Analysis
-
max time kernel
166s -
max time network
178s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
28/10/2023, 20:12
Behavioral task
behavioral1
Sample
NEAS.c0a159f39bab1083d20970a8376f8b80.exe
Resource
win7-20231020-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.c0a159f39bab1083d20970a8376f8b80.exe
Resource
win10v2004-20231023-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
NEAS.c0a159f39bab1083d20970a8376f8b80.exe
-
Size
416KB
-
MD5
c0a159f39bab1083d20970a8376f8b80
-
SHA1
4a93a86e92df4cab415e3caf16cc7e75c24b5a84
-
SHA256
e07fd3b68b089d26dd044e5303584ff2025fa127d1e6e68f217a6603efd6524d
-
SHA512
912a2dbd81307a8453f19b8a6d761672f5ce9b1a7dfbc1e6f32062c656de50df00fa909f5c48239aee6a7089107a48e7336879b4640acbc7cec928a76ddc6867
-
SSDEEP
12288:8GFhgYJ07kE0KoFtw2gu9RxrBIUbPLwH96/I0lOZ0vbqFB:zFhgYJ07kE0KoFtw2gu9RxrBIUbPLwHh
Score
10/10
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jmplbk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Lkgkqh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fddqpn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Gohaod32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Oemephgn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ccmgbf32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fmkgdgej.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ipplmh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Cgpjebcp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Djjemlhf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Fgppgi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Nlbkjf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Nelfnd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Diclff32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Dooaip32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hbbacobm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Amgekh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Laiaqp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ijcjgcni.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ljaooodf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Dklhmlac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Cjkjjmlf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Plagmh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Mbigapjb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ckkilhjm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Fllkjd32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pjkmhblk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Bdmmnd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Icmbcg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Pelacg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Eocegn32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Menpgmap.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Fgldoi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Qjiaak32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Niconj32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ijcjgcni.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ngbeok32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Afcffb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Gonnhf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ghiogkfp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ajlngk32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kmjinjnj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Pboblika.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ooalibaf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ldjhib32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lkqliaki.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Mgphjk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Opqdbhlb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ejaklmpd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mgphjk32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Benjkijd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Pbiklmhp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Dmmifaci.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Hgjldfqj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hbflnl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Njinfk32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ebgpkj32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Olidijjf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Cdaigi32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gonnhf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Faeihogj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Engjol32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Npgmjl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Meogbcel.exe -
Malware Backdoor - Berbew 64 IoCs
Berbew is a malware infection classified as a 'backdoor' Trojan. This malicious program's primary function is to cause chain infections - it can download/install additional malware such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/files/0x0007000000022ce7-6.dat family_berbew behavioral2/files/0x0007000000022ce7-8.dat family_berbew behavioral2/files/0x0007000000022ce1-14.dat family_berbew behavioral2/files/0x0007000000022ce1-16.dat family_berbew behavioral2/files/0x0008000000022ce4-22.dat family_berbew behavioral2/files/0x0008000000022ce4-24.dat family_berbew behavioral2/files/0x0008000000022cf0-30.dat family_berbew behavioral2/files/0x0008000000022cf0-32.dat family_berbew behavioral2/files/0x0006000000022cf5-38.dat family_berbew behavioral2/files/0x0006000000022cf5-40.dat family_berbew behavioral2/files/0x0006000000022cf7-46.dat family_berbew behavioral2/files/0x0006000000022cf7-48.dat family_berbew behavioral2/files/0x0006000000022cf9-54.dat family_berbew behavioral2/files/0x0006000000022cf9-55.dat family_berbew behavioral2/files/0x0006000000022cfb-62.dat family_berbew behavioral2/files/0x0006000000022cfb-63.dat family_berbew behavioral2/files/0x0006000000022cfd-70.dat family_berbew behavioral2/files/0x0006000000022cfd-72.dat family_berbew behavioral2/files/0x0006000000022cff-73.dat family_berbew behavioral2/files/0x0006000000022cff-78.dat family_berbew behavioral2/files/0x0006000000022cff-80.dat family_berbew behavioral2/files/0x0006000000022d01-86.dat family_berbew behavioral2/files/0x0006000000022d01-88.dat family_berbew behavioral2/files/0x0007000000022ceb-94.dat family_berbew behavioral2/files/0x0007000000022ceb-96.dat family_berbew behavioral2/files/0x0008000000022cef-102.dat family_berbew behavioral2/files/0x0008000000022cef-104.dat family_berbew behavioral2/files/0x0007000000022cf3-110.dat family_berbew behavioral2/files/0x0007000000022cf3-112.dat family_berbew behavioral2/files/0x0006000000022d04-113.dat family_berbew behavioral2/files/0x0006000000022d04-118.dat family_berbew behavioral2/files/0x0006000000022d04-120.dat family_berbew behavioral2/files/0x0006000000022d06-127.dat family_berbew behavioral2/files/0x0006000000022d06-126.dat family_berbew behavioral2/files/0x0006000000022d08-134.dat family_berbew behavioral2/files/0x0006000000022d08-136.dat family_berbew behavioral2/files/0x0006000000022d0a-137.dat family_berbew behavioral2/files/0x0006000000022d0a-142.dat family_berbew behavioral2/files/0x0006000000022d0a-144.dat family_berbew behavioral2/files/0x0006000000022d0c-150.dat family_berbew behavioral2/files/0x0006000000022d0c-152.dat family_berbew behavioral2/files/0x0006000000022d0e-158.dat family_berbew behavioral2/files/0x0006000000022d0e-160.dat family_berbew behavioral2/files/0x0006000000022d10-166.dat family_berbew behavioral2/files/0x0006000000022d10-167.dat family_berbew behavioral2/files/0x0006000000022d12-169.dat family_berbew behavioral2/files/0x0006000000022d12-174.dat family_berbew behavioral2/files/0x0006000000022d12-175.dat family_berbew behavioral2/files/0x0006000000022d14-182.dat family_berbew behavioral2/files/0x0006000000022d14-184.dat family_berbew behavioral2/files/0x0006000000022d16-185.dat family_berbew behavioral2/files/0x0006000000022d16-190.dat family_berbew behavioral2/files/0x0006000000022d16-192.dat family_berbew behavioral2/files/0x0006000000022d18-198.dat family_berbew behavioral2/files/0x0006000000022d18-200.dat family_berbew behavioral2/files/0x0006000000022d1a-201.dat family_berbew behavioral2/files/0x0006000000022d1a-206.dat family_berbew behavioral2/files/0x0006000000022d1a-208.dat family_berbew behavioral2/files/0x0006000000022d1c-214.dat family_berbew behavioral2/files/0x0006000000022d1c-215.dat family_berbew behavioral2/files/0x0006000000022d1e-222.dat family_berbew behavioral2/files/0x0006000000022d1e-223.dat family_berbew behavioral2/files/0x0006000000022d20-230.dat family_berbew behavioral2/files/0x0006000000022d20-232.dat family_berbew -
Executes dropped EXE 64 IoCs
pid Process 2776 Fblpflfg.exe 4736 Hohcmjic.exe 2080 Icmbcg32.exe 1992 Kmjinjnj.exe 1668 Komoed32.exe 4216 Lopkkdgf.exe 3832 Liofdigo.exe 472 Lmmokgne.exe 948 Niiaae32.exe 1532 Oplmdnpc.exe 1816 Pboblika.exe 4692 Qlajkm32.exe 5060 Agpqnd32.exe 3228 Bdmdng32.exe 3508 Cgpjebcp.exe 4968 Ddkpoelb.exe 4184 Djjemlhf.exe 5056 Ejdhcjpl.exe 4976 Ecoiapdj.exe 2712 Glhgojef.exe 2908 Ghadjkhh.exe 2276 Heohinog.exe 4764 Ilglgfjd.exe 3736 Kkjejqcl.exe 2504 Klnkoc32.exe 2440 Lmhnea32.exe 3108 Nlbnhkqo.exe 3576 Olidijjf.exe 3104 Oefamoma.exe 372 Pfoamp32.exe 3344 Ampojimo.exe 1968 Aochga32.exe 4068 Aofemaog.exe 3468 Amgekh32.exe 1784 Bcfkiock.exe 4612 Bidlqhgc.exe 724 Bjgifhep.exe 2684 Benjkijd.exe 872 Cphgca32.exe 2728 Dodjemee.exe 4000 Lkgkqh32.exe 1324 Nbbldp32.exe 4984 Negoaj32.exe 4856 Onbpop32.exe 1136 Ooalibaf.exe 4208 Oijqbh32.exe 4172 Oaeegjeb.exe 4996 Pbiklmhp.exe 1748 Pelacg32.exe 4556 Qniogl32.exe 4420 Aehpof32.exe 4228 Aified32.exe 1432 Aacjofkp.exe 5012 Apdkmn32.exe 3756 Bojhnjgf.exe 3320 Bedpjdoc.exe 2224 Bbhqdhnm.exe 4584 Bbljoh32.exe 4860 Bhibgo32.exe 3096 Coojpg32.exe 772 Dhlhcl32.exe 1016 Dhqaokcd.exe 1644 Emhmkh32.exe 3416 Fmapag32.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Plcdbghi.exe Pfilfm32.exe File created C:\Windows\SysWOW64\Eikcmf32.dll Pfilfm32.exe File created C:\Windows\SysWOW64\Agpqnd32.exe Qlajkm32.exe File opened for modification C:\Windows\SysWOW64\Ddmaia32.exe Cdfkhb32.exe File opened for modification C:\Windows\SysWOW64\Lqndahiq.exe Lkqliaki.exe File opened for modification C:\Windows\SysWOW64\Dmmifaci.exe Ccpkblqn.exe File created C:\Windows\SysWOW64\Olhgka32.dll Piphaf32.exe File created C:\Windows\SysWOW64\Cejjpn32.dll Lkjehbaa.exe File created C:\Windows\SysWOW64\Nnccmddi.exe Ngikpjml.exe File created C:\Windows\SysWOW64\Fblpflfg.exe NEAS.c0a159f39bab1083d20970a8376f8b80.exe File created C:\Windows\SysWOW64\Npbhdogo.dll Ejdhcjpl.exe File created C:\Windows\SysWOW64\Cjhfjg32.exe Bimkde32.exe File created C:\Windows\SysWOW64\Coojpg32.exe Bhibgo32.exe File opened for modification C:\Windows\SysWOW64\Hcpjpn32.exe Gfedfk32.exe File opened for modification C:\Windows\SysWOW64\Pfoamp32.exe Oefamoma.exe File created C:\Windows\SysWOW64\Pnflceji.dll Alcofi32.exe File opened for modification C:\Windows\SysWOW64\Hiljpi32.exe Hbbacobm.exe File created C:\Windows\SysWOW64\Mbigapjb.exe Menpgmap.exe File created C:\Windows\SysWOW64\Mgphjk32.exe Mnhdae32.exe File created C:\Windows\SysWOW64\Dfefeq32.exe Dkmebh32.exe File created C:\Windows\SysWOW64\Oaclhq32.dll Mgphjk32.exe File created C:\Windows\SysWOW64\Mhokhn32.dll Glhgojef.exe File opened for modification C:\Windows\SysWOW64\Bjpjoa32.exe Bokeai32.exe File opened for modification C:\Windows\SysWOW64\Ccmgbf32.exe Cckkmg32.exe File opened for modification C:\Windows\SysWOW64\Gjocaj32.exe Godehbed.exe File created C:\Windows\SysWOW64\Kqqjfe32.dll Ihhmaehj.exe File opened for modification C:\Windows\SysWOW64\Fieacc32.exe Epmmjnkp.exe File created C:\Windows\SysWOW64\Jkelbl32.dll Njjdae32.exe File created C:\Windows\SysWOW64\Offnae32.exe Ommjipel.exe File created C:\Windows\SysWOW64\Mqmckp32.dll Dfjgjf32.exe File opened for modification C:\Windows\SysWOW64\Cckkmg32.exe Combgh32.exe File opened for modification C:\Windows\SysWOW64\Oaeegjeb.exe Oijqbh32.exe File created C:\Windows\SysWOW64\Eleagb32.dll Coepob32.exe File opened for modification C:\Windows\SysWOW64\Kfmejopp.exe Kmdqai32.exe File created C:\Windows\SysWOW64\Diclff32.exe Dojgnpke.exe File created C:\Windows\SysWOW64\Kpmnqdjj.dll Aofemaog.exe File opened for modification C:\Windows\SysWOW64\Cndidlfb.exe Agcbqecp.exe File opened for modification C:\Windows\SysWOW64\Acfoep32.exe Ajlngk32.exe File created C:\Windows\SysWOW64\Pcdmoe32.dll Cjkjjmlf.exe File created C:\Windows\SysWOW64\Ommjipel.exe Npgmjl32.exe File opened for modification C:\Windows\SysWOW64\Hbmclobc.exe Gddigk32.exe File created C:\Windows\SysWOW64\Fekmdelm.dll Dhlhcl32.exe File opened for modification C:\Windows\SysWOW64\Fecmjq32.exe Fojenfeg.exe File opened for modification C:\Windows\SysWOW64\Gonnhf32.exe Fefjpp32.exe File created C:\Windows\SysWOW64\Hlhife32.exe Faeihogj.exe File created C:\Windows\SysWOW64\Fieacc32.exe Epmmjnkp.exe File created C:\Windows\SysWOW64\Eiqehj32.dll Mmcnlc32.exe File created C:\Windows\SysWOW64\Mgkoolil.exe Mflbdibj.exe File created C:\Windows\SysWOW64\Apdkmn32.exe Aacjofkp.exe File opened for modification C:\Windows\SysWOW64\Kibmqond.exe Kkomgkoj.exe File created C:\Windows\SysWOW64\Enbhpkpn.dll Ilglgfjd.exe File opened for modification C:\Windows\SysWOW64\Ebgpkj32.exe Emjgcc32.exe File created C:\Windows\SysWOW64\Ljfhjn32.exe Lqndahiq.exe File created C:\Windows\SysWOW64\Omofpp32.dll Mgaoda32.exe File created C:\Windows\SysWOW64\Bhipiihc.exe Bkeppeii.exe File created C:\Windows\SysWOW64\Mflbdibj.exe Mmcnlc32.exe File created C:\Windows\SysWOW64\Koglmqej.dll Faeihogj.exe File created C:\Windows\SysWOW64\Hbmclobc.exe Gddigk32.exe File created C:\Windows\SysWOW64\Kkomgkoj.exe Jkjclk32.exe File created C:\Windows\SysWOW64\Lgamhjja.exe Lbddpclj.exe File opened for modification C:\Windows\SysWOW64\Bjkhme32.exe Aenpeoom.exe File opened for modification C:\Windows\SysWOW64\Jcgbmd32.exe Gbpnegbo.exe File created C:\Windows\SysWOW64\Edldoc32.dll Emhmkh32.exe File created C:\Windows\SysWOW64\Lcmmho32.dll Icmbcg32.exe -
Program crash 2 IoCs
pid pid_target Process procid_target 3736 1724 WerFault.exe 388 3840 1724 WerFault.exe 388 -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Knndpffi.dll" Pfoamp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pmeqhd32.dll" Combgh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ihkigd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Olidijjf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hflhco32.dll" Qniogl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Dhqaokcd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ohboeenl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Polcin32.dll" Fieacc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pcdmoe32.dll" Cjkjjmlf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Apehmkbq.dll" Jqhaolli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mhokhn32.dll" Glhgojef.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ejhehcge.dll" Oefamoma.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Apdkmn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Npnjcm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Hbihdn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Hbihdn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Bimkde32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Emenhcdf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jaejqa32.dll" Qlajkm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Pbiklmhp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Laiaqp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fgpijd32.dll" Ecoiapdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aaafbp32.dll" Lmhnea32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Bhibgo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Icknblga.dll" Gonnhf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Gohaod32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Niconj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Oefamoma.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gjecoa32.dll" Pgihppgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jecdnddf.dll" Qcbfjqkp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Mndhkc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Menpgmap.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Olmdln32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ipplmh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Lopkkdgf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nofoflhf.dll" Hcpjpn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fdqkap32.dll" Gbnobf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ngikpjml.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Bbhqdhnm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Fgppgi32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Kqbdej32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Nnccmddi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Opqdbhlb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Lankloml.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ampojimo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fldailbk.dll" Bjgifhep.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gpdkjdfa.dll" Dkljka32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Mfqlph32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekdanmkl.dll" Plagmh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Kkomgkoj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ledoie32.dll" Lgamhjja.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ncbcjefh.dll" Nlbkjf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pecakp32.dll" Ccmgbf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Bkeppeii.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kimnnbaj.dll" Npgmjl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bbgalejf.dll" Aified32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Eogoaifl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjickj32.dll" Fddqpn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Qcbfjqkp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hkpmnl32.dll" Ccpkblqn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Nlbkjf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Amgekh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Amgekh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Qcbfjqkp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2572 wrote to memory of 2776 2572 NEAS.c0a159f39bab1083d20970a8376f8b80.exe 92 PID 2572 wrote to memory of 2776 2572 NEAS.c0a159f39bab1083d20970a8376f8b80.exe 92 PID 2572 wrote to memory of 2776 2572 NEAS.c0a159f39bab1083d20970a8376f8b80.exe 92 PID 2776 wrote to memory of 4736 2776 Fblpflfg.exe 93 PID 2776 wrote to memory of 4736 2776 Fblpflfg.exe 93 PID 2776 wrote to memory of 4736 2776 Fblpflfg.exe 93 PID 4736 wrote to memory of 2080 4736 Hohcmjic.exe 94 PID 4736 wrote to memory of 2080 4736 Hohcmjic.exe 94 PID 4736 wrote to memory of 2080 4736 Hohcmjic.exe 94 PID 2080 wrote to memory of 1992 2080 Icmbcg32.exe 95 PID 2080 wrote to memory of 1992 2080 Icmbcg32.exe 95 PID 2080 wrote to memory of 1992 2080 Icmbcg32.exe 95 PID 1992 wrote to memory of 1668 1992 Kmjinjnj.exe 96 PID 1992 wrote to memory of 1668 1992 Kmjinjnj.exe 96 PID 1992 wrote to memory of 1668 1992 Kmjinjnj.exe 96 PID 1668 wrote to memory of 4216 1668 Komoed32.exe 97 PID 1668 wrote to memory of 4216 1668 Komoed32.exe 97 PID 1668 wrote to memory of 4216 1668 Komoed32.exe 97 PID 4216 wrote to memory of 3832 4216 Lopkkdgf.exe 98 PID 4216 wrote to memory of 3832 4216 Lopkkdgf.exe 98 PID 4216 wrote to memory of 3832 4216 Lopkkdgf.exe 98 PID 3832 wrote to memory of 472 3832 Liofdigo.exe 99 PID 3832 wrote to memory of 472 3832 Liofdigo.exe 99 PID 3832 wrote to memory of 472 3832 Liofdigo.exe 99 PID 472 wrote to memory of 948 472 Lmmokgne.exe 100 PID 472 wrote to memory of 948 472 Lmmokgne.exe 100 PID 472 wrote to memory of 948 472 Lmmokgne.exe 100 PID 948 wrote to memory of 1532 948 Niiaae32.exe 101 PID 948 wrote to memory of 1532 948 Niiaae32.exe 101 PID 948 wrote to memory of 1532 948 Niiaae32.exe 101 PID 1532 wrote to memory of 1816 1532 Oplmdnpc.exe 102 PID 1532 wrote to memory of 1816 1532 Oplmdnpc.exe 102 PID 1532 wrote to memory of 1816 1532 Oplmdnpc.exe 102 PID 1816 wrote to memory of 4692 1816 Pboblika.exe 103 PID 1816 wrote to memory of 4692 1816 Pboblika.exe 103 PID 1816 wrote to memory of 4692 1816 Pboblika.exe 103 PID 4692 wrote to memory of 5060 4692 Qlajkm32.exe 104 PID 4692 wrote to memory of 5060 4692 Qlajkm32.exe 104 PID 4692 wrote to memory of 5060 4692 Qlajkm32.exe 104 PID 5060 wrote to memory of 3228 5060 Agpqnd32.exe 105 PID 5060 wrote to memory of 3228 5060 Agpqnd32.exe 105 PID 5060 wrote to memory of 3228 5060 Agpqnd32.exe 105 PID 3228 wrote to memory of 3508 3228 Bdmdng32.exe 106 PID 3228 wrote to memory of 3508 3228 Bdmdng32.exe 106 PID 3228 wrote to memory of 3508 3228 Bdmdng32.exe 106 PID 3508 wrote to memory of 4968 3508 Cgpjebcp.exe 107 PID 3508 wrote to memory of 4968 3508 Cgpjebcp.exe 107 PID 3508 wrote to memory of 4968 3508 Cgpjebcp.exe 107 PID 4968 wrote to memory of 4184 4968 Ddkpoelb.exe 108 PID 4968 wrote to memory of 4184 4968 Ddkpoelb.exe 108 PID 4968 wrote to memory of 4184 4968 Ddkpoelb.exe 108 PID 4184 wrote to memory of 5056 4184 Djjemlhf.exe 109 PID 4184 wrote to memory of 5056 4184 Djjemlhf.exe 109 PID 4184 wrote to memory of 5056 4184 Djjemlhf.exe 109 PID 5056 wrote to memory of 4976 5056 Ejdhcjpl.exe 110 PID 5056 wrote to memory of 4976 5056 Ejdhcjpl.exe 110 PID 5056 wrote to memory of 4976 5056 Ejdhcjpl.exe 110 PID 4976 wrote to memory of 2712 4976 Ecoiapdj.exe 111 PID 4976 wrote to memory of 2712 4976 Ecoiapdj.exe 111 PID 4976 wrote to memory of 2712 4976 Ecoiapdj.exe 111 PID 2712 wrote to memory of 2908 2712 Glhgojef.exe 112 PID 2712 wrote to memory of 2908 2712 Glhgojef.exe 112 PID 2712 wrote to memory of 2908 2712 Glhgojef.exe 112 PID 2908 wrote to memory of 2276 2908 Ghadjkhh.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.c0a159f39bab1083d20970a8376f8b80.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.c0a159f39bab1083d20970a8376f8b80.exe"1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Windows\SysWOW64\Fblpflfg.exeC:\Windows\system32\Fblpflfg.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\SysWOW64\Hohcmjic.exeC:\Windows\system32\Hohcmjic.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Windows\SysWOW64\Icmbcg32.exeC:\Windows\system32\Icmbcg32.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Windows\SysWOW64\Kmjinjnj.exeC:\Windows\system32\Kmjinjnj.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\SysWOW64\Komoed32.exeC:\Windows\system32\Komoed32.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Windows\SysWOW64\Lopkkdgf.exeC:\Windows\system32\Lopkkdgf.exe7⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Windows\SysWOW64\Liofdigo.exeC:\Windows\system32\Liofdigo.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Windows\SysWOW64\Lmmokgne.exeC:\Windows\system32\Lmmokgne.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:472 -
C:\Windows\SysWOW64\Niiaae32.exeC:\Windows\system32\Niiaae32.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Windows\SysWOW64\Oplmdnpc.exeC:\Windows\system32\Oplmdnpc.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Windows\SysWOW64\Pboblika.exeC:\Windows\system32\Pboblika.exe12⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Windows\SysWOW64\Qlajkm32.exeC:\Windows\system32\Qlajkm32.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Windows\SysWOW64\Agpqnd32.exeC:\Windows\system32\Agpqnd32.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Windows\SysWOW64\Bdmdng32.exeC:\Windows\system32\Bdmdng32.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Windows\SysWOW64\Cgpjebcp.exeC:\Windows\system32\Cgpjebcp.exe16⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Windows\SysWOW64\Ddkpoelb.exeC:\Windows\system32\Ddkpoelb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Windows\SysWOW64\Djjemlhf.exeC:\Windows\system32\Djjemlhf.exe18⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Windows\SysWOW64\Ejdhcjpl.exeC:\Windows\system32\Ejdhcjpl.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Windows\SysWOW64\Ecoiapdj.exeC:\Windows\system32\Ecoiapdj.exe20⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Windows\SysWOW64\Glhgojef.exeC:\Windows\system32\Glhgojef.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\SysWOW64\Ghadjkhh.exeC:\Windows\system32\Ghadjkhh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Windows\SysWOW64\Heohinog.exeC:\Windows\system32\Heohinog.exe23⤵
- Executes dropped EXE
PID:2276 -
C:\Windows\SysWOW64\Ilglgfjd.exeC:\Windows\system32\Ilglgfjd.exe24⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4764 -
C:\Windows\SysWOW64\Kkjejqcl.exeC:\Windows\system32\Kkjejqcl.exe25⤵
- Executes dropped EXE
PID:3736 -
C:\Windows\SysWOW64\Klnkoc32.exeC:\Windows\system32\Klnkoc32.exe26⤵
- Executes dropped EXE
PID:2504 -
C:\Windows\SysWOW64\Lmhnea32.exeC:\Windows\system32\Lmhnea32.exe27⤵
- Executes dropped EXE
- Modifies registry class
PID:2440 -
C:\Windows\SysWOW64\Nlbnhkqo.exeC:\Windows\system32\Nlbnhkqo.exe28⤵
- Executes dropped EXE
PID:3108 -
C:\Windows\SysWOW64\Olidijjf.exeC:\Windows\system32\Olidijjf.exe29⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:3576 -
C:\Windows\SysWOW64\Oefamoma.exeC:\Windows\system32\Oefamoma.exe30⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:3104 -
C:\Windows\SysWOW64\Pfoamp32.exeC:\Windows\system32\Pfoamp32.exe31⤵
- Executes dropped EXE
- Modifies registry class
PID:372 -
C:\Windows\SysWOW64\Ampojimo.exeC:\Windows\system32\Ampojimo.exe32⤵
- Executes dropped EXE
- Modifies registry class
PID:3344 -
C:\Windows\SysWOW64\Aochga32.exeC:\Windows\system32\Aochga32.exe33⤵
- Executes dropped EXE
PID:1968 -
C:\Windows\SysWOW64\Aofemaog.exeC:\Windows\system32\Aofemaog.exe34⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4068 -
C:\Windows\SysWOW64\Amgekh32.exeC:\Windows\system32\Amgekh32.exe35⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:3468 -
C:\Windows\SysWOW64\Bcfkiock.exeC:\Windows\system32\Bcfkiock.exe36⤵
- Executes dropped EXE
PID:1784 -
C:\Windows\SysWOW64\Bidlqhgc.exeC:\Windows\system32\Bidlqhgc.exe37⤵
- Executes dropped EXE
PID:4612 -
C:\Windows\SysWOW64\Bjgifhep.exeC:\Windows\system32\Bjgifhep.exe38⤵
- Executes dropped EXE
- Modifies registry class
PID:724 -
C:\Windows\SysWOW64\Benjkijd.exeC:\Windows\system32\Benjkijd.exe39⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2684 -
C:\Windows\SysWOW64\Cphgca32.exeC:\Windows\system32\Cphgca32.exe40⤵
- Executes dropped EXE
PID:872 -
C:\Windows\SysWOW64\Dodjemee.exeC:\Windows\system32\Dodjemee.exe41⤵
- Executes dropped EXE
PID:2728 -
C:\Windows\SysWOW64\Lkgkqh32.exeC:\Windows\system32\Lkgkqh32.exe42⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:4000 -
C:\Windows\SysWOW64\Nbbldp32.exeC:\Windows\system32\Nbbldp32.exe43⤵
- Executes dropped EXE
PID:1324 -
C:\Windows\SysWOW64\Negoaj32.exeC:\Windows\system32\Negoaj32.exe44⤵
- Executes dropped EXE
PID:4984 -
C:\Windows\SysWOW64\Onbpop32.exeC:\Windows\system32\Onbpop32.exe45⤵
- Executes dropped EXE
PID:4856 -
C:\Windows\SysWOW64\Ooalibaf.exeC:\Windows\system32\Ooalibaf.exe46⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1136 -
C:\Windows\SysWOW64\Oijqbh32.exeC:\Windows\system32\Oijqbh32.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4208 -
C:\Windows\SysWOW64\Oaeegjeb.exeC:\Windows\system32\Oaeegjeb.exe48⤵
- Executes dropped EXE
PID:4172 -
C:\Windows\SysWOW64\Pbiklmhp.exeC:\Windows\system32\Pbiklmhp.exe49⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:4996 -
C:\Windows\SysWOW64\Pelacg32.exeC:\Windows\system32\Pelacg32.exe50⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1748 -
C:\Windows\SysWOW64\Qniogl32.exeC:\Windows\system32\Qniogl32.exe51⤵
- Executes dropped EXE
- Modifies registry class
PID:4556 -
C:\Windows\SysWOW64\Aehpof32.exeC:\Windows\system32\Aehpof32.exe52⤵
- Executes dropped EXE
PID:4420 -
C:\Windows\SysWOW64\Aified32.exeC:\Windows\system32\Aified32.exe53⤵
- Executes dropped EXE
- Modifies registry class
PID:4228 -
C:\Windows\SysWOW64\Aacjofkp.exeC:\Windows\system32\Aacjofkp.exe54⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1432 -
C:\Windows\SysWOW64\Apdkmn32.exeC:\Windows\system32\Apdkmn32.exe55⤵
- Executes dropped EXE
- Modifies registry class
PID:5012 -
C:\Windows\SysWOW64\Bojhnjgf.exeC:\Windows\system32\Bojhnjgf.exe56⤵
- Executes dropped EXE
PID:3756 -
C:\Windows\SysWOW64\Bedpjdoc.exeC:\Windows\system32\Bedpjdoc.exe57⤵
- Executes dropped EXE
PID:3320 -
C:\Windows\SysWOW64\Bbhqdhnm.exeC:\Windows\system32\Bbhqdhnm.exe58⤵
- Executes dropped EXE
- Modifies registry class
PID:2224 -
C:\Windows\SysWOW64\Bbljoh32.exeC:\Windows\system32\Bbljoh32.exe59⤵
- Executes dropped EXE
PID:4584 -
C:\Windows\SysWOW64\Bhibgo32.exeC:\Windows\system32\Bhibgo32.exe60⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:4860 -
C:\Windows\SysWOW64\Coojpg32.exeC:\Windows\system32\Coojpg32.exe61⤵
- Executes dropped EXE
PID:3096 -
C:\Windows\SysWOW64\Dhlhcl32.exeC:\Windows\system32\Dhlhcl32.exe62⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:772 -
C:\Windows\SysWOW64\Dhqaokcd.exeC:\Windows\system32\Dhqaokcd.exe63⤵
- Executes dropped EXE
- Modifies registry class
PID:1016 -
C:\Windows\SysWOW64\Emhmkh32.exeC:\Windows\system32\Emhmkh32.exe64⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1644 -
C:\Windows\SysWOW64\Fmapag32.exeC:\Windows\system32\Fmapag32.exe65⤵
- Executes dropped EXE
PID:3416 -
C:\Windows\SysWOW64\Godehbed.exeC:\Windows\system32\Godehbed.exe66⤵
- Drops file in System32 directory
PID:4796 -
C:\Windows\SysWOW64\Gjocaj32.exeC:\Windows\system32\Gjocaj32.exe67⤵PID:4028
-
C:\Windows\SysWOW64\Gfedfk32.exeC:\Windows\system32\Gfedfk32.exe68⤵
- Drops file in System32 directory
PID:4788 -
C:\Windows\SysWOW64\Hcpjpn32.exeC:\Windows\system32\Hcpjpn32.exe69⤵
- Modifies registry class
PID:548 -
C:\Windows\SysWOW64\Nneiikqe.exeC:\Windows\system32\Nneiikqe.exe70⤵PID:4772
-
C:\Windows\SysWOW64\Qaegcb32.exeC:\Windows\system32\Qaegcb32.exe71⤵PID:648
-
C:\Windows\SysWOW64\Alcofi32.exeC:\Windows\system32\Alcofi32.exe72⤵
- Drops file in System32 directory
PID:5116 -
C:\Windows\SysWOW64\Abngccbl.exeC:\Windows\system32\Abngccbl.exe73⤵PID:1164
-
C:\Windows\SysWOW64\Ajikhfpg.exeC:\Windows\system32\Ajikhfpg.exe74⤵PID:1512
-
C:\Windows\SysWOW64\Aenpeoom.exeC:\Windows\system32\Aenpeoom.exe75⤵
- Drops file in System32 directory
PID:2740 -
C:\Windows\SysWOW64\Bjkhme32.exeC:\Windows\system32\Bjkhme32.exe76⤵PID:1504
-
C:\Windows\SysWOW64\Bhohfj32.exeC:\Windows\system32\Bhohfj32.exe77⤵PID:4852
-
C:\Windows\SysWOW64\Bbifobho.exeC:\Windows\system32\Bbifobho.exe78⤵PID:1872
-
C:\Windows\SysWOW64\Coepob32.exeC:\Windows\system32\Coepob32.exe79⤵
- Drops file in System32 directory
PID:1756 -
C:\Windows\SysWOW64\Cdaigi32.exeC:\Windows\system32\Cdaigi32.exe80⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4072 -
C:\Windows\SysWOW64\Dlpgiebo.exeC:\Windows\system32\Dlpgiebo.exe81⤵PID:320
-
C:\Windows\SysWOW64\Dldpde32.exeC:\Windows\system32\Dldpde32.exe82⤵PID:1936
-
C:\Windows\SysWOW64\Ddpeigle.exeC:\Windows\system32\Ddpeigle.exe83⤵PID:2956
-
C:\Windows\SysWOW64\Dkjmea32.exeC:\Windows\system32\Dkjmea32.exe84⤵PID:4700
-
C:\Windows\SysWOW64\Dkljka32.exeC:\Windows\system32\Dkljka32.exe85⤵
- Modifies registry class
PID:4992 -
C:\Windows\SysWOW64\Deanhj32.exeC:\Windows\system32\Deanhj32.exe86⤵PID:400
-
C:\Windows\SysWOW64\Eaklcj32.exeC:\Windows\system32\Eaklcj32.exe87⤵PID:2616
-
C:\Windows\SysWOW64\Ecjhmm32.exeC:\Windows\system32\Ecjhmm32.exe88⤵PID:2236
-
C:\Windows\SysWOW64\Eocegn32.exeC:\Windows\system32\Eocegn32.exe89⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2932 -
C:\Windows\SysWOW64\Fdpnpe32.exeC:\Windows\system32\Fdpnpe32.exe90⤵PID:1816
-
C:\Windows\SysWOW64\Fafkoiji.exeC:\Windows\system32\Fafkoiji.exe91⤵PID:4260
-
C:\Windows\SysWOW64\Gbpnegbo.exeC:\Windows\system32\Gbpnegbo.exe92⤵
- Drops file in System32 directory
PID:1280 -
C:\Windows\SysWOW64\Jcgbmd32.exeC:\Windows\system32\Jcgbmd32.exe93⤵PID:852
-
C:\Windows\SysWOW64\Jehoemmb.exeC:\Windows\system32\Jehoemmb.exe94⤵PID:1940
-
C:\Windows\SysWOW64\Kmdqai32.exeC:\Windows\system32\Kmdqai32.exe95⤵
- Drops file in System32 directory
PID:212 -
C:\Windows\SysWOW64\Kfmejopp.exeC:\Windows\system32\Kfmejopp.exe96⤵PID:4736
-
C:\Windows\SysWOW64\Ldjhib32.exeC:\Windows\system32\Ldjhib32.exe97⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3848 -
C:\Windows\SysWOW64\Opongobp.exeC:\Windows\system32\Opongobp.exe98⤵PID:4368
-
C:\Windows\SysWOW64\Afcffb32.exeC:\Windows\system32\Afcffb32.exe99⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2976 -
C:\Windows\SysWOW64\Agcbqecp.exeC:\Windows\system32\Agcbqecp.exe100⤵
- Drops file in System32 directory
PID:4428 -
C:\Windows\SysWOW64\Cndidlfb.exeC:\Windows\system32\Cndidlfb.exe101⤵PID:4552
-
C:\Windows\SysWOW64\Cjkjjmlf.exeC:\Windows\system32\Cjkjjmlf.exe102⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:3728 -
C:\Windows\SysWOW64\Chokcakp.exeC:\Windows\system32\Chokcakp.exe103⤵PID:948
-
C:\Windows\SysWOW64\Cdfkhb32.exeC:\Windows\system32\Cdfkhb32.exe104⤵
- Drops file in System32 directory
PID:2148 -
C:\Windows\SysWOW64\Ddmaia32.exeC:\Windows\system32\Ddmaia32.exe105⤵PID:2744
-
C:\Windows\SysWOW64\Ddakdqff.exeC:\Windows\system32\Ddakdqff.exe106⤵PID:1852
-
C:\Windows\SysWOW64\Eogoaifl.exeC:\Windows\system32\Eogoaifl.exe107⤵
- Modifies registry class
PID:1916 -
C:\Windows\SysWOW64\Egkgljkm.exeC:\Windows\system32\Egkgljkm.exe108⤵PID:224
-
C:\Windows\SysWOW64\Fgppgi32.exeC:\Windows\system32\Fgppgi32.exe109⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:3448 -
C:\Windows\SysWOW64\Fddqpn32.exeC:\Windows\system32\Fddqpn32.exe110⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:4188 -
C:\Windows\SysWOW64\Fojenfeg.exeC:\Windows\system32\Fojenfeg.exe111⤵
- Drops file in System32 directory
PID:3284 -
C:\Windows\SysWOW64\Fecmjq32.exeC:\Windows\system32\Fecmjq32.exe112⤵PID:2400
-
C:\Windows\SysWOW64\Fkqebg32.exeC:\Windows\system32\Fkqebg32.exe113⤵PID:2488
-
C:\Windows\SysWOW64\Fefjpp32.exeC:\Windows\system32\Fefjpp32.exe114⤵
- Drops file in System32 directory
PID:4248 -
C:\Windows\SysWOW64\Gonnhf32.exeC:\Windows\system32\Gonnhf32.exe115⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:2080 -
C:\Windows\SysWOW64\Ghiogkfp.exeC:\Windows\system32\Ghiogkfp.exe116⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4376 -
C:\Windows\SysWOW64\Gochceml.exeC:\Windows\system32\Gochceml.exe117⤵PID:3300
-
C:\Windows\SysWOW64\Goediekj.exeC:\Windows\system32\Goediekj.exe118⤵PID:2356
-
C:\Windows\SysWOW64\Gohaod32.exeC:\Windows\system32\Gohaod32.exe119⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:4816 -
C:\Windows\SysWOW64\Gddigk32.exeC:\Windows\system32\Gddigk32.exe120⤵
- Drops file in System32 directory
PID:1724 -
C:\Windows\SysWOW64\Hbmclobc.exeC:\Windows\system32\Hbmclobc.exe121⤵PID:4220
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-