Analysis
-
max time kernel
170s -
max time network
175s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
16/10/2023, 12:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NEAS.NEAS763ff573c107a399f5052fc4a94013efexe_JC.exe
Resource
win7-20230831-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.NEAS763ff573c107a399f5052fc4a94013efexe_JC.exe
Resource
win10v2004-20230915-en
5 signatures
150 seconds
General
-
Target
NEAS.NEAS763ff573c107a399f5052fc4a94013efexe_JC.exe
-
Size
80KB
-
MD5
763ff573c107a399f5052fc4a94013ef
-
SHA1
d027e0c8f9b1b2b71aca54093f2f63f9079f9a86
-
SHA256
1769816ca7da5837deec3d4f04576589ccae44a0a13f4b4b2a316d232d6af8a0
-
SHA512
c1d27019d84197a1b792cfd3def9100e151ba47fd83e3a3e9e59b61f0a0139f5669f06cca29ec218fac573071985aca2b57103a98c75526ea4481f224bf9c1b5
-
SSDEEP
1536:j57ohMy4xuDD4VKGTQ9+1tCEnozO8J5YMkhohBE8VGh:jaCy4xuf4+mtC2H8bUAEQGh
Score
10/10
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dlckik32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lmpkadnm.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lnohlgep.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kemhei32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Abgjkpll.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Falcli32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kadnfkji.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Copajm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ehndhn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Iacnpjmg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gfjkjo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Klibdcjo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eqkmpo32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lclpdncg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Daeifj32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ijedehgm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Elfhmc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jlidkh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pfjcpc32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hgboiq32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lajokiaa.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eoindndf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Njlcdf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nlfnkoia.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Imkbglei.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hlkfle32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dnbakghm.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dkpjdo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Afjlgafe.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oocmcn32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Geenclkn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dgbanq32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Afjlgafe.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jaonlhbj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" NEAS.NEAS763ff573c107a399f5052fc4a94013efexe_JC.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mjehok32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dgbhgi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fbajlo32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ggjqqg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Acppddig.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mcqjon32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ncbfcp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Odbgbb32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qejkfp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hbenio32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lndagg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gpolbo32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gbpedjnb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Amfhgj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Plimpg32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dpmknf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cpdgjc32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lgjijmin.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Koceep32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hbegakcb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ehndhn32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Joekkl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Eoindndf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Eqkmpo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hbegakcb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Edjgpi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hehdpjki.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dnbakghm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dpkehi32.exe -
Executes dropped EXE 64 IoCs
pid Process 4864 Lgccinoe.exe 3808 Lmpkadnm.exe 4168 Lnohlgep.exe 4152 Lclpdncg.exe 996 Lnadagbm.exe 3336 Lgjijmin.exe 1720 Lndagg32.exe 560 Mcqjon32.exe 4292 Dnbakghm.exe 1112 Gfjkjo32.exe 2388 Hifcgion.exe 3824 Jllokajf.exe 4468 Gpolbo32.exe 2600 Gbpedjnb.exe 2984 Lljdai32.exe 4196 Nfldgk32.exe 1532 Aalmimfd.exe 1512 Daeifj32.exe 3880 Dgbanq32.exe 4700 Dahfkimd.exe 2272 Dkpjdo32.exe 5088 Kemhei32.exe 1800 Lajokiaa.exe 4620 Pbgqdb32.exe 1616 Piaiqlak.exe 3632 Amfhgj32.exe 1516 Acppddig.exe 5008 Acbmjcgd.exe 2552 Aioebj32.exe 5080 Abgjkpll.exe 2312 Bboplo32.exe 3832 Igneda32.exe 2068 Iaifbg32.exe 4192 Jjakkmpk.exe 1440 Jgekdq32.exe 4696 Dpkehi32.exe 648 Fempbm32.exe 1772 Hjpkjh32.exe 1868 Hqjcgbbo.exe 4160 Hcipcnac.exe 3416 Ioppho32.exe 1880 Ijedehgm.exe 1976 Iqombb32.exe 3124 Ohkijc32.exe 5112 Bhennm32.exe 1236 Elfhmc32.exe 4496 Eliecc32.exe 3204 Eaenkj32.exe 3020 Ehofhdli.exe 3192 Eoindndf.exe 4216 Eecfah32.exe 4124 Fongpm32.exe 4920 Falcli32.exe 3352 Flbhia32.exe 4104 Mjehok32.exe 1920 Nlknbb32.exe 1720 Ncbfcp32.exe 3992 Cdfgdf32.exe 4552 Cjcolm32.exe 2072 Koceep32.exe 2392 Kfmmajed.exe 1172 Kadnfkji.exe 1416 Klibdcjo.exe 3676 Plimpg32.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Abgjkpll.exe Aioebj32.exe File created C:\Windows\SysWOW64\Dfjood32.dll Iqombb32.exe File opened for modification C:\Windows\SysWOW64\Cdfgdf32.exe Ncbfcp32.exe File opened for modification C:\Windows\SysWOW64\Njlcdf32.exe Jlidkh32.exe File created C:\Windows\SysWOW64\Mnhkklbb.exe Kdmqfi32.exe File opened for modification C:\Windows\SysWOW64\Ibcjjm32.exe Iacnpjmg.exe File created C:\Windows\SysWOW64\Lljdai32.exe Gbpedjnb.exe File created C:\Windows\SysWOW64\Gbpedjnb.exe Gpolbo32.exe File opened for modification C:\Windows\SysWOW64\Ehofhdli.exe Eaenkj32.exe File created C:\Windows\SysWOW64\Fdhpoegg.dll Djgbmffn.exe File created C:\Windows\SysWOW64\Njlcdf32.exe Jlidkh32.exe File created C:\Windows\SysWOW64\Digiihci.dll Hbenio32.exe File created C:\Windows\SysWOW64\Jhficc32.exe Jamafidm.exe File opened for modification C:\Windows\SysWOW64\Jaajah32.exe Jaonlhbj.exe File opened for modification C:\Windows\SysWOW64\Lajokiaa.exe Kemhei32.exe File opened for modification C:\Windows\SysWOW64\Hcipcnac.exe Hqjcgbbo.exe File created C:\Windows\SysWOW64\Eecfah32.exe Eoindndf.exe File opened for modification C:\Windows\SysWOW64\Qejkfp32.exe Ponfdf32.exe File created C:\Windows\SysWOW64\Iipkfmal.dll Lajokiaa.exe File created C:\Windows\SysWOW64\Koceep32.exe Cjcolm32.exe File created C:\Windows\SysWOW64\Nlfnkoia.exe Mnhkklbb.exe File created C:\Windows\SysWOW64\Hkibcg32.dll Gnppbapl.exe File created C:\Windows\SysWOW64\Hhmmffbg.exe Gndima32.exe File opened for modification C:\Windows\SysWOW64\Hpdegdci.exe Hhmmffbg.exe File created C:\Windows\SysWOW64\Lgccinoe.exe NEAS.NEAS763ff573c107a399f5052fc4a94013efexe_JC.exe File opened for modification C:\Windows\SysWOW64\Fongpm32.exe Eecfah32.exe File created C:\Windows\SysWOW64\Gimmkk32.dll Kadnfkji.exe File opened for modification C:\Windows\SysWOW64\Lclpdncg.exe Lnohlgep.exe File created C:\Windows\SysWOW64\Hhndme32.dll Kfmmajed.exe File created C:\Windows\SysWOW64\Dlckik32.exe Eckfaj32.exe File created C:\Windows\SysWOW64\Jjhjli32.exe Hgboiq32.exe File created C:\Windows\SysWOW64\Fkhafjhn.dll Gkofpf32.exe File created C:\Windows\SysWOW64\Indfedih.dll Hiackied.exe File created C:\Windows\SysWOW64\Ohkijc32.exe Iqombb32.exe File opened for modification C:\Windows\SysWOW64\Efpofi32.exe Dhnbkfek.exe File created C:\Windows\SysWOW64\Jpgcpo32.dll Iaifbg32.exe File created C:\Windows\SysWOW64\Ckdiqnel.dll Ohkijc32.exe File created C:\Windows\SysWOW64\Jlgooa32.exe Jaajah32.exe File opened for modification C:\Windows\SysWOW64\Dahfkimd.exe Dgbanq32.exe File created C:\Windows\SysWOW64\Hgfoqnae.dll Lndagg32.exe File created C:\Windows\SysWOW64\Mjehok32.exe Flbhia32.exe File created C:\Windows\SysWOW64\Beijfp32.dll Koceep32.exe File opened for modification C:\Windows\SysWOW64\Eqkmpo32.exe Dgbhgi32.exe File opened for modification C:\Windows\SysWOW64\Bgkijp32.exe Qhhphebj.exe File created C:\Windows\SysWOW64\Lndagg32.exe Lgjijmin.exe File created C:\Windows\SysWOW64\Ponfdf32.exe Nlfnkoia.exe File created C:\Windows\SysWOW64\Hodogb32.dll Aoeleelp.exe File created C:\Windows\SysWOW64\Ipbahb32.exe Iaaakj32.exe File created C:\Windows\SysWOW64\Gpolbo32.exe Jllokajf.exe File created C:\Windows\SysWOW64\Pfjbic32.dll Ncbfcp32.exe File created C:\Windows\SysWOW64\Fmbdpnaj.dll Jllokajf.exe File created C:\Windows\SysWOW64\Dgbhgi32.exe Djjobedk.exe File created C:\Windows\SysWOW64\Dpmknf32.exe Aoofej32.exe File opened for modification C:\Windows\SysWOW64\Nppfimnm.exe Mqfpma32.exe File opened for modification C:\Windows\SysWOW64\Amfhgj32.exe Piaiqlak.exe File created C:\Windows\SysWOW64\Hjpkjh32.exe Fempbm32.exe File opened for modification C:\Windows\SysWOW64\Dgbhgi32.exe Djjobedk.exe File created C:\Windows\SysWOW64\Ckidoc32.exe Odbgbb32.exe File created C:\Windows\SysWOW64\Jgmjfpco.exe Imkbglei.exe File created C:\Windows\SysWOW64\Fijdcljo.exe Ehndhn32.exe File opened for modification C:\Windows\SysWOW64\Fijdcljo.exe Ehndhn32.exe File opened for modification C:\Windows\SysWOW64\Fempbm32.exe Dpkehi32.exe File created C:\Windows\SysWOW64\Odnjbcmc.dll Bboplo32.exe File opened for modification C:\Windows\SysWOW64\Acbmjcgd.exe Acppddig.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hohahelb.dll" Gfjkjo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Acppddig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bhennm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dobnpm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ckidoc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pfjojopo.dll" Daiegp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ngbeepdp.dll" Gbgbgalj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oihllb32.dll" Iifmfh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Abocgb32.dll" Dahfkimd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Abgjkpll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Anfimpdb.dll" Ioppho32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aqhhdgfp.dll" Copajm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dlcaca32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjfloq32.dll" Kdmqfi32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hpdegdci.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ipbahb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jajdai32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Okleqm32.dll" Bhennm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Oocmcn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ibcjjm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ehndhn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fiboaq32.dll" Mcqjon32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nbjadm32.dll" Eoindndf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bchogd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nedjdp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kdmqfi32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dhnbkfek.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ehndhn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hecjej32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iklpcimi.dll" Jajdai32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Iifmfh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Knojng32.dll" Pbgqdb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ijedehgm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cdfgdf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Eckfaj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fbajlo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ponfdf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gnppbapl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdnjmc32.dll" NEAS.NEAS763ff573c107a399f5052fc4a94013efexe_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cnbkdhik.dll" Odbgbb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hhfplejl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Iifmfh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjopqdfa.dll" Iacnpjmg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jlidkh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Qmblkmcd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmpokcoh.dll" Fbdeba32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fkhafjhn.dll" Gkofpf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hbenio32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekekpd32.dll" Cjcolm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Koceep32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fbajlo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hkibcg32.dll" Gnppbapl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hcneiljl.dll" Ihbphcpo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hgfoqnae.dll" Lndagg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odnjbcmc.dll" Bboplo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hehdpjki.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ibcjjm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gjikhb32.dll" Fongpm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Flbhia32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ejdkniha.dll" Cdfgdf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gkkgaf32.dll" Fbajlo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Gkofpf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dpkehi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kaemgn32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3020 wrote to memory of 4864 3020 NEAS.NEAS763ff573c107a399f5052fc4a94013efexe_JC.exe 83 PID 3020 wrote to memory of 4864 3020 NEAS.NEAS763ff573c107a399f5052fc4a94013efexe_JC.exe 83 PID 3020 wrote to memory of 4864 3020 NEAS.NEAS763ff573c107a399f5052fc4a94013efexe_JC.exe 83 PID 4864 wrote to memory of 3808 4864 Lgccinoe.exe 84 PID 4864 wrote to memory of 3808 4864 Lgccinoe.exe 84 PID 4864 wrote to memory of 3808 4864 Lgccinoe.exe 84 PID 3808 wrote to memory of 4168 3808 Lmpkadnm.exe 85 PID 3808 wrote to memory of 4168 3808 Lmpkadnm.exe 85 PID 3808 wrote to memory of 4168 3808 Lmpkadnm.exe 85 PID 4168 wrote to memory of 4152 4168 Lnohlgep.exe 86 PID 4168 wrote to memory of 4152 4168 Lnohlgep.exe 86 PID 4168 wrote to memory of 4152 4168 Lnohlgep.exe 86 PID 4152 wrote to memory of 996 4152 Lclpdncg.exe 87 PID 4152 wrote to memory of 996 4152 Lclpdncg.exe 87 PID 4152 wrote to memory of 996 4152 Lclpdncg.exe 87 PID 996 wrote to memory of 3336 996 Lnadagbm.exe 88 PID 996 wrote to memory of 3336 996 Lnadagbm.exe 88 PID 996 wrote to memory of 3336 996 Lnadagbm.exe 88 PID 3336 wrote to memory of 1720 3336 Lgjijmin.exe 89 PID 3336 wrote to memory of 1720 3336 Lgjijmin.exe 89 PID 3336 wrote to memory of 1720 3336 Lgjijmin.exe 89 PID 1720 wrote to memory of 560 1720 Lndagg32.exe 90 PID 1720 wrote to memory of 560 1720 Lndagg32.exe 90 PID 1720 wrote to memory of 560 1720 Lndagg32.exe 90 PID 560 wrote to memory of 4292 560 Mcqjon32.exe 91 PID 560 wrote to memory of 4292 560 Mcqjon32.exe 91 PID 560 wrote to memory of 4292 560 Mcqjon32.exe 91 PID 4292 wrote to memory of 1112 4292 Dnbakghm.exe 92 PID 4292 wrote to memory of 1112 4292 Dnbakghm.exe 92 PID 4292 wrote to memory of 1112 4292 Dnbakghm.exe 92 PID 1112 wrote to memory of 2388 1112 Gfjkjo32.exe 93 PID 1112 wrote to memory of 2388 1112 Gfjkjo32.exe 93 PID 1112 wrote to memory of 2388 1112 Gfjkjo32.exe 93 PID 2388 wrote to memory of 3824 2388 Hifcgion.exe 94 PID 2388 wrote to memory of 3824 2388 Hifcgion.exe 94 PID 2388 wrote to memory of 3824 2388 Hifcgion.exe 94 PID 3824 wrote to memory of 4468 3824 Jllokajf.exe 96 PID 3824 wrote to memory of 4468 3824 Jllokajf.exe 96 PID 3824 wrote to memory of 4468 3824 Jllokajf.exe 96 PID 4468 wrote to memory of 2600 4468 Gpolbo32.exe 97 PID 4468 wrote to memory of 2600 4468 Gpolbo32.exe 97 PID 4468 wrote to memory of 2600 4468 Gpolbo32.exe 97 PID 2600 wrote to memory of 2984 2600 Gbpedjnb.exe 99 PID 2600 wrote to memory of 2984 2600 Gbpedjnb.exe 99 PID 2600 wrote to memory of 2984 2600 Gbpedjnb.exe 99 PID 2984 wrote to memory of 4196 2984 Lljdai32.exe 100 PID 2984 wrote to memory of 4196 2984 Lljdai32.exe 100 PID 2984 wrote to memory of 4196 2984 Lljdai32.exe 100 PID 4196 wrote to memory of 1532 4196 Nfldgk32.exe 101 PID 4196 wrote to memory of 1532 4196 Nfldgk32.exe 101 PID 4196 wrote to memory of 1532 4196 Nfldgk32.exe 101 PID 1532 wrote to memory of 1512 1532 Aalmimfd.exe 102 PID 1532 wrote to memory of 1512 1532 Aalmimfd.exe 102 PID 1532 wrote to memory of 1512 1532 Aalmimfd.exe 102 PID 1512 wrote to memory of 3880 1512 Daeifj32.exe 103 PID 1512 wrote to memory of 3880 1512 Daeifj32.exe 103 PID 1512 wrote to memory of 3880 1512 Daeifj32.exe 103 PID 3880 wrote to memory of 4700 3880 Dgbanq32.exe 104 PID 3880 wrote to memory of 4700 3880 Dgbanq32.exe 104 PID 3880 wrote to memory of 4700 3880 Dgbanq32.exe 104 PID 4700 wrote to memory of 2272 4700 Dahfkimd.exe 105 PID 4700 wrote to memory of 2272 4700 Dahfkimd.exe 105 PID 4700 wrote to memory of 2272 4700 Dahfkimd.exe 105 PID 2272 wrote to memory of 5088 2272 Dkpjdo32.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS763ff573c107a399f5052fc4a94013efexe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS763ff573c107a399f5052fc4a94013efexe_JC.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Windows\SysWOW64\Lgccinoe.exeC:\Windows\system32\Lgccinoe.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Windows\SysWOW64\Lmpkadnm.exeC:\Windows\system32\Lmpkadnm.exe3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Windows\SysWOW64\Lnohlgep.exeC:\Windows\system32\Lnohlgep.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Windows\SysWOW64\Lclpdncg.exeC:\Windows\system32\Lclpdncg.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Windows\SysWOW64\Lnadagbm.exeC:\Windows\system32\Lnadagbm.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Windows\SysWOW64\Lgjijmin.exeC:\Windows\system32\Lgjijmin.exe7⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Windows\SysWOW64\Lndagg32.exeC:\Windows\system32\Lndagg32.exe8⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\SysWOW64\Mcqjon32.exeC:\Windows\system32\Mcqjon32.exe9⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Windows\SysWOW64\Dnbakghm.exeC:\Windows\system32\Dnbakghm.exe10⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Windows\SysWOW64\Gfjkjo32.exeC:\Windows\system32\Gfjkjo32.exe11⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Windows\SysWOW64\Hifcgion.exeC:\Windows\system32\Hifcgion.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Windows\SysWOW64\Jllokajf.exeC:\Windows\system32\Jllokajf.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Windows\SysWOW64\Gpolbo32.exeC:\Windows\system32\Gpolbo32.exe14⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Windows\SysWOW64\Gbpedjnb.exeC:\Windows\system32\Gbpedjnb.exe15⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Windows\SysWOW64\Lljdai32.exeC:\Windows\system32\Lljdai32.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Windows\SysWOW64\Nfldgk32.exeC:\Windows\system32\Nfldgk32.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Windows\SysWOW64\Aalmimfd.exeC:\Windows\system32\Aalmimfd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Windows\SysWOW64\Daeifj32.exeC:\Windows\system32\Daeifj32.exe19⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Windows\SysWOW64\Dgbanq32.exeC:\Windows\system32\Dgbanq32.exe20⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Windows\SysWOW64\Dahfkimd.exeC:\Windows\system32\Dahfkimd.exe21⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Windows\SysWOW64\Dkpjdo32.exeC:\Windows\system32\Dkpjdo32.exe22⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Windows\SysWOW64\Kemhei32.exeC:\Windows\system32\Kemhei32.exe23⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:5088 -
C:\Windows\SysWOW64\Lajokiaa.exeC:\Windows\system32\Lajokiaa.exe24⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:1800 -
C:\Windows\SysWOW64\Pbgqdb32.exeC:\Windows\system32\Pbgqdb32.exe25⤵
- Executes dropped EXE
- Modifies registry class
PID:4620 -
C:\Windows\SysWOW64\Piaiqlak.exeC:\Windows\system32\Piaiqlak.exe26⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1616 -
C:\Windows\SysWOW64\Amfhgj32.exeC:\Windows\system32\Amfhgj32.exe27⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:3632 -
C:\Windows\SysWOW64\Acppddig.exeC:\Windows\system32\Acppddig.exe28⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:1516 -
C:\Windows\SysWOW64\Acbmjcgd.exeC:\Windows\system32\Acbmjcgd.exe29⤵
- Executes dropped EXE
PID:5008 -
C:\Windows\SysWOW64\Aioebj32.exeC:\Windows\system32\Aioebj32.exe30⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2552 -
C:\Windows\SysWOW64\Abgjkpll.exeC:\Windows\system32\Abgjkpll.exe31⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:5080 -
C:\Windows\SysWOW64\Bboplo32.exeC:\Windows\system32\Bboplo32.exe32⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2312 -
C:\Windows\SysWOW64\Igneda32.exeC:\Windows\system32\Igneda32.exe33⤵
- Executes dropped EXE
PID:3832 -
C:\Windows\SysWOW64\Iaifbg32.exeC:\Windows\system32\Iaifbg32.exe34⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2068 -
C:\Windows\SysWOW64\Jjakkmpk.exeC:\Windows\system32\Jjakkmpk.exe35⤵
- Executes dropped EXE
PID:4192 -
C:\Windows\SysWOW64\Jgekdq32.exeC:\Windows\system32\Jgekdq32.exe36⤵
- Executes dropped EXE
PID:1440 -
C:\Windows\SysWOW64\Dpkehi32.exeC:\Windows\system32\Dpkehi32.exe37⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:4696 -
C:\Windows\SysWOW64\Fempbm32.exeC:\Windows\system32\Fempbm32.exe38⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:648 -
C:\Windows\SysWOW64\Hjpkjh32.exeC:\Windows\system32\Hjpkjh32.exe39⤵
- Executes dropped EXE
PID:1772 -
C:\Windows\SysWOW64\Hqjcgbbo.exeC:\Windows\system32\Hqjcgbbo.exe40⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1868 -
C:\Windows\SysWOW64\Hcipcnac.exeC:\Windows\system32\Hcipcnac.exe41⤵
- Executes dropped EXE
PID:4160 -
C:\Windows\SysWOW64\Ioppho32.exeC:\Windows\system32\Ioppho32.exe42⤵
- Executes dropped EXE
- Modifies registry class
PID:3416 -
C:\Windows\SysWOW64\Ijedehgm.exeC:\Windows\system32\Ijedehgm.exe43⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:1880 -
C:\Windows\SysWOW64\Iqombb32.exeC:\Windows\system32\Iqombb32.exe44⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1976 -
C:\Windows\SysWOW64\Ohkijc32.exeC:\Windows\system32\Ohkijc32.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3124 -
C:\Windows\SysWOW64\Bhennm32.exeC:\Windows\system32\Bhennm32.exe46⤵
- Executes dropped EXE
- Modifies registry class
PID:5112 -
C:\Windows\SysWOW64\Elfhmc32.exeC:\Windows\system32\Elfhmc32.exe47⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1236 -
C:\Windows\SysWOW64\Eliecc32.exeC:\Windows\system32\Eliecc32.exe48⤵
- Executes dropped EXE
PID:4496 -
C:\Windows\SysWOW64\Eaenkj32.exeC:\Windows\system32\Eaenkj32.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3204 -
C:\Windows\SysWOW64\Ehofhdli.exeC:\Windows\system32\Ehofhdli.exe50⤵
- Executes dropped EXE
PID:3020 -
C:\Windows\SysWOW64\Eoindndf.exeC:\Windows\system32\Eoindndf.exe51⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:3192 -
C:\Windows\SysWOW64\Eecfah32.exeC:\Windows\system32\Eecfah32.exe52⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4216 -
C:\Windows\SysWOW64\Fongpm32.exeC:\Windows\system32\Fongpm32.exe53⤵
- Executes dropped EXE
- Modifies registry class
PID:4124 -
C:\Windows\SysWOW64\Falcli32.exeC:\Windows\system32\Falcli32.exe54⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:4920 -
C:\Windows\SysWOW64\Flbhia32.exeC:\Windows\system32\Flbhia32.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:3352 -
C:\Windows\SysWOW64\Mjehok32.exeC:\Windows\system32\Mjehok32.exe56⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:4104 -
C:\Windows\SysWOW64\Nlknbb32.exeC:\Windows\system32\Nlknbb32.exe57⤵
- Executes dropped EXE
PID:1920 -
C:\Windows\SysWOW64\Ncbfcp32.exeC:\Windows\system32\Ncbfcp32.exe58⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:1720 -
C:\Windows\SysWOW64\Cdfgdf32.exeC:\Windows\system32\Cdfgdf32.exe59⤵
- Executes dropped EXE
- Modifies registry class
PID:3992 -
C:\Windows\SysWOW64\Cjcolm32.exeC:\Windows\system32\Cjcolm32.exe60⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:4552 -
C:\Windows\SysWOW64\Koceep32.exeC:\Windows\system32\Koceep32.exe61⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2072 -
C:\Windows\SysWOW64\Kfmmajed.exeC:\Windows\system32\Kfmmajed.exe62⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2392 -
C:\Windows\SysWOW64\Kadnfkji.exeC:\Windows\system32\Kadnfkji.exe63⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:1172 -
C:\Windows\SysWOW64\Klibdcjo.exeC:\Windows\system32\Klibdcjo.exe64⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1416 -
C:\Windows\SysWOW64\Plimpg32.exeC:\Windows\system32\Plimpg32.exe65⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:3676 -
C:\Windows\SysWOW64\Cjbhbf32.exeC:\Windows\system32\Cjbhbf32.exe66⤵PID:768
-
C:\Windows\SysWOW64\Cnndbecl.exeC:\Windows\system32\Cnndbecl.exe67⤵PID:1132
-
C:\Windows\SysWOW64\Copajm32.exeC:\Windows\system32\Copajm32.exe68⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:3612 -
C:\Windows\SysWOW64\Cfiiggpg.exeC:\Windows\system32\Cfiiggpg.exe69⤵PID:2944
-
C:\Windows\SysWOW64\Dlcaca32.exeC:\Windows\system32\Dlcaca32.exe70⤵
- Modifies registry class
PID:2600 -
C:\Windows\SysWOW64\Dobnpm32.exeC:\Windows\system32\Dobnpm32.exe71⤵
- Modifies registry class
PID:884 -
C:\Windows\SysWOW64\Djgbmffn.exeC:\Windows\system32\Djgbmffn.exe72⤵
- Drops file in System32 directory
PID:3260 -
C:\Windows\SysWOW64\Dodjemee.exeC:\Windows\system32\Dodjemee.exe73⤵PID:212
-
C:\Windows\SysWOW64\Djjobedk.exeC:\Windows\system32\Djjobedk.exe74⤵
- Drops file in System32 directory
PID:4172 -
C:\Windows\SysWOW64\Dgbhgi32.exeC:\Windows\system32\Dgbhgi32.exe75⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:1448 -
C:\Windows\SysWOW64\Eqkmpo32.exeC:\Windows\system32\Eqkmpo32.exe76⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3148 -
C:\Windows\SysWOW64\Ejcaidlp.exeC:\Windows\system32\Ejcaidlp.exe77⤵PID:2904
-
C:\Windows\SysWOW64\Eckfaj32.exeC:\Windows\system32\Eckfaj32.exe78⤵
- Drops file in System32 directory
- Modifies registry class
PID:1708 -
C:\Windows\SysWOW64\Dlckik32.exeC:\Windows\system32\Dlckik32.exe79⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3820 -
C:\Windows\SysWOW64\Eokjke32.exeC:\Windows\system32\Eokjke32.exe80⤵PID:1808
-
C:\Windows\SysWOW64\Hbegakcb.exeC:\Windows\system32\Hbegakcb.exe81⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3384 -
C:\Windows\SysWOW64\Kaemgn32.exeC:\Windows\system32\Kaemgn32.exe82⤵
- Modifies registry class
PID:468 -
C:\Windows\SysWOW64\Odbgbb32.exeC:\Windows\system32\Odbgbb32.exe83⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:3452 -
C:\Windows\SysWOW64\Ckidoc32.exeC:\Windows\system32\Ckidoc32.exe84⤵
- Modifies registry class
PID:856 -
C:\Windows\SysWOW64\Edihof32.exeC:\Windows\system32\Edihof32.exe85⤵PID:3680
-
C:\Windows\SysWOW64\Gfpcpefb.exeC:\Windows\system32\Gfpcpefb.exe86⤵PID:4676
-
C:\Windows\SysWOW64\Jlidkh32.exeC:\Windows\system32\Jlidkh32.exe87⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:3828 -
C:\Windows\SysWOW64\Njlcdf32.exeC:\Windows\system32\Njlcdf32.exe88⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4788 -
C:\Windows\SysWOW64\Pqhammje.exeC:\Windows\system32\Pqhammje.exe89⤵PID:2832
-
C:\Windows\SysWOW64\Pckfdh32.exeC:\Windows\system32\Pckfdh32.exe90⤵PID:4748
-
C:\Windows\SysWOW64\Pfjcpc32.exeC:\Windows\system32\Pfjcpc32.exe91⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4796 -
C:\Windows\SysWOW64\Afjlgafe.exeC:\Windows\system32\Afjlgafe.exe92⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3140 -
C:\Windows\SysWOW64\Bchogd32.exeC:\Windows\system32\Bchogd32.exe93⤵
- Modifies registry class
PID:2316 -
C:\Windows\SysWOW64\Femgia32.exeC:\Windows\system32\Femgia32.exe94⤵PID:2452
-
C:\Windows\SysWOW64\Jeekeg32.exeC:\Windows\system32\Jeekeg32.exe95⤵PID:3416
-
C:\Windows\SysWOW64\Nedjdp32.exeC:\Windows\system32\Nedjdp32.exe96⤵
- Modifies registry class
PID:1700 -
C:\Windows\SysWOW64\Afboll32.exeC:\Windows\system32\Afboll32.exe97⤵PID:4484
-
C:\Windows\SysWOW64\Daiegp32.exeC:\Windows\system32\Daiegp32.exe98⤵
- Modifies registry class
PID:1896 -
C:\Windows\SysWOW64\Edjgpi32.exeC:\Windows\system32\Edjgpi32.exe99⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2664 -
C:\Windows\SysWOW64\Hgboiq32.exeC:\Windows\system32\Hgboiq32.exe100⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:1732 -
C:\Windows\SysWOW64\Jjhjli32.exeC:\Windows\system32\Jjhjli32.exe101⤵PID:1080
-
C:\Windows\SysWOW64\Kkaimj32.exeC:\Windows\system32\Kkaimj32.exe102⤵PID:5104
-
C:\Windows\SysWOW64\Leenanik.exeC:\Windows\system32\Leenanik.exe103⤵PID:4632
-
C:\Windows\SysWOW64\Magnbnea.exeC:\Windows\system32\Magnbnea.exe104⤵PID:3352
-
C:\Windows\SysWOW64\Oocmcn32.exeC:\Windows\system32\Oocmcn32.exe105⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:1120 -
C:\Windows\SysWOW64\Aoofej32.exeC:\Windows\system32\Aoofej32.exe106⤵
- Drops file in System32 directory
PID:1920 -
C:\Windows\SysWOW64\Dpmknf32.exeC:\Windows\system32\Dpmknf32.exe107⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3832 -
C:\Windows\SysWOW64\Ejoogm32.exeC:\Windows\system32\Ejoogm32.exe108⤵PID:2584
-
C:\Windows\SysWOW64\Fbajlo32.exeC:\Windows\system32\Fbajlo32.exe109⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:1332 -
C:\Windows\SysWOW64\Glgjfb32.exeC:\Windows\system32\Glgjfb32.exe110⤵PID:4752
-
C:\Windows\SysWOW64\Ikpjkf32.exeC:\Windows\system32\Ikpjkf32.exe111⤵PID:5092
-
C:\Windows\SysWOW64\Kdmqfi32.exeC:\Windows\system32\Kdmqfi32.exe112⤵
- Drops file in System32 directory
- Modifies registry class
PID:1020 -
C:\Windows\SysWOW64\Mnhkklbb.exeC:\Windows\system32\Mnhkklbb.exe113⤵
- Drops file in System32 directory
PID:4196 -
C:\Windows\SysWOW64\Nlfnkoia.exeC:\Windows\system32\Nlfnkoia.exe114⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:1680 -
C:\Windows\SysWOW64\Ponfdf32.exeC:\Windows\system32\Ponfdf32.exe115⤵
- Drops file in System32 directory
- Modifies registry class
PID:916 -
C:\Windows\SysWOW64\Qejkfp32.exeC:\Windows\system32\Qejkfp32.exe116⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2944 -
C:\Windows\SysWOW64\Aoeleelp.exeC:\Windows\system32\Aoeleelp.exe117⤵
- Drops file in System32 directory
PID:4412 -
C:\Windows\SysWOW64\Dhnbkfek.exeC:\Windows\system32\Dhnbkfek.exe118⤵
- Drops file in System32 directory
- Modifies registry class
PID:3184 -
C:\Windows\SysWOW64\Efpofi32.exeC:\Windows\system32\Efpofi32.exe119⤵PID:4912
-
C:\Windows\SysWOW64\Gmmmoppl.exeC:\Windows\system32\Gmmmoppl.exe120⤵PID:2384
-
C:\Windows\SysWOW64\Gldgflba.exeC:\Windows\system32\Gldgflba.exe121⤵PID:3872
-
C:\Windows\SysWOW64\Hfaaddlo.exeC:\Windows\system32\Hfaaddlo.exe122⤵PID:1772
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-