.exe 2480 Lbfahp32.exe 2044 Lchnnp32.exe 1804 Mpolmdkg.exe 2540 Mlelaeqk.exe 1740 Mhlmgf32.exe 1944 Mdcnlglc.exe 2380 Nnplpl32.exe -
Loads dropped DLL 22 IoCs
pid Process 1992 2fc8a89db62a4d4d421ae83d83b1f0f371eb9a1bfcf0b06ddd2671f56cadd503_NeikiAnalytics.exe 1992 2fc8a89db62a4d4d421ae83d83b1f0f371eb9a1bfcf0b06ddd2671f56cadd503_NeikiAnalytics.exe 1676 Lekhfgfc.exe 1676 Lekhfgfc.exe 2680 Lmgmjjdn.exe 2680 Lmgmjjdn.exe 2756 Ldqegd32.exe 2756 Ldqegd32.exe 2508 Limmokib.exe 2508 Limmokib.exe 2480 Lbfahp32.exe 2480 Lbfahp32.exe 2044 Lchnnp32.exe 2044 Lchnnp32.exe 1804 Mpolmdkg.exe 1804 Mpolmdkg.exe 2540 Mlelaeqk.exe 2540 Mlelaeqk.exe 1740 Mhlmgf32.exe 1740 Mhlmgf32.exe 1944 Mdcnlglc.exe 1944 Mdcnlglc.exe -
Drops file in System32 directory 36 IoCs
description ioc Process File created C:\Windows\SysWOW64\Ghgobd32.dll 2fc8a89db62a4d4d421ae83d83b1f0f371eb9a1bfcf0b06ddd2671f56cadd503_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\Lbfahp32.exe Limmokib.exe File created C:\Windows\SysWOW64\Hkfeblka.dll Lchnnp32.exe File opened for modification C:\Windows\SysWOW64\Lekhfgfc.exe 2fc8a89db62a4d4d421ae83d83b1f0f371eb9a1bfcf0b06ddd2671f56cadd503_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\Lmgmjjdn.exe Lekhfgfc.exe File created C:\Windows\SysWOW64\Ldqegd32.exe Lmgmjjdn.exe File created C:\Windows\SysWOW64\Coeidfmm.dll Lmgmjjdn.exe File opened for modification C:\Windows\SysWOW64\Lchnnp32.exe Lbfahp32.exe File created C:\Windows\SysWOW64\Hcopljni.dll Mhlmgf32.exe File opened for modification C:\Windows\SysWOW64\Nleiqhcg.exe Nnplpl32.exe File opened for modification C:\Windows\SysWOW64\Limmokib.exe Ldqegd32.exe File created C:\Windows\SysWOW64\Lbfahp32.exe Limmokib.exe File created C:\Windows\SysWOW64\Mlelaeqk.exe Mpolmdkg.exe File created C:\Windows\SysWOW64\Mhlmgf32.exe Mlelaeqk.exe File opened for modification C:\Windows\SysWOW64\Mhlmgf32.exe Mlelaeqk.exe File created C:\Windows\SysWOW64\Obneof32.dll Mdcnlglc.exe File created C:\Windows\SysWOW64\Llkjofpc.dll Lekhfgfc.exe File created C:\Windows\SysWOW64\Dhnakg32.dll Limmokib.exe File created C:\Windows\SysWOW64\Cddjolah.dll Lbfahp32.exe File created C:\Windows\SysWOW64\Mapmaj32.dll Mpolmdkg.exe File created C:\Windows\SysWOW64\Mdcnlglc.exe Mhlmgf32.exe File created C:\Windows\SysWOW64\Lekhfgfc.exe 2fc8a89db62a4d4d421ae83d83b1f0f371eb9a1bfcf0b06ddd2671f56cadd503_NeikiAnalytics.exe File created C:\Windows\SysWOW64\Lmgmjjdn.exe Lekhfgfc.exe File created C:\Windows\SysWOW64\Lchnnp32.exe Lbfahp32.exe File created C:\Windows\SysWOW64\Mpolmdkg.exe Lchnnp32.exe File opened for modification C:\Windows\SysWOW64\Mlelaeqk.exe Mpolmdkg.exe File created C:\Windows\SysWOW64\Nnplpl32.exe Mdcnlglc.exe File opened for modification C:\Windows\SysWOW64\Nnplpl32.exe Mdcnlglc.exe File created C:\Windows\SysWOW64\Icaooali.dll Mlelaeqk.exe File created C:\Windows\SysWOW64\Nleiqhcg.exe Nnplpl32.exe File created C:\Windows\SysWOW64\Hhbabqdh.dll Nnplpl32.exe File opened for modification C:\Windows\SysWOW64\Ldqegd32.exe Lmgmjjdn.exe File created C:\Windows\SysWOW64\Limmokib.exe Ldqegd32.exe File created C:\Windows\SysWOW64\Acjgoa32.dll Ldqegd32.exe File opened for modification C:\Windows\SysWOW64\Mpolmdkg.exe Lchnnp32.exe File opened for modification C:\Windows\SysWOW64\Mdcnlglc.exe Mhlmgf32.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 4448 4428 WerFault.exe 400 -
Modifies registry class 39 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Lbfahp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mapmaj32.dll" Mpolmdkg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ldqegd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Lchnnp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Mlelaeqk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Icaooali.dll" Mlelaeqk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Mlelaeqk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node 2fc8a89db62a4d4d421ae83d83b1f0f371eb9a1bfcf0b06ddd2671f56cadd503_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Lekhfgfc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ldqegd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Lmgmjjdn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Acjgoa32.dll" Ldqegd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dhnakg32.dll" Limmokib.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Lbfahp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Mpolmdkg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 2fc8a89db62a4d4d421ae83d83b1f0f371eb9a1bfcf0b06ddd2671f56cadd503_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghgobd32.dll" 2fc8a89db62a4d4d421ae83d83b1f0f371eb9a1bfcf0b06ddd2671f56cadd503_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Lmgmjjdn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Nnplpl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Lchnnp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Obneof32.dll" Mdcnlglc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Mdcnlglc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Limmokib.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hcopljni.dll" Mhlmgf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Mhlmgf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID 2fc8a89db62a4d4d421ae83d83b1f0f371eb9a1bfcf0b06ddd2671f56cadd503_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Lekhfgfc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Coeidfmm.dll" Lmgmjjdn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hkfeblka.dll" Lchnnp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Mpolmdkg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Limmokib.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Mhlmgf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Mdcnlglc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Nnplpl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717} 2fc8a89db62a4d4d421ae83d83b1f0f371eb9a1bfcf0b06ddd2671f56cadd503_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" 2fc8a89db62a4d4d421ae83d83b1f0f371eb9a1bfcf0b06ddd2671f56cadd503_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Llkjofpc.dll" Lekhfgfc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cddjolah.dll" Lbfahp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hhbabqdh.dll" Nnplpl32.exe -
Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 1992 wrote to memory of 1676 1992 2fc8a89db62a4d4d421ae83d83b1f0f371eb9a1bfcf0b06ddd2671f56cadd503_NeikiAnalytics.exe 28 PID 1992 wrote to memory of 1676 1992 2fc8a89db62a4d4d421ae83d83b1f0f371eb9a1bfcf0b06ddd2671f56cadd503_NeikiAnalytics.exe 28 PID 1992 wrote to memory of 1676 1992 2fc8a89db62a4d4d421ae83d83b1f0f371eb9a1bfcf0b06ddd2671f56cadd503_NeikiAnalytics.exe 28 PID 1992 wrote to memory of 1676 1992 2fc8a89db62a4d4d421ae83d83b1f0f371eb9a1bfcf0b06ddd2671f56cadd503_NeikiAnalytics.exe 28 PID 1676 wrote to memory of 2680 1676 Lekhfgfc.exe 29 PID 1676 wrote to memory of 2680 1676 Lekhfgfc.exe 29 PID 1676 wrote to memory of 2680 1676 Lekhfgfc.exe 29 PID 1676 wrote to memory of 2680 1676 Lekhfgfc.exe 29 PID 2680 wrote to memory of 2756 2680 Lmgmjjdn.exe 30 PID 2680 wrote to memory of 2756 2680 Lmgmjjdn.exe 30 PID 2680 wrote to memory of 2756 2680 Lmgmjjdn.exe 30 PID 2680 wrote to memory of 2756 2680 Lmgmjjdn.exe 30 PID 2756 wrote to memory of 2508 2756 Ldqegd32.exe 31 PID 2756 wrote to memory of 2508 2756 Ldqegd32.exe 31 PID 2756 wrote to memory of 2508 2756 Ldqegd32.exe 31 PID 2756 wrote to memory of 2508 2756 Ldqegd32.exe 31 PID 2508 wrote to memory of 2480 2508 Limmokib.exe 32 PID 2508 wrote to memory of 2480 2508 Limmokib.exe 32 PID 2508 wrote to memory of 2480 2508 Limmokib.exe 32 PID 2508 wrote to memory of 2480 2508 Limmokib.exe 32 PID 2480 wrote to memory of 2044 2480 Lbfahp32.exe 33 PID 2480 wrote to memory of 2044 2480 Lbfahp32.exe 33 PID 2480 wrote to memory of 2044 2480 Lbfahp32.exe 33 PID 2480 wrote to memory of 2044 2480 Lbfahp32.exe 33 PID 2044 wrote to memory of 1804 2044 Lchnnp32.exe 34 PID 2044 wrote to memory of 1804 2044 Lchnnp32.exe 34 PID 2044 wrote to memory of 1804 2044 Lchnnp32.exe 34 PID 2044 wrote to memory of 1804 2044 Lchnnp32.exe 34 PID 1804 wrote to memory of 2540 1804 Mpolmdkg.exe 35 PID 1804 wrote to memory of 2540 1804 Mpolmdkg.exe 35 PID 1804 wrote to memory of 2540 1804 Mpolmdkg.exe 35 PID 1804 wrote to memory of 2540 1804 Mpolmdkg.exe 35 PID 2540 wrote to memory of 1740 2540 Mlelaeqk.exe 36 PID 2540 wrote to memory of 1740 2540 Mlelaeqk.exe 36 PID 2540 wrote to memory of 1740 2540 Mlelaeqk.exe 36 PID 2540 wrote to memory of 1740 2540 Mlelaeqk.exe 36 PID 1740 wrote to memory of 1944 1740 Mhlmgf32.exe 37 PID 1740 wrote to memory of 1944 1740 Mhlmgf32.exe 37 PID 1740 wrote to memory of 1944 1740 Mhlmgf32.exe 37 PID 1740 wrote to memory of 1944 1740 Mhlmgf32.exe 37 PID 1944 wrote to memory of 2380 1944 Mdcnlglc.exe 38 PID 1944 wrote to memory of 2380 1944 Mdcnlglc.exe 38 PID 1944 wrote to memory of 2380 1944 Mdcnlglc.exe 38 PID 1944 wrote to memory of 2380 1944 Mdcnlglc.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\2fc8a89db62a4d4d421ae83d83b1f0f371eb9a1bfcf0b06ddd2671f56cadd503_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2fc8a89db62a4d4d421ae83d83b1f0f371eb9a1bfcf0b06ddd2671f56cadd503_NeikiAnalytics.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\SysWOW64\Lekhfgfc.exeC:\Windows\system32\Lekhfgfc.exe2⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Windows\SysWOW64\Lmgmjjdn.exeC:\Windows\system32\Lmgmjjdn.exe3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\SysWOW64\Ldqegd32.exeC:\Windows\system32\Ldqegd32.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Windows\SysWOW64\Limmokib.exeC:\Windows\system32\Limmokib.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Windows\SysWOW64\Lbfahp32.exeC:\Windows\system32\Lbfahp32.exe6⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Windows\SysWOW64\Lchnnp32.exeC:\Windows\system32\Lchnnp32.exe7⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Windows\SysWOW64\Mpolmdkg.exeC:\Windows\system32\Mpolmdkg.exe8⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Windows\SysWOW64\Mlelaeqk.exeC:\Windows\system32\Mlelaeqk.exe9⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Windows\SysWOW64\Mhlmgf32.exeC:\Windows\system32\Mhlmgf32.exe10⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\SysWOW64\Mdcnlglc.exeC:\Windows\system32\Mdcnlglc.exe11⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Windows\SysWOW64\Nnplpl32.exeC:\Windows\system32\Nnplpl32.exe12⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2380 -
C:\Windows\SysWOW64\Nleiqhcg.exeC:\Windows\system32\Nleiqhcg.exe13⤵PID:1428
-
C:\Windows\SysWOW64\Nqcagfim.exeC:\Windows\system32\Nqcagfim.exe14⤵PID:2580
-
C:\Windows\SysWOW64\Nfpjomgd.exeC:\Windows\system32\Nfpjomgd.exe15⤵PID:2248
-
C:\Windows\SysWOW64\Ofdcjm32.exeC:\Windows\system32\Ofdcjm32.exe16⤵PID:484
-
C:\Windows\SysWOW64\Odjpkihg.exeC:\Windows\system32\Odjpkihg.exe17⤵PID:2880
-
C:\Windows\SysWOW64\Okchhc32.exeC:\Windows\system32\Okchhc32.exe18⤵PID:1112
-
C:\Windows\SysWOW64\Okfencna.exeC:\Windows\system32\Okfencna.exe19⤵PID:3032
-
C:\Windows\SysWOW64\Oqcnfjli.exeC:\Windows\system32\Oqcnfjli.exe20⤵PID:988
-
C:\Windows\SysWOW64\Ojkboo32.exeC:\Windows\system32\Ojkboo32.exe21⤵PID:1468
-
C:\Windows\SysWOW64\Pphjgfqq.exeC:\Windows\system32\Pphjgfqq.exe22⤵PID:1568
-
C:\Windows\SysWOW64\Pipopl32.exeC:\Windows\system32\Pipopl32.exe23⤵PID:2132
-
C:\Windows\SysWOW64\Pcfcmd32.exeC:\Windows\system32\Pcfcmd32.exe24⤵PID:1828
-
C:\Windows\SysWOW64\Piblek32.exeC:\Windows\system32\Piblek32.exe25⤵PID:1348
-
C:\Windows\SysWOW64\Peiljl32.exeC:\Windows\system32\Peiljl32.exe26⤵PID:1316
-
C:\Windows\SysWOW64\Ppoqge32.exeC:\Windows\system32\Ppoqge32.exe27⤵PID:2016
-
C:\Windows\SysWOW64\Pelipl32.exeC:\Windows\system32\Pelipl32.exe28⤵PID:1972
-
C:\Windows\SysWOW64\Pbpjiphi.exeC:\Windows\system32\Pbpjiphi.exe29⤵PID:1528
-
C:\Windows\SysWOW64\Qnfjna32.exeC:\Windows\system32\Qnfjna32.exe30⤵PID:2672
-
C:\Windows\SysWOW64\Qeqbkkej.exeC:\Windows\system32\Qeqbkkej.exe31⤵PID:1108
-
C:\Windows\SysWOW64\Qnigda32.exeC:\Windows\system32\Qnigda32.exe32⤵PID:2492
-
C:\Windows\SysWOW64\Ajphib32.exeC:\Windows\system32\Ajphib32.exe33⤵PID:2656
-
C:\Windows\SysWOW64\Aplpai32.exeC:\Windows\system32\Aplpai32.exe34⤵PID:1780
-
C:\Windows\SysWOW64\Aalmklfi.exeC:\Windows\system32\Aalmklfi.exe35⤵PID:1472
-
C:\Windows\SysWOW64\Abmibdlh.exeC:\Windows\system32\Abmibdlh.exe36⤵PID:2128
-
C:\Windows\SysWOW64\Aigaon32.exeC:\Windows\system32\Aigaon32.exe37⤵PID:1768
-
C:\Windows\SysWOW64\Apajlhka.exeC:\Windows\system32\Apajlhka.exe38⤵PID:1712
-
C:\Windows\SysWOW64\Afkbib32.exeC:\Windows\system32\Afkbib32.exe39⤵PID:804
-
C:\Windows\SysWOW64\Amejeljk.exeC:\Windows\system32\Amejeljk.exe40⤵PID:1484
-
C:\Windows\SysWOW64\Apcfahio.exeC:\Windows\system32\Apcfahio.exe41⤵PID:2616
-
C:\Windows\SysWOW64\Ailkjmpo.exeC:\Windows\system32\Ailkjmpo.exe42⤵PID:2200
-
C:\Windows\SysWOW64\Bpfcgg32.exeC:\Windows\system32\Bpfcgg32.exe43⤵PID:2208
-
C:\Windows\SysWOW64\Bhahlj32.exeC:\Windows\system32\Bhahlj32.exe44⤵PID:704
-
C:\Windows\SysWOW64\Bokphdld.exeC:\Windows\system32\Bokphdld.exe45⤵PID:872
-
C:\Windows\SysWOW64\Beehencq.exeC:\Windows\system32\Beehencq.exe46⤵PID:2804
-
C:\Windows\SysWOW64\Bhcdaibd.exeC:\Windows\system32\Bhcdaibd.exe47⤵PID:1128
-
C:\Windows\SysWOW64\Bnpmipql.exeC:\Windows\system32\Bnpmipql.exe48⤵PID:1208
-
C:\Windows\SysWOW64\Bdjefj32.exeC:\Windows\system32\Bdjefj32.exe49⤵PID:556
-
C:\Windows\SysWOW64\Bghabf32.exeC:\Windows\system32\Bghabf32.exe50⤵PID:1004
-
C:\Windows\SysWOW64\Bopicc32.exeC:\Windows\system32\Bopicc32.exe51⤵PID:1908
-
C:\Windows\SysWOW64\Banepo32.exeC:\Windows\system32\Banepo32.exe52⤵PID:1852
-
C:\Windows\SysWOW64\Bhhnli32.exeC:\Windows\system32\Bhhnli32.exe53⤵PID:888
-
C:\Windows\SysWOW64\Bkfjhd32.exeC:\Windows\system32\Bkfjhd32.exe54⤵PID:1904
-
C:\Windows\SysWOW64\Bnefdp32.exeC:\Windows\system32\Bnefdp32.exe55⤵PID:2260
-
C:\Windows\SysWOW64\Bpcbqk32.exeC:\Windows\system32\Bpcbqk32.exe56⤵PID:2760
-
C:\Windows\SysWOW64\Bcaomf32.exeC:\Windows\system32\Bcaomf32.exe57⤵PID:2928
-
C:\Windows\SysWOW64\Cjlgiqbk.exeC:\Windows\system32\Cjlgiqbk.exe58⤵PID:2544
-
C:\Windows\SysWOW64\Cpeofk32.exeC:\Windows\system32\Cpeofk32.exe59⤵PID:1088
-
C:\Windows\SysWOW64\Ccdlbf32.exeC:\Windows\system32\Ccdlbf32.exe60⤵PID:2280
-
C:\Windows\SysWOW64\Cfbhnaho.exeC:\Windows\system32\Cfbhnaho.exe61⤵PID:352
-
C:\Windows\SysWOW64\Cnippoha.exeC:\Windows\system32\Cnippoha.exe62⤵PID:1188
-
C:\Windows\SysWOW64\Cphlljge.exeC:\Windows\system32\Cphlljge.exe63⤵PID:1244
-
C:\Windows\SysWOW64\Cgbdhd32.exeC:\Windows\system32\Cgbdhd32.exe64⤵PID:3064
-
C:\Windows\SysWOW64\Chcqpmep.exeC:\Windows\system32\Chcqpmep.exe65⤵PID:1708
-
C:\Windows\SysWOW64\Comimg32.exeC:\Windows\system32\Comimg32.exe66⤵PID:1844
-
C:\Windows\SysWOW64\Cjbmjplb.exeC:\Windows\system32\Cjbmjplb.exe67⤵PID:2932
-
C:\Windows\SysWOW64\Copfbfjj.exeC:\Windows\system32\Copfbfjj.exe68⤵PID:1604
-
C:\Windows\SysWOW64\Cbnbobin.exeC:\Windows\system32\Cbnbobin.exe69⤵PID:2504
-
C:\Windows\SysWOW64\Clcflkic.exeC:\Windows\system32\Clcflkic.exe70⤵PID:2212
-
C:\Windows\SysWOW64\Cndbcc32.exeC:\Windows\system32\Cndbcc32.exe71⤵PID:2568
-
C:\Windows\SysWOW64\Dodonf32.exeC:\Windows\system32\Dodonf32.exe72⤵PID:2956
-
C:\Windows\SysWOW64\Dqelenlc.exeC:\Windows\system32\Dqelenlc.exe73⤵PID:1592
-
C:\Windows\SysWOW64\Dhmcfkme.exeC:\Windows\system32\Dhmcfkme.exe74⤵PID:2204
-
C:\Windows\SysWOW64\Djnpnc32.exeC:\Windows\system32\Djnpnc32.exe75⤵PID:2752
-
C:\Windows\SysWOW64\Dqhhknjp.exeC:\Windows\system32\Dqhhknjp.exe76⤵PID:2604
-
C:\Windows\SysWOW64\Dgaqgh32.exeC:\Windows\system32\Dgaqgh32.exe77⤵PID:2500
-
C:\Windows\SysWOW64\Djpmccqq.exeC:\Windows\system32\Djpmccqq.exe78⤵PID:2004
-
C:\Windows\SysWOW64\Dqjepm32.exeC:\Windows\system32\Dqjepm32.exe79⤵PID:1552
-
C:\Windows\SysWOW64\Dfgmhd32.exeC:\Windows\system32\Dfgmhd32.exe80⤵PID:2328
-
C:\Windows\SysWOW64\Dmafennb.exeC:\Windows\system32\Dmafennb.exe81⤵PID:1900
-
C:\Windows\SysWOW64\Doobajme.exeC:\Windows\system32\Doobajme.exe82⤵PID:772
-
C:\Windows\SysWOW64\Dgfjbgmh.exeC:\Windows\system32\Dgfjbgmh.exe83⤵PID:2168
-
C:\Windows\SysWOW64\Djefobmk.exeC:\Windows\system32\Djefobmk.exe84⤵PID:2516
-
C:\Windows\SysWOW64\Emcbkn32.exeC:\Windows\system32\Emcbkn32.exe85⤵PID:1808
-
C:\Windows\SysWOW64\Ebpkce32.exeC:\Windows\system32\Ebpkce32.exe86⤵PID:1212
-
C:\Windows\SysWOW64\Ejgcdb32.exeC:\Windows\system32\Ejgcdb32.exe87⤵PID:612
-
C:\Windows\SysWOW64\Eijcpoac.exeC:\Windows\system32\Eijcpoac.exe88⤵PID:2184
-
C:\Windows\SysWOW64\Ekholjqg.exeC:\Windows\system32\Ekholjqg.exe89⤵PID:2940
-
C:\Windows\SysWOW64\Ecpgmhai.exeC:\Windows\system32\Ecpgmhai.exe90⤵PID:1524
-
C:\Windows\SysWOW64\Eeqdep32.exeC:\Windows\system32\Eeqdep32.exe91⤵PID:2936
-
C:\Windows\SysWOW64\Epfhbign.exeC:\Windows\system32\Epfhbign.exe92⤵PID:236
-
C:\Windows\SysWOW64\Eiomkn32.exeC:\Windows\system32\Eiomkn32.exe93⤵PID:1548
-
C:\Windows\SysWOW64\Epieghdk.exeC:\Windows\system32\Epieghdk.exe94⤵PID:2908
-
C:\Windows\SysWOW64\Ebgacddo.exeC:\Windows\system32\Ebgacddo.exe95⤵PID:780
-
C:\Windows\SysWOW64\Eiaiqn32.exeC:\Windows\system32\Eiaiqn32.exe96⤵PID:1116
-
C:\Windows\SysWOW64\Eloemi32.exeC:\Windows\system32\Eloemi32.exe97⤵PID:1680
-
C:\Windows\SysWOW64\Ejbfhfaj.exeC:\Windows\system32\Ejbfhfaj.exe98⤵PID:2348
-
C:\Windows\SysWOW64\Ealnephf.exeC:\Windows\system32\Ealnephf.exe99⤵PID:2028
-
C:\Windows\SysWOW64\Fehjeo32.exeC:\Windows\system32\Fehjeo32.exe100⤵PID:2836
-
C:\Windows\SysWOW64\Fhffaj32.exeC:\Windows\system32\Fhffaj32.exe101⤵PID:1436
-
C:\Windows\SysWOW64\Fjdbnf32.exeC:\Windows\system32\Fjdbnf32.exe102⤵PID:2748
-
C:\Windows\SysWOW64\Faokjpfd.exeC:\Windows\system32\Faokjpfd.exe103⤵PID:268
-
C:\Windows\SysWOW64\Fcmgfkeg.exeC:\Windows\system32\Fcmgfkeg.exe104⤵PID:2332
-
C:\Windows\SysWOW64\Fhhcgj32.exeC:\Windows\system32\Fhhcgj32.exe105⤵PID:1364
-
C:\Windows\SysWOW64\Fnbkddem.exeC:\Windows\system32\Fnbkddem.exe106⤵PID:1440
-
C:\Windows\SysWOW64\Fmekoalh.exeC:\Windows\system32\Fmekoalh.exe107⤵PID:2424
-
C:\Windows\SysWOW64\Fpdhklkl.exeC:\Windows\system32\Fpdhklkl.exe108⤵PID:2256
-
C:\Windows\SysWOW64\Fdoclk32.exeC:\Windows\system32\Fdoclk32.exe109⤵PID:264
-
C:\Windows\SysWOW64\Ffnphf32.exeC:\Windows\system32\Ffnphf32.exe110⤵PID:2716
-
C:\Windows\SysWOW64\Filldb32.exeC:\Windows\system32\Filldb32.exe111⤵PID:640
-
C:\Windows\SysWOW64\Facdeo32.exeC:\Windows\system32\Facdeo32.exe112⤵PID:3056
-
C:\Windows\SysWOW64\Fpfdalii.exeC:\Windows\system32\Fpfdalii.exe113⤵PID:876
-
C:\Windows\SysWOW64\Fbdqmghm.exeC:\Windows\system32\Fbdqmghm.exe114⤵PID:1164
-
C:\Windows\SysWOW64\Fjlhneio.exeC:\Windows\system32\Fjlhneio.exe115⤵PID:2292
-
C:\Windows\SysWOW64\Fmjejphb.exeC:\Windows\system32\Fmjejphb.exe116⤵PID:2852
-
C:\Windows\SysWOW64\Fddmgjpo.exeC:\Windows\system32\Fddmgjpo.exe117⤵PID:2560
-
C:\Windows\SysWOW64\Ffbicfoc.exeC:\Windows\system32\Ffbicfoc.exe118⤵PID:2124
-
C:\Windows\SysWOW64\Fiaeoang.exeC:\Windows\system32\Fiaeoang.exe119⤵PID:1448
-
C:\Windows\SysWOW64\Gpknlk32.exeC:\Windows\system32\Gpknlk32.exe120⤵PID:572
-
C:\Windows\SysWOW64\Gonnhhln.exeC:\Windows\system32\Gonnhhln.exe121⤵PID:2864
-
C:\Windows\SysWOW64\Gfefiemq.exeC:\Windows\system32\Gfefiemq.exe122⤵PID:1616
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-