Analysis
-
max time kernel
142s -
max time network
180s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
21/10/2023, 21:16
Behavioral task
behavioral1
Sample
NEAS.3192901d445671395d257daf568b7ff0.exe
Resource
win7-20231020-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.3192901d445671395d257daf568b7ff0.exe
Resource
win10v2004-20231020-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
NEAS.3192901d445671395d257daf568b7ff0.exe
-
Size
121KB
-
MD5
3192901d445671395d257daf568b7ff0
-
SHA1
a3783f9350668c8ad70d08994545d39d8b08ece3
-
SHA256
553f46ec3540a6605096fe332d784960641a5e9003d5a446998ed20a46aac452
-
SHA512
cd4e82796675e74683159268b2d2c280f0c3a34aae3e071a2245f38049a759c37026abb39d7256367a01dfb85c49b865cafc66d1548c1fd6523ee36b8ac5c669
-
SSDEEP
1536:GatnoL1u4oJDYDDqJQkLBm+5mqiMzICV19zQYOd5ijJnD5ir3oGuiWDD:GaBG1u4oJUgBm7qXVO7AJnD5tvv
Score
10/10
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dnjdncio.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bejobk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Akbjidbf.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aohbbqme.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jgiiclkl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kgkfil32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Niqnli32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ndpjnq32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bpaacblm.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gmkibl32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jmlkpgia.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lggeej32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pilpfm32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ffeaichg.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hfajlp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Moacbe32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hfnpca32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ngklppei.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Dodjemee.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Amibqhed.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Okcccdkp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Onbpop32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Iajkohmj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ldiiio32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nheqnpjk.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Laeoec32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jmqekg32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cnboma32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Djeegf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kkioojpp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Nkeipk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Pcfhlh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Nnimia32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Clbdpc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Hfkdkqeo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iokocmnf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kjdqhjpf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Dcdpakii.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hfkdkqeo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cpifeb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Gcgqag32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bcomonkq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Dfeibf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Knldfe32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cmmgof32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jglaepim.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Apfhajjf.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ecoaijio.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Djeegf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Hmifcjif.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pmdpok32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eflocepa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Eippgckc.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jelhcd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Khhaanop.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nieggill.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Egeemiml.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jmlkpgia.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ldkfno32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Djlkhe32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dqhpjohb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Gceaofmc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bboplo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bjcfeola.exe -
Malware Backdoor - Berbew 64 IoCs
Berbew is a malware infection classified as a 'backdoor' Trojan. This malicious program's primary function is to cause chain infections - it can download/install additional malware such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/memory/4276-0-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew behavioral2/files/0x0006000000022e31-6.dat family_berbew behavioral2/memory/632-7-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew behavioral2/files/0x0006000000022e31-8.dat family_berbew behavioral2/files/0x0006000000022e33-14.dat family_berbew behavioral2/memory/1832-15-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew behavioral2/files/0x0006000000022e33-16.dat family_berbew behavioral2/files/0x0006000000022e35-24.dat family_berbew behavioral2/memory/1668-23-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew behavioral2/files/0x0006000000022e37-30.dat family_berbew behavioral2/files/0x0006000000022e3a-39.dat family_berbew behavioral2/memory/744-40-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew behavioral2/files/0x0006000000022e3a-38.dat family_berbew behavioral2/memory/4772-32-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew behavioral2/files/0x0006000000022e37-31.dat family_berbew behavioral2/files/0x0006000000022e35-22.dat family_berbew behavioral2/files/0x0006000000022e3c-46.dat family_berbew behavioral2/files/0x0006000000022e3c-48.dat family_berbew behavioral2/memory/3588-47-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew behavioral2/memory/2408-55-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew behavioral2/files/0x0006000000022e3e-56.dat family_berbew behavioral2/files/0x0006000000022e3e-54.dat family_berbew behavioral2/files/0x0006000000022e40-57.dat family_berbew behavioral2/files/0x0006000000022e40-62.dat family_berbew behavioral2/memory/3656-63-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew behavioral2/files/0x0006000000022e40-64.dat family_berbew behavioral2/files/0x0006000000022e42-70.dat family_berbew behavioral2/files/0x0006000000022e42-71.dat family_berbew behavioral2/memory/4404-75-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew behavioral2/files/0x0006000000022e44-80.dat family_berbew behavioral2/memory/2780-79-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew behavioral2/files/0x0006000000022e44-78.dat family_berbew behavioral2/files/0x0006000000022e46-86.dat family_berbew behavioral2/files/0x0006000000022e46-87.dat family_berbew behavioral2/memory/452-88-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew behavioral2/files/0x0006000000022e48-94.dat family_berbew behavioral2/memory/4356-96-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew behavioral2/files/0x0006000000022e48-95.dat family_berbew behavioral2/files/0x0006000000022e4a-102.dat family_berbew behavioral2/memory/1456-103-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew behavioral2/files/0x0006000000022e4a-104.dat family_berbew behavioral2/files/0x0006000000022e4c-110.dat family_berbew behavioral2/files/0x0006000000022e4c-112.dat family_berbew behavioral2/memory/2092-111-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew behavioral2/files/0x0006000000022e4e-118.dat family_berbew behavioral2/memory/2968-119-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew behavioral2/files/0x0006000000022e4e-120.dat family_berbew behavioral2/files/0x0006000000022e52-126.dat family_berbew behavioral2/files/0x0006000000022e52-128.dat family_berbew behavioral2/memory/2484-127-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew behavioral2/files/0x0006000000022e56-134.dat family_berbew behavioral2/memory/4856-135-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew behavioral2/files/0x0006000000022e56-136.dat family_berbew behavioral2/files/0x0006000000022e58-142.dat family_berbew behavioral2/memory/4656-144-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew behavioral2/files/0x0006000000022e58-143.dat family_berbew behavioral2/files/0x0006000000022e5a-150.dat family_berbew behavioral2/memory/2464-151-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew behavioral2/files/0x0006000000022e5a-152.dat family_berbew behavioral2/files/0x0006000000022e5e-158.dat family_berbew behavioral2/memory/1260-160-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew behavioral2/files/0x0006000000022e5e-159.dat family_berbew behavioral2/files/0x0007000000022e50-166.dat family_berbew behavioral2/memory/976-168-0x0000000000400000-0x0000000000447000-memory.dmp family_berbew -
Executes dropped EXE 64 IoCs
pid Process 632 Nheqnpjk.exe 1832 Nkeipk32.exe 1668 Napameoi.exe 4772 Nlefjnno.exe 744 Nconfh32.exe 3588 Ndpjnq32.exe 2408 Pilpfm32.exe 3656 Pbddobla.exe 4404 Piceflpi.exe 2780 Pomncfge.exe 452 Qckfid32.exe 4356 Qpbgnecp.exe 1456 Aeopfl32.exe 2092 Abcppq32.exe 2968 Aimhmkgn.exe 2484 Afceko32.exe 4856 Apngjd32.exe 4656 Bejobk32.exe 2464 Bboplo32.exe 1260 Bcnleb32.exe 976 Bliajd32.exe 4868 Cpifeb32.exe 1644 Cmmgof32.exe 4668 Clbdpc32.exe 4976 Cbmlmmjd.exe 2280 Cpqlfa32.exe 3200 Cmdmpe32.exe 4336 Dgdgijhp.exe 336 Dpllbp32.exe 2448 Dpoiho32.exe 4236 Dmbiackg.exe 3324 Ecoaijio.exe 512 Eilfldoi.exe 3176 Egpgehnb.exe 1488 Eippgckc.exe 1592 Epjhcnbp.exe 2752 Eegqldqg.exe 2256 Flaiho32.exe 3136 Fgkfqgce.exe 3856 Flhoinbl.exe 4644 Ffpcbchm.exe 3224 Fdadpk32.exe 3724 Gjnlha32.exe 3860 Gcgqag32.exe 3236 Gloejmld.exe 3956 Ggdigekj.exe 1196 Glabolja.exe 1200 Gcngafol.exe 1304 Hfnpca32.exe 1928 Hgbfhc32.exe 3328 Jeilne32.exe 4540 Jelhcd32.exe 1116 Jjhalkjc.exe 224 Jglaepim.exe 2740 Jaefne32.exe 2156 Khakqo32.exe 1432 Khcgfo32.exe 1992 Keghocao.exe 3668 Kjdqhjpf.exe 1548 Khhaanop.exe 1584 Ldanloba.exe 4612 Laeoec32.exe 5104 Laglkb32.exe 4364 Lfddci32.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Gfjmfj32.dll Khhaanop.exe File created C:\Windows\SysWOW64\Eggbbhkj.exe Eqmjen32.exe File created C:\Windows\SysWOW64\Gnkflo32.exe Gceaofmc.exe File created C:\Windows\SysWOW64\Dcjdmmji.dll Ifdgaond.exe File created C:\Windows\SysWOW64\Mjndfpnf.dll Loqjlg32.exe File created C:\Windows\SysWOW64\Pilpfm32.exe Ndpjnq32.exe File created C:\Windows\SysWOW64\Bdnofdgl.dll Fgkfqgce.exe File created C:\Windows\SysWOW64\Jglaepim.exe Jjhalkjc.exe File created C:\Windows\SysWOW64\Hdaajd32.exe Hndibn32.exe File created C:\Windows\SysWOW64\Napameoi.exe Nkeipk32.exe File created C:\Windows\SysWOW64\Cpifeb32.exe Bliajd32.exe File created C:\Windows\SysWOW64\Ikbekfli.dll Bjcfeola.exe File created C:\Windows\SysWOW64\Fmfbakio.dll NEAS.3192901d445671395d257daf568b7ff0.exe File opened for modification C:\Windows\SysWOW64\Ionlhlld.exe Iffcgoka.exe File created C:\Windows\SysWOW64\Fhofop32.dll Jkkbnl32.exe File created C:\Windows\SysWOW64\Iefkmhfm.dll Jmqekg32.exe File opened for modification C:\Windows\SysWOW64\Ldkfno32.exe Lggeej32.exe File opened for modification C:\Windows\SysWOW64\Piceflpi.exe Pbddobla.exe File created C:\Windows\SysWOW64\Pllppnnm.exe Pkkdhe32.exe File created C:\Windows\SysWOW64\Gaibhj32.exe Gnkflo32.exe File created C:\Windows\SysWOW64\Hdodeedi.exe Hnblmnfa.exe File created C:\Windows\SysWOW64\Iokocmnf.exe Ifdgaond.exe File created C:\Windows\SysWOW64\Jmjojh32.exe Jkkbnl32.exe File created C:\Windows\SysWOW64\Eiebieom.dll Okcccdkp.exe File created C:\Windows\SysWOW64\Flaiho32.exe Eegqldqg.exe File opened for modification C:\Windows\SysWOW64\Pkkdhe32.exe Iadljc32.exe File opened for modification C:\Windows\SysWOW64\Ffeaichg.exe Fqiiamjp.exe File created C:\Windows\SysWOW64\Aikijjon.exe Pmdpok32.exe File created C:\Windows\SysWOW64\Ljoempek.dll Pmdpok32.exe File created C:\Windows\SysWOW64\Aaaakfgk.dll Ffeaichg.exe File created C:\Windows\SysWOW64\Fpnfbi32.exe Fnmjkahi.exe File created C:\Windows\SysWOW64\Nlefjnno.exe Napameoi.exe File created C:\Windows\SysWOW64\Begcjjql.exe Blnoad32.exe File opened for modification C:\Windows\SysWOW64\Cohkinob.exe Cngnbfid.exe File opened for modification C:\Windows\SysWOW64\Hagnihom.exe Hfajlp32.exe File created C:\Windows\SysWOW64\Jenhmaeh.dll Moacbe32.exe File opened for modification C:\Windows\SysWOW64\Nicjaino.exe Nbibeo32.exe File opened for modification C:\Windows\SysWOW64\Qpbgnecp.exe Qckfid32.exe File created C:\Windows\SysWOW64\Cpqlfa32.exe Cbmlmmjd.exe File created C:\Windows\SysWOW64\Fjkchf32.dll Bcomonkq.exe File created C:\Windows\SysWOW64\Ghjdclhp.dll Hdaajd32.exe File created C:\Windows\SysWOW64\Mqnfon32.exe Loqjlg32.exe File opened for modification C:\Windows\SysWOW64\Dpoiho32.exe Dpllbp32.exe File created C:\Windows\SysWOW64\Djeegf32.exe Copajm32.exe File created C:\Windows\SysWOW64\Daacgiil.dll Eflocepa.exe File created C:\Windows\SysWOW64\Mcfqjihp.dll Gcgndf32.exe File created C:\Windows\SysWOW64\Eecmcl32.dll Qnniopcm.exe File opened for modification C:\Windows\SysWOW64\Bpkbmi32.exe Bnlfqngm.exe File opened for modification C:\Windows\SysWOW64\Fpnfbi32.exe Fnmjkahi.exe File created C:\Windows\SysWOW64\Cdhcea32.dll Djjobedk.exe File created C:\Windows\SysWOW64\Eliodqqf.dll Dofgklcb.exe File opened for modification C:\Windows\SysWOW64\Hndibn32.exe Hfmqapcl.exe File created C:\Windows\SysWOW64\Nicjaino.exe Nbibeo32.exe File opened for modification C:\Windows\SysWOW64\Jglaepim.exe Jjhalkjc.exe File opened for modification C:\Windows\SysWOW64\Qipqibmf.exe Pgbdmfnc.exe File created C:\Windows\SysWOW64\Bcomonkq.exe Bpaacblm.exe File created C:\Windows\SysWOW64\Cegjdgdl.dll Iajkohmj.exe File created C:\Windows\SysWOW64\Hgbfhc32.exe Hfnpca32.exe File opened for modification C:\Windows\SysWOW64\Djbbhafj.exe Cnboma32.exe File opened for modification C:\Windows\SysWOW64\Pllppnnm.exe Pkkdhe32.exe File opened for modification C:\Windows\SysWOW64\Laglkb32.exe Laeoec32.exe File created C:\Windows\SysWOW64\Pmdpok32.exe Pppoeg32.exe File created C:\Windows\SysWOW64\Mokbiohj.dll Blqlgdhi.exe File created C:\Windows\SysWOW64\Emoaopnf.exe Dfeibf32.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 3680 5744 WerFault.exe 311 -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Nnpcjplf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmfbakio.dll" NEAS.3192901d445671395d257daf568b7ff0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Gloejmld.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Keghocao.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Adjnaj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Bnlfqngm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Bgimjmfl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Iajkohmj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjndfpnf.dll" Loqjlg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Afceko32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Bboplo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Cmmgof32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Dgbhgi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nqkiog32.dll" Hfkdkqeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Idfkednq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Eippgckc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Dofgklcb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Kkioojpp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Pgbdmfnc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ajggjq32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Blqlgdhi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Eqmjen32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmacohmb.dll" Gablgk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Nnimia32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Dodjemee.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Fqiiamjp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Hfkdkqeo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Emoaopnf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Nieggill.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kdqccq32.dll" Alfcflfb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ikbekfli.dll" Bjcfeola.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kekdfb32.dll" Aikijjon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Dncnnd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Dfeibf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Plkdkcqg.dll" Kkioojpp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Khakqo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fkjhae32.dll" Qciebg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Jmjojh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Bnlfqngm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Nqnofkkj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Nieggill.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gnggfhnm.dll" Nheqnpjk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Pppoeg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Cohkinob.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Emfgpo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Fpimgjbm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pcacpg32.dll" Ffcedd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kdogqi32.dll" Afceko32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Apfhajjf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Bjgifhep.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mcfqjihp.dll" Gcgndf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Giliddlo.dll" Hfajlp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Kdfmcobk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Cbmlmmjd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dpkhci32.dll" Flhoinbl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Plcnfpfp.dll" Bgbmdd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oaqafbfj.dll" Jpoagb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ncloojfj.dll" Ndpjnq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fndinf32.dll" Blnoad32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ffhnocfd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Kobnji32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Knjhae32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ngodlgka.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Aimhmkgn.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4276 wrote to memory of 632 4276 NEAS.3192901d445671395d257daf568b7ff0.exe 87 PID 4276 wrote to memory of 632 4276 NEAS.3192901d445671395d257daf568b7ff0.exe 87 PID 4276 wrote to memory of 632 4276 NEAS.3192901d445671395d257daf568b7ff0.exe 87 PID 632 wrote to memory of 1832 632 Nheqnpjk.exe 89 PID 632 wrote to memory of 1832 632 Nheqnpjk.exe 89 PID 632 wrote to memory of 1832 632 Nheqnpjk.exe 89 PID 1832 wrote to memory of 1668 1832 Nkeipk32.exe 90 PID 1832 wrote to memory of 1668 1832 Nkeipk32.exe 90 PID 1832 wrote to memory of 1668 1832 Nkeipk32.exe 90 PID 1668 wrote to memory of 4772 1668 Napameoi.exe 91 PID 1668 wrote to memory of 4772 1668 Napameoi.exe 91 PID 1668 wrote to memory of 4772 1668 Napameoi.exe 91 PID 4772 wrote to memory of 744 4772 Nlefjnno.exe 92 PID 4772 wrote to memory of 744 4772 Nlefjnno.exe 92 PID 4772 wrote to memory of 744 4772 Nlefjnno.exe 92 PID 744 wrote to memory of 3588 744 Nconfh32.exe 94 PID 744 wrote to memory of 3588 744 Nconfh32.exe 94 PID 744 wrote to memory of 3588 744 Nconfh32.exe 94 PID 3588 wrote to memory of 2408 3588 Ndpjnq32.exe 95 PID 3588 wrote to memory of 2408 3588 Ndpjnq32.exe 95 PID 3588 wrote to memory of 2408 3588 Ndpjnq32.exe 95 PID 2408 wrote to memory of 3656 2408 Pilpfm32.exe 96 PID 2408 wrote to memory of 3656 2408 Pilpfm32.exe 96 PID 2408 wrote to memory of 3656 2408 Pilpfm32.exe 96 PID 3656 wrote to memory of 4404 3656 Pbddobla.exe 97 PID 3656 wrote to memory of 4404 3656 Pbddobla.exe 97 PID 3656 wrote to memory of 4404 3656 Pbddobla.exe 97 PID 4404 wrote to memory of 2780 4404 Piceflpi.exe 98 PID 4404 wrote to memory of 2780 4404 Piceflpi.exe 98 PID 4404 wrote to memory of 2780 4404 Piceflpi.exe 98 PID 2780 wrote to memory of 452 2780 Pomncfge.exe 99 PID 2780 wrote to memory of 452 2780 Pomncfge.exe 99 PID 2780 wrote to memory of 452 2780 Pomncfge.exe 99 PID 452 wrote to memory of 4356 452 Qckfid32.exe 100 PID 452 wrote to memory of 4356 452 Qckfid32.exe 100 PID 452 wrote to memory of 4356 452 Qckfid32.exe 100 PID 4356 wrote to memory of 1456 4356 Qpbgnecp.exe 101 PID 4356 wrote to memory of 1456 4356 Qpbgnecp.exe 101 PID 4356 wrote to memory of 1456 4356 Qpbgnecp.exe 101 PID 1456 wrote to memory of 2092 1456 Aeopfl32.exe 102 PID 1456 wrote to memory of 2092 1456 Aeopfl32.exe 102 PID 1456 wrote to memory of 2092 1456 Aeopfl32.exe 102 PID 2092 wrote to memory of 2968 2092 Abcppq32.exe 103 PID 2092 wrote to memory of 2968 2092 Abcppq32.exe 103 PID 2092 wrote to memory of 2968 2092 Abcppq32.exe 103 PID 2968 wrote to memory of 2484 2968 Aimhmkgn.exe 104 PID 2968 wrote to memory of 2484 2968 Aimhmkgn.exe 104 PID 2968 wrote to memory of 2484 2968 Aimhmkgn.exe 104 PID 2484 wrote to memory of 4856 2484 Afceko32.exe 105 PID 2484 wrote to memory of 4856 2484 Afceko32.exe 105 PID 2484 wrote to memory of 4856 2484 Afceko32.exe 105 PID 4856 wrote to memory of 4656 4856 Apngjd32.exe 106 PID 4856 wrote to memory of 4656 4856 Apngjd32.exe 106 PID 4856 wrote to memory of 4656 4856 Apngjd32.exe 106 PID 4656 wrote to memory of 2464 4656 Bejobk32.exe 107 PID 4656 wrote to memory of 2464 4656 Bejobk32.exe 107 PID 4656 wrote to memory of 2464 4656 Bejobk32.exe 107 PID 2464 wrote to memory of 1260 2464 Bboplo32.exe 108 PID 2464 wrote to memory of 1260 2464 Bboplo32.exe 108 PID 2464 wrote to memory of 1260 2464 Bboplo32.exe 108 PID 1260 wrote to memory of 976 1260 Bcnleb32.exe 109 PID 1260 wrote to memory of 976 1260 Bcnleb32.exe 109 PID 1260 wrote to memory of 976 1260 Bcnleb32.exe 109 PID 976 wrote to memory of 4868 976 Bliajd32.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.3192901d445671395d257daf568b7ff0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.3192901d445671395d257daf568b7ff0.exe"1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Windows\SysWOW64\Nheqnpjk.exeC:\Windows\system32\Nheqnpjk.exe2⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Windows\SysWOW64\Nkeipk32.exeC:\Windows\system32\Nkeipk32.exe3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Windows\SysWOW64\Napameoi.exeC:\Windows\system32\Napameoi.exe4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Windows\SysWOW64\Nlefjnno.exeC:\Windows\system32\Nlefjnno.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Windows\SysWOW64\Nconfh32.exeC:\Windows\system32\Nconfh32.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Windows\SysWOW64\Ndpjnq32.exeC:\Windows\system32\Ndpjnq32.exe7⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Windows\SysWOW64\Pilpfm32.exeC:\Windows\system32\Pilpfm32.exe8⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\SysWOW64\Pbddobla.exeC:\Windows\system32\Pbddobla.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Windows\SysWOW64\Piceflpi.exeC:\Windows\system32\Piceflpi.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Windows\SysWOW64\Pomncfge.exeC:\Windows\system32\Pomncfge.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Windows\SysWOW64\Qckfid32.exeC:\Windows\system32\Qckfid32.exe12⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:452 -
C:\Windows\SysWOW64\Qpbgnecp.exeC:\Windows\system32\Qpbgnecp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Windows\SysWOW64\Aeopfl32.exeC:\Windows\system32\Aeopfl32.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Windows\SysWOW64\Abcppq32.exeC:\Windows\system32\Abcppq32.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\SysWOW64\Aimhmkgn.exeC:\Windows\system32\Aimhmkgn.exe16⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Windows\SysWOW64\Afceko32.exeC:\Windows\system32\Afceko32.exe17⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\SysWOW64\Apngjd32.exeC:\Windows\system32\Apngjd32.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Windows\SysWOW64\Bejobk32.exeC:\Windows\system32\Bejobk32.exe19⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Windows\SysWOW64\Bboplo32.exeC:\Windows\system32\Bboplo32.exe20⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Windows\SysWOW64\Bcnleb32.exeC:\Windows\system32\Bcnleb32.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Windows\SysWOW64\Bliajd32.exeC:\Windows\system32\Bliajd32.exe22⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Windows\SysWOW64\Cpifeb32.exeC:\Windows\system32\Cpifeb32.exe23⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:4868 -
C:\Windows\SysWOW64\Cmmgof32.exeC:\Windows\system32\Cmmgof32.exe24⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:1644 -
C:\Windows\SysWOW64\Clbdpc32.exeC:\Windows\system32\Clbdpc32.exe25⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:4668 -
C:\Windows\SysWOW64\Cbmlmmjd.exeC:\Windows\system32\Cbmlmmjd.exe26⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:4976 -
C:\Windows\SysWOW64\Cpqlfa32.exeC:\Windows\system32\Cpqlfa32.exe27⤵
- Executes dropped EXE
PID:2280 -
C:\Windows\SysWOW64\Cmdmpe32.exeC:\Windows\system32\Cmdmpe32.exe28⤵
- Executes dropped EXE
PID:3200 -
C:\Windows\SysWOW64\Dgdgijhp.exeC:\Windows\system32\Dgdgijhp.exe29⤵
- Executes dropped EXE
PID:4336 -
C:\Windows\SysWOW64\Dpllbp32.exeC:\Windows\system32\Dpllbp32.exe30⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:336 -
C:\Windows\SysWOW64\Dpoiho32.exeC:\Windows\system32\Dpoiho32.exe31⤵
- Executes dropped EXE
PID:2448 -
C:\Windows\SysWOW64\Dmbiackg.exeC:\Windows\system32\Dmbiackg.exe32⤵
- Executes dropped EXE
PID:4236 -
C:\Windows\SysWOW64\Ecoaijio.exeC:\Windows\system32\Ecoaijio.exe33⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:3324 -
C:\Windows\SysWOW64\Eilfldoi.exeC:\Windows\system32\Eilfldoi.exe34⤵
- Executes dropped EXE
PID:512 -
C:\Windows\SysWOW64\Egpgehnb.exeC:\Windows\system32\Egpgehnb.exe35⤵
- Executes dropped EXE
PID:3176 -
C:\Windows\SysWOW64\Eippgckc.exeC:\Windows\system32\Eippgckc.exe36⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:1488 -
C:\Windows\SysWOW64\Epjhcnbp.exeC:\Windows\system32\Epjhcnbp.exe37⤵
- Executes dropped EXE
PID:1592 -
C:\Windows\SysWOW64\Eegqldqg.exeC:\Windows\system32\Eegqldqg.exe38⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2752 -
C:\Windows\SysWOW64\Flaiho32.exeC:\Windows\system32\Flaiho32.exe39⤵
- Executes dropped EXE
PID:2256 -
C:\Windows\SysWOW64\Fgkfqgce.exeC:\Windows\system32\Fgkfqgce.exe40⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3136 -
C:\Windows\SysWOW64\Flhoinbl.exeC:\Windows\system32\Flhoinbl.exe41⤵
- Executes dropped EXE
- Modifies registry class
PID:3856 -
C:\Windows\SysWOW64\Ffpcbchm.exeC:\Windows\system32\Ffpcbchm.exe42⤵
- Executes dropped EXE
PID:4644 -
C:\Windows\SysWOW64\Fdadpk32.exeC:\Windows\system32\Fdadpk32.exe43⤵
- Executes dropped EXE
PID:3224 -
C:\Windows\SysWOW64\Gjnlha32.exeC:\Windows\system32\Gjnlha32.exe44⤵
- Executes dropped EXE
PID:3724 -
C:\Windows\SysWOW64\Gcgqag32.exeC:\Windows\system32\Gcgqag32.exe45⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:3860 -
C:\Windows\SysWOW64\Gloejmld.exeC:\Windows\system32\Gloejmld.exe46⤵
- Executes dropped EXE
- Modifies registry class
PID:3236 -
C:\Windows\SysWOW64\Ggdigekj.exeC:\Windows\system32\Ggdigekj.exe47⤵
- Executes dropped EXE
PID:3956 -
C:\Windows\SysWOW64\Glabolja.exeC:\Windows\system32\Glabolja.exe48⤵
- Executes dropped EXE
PID:1196 -
C:\Windows\SysWOW64\Gcngafol.exeC:\Windows\system32\Gcngafol.exe49⤵
- Executes dropped EXE
PID:1200 -
C:\Windows\SysWOW64\Hfnpca32.exeC:\Windows\system32\Hfnpca32.exe50⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:1304 -
C:\Windows\SysWOW64\Hgbfhc32.exeC:\Windows\system32\Hgbfhc32.exe51⤵
- Executes dropped EXE
PID:1928 -
C:\Windows\SysWOW64\Jeilne32.exeC:\Windows\system32\Jeilne32.exe52⤵
- Executes dropped EXE
PID:3328 -
C:\Windows\SysWOW64\Jelhcd32.exeC:\Windows\system32\Jelhcd32.exe53⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:4540 -
C:\Windows\SysWOW64\Jjhalkjc.exeC:\Windows\system32\Jjhalkjc.exe54⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1116 -
C:\Windows\SysWOW64\Jglaepim.exeC:\Windows\system32\Jglaepim.exe55⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:224 -
C:\Windows\SysWOW64\Jaefne32.exeC:\Windows\system32\Jaefne32.exe56⤵
- Executes dropped EXE
PID:2740 -
C:\Windows\SysWOW64\Khakqo32.exeC:\Windows\system32\Khakqo32.exe57⤵
- Executes dropped EXE
- Modifies registry class
PID:2156 -
C:\Windows\SysWOW64\Khcgfo32.exeC:\Windows\system32\Khcgfo32.exe58⤵
- Executes dropped EXE
PID:1432 -
C:\Windows\SysWOW64\Keghocao.exeC:\Windows\system32\Keghocao.exe59⤵
- Executes dropped EXE
- Modifies registry class
PID:1992 -
C:\Windows\SysWOW64\Kjdqhjpf.exeC:\Windows\system32\Kjdqhjpf.exe60⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:3668 -
C:\Windows\SysWOW64\Khhaanop.exeC:\Windows\system32\Khhaanop.exe61⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:1548 -
C:\Windows\SysWOW64\Ldanloba.exeC:\Windows\system32\Ldanloba.exe62⤵
- Executes dropped EXE
PID:1584 -
C:\Windows\SysWOW64\Laeoec32.exeC:\Windows\system32\Laeoec32.exe63⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:4612 -
C:\Windows\SysWOW64\Laglkb32.exeC:\Windows\system32\Laglkb32.exe64⤵
- Executes dropped EXE
PID:5104 -
C:\Windows\SysWOW64\Lfddci32.exeC:\Windows\system32\Lfddci32.exe65⤵
- Executes dropped EXE
PID:4364 -
C:\Windows\SysWOW64\Lajhpbme.exeC:\Windows\system32\Lajhpbme.exe66⤵PID:3740
-
C:\Windows\SysWOW64\Ldhdlnli.exeC:\Windows\system32\Ldhdlnli.exe67⤵PID:1452
-
C:\Windows\SysWOW64\Ngklppei.exeC:\Windows\system32\Ngklppei.exe68⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5000 -
C:\Windows\SysWOW64\Cnboma32.exeC:\Windows\system32\Cnboma32.exe69⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:1464 -
C:\Windows\SysWOW64\Djbbhafj.exeC:\Windows\system32\Djbbhafj.exe70⤵PID:4400
-
C:\Windows\SysWOW64\Iadljc32.exeC:\Windows\system32\Iadljc32.exe71⤵
- Drops file in System32 directory
PID:4136 -
C:\Windows\SysWOW64\Pkkdhe32.exeC:\Windows\system32\Pkkdhe32.exe72⤵
- Drops file in System32 directory
PID:372 -
C:\Windows\SysWOW64\Pllppnnm.exeC:\Windows\system32\Pllppnnm.exe73⤵PID:4624
-
C:\Windows\SysWOW64\Pcfhlh32.exeC:\Windows\system32\Pcfhlh32.exe74⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3572 -
C:\Windows\SysWOW64\Pgbdmfnc.exeC:\Windows\system32\Pgbdmfnc.exe75⤵
- Drops file in System32 directory
- Modifies registry class
PID:2988 -
C:\Windows\SysWOW64\Qipqibmf.exeC:\Windows\system32\Qipqibmf.exe76⤵PID:4908
-
C:\Windows\SysWOW64\Qlomemlj.exeC:\Windows\system32\Qlomemlj.exe77⤵PID:1204
-
C:\Windows\SysWOW64\Qciebg32.exeC:\Windows\system32\Qciebg32.exe78⤵
- Modifies registry class
PID:4372 -
C:\Windows\SysWOW64\Qkpmcddi.exeC:\Windows\system32\Qkpmcddi.exe79⤵PID:548
-
C:\Windows\SysWOW64\Qnniopcm.exeC:\Windows\system32\Qnniopcm.exe80⤵
- Drops file in System32 directory
PID:3492 -
C:\Windows\SysWOW64\Akbjidbf.exeC:\Windows\system32\Akbjidbf.exe81⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4484 -
C:\Windows\SysWOW64\Adjnaj32.exeC:\Windows\system32\Adjnaj32.exe82⤵
- Modifies registry class
PID:2980 -
C:\Windows\SysWOW64\Agikne32.exeC:\Windows\system32\Agikne32.exe83⤵PID:4320
-
C:\Windows\SysWOW64\Ajggjq32.exeC:\Windows\system32\Ajggjq32.exe84⤵
- Modifies registry class
PID:4828 -
C:\Windows\SysWOW64\Alfcflfb.exeC:\Windows\system32\Alfcflfb.exe85⤵
- Modifies registry class
PID:1832 -
C:\Windows\SysWOW64\Apfhajjf.exeC:\Windows\system32\Apfhajjf.exe86⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:812 -
C:\Windows\SysWOW64\Adadbi32.exeC:\Windows\system32\Adadbi32.exe87⤵PID:3664
-
C:\Windows\SysWOW64\Ajnmjp32.exeC:\Windows\system32\Ajnmjp32.exe88⤵PID:4032
-
C:\Windows\SysWOW64\Addahh32.exeC:\Windows\system32\Addahh32.exe89⤵PID:1504
-
C:\Windows\SysWOW64\Bgbmdd32.exeC:\Windows\system32\Bgbmdd32.exe90⤵
- Modifies registry class
PID:3052 -
C:\Windows\SysWOW64\Bnlfqngm.exeC:\Windows\system32\Bnlfqngm.exe91⤵
- Drops file in System32 directory
- Modifies registry class
PID:4040 -
C:\Windows\SysWOW64\Bpkbmi32.exeC:\Windows\system32\Bpkbmi32.exe92⤵PID:1692
-
C:\Windows\SysWOW64\Bcinie32.exeC:\Windows\system32\Bcinie32.exe93⤵PID:3844
-
C:\Windows\SysWOW64\Bjcfeola.exeC:\Windows\system32\Bjcfeola.exe94⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:4876 -
C:\Windows\SysWOW64\Blabakle.exeC:\Windows\system32\Blabakle.exe95⤵PID:2940
-
C:\Windows\SysWOW64\Bkbcpb32.exeC:\Windows\system32\Bkbcpb32.exe96⤵PID:696
-
C:\Windows\SysWOW64\Bmhibi32.exeC:\Windows\system32\Bmhibi32.exe97⤵PID:3588
-
C:\Windows\SysWOW64\Pppoeg32.exeC:\Windows\system32\Pppoeg32.exe98⤵
- Drops file in System32 directory
- Modifies registry class
PID:3608 -
C:\Windows\SysWOW64\Pmdpok32.exeC:\Windows\system32\Pmdpok32.exe99⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:4088 -
C:\Windows\SysWOW64\Aikijjon.exeC:\Windows\system32\Aikijjon.exe100⤵
- Modifies registry class
PID:4416 -
C:\Windows\SysWOW64\Aohbbqme.exeC:\Windows\system32\Aohbbqme.exe101⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2408 -
C:\Windows\SysWOW64\Amibqhed.exeC:\Windows\system32\Amibqhed.exe102⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3920 -
C:\Windows\SysWOW64\Bgafin32.exeC:\Windows\system32\Bgafin32.exe103⤵PID:3704
-
C:\Windows\SysWOW64\Blnoad32.exeC:\Windows\system32\Blnoad32.exe104⤵
- Drops file in System32 directory
- Modifies registry class
PID:4716 -
C:\Windows\SysWOW64\Begcjjql.exeC:\Windows\system32\Begcjjql.exe105⤵PID:4312
-
C:\Windows\SysWOW64\Blqlgdhi.exeC:\Windows\system32\Blqlgdhi.exe106⤵
- Drops file in System32 directory
- Modifies registry class
PID:3372 -
C:\Windows\SysWOW64\Beippj32.exeC:\Windows\system32\Beippj32.exe107⤵PID:4964
-
C:\Windows\SysWOW64\Boaeioej.exeC:\Windows\system32\Boaeioej.exe108⤵PID:364
-
C:\Windows\SysWOW64\Bgimjmfl.exeC:\Windows\system32\Bgimjmfl.exe109⤵
- Modifies registry class
PID:2920 -
C:\Windows\SysWOW64\Bjgifhep.exeC:\Windows\system32\Bjgifhep.exe110⤵
- Modifies registry class
PID:336 -
C:\Windows\SysWOW64\Bpaacblm.exeC:\Windows\system32\Bpaacblm.exe111⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:4236 -
C:\Windows\SysWOW64\Bcomonkq.exeC:\Windows\system32\Bcomonkq.exe112⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:2756 -
C:\Windows\SysWOW64\Clhbhc32.exeC:\Windows\system32\Clhbhc32.exe113⤵PID:3948
-
C:\Windows\SysWOW64\Cfpfqiha.exeC:\Windows\system32\Cfpfqiha.exe114⤵PID:5080
-
C:\Windows\SysWOW64\Cngnbfid.exeC:\Windows\system32\Cngnbfid.exe115⤵
- Drops file in System32 directory
PID:3856 -
C:\Windows\SysWOW64\Cohkinob.exeC:\Windows\system32\Cohkinob.exe116⤵
- Modifies registry class
PID:916 -
C:\Windows\SysWOW64\Cfbcfh32.exeC:\Windows\system32\Cfbcfh32.exe117⤵PID:1196
-
C:\Windows\SysWOW64\Copajm32.exeC:\Windows\system32\Copajm32.exe118⤵
- Drops file in System32 directory
PID:4220 -
C:\Windows\SysWOW64\Djeegf32.exeC:\Windows\system32\Djeegf32.exe119⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3328 -
C:\Windows\SysWOW64\Dobnpm32.exeC:\Windows\system32\Dobnpm32.exe120⤵PID:4228
-
C:\Windows\SysWOW64\Dflflg32.exeC:\Windows\system32\Dflflg32.exe121⤵PID:1120
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-