Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
176s -
max time network
184s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
31/10/2023, 08:50
Behavioral task
behavioral1
Sample
NEAS.08c2d4ccd547305025da8ec21f6c1890.exe
Resource
win7-20231023-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.08c2d4ccd547305025da8ec21f6c1890.exe
Resource
win10v2004-20231023-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
NEAS.08c2d4ccd547305025da8ec21f6c1890.exe
-
Size
104KB
-
MD5
08c2d4ccd547305025da8ec21f6c1890
-
SHA1
2a1573394f99574077e2b1e1e7fa011dc5845718
-
SHA256
da854df6ced703edde4d2618f2845332d7010e1e98a0d49b6f79466949a04528
-
SHA512
eccbec5ce5f0dfaa8e1a719aec85b6fc7e4d90623e02470a6c187ee9cbeb71a176da0fc9b9887631078342a250ce3873cb2168e0545a048a4af8cdbdcbd979c4
-
SSDEEP
3072:3KUXGBYP3o8dYxN6Csgy7D9je5Ix7cEGrhkngpDvchkqbAIQS:1XGBU3oEYEo5Ix4brq2Ahn
Score
10/10
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pjhpccnn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cfdhdn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Jgqdal32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Omcjne32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cipppc32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pchljlpo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ednolp32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ackfbj32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cnndbecl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gdbmalja.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bcfabgel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Afceed32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Gljlhc32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eppoln32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Lgjgfmoo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Mfmphg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ljjicl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Didjkbim.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aoenbkll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Pjalpida.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Lplpcc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ffaogm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Gideogil.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fdpnng32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mbnjcg32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Obgofmjb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Mkjjncgg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Bflhkc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Mnaghb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Hnkonpeo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lgamhjja.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Gpcffalc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Iebnqofj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Dojqcjgi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Amhdfo32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gpgndkhb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pplcnf32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jqgldb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Hoglmg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Omdpio32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Kahqbgjp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oiojhkkj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Oljonc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Pplcnf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Djomjfde.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mldmlf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Meonklfm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Idffkm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Jpbdfgge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ocbhjjqn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Mjjkkghp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Glfmaemc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Dnqcop32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gjqigg32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Defadfql.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pibdff32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cbpacmbc.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mqdcga32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hkhblo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Okjcdq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Fojehjmo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lplpcc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Eaddcnad.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fhmiqfma.exe -
Malware Backdoor - Berbew 64 IoCs
Berbew is a malware infection classified as a 'backdoor' Trojan. This malicious program's primary function is to cause chain infections - it can download/install additional malware such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/memory/668-0-0x0000000000400000-0x0000000000443000-memory.dmp family_berbew behavioral2/files/0x0007000000022ccd-6.dat family_berbew behavioral2/files/0x0007000000022ccd-8.dat family_berbew behavioral2/memory/3952-7-0x0000000000400000-0x0000000000443000-memory.dmp family_berbew behavioral2/files/0x0007000000022cd5-14.dat family_berbew behavioral2/memory/2800-15-0x0000000000400000-0x0000000000443000-memory.dmp family_berbew behavioral2/files/0x0007000000022cd5-16.dat family_berbew behavioral2/files/0x0007000000022cd7-22.dat family_berbew behavioral2/files/0x0007000000022cd7-24.dat family_berbew behavioral2/memory/2020-23-0x0000000000400000-0x0000000000443000-memory.dmp family_berbew behavioral2/files/0x0008000000022cd9-30.dat family_berbew behavioral2/files/0x0008000000022cd9-32.dat family_berbew behavioral2/memory/3164-31-0x0000000000400000-0x0000000000443000-memory.dmp family_berbew behavioral2/files/0x0008000000022cdc-38.dat family_berbew behavioral2/memory/3556-39-0x0000000000400000-0x0000000000443000-memory.dmp family_berbew behavioral2/files/0x0008000000022cdc-40.dat family_berbew behavioral2/files/0x0006000000022cde-41.dat family_berbew behavioral2/files/0x0006000000022cde-46.dat family_berbew behavioral2/files/0x0006000000022cde-48.dat family_berbew behavioral2/memory/4784-47-0x0000000000400000-0x0000000000443000-memory.dmp family_berbew behavioral2/files/0x0006000000022ce0-54.dat family_berbew behavioral2/files/0x0006000000022ce0-56.dat family_berbew behavioral2/memory/3816-55-0x0000000000400000-0x0000000000443000-memory.dmp family_berbew behavioral2/files/0x0006000000022ce2-63.dat family_berbew behavioral2/memory/2024-64-0x0000000000400000-0x0000000000443000-memory.dmp family_berbew behavioral2/files/0x0006000000022ce2-62.dat family_berbew behavioral2/files/0x0006000000022ce4-70.dat family_berbew behavioral2/memory/4936-71-0x0000000000400000-0x0000000000443000-memory.dmp family_berbew behavioral2/files/0x0006000000022ce4-72.dat family_berbew behavioral2/files/0x0006000000022ce6-73.dat family_berbew behavioral2/files/0x0006000000022ce6-80.dat family_berbew behavioral2/memory/812-79-0x0000000000400000-0x0000000000443000-memory.dmp family_berbew behavioral2/files/0x0006000000022ce6-78.dat family_berbew behavioral2/memory/3336-87-0x0000000000400000-0x0000000000443000-memory.dmp family_berbew behavioral2/files/0x0006000000022ce8-88.dat family_berbew behavioral2/files/0x0006000000022ce8-86.dat family_berbew behavioral2/files/0x0006000000022cea-94.dat family_berbew behavioral2/files/0x0006000000022cea-96.dat family_berbew behavioral2/memory/4904-95-0x0000000000400000-0x0000000000443000-memory.dmp family_berbew behavioral2/memory/1580-103-0x0000000000400000-0x0000000000443000-memory.dmp family_berbew behavioral2/files/0x0006000000022cec-104.dat family_berbew behavioral2/files/0x0006000000022cec-102.dat family_berbew behavioral2/files/0x0006000000022cee-110.dat family_berbew behavioral2/files/0x0006000000022cee-112.dat family_berbew behavioral2/memory/5044-111-0x0000000000400000-0x0000000000443000-memory.dmp family_berbew behavioral2/files/0x0006000000022cf0-118.dat family_berbew behavioral2/files/0x0006000000022cf2-121.dat family_berbew behavioral2/files/0x0006000000022cf0-120.dat family_berbew behavioral2/memory/3096-119-0x0000000000400000-0x0000000000443000-memory.dmp family_berbew behavioral2/files/0x0006000000022cf2-126.dat family_berbew behavioral2/memory/3460-127-0x0000000000400000-0x0000000000443000-memory.dmp family_berbew behavioral2/files/0x0006000000022cf2-128.dat family_berbew behavioral2/files/0x0006000000022cf4-134.dat family_berbew behavioral2/files/0x0006000000022cf4-135.dat family_berbew behavioral2/memory/1344-136-0x0000000000400000-0x0000000000443000-memory.dmp family_berbew behavioral2/files/0x0006000000022cf6-138.dat family_berbew behavioral2/files/0x0006000000022cf6-142.dat family_berbew behavioral2/files/0x0006000000022cf6-144.dat family_berbew behavioral2/memory/5092-143-0x0000000000400000-0x0000000000443000-memory.dmp family_berbew behavioral2/files/0x0006000000022cf8-150.dat family_berbew behavioral2/files/0x0006000000022cf8-152.dat family_berbew behavioral2/memory/1116-151-0x0000000000400000-0x0000000000443000-memory.dmp family_berbew behavioral2/files/0x0006000000022cfc-158.dat family_berbew behavioral2/files/0x0006000000022cfc-160.dat family_berbew -
Executes dropped EXE 64 IoCs
pid Process 3952 Dbdano32.exe 2800 Ehofhdli.exe 2020 Falcli32.exe 3164 Geflne32.exe 3556 Gkeakl32.exe 4784 Hcabhido.exe 3816 Ieiajckh.exe 2024 Icmbcg32.exe 4936 Jbghpc32.exe 812 Jkcfch32.exe 3336 Jjefao32.exe 4904 Kbgafqla.exe 1580 Kjcccm32.exe 5044 Lcndab32.exe 3096 Ljjicl32.exe 3460 Llpofd32.exe 1344 Mjehok32.exe 5092 Njahki32.exe 1116 Odnfonag.exe 4940 Odelpm32.exe 4064 Pindcboi.exe 4232 Qkmqne32.exe 3152 Agfnhf32.exe 3184 Apcllk32.exe 4524 Acgacegg.exe 1644 Bgggockk.exe 4476 Bjhpqn32.exe 4768 Bcpdidol.exe 4920 Bdpqcg32.exe 2884 Cnjbbl32.exe 3732 Cjcolm32.exe 3700 Ddkpoelb.exe 5056 Djjemlhf.exe 4420 Egoomnin.exe 1748 Fjdajhbi.exe 1276 Fdobhm32.exe 3932 Gjkgkg32.exe 4780 Helkdnaj.exe 3136 Iefnjm32.exe 5072 Khpcid32.exe 4864 Linojbdc.exe 652 Mbnjcg32.exe 3432 Olfgcj32.exe 1288 Pmpfcl32.exe 2912 Plgpjhnf.exe 5024 Qbhnga32.exe 3540 Agmmnnpj.exe 1880 Agojdnng.exe 4900 Bmlofhca.exe 4020 Bgkipl32.exe 316 Cphgca32.exe 4528 Cnndbecl.exe 3944 Dqomdppm.exe 3172 Djgbmffn.exe 3600 Dqfceoje.exe 3236 Dokqfl32.exe 3232 Emhdeoel.exe 2224 Fcgemhic.exe 4804 Fnofpqff.exe 1440 Gfaaebnj.exe 2016 Gmnfglcd.exe 3412 Galonj32.exe 1848 Hhhdpd32.exe 3888 Hmdlhk32.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Iecmabmp.exe Ijmhdi32.exe File created C:\Windows\SysWOW64\Ofeebpmn.dll Defadfql.exe File opened for modification C:\Windows\SysWOW64\Dpcpei32.exe Denlgq32.exe File opened for modification C:\Windows\SysWOW64\Alkidi32.exe Qemhlp32.exe File created C:\Windows\SysWOW64\Nkloef32.dll Icedkn32.exe File created C:\Windows\SysWOW64\Qagdia32.exe Qjmllgjd.exe File opened for modification C:\Windows\SysWOW64\Qlmhfj32.exe Qagdia32.exe File created C:\Windows\SysWOW64\Kkjlmn32.dll Jglkfmmi.exe File opened for modification C:\Windows\SysWOW64\Oocmcn32.exe Oaomij32.exe File opened for modification C:\Windows\SysWOW64\Qbljig32.exe Qpmnml32.exe File created C:\Windows\SysWOW64\Abjllocj.dll Fajgekol.exe File opened for modification C:\Windows\SysWOW64\Baohmo32.exe Bhgcdjje.exe File created C:\Windows\SysWOW64\Aegphhqg.dll Jlgeig32.exe File opened for modification C:\Windows\SysWOW64\Lhbafo32.exe Ladpnepb.exe File created C:\Windows\SysWOW64\Gjnlag32.exe Gcddemmd.exe File opened for modification C:\Windows\SysWOW64\Epnbgo32.exe Efemni32.exe File created C:\Windows\SysWOW64\Mnknkbdk.exe Magnbnea.exe File created C:\Windows\SysWOW64\Qhigbl32.exe Qmccecfp.exe File created C:\Windows\SysWOW64\Hnfafpfd.exe Hkhdjdgq.exe File created C:\Windows\SysWOW64\Ipldcb32.dll Fpjcpbdn.exe File created C:\Windows\SysWOW64\Gcddemmd.exe Gljlhc32.exe File created C:\Windows\SysWOW64\Omnlck32.dll Hfacai32.exe File opened for modification C:\Windows\SysWOW64\Bppcii32.exe Bblcpe32.exe File opened for modification C:\Windows\SysWOW64\Cnndbecl.exe Cphgca32.exe File opened for modification C:\Windows\SysWOW64\Mnaghb32.exe Mhpeelnd.exe File created C:\Windows\SysWOW64\Hiackied.exe Hnkonpeo.exe File opened for modification C:\Windows\SysWOW64\Bbjfjepf.exe Aiabap32.exe File opened for modification C:\Windows\SysWOW64\Fgcjoglo.exe Flnebnli.exe File created C:\Windows\SysWOW64\Hebhdloe.dll Mmdlob32.exe File created C:\Windows\SysWOW64\Nkmede32.exe Mfmphg32.exe File opened for modification C:\Windows\SysWOW64\Jbghpc32.exe Icmbcg32.exe File created C:\Windows\SysWOW64\Pindcboi.exe Odelpm32.exe File opened for modification C:\Windows\SysWOW64\Fdopkhfk.exe Eagahnob.exe File opened for modification C:\Windows\SysWOW64\Fhmiqfma.exe Fabqdl32.exe File created C:\Windows\SysWOW64\Fbellhbi.exe Ffnkggld.exe File created C:\Windows\SysWOW64\Afildo32.exe Akchgfok.exe File opened for modification C:\Windows\SysWOW64\Fdobhm32.exe Fjdajhbi.exe File opened for modification C:\Windows\SysWOW64\Jondojna.exe Jhdlbp32.exe File created C:\Windows\SysWOW64\Jgjnpm32.exe Jnaighhk.exe File opened for modification C:\Windows\SysWOW64\Ckbnlfeb.exe Cdhfpm32.exe File created C:\Windows\SysWOW64\Maofkn32.dll Efjgihdi.exe File opened for modification C:\Windows\SysWOW64\Mfmphg32.exe Mmdlob32.exe File opened for modification C:\Windows\SysWOW64\Ofijifbj.exe Ngpcmj32.exe File created C:\Windows\SysWOW64\Cajqng32.exe Bgimepmd.exe File created C:\Windows\SysWOW64\Bkogmaid.dll Glfmaemc.exe File created C:\Windows\SysWOW64\Mdgnkm32.exe Mibind32.exe File created C:\Windows\SysWOW64\Cekmph32.dll Linojbdc.exe File opened for modification C:\Windows\SysWOW64\Hhhdpd32.exe Galonj32.exe File created C:\Windows\SysWOW64\Fkjfkacd.exe Fdpnng32.exe File created C:\Windows\SysWOW64\Podcnh32.exe Odooqo32.exe File opened for modification C:\Windows\SysWOW64\Nmfmnjgh.exe Njgqaohd.exe File created C:\Windows\SysWOW64\Efemni32.exe Defadfql.exe File opened for modification C:\Windows\SysWOW64\Hqhfki32.exe Hhaoik32.exe File opened for modification C:\Windows\SysWOW64\Bmlofhca.exe Agojdnng.exe File created C:\Windows\SysWOW64\Bkpcamfq.dll Mbjnlfnn.exe File opened for modification C:\Windows\SysWOW64\Iildfd32.exe Icalij32.exe File created C:\Windows\SysWOW64\Hbakiina.exe Hkhblo32.exe File created C:\Windows\SysWOW64\Gmdaen32.dll Ifhbcejp.exe File opened for modification C:\Windows\SysWOW64\Hdpicj32.exe Hnfafpfd.exe File opened for modification C:\Windows\SysWOW64\Fkjfkacd.exe Fdpnng32.exe File created C:\Windows\SysWOW64\Dbehbk32.exe Dlkpealn.exe File created C:\Windows\SysWOW64\Gideogil.exe Ffclml32.exe File created C:\Windows\SysWOW64\Egihhe32.exe Dnqcop32.exe File created C:\Windows\SysWOW64\Kbfpcj32.dll Jjhaea32.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qgbqlaea.dll" Nldhpeop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Pjhpccnn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Elhdhn32.dll" Bigbgehl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Aelcjbig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Blihca32.dll" Fdnipbbo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbipejob.dll" Gideogil.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Omcjne32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Chdikajj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Jdmcnnnb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Mjmokmji.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Kakmhg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Mcjlna32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Nnlhjg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ncmpimbp.dll" Aebbqk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Jnfcbg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Edmhai32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iqqpmc32.dll" Hhmmffbg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Hpkkhc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Odelpm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Lkiqla32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Jnfcbg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Kddnpj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Plndma32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jabglkpp.dll" Lfgboc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Mkiccmck.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmdknbko.dll" Docckfai.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Nekgna32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bihnci32.dll" Npbhqj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Olehai32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Mlifgfnj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Gcddemmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Helkdnaj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Eqopqh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Dkqahk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Pjalpida.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Mmkdlbea.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Koggqlmo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Fnopqnjc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhbbpc32.dll" Gnoame32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ngdfifao.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kqcgjq32.dll" Bpnncl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Bflhkc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hajhgcdo.dll" Dlkpealn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kpbdjgcj.dll" Akpojpic.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Kkkdjcjb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pgfggene.dll" Qhpbpl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Bfghem32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Oecnmi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkjipj32.dll" Bagfeioc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Peicfccb.dll" Paaaeg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Kfhdqa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qogqapmf.dll" Igajka32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Mfmphg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Dhjcdimf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Dpmknf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pqghbd32.dll" Hpiemj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbmdmedg.dll" Mgibil32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bcfgnofb.dll" Mdeafm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hodioegj.dll" Bcpdidol.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Bhohfj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ippgqg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gdakbbno.dll" Idahcm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Fjpppipq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gjkgqilj.dll" Idffkm32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 668 wrote to memory of 3952 668 NEAS.08c2d4ccd547305025da8ec21f6c1890.exe 91 PID 668 wrote to memory of 3952 668 NEAS.08c2d4ccd547305025da8ec21f6c1890.exe 91 PID 668 wrote to memory of 3952 668 NEAS.08c2d4ccd547305025da8ec21f6c1890.exe 91 PID 3952 wrote to memory of 2800 3952 Dbdano32.exe 92 PID 3952 wrote to memory of 2800 3952 Dbdano32.exe 92 PID 3952 wrote to memory of 2800 3952 Dbdano32.exe 92 PID 2800 wrote to memory of 2020 2800 Ehofhdli.exe 93 PID 2800 wrote to memory of 2020 2800 Ehofhdli.exe 93 PID 2800 wrote to memory of 2020 2800 Ehofhdli.exe 93 PID 2020 wrote to memory of 3164 2020 Falcli32.exe 94 PID 2020 wrote to memory of 3164 2020 Falcli32.exe 94 PID 2020 wrote to memory of 3164 2020 Falcli32.exe 94 PID 3164 wrote to memory of 3556 3164 Geflne32.exe 95 PID 3164 wrote to memory of 3556 3164 Geflne32.exe 95 PID 3164 wrote to memory of 3556 3164 Geflne32.exe 95 PID 3556 wrote to memory of 4784 3556 Gkeakl32.exe 96 PID 3556 wrote to memory of 4784 3556 Gkeakl32.exe 96 PID 3556 wrote to memory of 4784 3556 Gkeakl32.exe 96 PID 4784 wrote to memory of 3816 4784 Hcabhido.exe 97 PID 4784 wrote to memory of 3816 4784 Hcabhido.exe 97 PID 4784 wrote to memory of 3816 4784 Hcabhido.exe 97 PID 3816 wrote to memory of 2024 3816 Ieiajckh.exe 98 PID 3816 wrote to memory of 2024 3816 Ieiajckh.exe 98 PID 3816 wrote to memory of 2024 3816 Ieiajckh.exe 98 PID 2024 wrote to memory of 4936 2024 Icmbcg32.exe 99 PID 2024 wrote to memory of 4936 2024 Icmbcg32.exe 99 PID 2024 wrote to memory of 4936 2024 Icmbcg32.exe 99 PID 4936 wrote to memory of 812 4936 Jbghpc32.exe 100 PID 4936 wrote to memory of 812 4936 Jbghpc32.exe 100 PID 4936 wrote to memory of 812 4936 Jbghpc32.exe 100 PID 812 wrote to memory of 3336 812 Jkcfch32.exe 101 PID 812 wrote to memory of 3336 812 Jkcfch32.exe 101 PID 812 wrote to memory of 3336 812 Jkcfch32.exe 101 PID 3336 wrote to memory of 4904 3336 Jjefao32.exe 102 PID 3336 wrote to memory of 4904 3336 Jjefao32.exe 102 PID 3336 wrote to memory of 4904 3336 Jjefao32.exe 102 PID 4904 wrote to memory of 1580 4904 Kbgafqla.exe 103 PID 4904 wrote to memory of 1580 4904 Kbgafqla.exe 103 PID 4904 wrote to memory of 1580 4904 Kbgafqla.exe 103 PID 1580 wrote to memory of 5044 1580 Kjcccm32.exe 104 PID 1580 wrote to memory of 5044 1580 Kjcccm32.exe 104 PID 1580 wrote to memory of 5044 1580 Kjcccm32.exe 104 PID 5044 wrote to memory of 3096 5044 Lcndab32.exe 105 PID 5044 wrote to memory of 3096 5044 Lcndab32.exe 105 PID 5044 wrote to memory of 3096 5044 Lcndab32.exe 105 PID 3096 wrote to memory of 3460 3096 Ljjicl32.exe 106 PID 3096 wrote to memory of 3460 3096 Ljjicl32.exe 106 PID 3096 wrote to memory of 3460 3096 Ljjicl32.exe 106 PID 3460 wrote to memory of 1344 3460 Llpofd32.exe 107 PID 3460 wrote to memory of 1344 3460 Llpofd32.exe 107 PID 3460 wrote to memory of 1344 3460 Llpofd32.exe 107 PID 1344 wrote to memory of 5092 1344 Mjehok32.exe 108 PID 1344 wrote to memory of 5092 1344 Mjehok32.exe 108 PID 1344 wrote to memory of 5092 1344 Mjehok32.exe 108 PID 5092 wrote to memory of 1116 5092 Njahki32.exe 110 PID 5092 wrote to memory of 1116 5092 Njahki32.exe 110 PID 5092 wrote to memory of 1116 5092 Njahki32.exe 110 PID 1116 wrote to memory of 4940 1116 Odnfonag.exe 112 PID 1116 wrote to memory of 4940 1116 Odnfonag.exe 112 PID 1116 wrote to memory of 4940 1116 Odnfonag.exe 112 PID 4940 wrote to memory of 4064 4940 Odelpm32.exe 113 PID 4940 wrote to memory of 4064 4940 Odelpm32.exe 113 PID 4940 wrote to memory of 4064 4940 Odelpm32.exe 113 PID 4064 wrote to memory of 4232 4064 Pindcboi.exe 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.08c2d4ccd547305025da8ec21f6c1890.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.08c2d4ccd547305025da8ec21f6c1890.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:668 -
C:\Windows\SysWOW64\Dbdano32.exeC:\Windows\system32\Dbdano32.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Windows\SysWOW64\Ehofhdli.exeC:\Windows\system32\Ehofhdli.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Windows\SysWOW64\Falcli32.exeC:\Windows\system32\Falcli32.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Windows\SysWOW64\Geflne32.exeC:\Windows\system32\Geflne32.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Windows\SysWOW64\Gkeakl32.exeC:\Windows\system32\Gkeakl32.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Windows\SysWOW64\Hcabhido.exeC:\Windows\system32\Hcabhido.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Windows\SysWOW64\Ieiajckh.exeC:\Windows\system32\Ieiajckh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Windows\SysWOW64\Icmbcg32.exeC:\Windows\system32\Icmbcg32.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\SysWOW64\Jbghpc32.exeC:\Windows\system32\Jbghpc32.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Windows\SysWOW64\Jkcfch32.exeC:\Windows\system32\Jkcfch32.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:812 -
C:\Windows\SysWOW64\Jjefao32.exeC:\Windows\system32\Jjefao32.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Windows\SysWOW64\Kbgafqla.exeC:\Windows\system32\Kbgafqla.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Windows\SysWOW64\Kjcccm32.exeC:\Windows\system32\Kjcccm32.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Windows\SysWOW64\Lcndab32.exeC:\Windows\system32\Lcndab32.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Windows\SysWOW64\Ljjicl32.exeC:\Windows\system32\Ljjicl32.exe16⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Windows\SysWOW64\Llpofd32.exeC:\Windows\system32\Llpofd32.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Windows\SysWOW64\Mjehok32.exeC:\Windows\system32\Mjehok32.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Windows\SysWOW64\Njahki32.exeC:\Windows\system32\Njahki32.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Windows\SysWOW64\Odnfonag.exeC:\Windows\system32\Odnfonag.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Windows\SysWOW64\Odelpm32.exeC:\Windows\system32\Odelpm32.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Windows\SysWOW64\Pindcboi.exeC:\Windows\system32\Pindcboi.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Windows\SysWOW64\Qkmqne32.exeC:\Windows\system32\Qkmqne32.exe23⤵
- Executes dropped EXE
PID:4232 -
C:\Windows\SysWOW64\Agfnhf32.exeC:\Windows\system32\Agfnhf32.exe24⤵
- Executes dropped EXE
PID:3152 -
C:\Windows\SysWOW64\Apcllk32.exeC:\Windows\system32\Apcllk32.exe25⤵
- Executes dropped EXE
PID:3184 -
C:\Windows\SysWOW64\Acgacegg.exeC:\Windows\system32\Acgacegg.exe26⤵
- Executes dropped EXE
PID:4524 -
C:\Windows\SysWOW64\Bgggockk.exeC:\Windows\system32\Bgggockk.exe27⤵
- Executes dropped EXE
PID:1644 -
C:\Windows\SysWOW64\Bjhpqn32.exeC:\Windows\system32\Bjhpqn32.exe28⤵
- Executes dropped EXE
PID:4476 -
C:\Windows\SysWOW64\Bcpdidol.exeC:\Windows\system32\Bcpdidol.exe29⤵
- Executes dropped EXE
- Modifies registry class
PID:4768 -
C:\Windows\SysWOW64\Bdpqcg32.exeC:\Windows\system32\Bdpqcg32.exe30⤵
- Executes dropped EXE
PID:4920 -
C:\Windows\SysWOW64\Cnjbbl32.exeC:\Windows\system32\Cnjbbl32.exe31⤵
- Executes dropped EXE
PID:2884 -
C:\Windows\SysWOW64\Cjcolm32.exeC:\Windows\system32\Cjcolm32.exe32⤵
- Executes dropped EXE
PID:3732 -
C:\Windows\SysWOW64\Ddkpoelb.exeC:\Windows\system32\Ddkpoelb.exe33⤵
- Executes dropped EXE
PID:3700 -
C:\Windows\SysWOW64\Djjemlhf.exeC:\Windows\system32\Djjemlhf.exe34⤵
- Executes dropped EXE
PID:5056 -
C:\Windows\SysWOW64\Egoomnin.exeC:\Windows\system32\Egoomnin.exe35⤵
- Executes dropped EXE
PID:4420 -
C:\Windows\SysWOW64\Fjdajhbi.exeC:\Windows\system32\Fjdajhbi.exe36⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1748 -
C:\Windows\SysWOW64\Fdobhm32.exeC:\Windows\system32\Fdobhm32.exe37⤵
- Executes dropped EXE
PID:1276 -
C:\Windows\SysWOW64\Gjkgkg32.exeC:\Windows\system32\Gjkgkg32.exe38⤵
- Executes dropped EXE
PID:3932 -
C:\Windows\SysWOW64\Helkdnaj.exeC:\Windows\system32\Helkdnaj.exe39⤵
- Executes dropped EXE
- Modifies registry class
PID:4780 -
C:\Windows\SysWOW64\Iefnjm32.exeC:\Windows\system32\Iefnjm32.exe40⤵
- Executes dropped EXE
PID:3136 -
C:\Windows\SysWOW64\Khpcid32.exeC:\Windows\system32\Khpcid32.exe41⤵
- Executes dropped EXE
PID:5072 -
C:\Windows\SysWOW64\Linojbdc.exeC:\Windows\system32\Linojbdc.exe42⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4864 -
C:\Windows\SysWOW64\Mbnjcg32.exeC:\Windows\system32\Mbnjcg32.exe43⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:652 -
C:\Windows\SysWOW64\Olfgcj32.exeC:\Windows\system32\Olfgcj32.exe44⤵
- Executes dropped EXE
PID:3432 -
C:\Windows\SysWOW64\Pmpfcl32.exeC:\Windows\system32\Pmpfcl32.exe45⤵
- Executes dropped EXE
PID:1288 -
C:\Windows\SysWOW64\Plgpjhnf.exeC:\Windows\system32\Plgpjhnf.exe46⤵
- Executes dropped EXE
PID:2912 -
C:\Windows\SysWOW64\Qbhnga32.exeC:\Windows\system32\Qbhnga32.exe47⤵
- Executes dropped EXE
PID:5024 -
C:\Windows\SysWOW64\Agmmnnpj.exeC:\Windows\system32\Agmmnnpj.exe48⤵
- Executes dropped EXE
PID:3540 -
C:\Windows\SysWOW64\Agojdnng.exeC:\Windows\system32\Agojdnng.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1880 -
C:\Windows\SysWOW64\Bmlofhca.exeC:\Windows\system32\Bmlofhca.exe50⤵
- Executes dropped EXE
PID:4900 -
C:\Windows\SysWOW64\Bgkipl32.exeC:\Windows\system32\Bgkipl32.exe51⤵
- Executes dropped EXE
PID:4020 -
C:\Windows\SysWOW64\Cphgca32.exeC:\Windows\system32\Cphgca32.exe52⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:316 -
C:\Windows\SysWOW64\Cnndbecl.exeC:\Windows\system32\Cnndbecl.exe53⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:4528 -
C:\Windows\SysWOW64\Dqomdppm.exeC:\Windows\system32\Dqomdppm.exe54⤵
- Executes dropped EXE
PID:3944 -
C:\Windows\SysWOW64\Djgbmffn.exeC:\Windows\system32\Djgbmffn.exe55⤵
- Executes dropped EXE
PID:3172 -
C:\Windows\SysWOW64\Dqfceoje.exeC:\Windows\system32\Dqfceoje.exe56⤵
- Executes dropped EXE
PID:3600 -
C:\Windows\SysWOW64\Dokqfl32.exeC:\Windows\system32\Dokqfl32.exe57⤵
- Executes dropped EXE
PID:3236 -
C:\Windows\SysWOW64\Emhdeoel.exeC:\Windows\system32\Emhdeoel.exe58⤵
- Executes dropped EXE
PID:3232 -
C:\Windows\SysWOW64\Fcgemhic.exeC:\Windows\system32\Fcgemhic.exe59⤵
- Executes dropped EXE
PID:2224 -
C:\Windows\SysWOW64\Fnofpqff.exeC:\Windows\system32\Fnofpqff.exe60⤵
- Executes dropped EXE
PID:4804 -
C:\Windows\SysWOW64\Gfaaebnj.exeC:\Windows\system32\Gfaaebnj.exe61⤵
- Executes dropped EXE
PID:1440 -
C:\Windows\SysWOW64\Gmnfglcd.exeC:\Windows\system32\Gmnfglcd.exe62⤵
- Executes dropped EXE
PID:2016 -
C:\Windows\SysWOW64\Galonj32.exeC:\Windows\system32\Galonj32.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3412 -
C:\Windows\SysWOW64\Hhhdpd32.exeC:\Windows\system32\Hhhdpd32.exe64⤵
- Executes dropped EXE
PID:1848 -
C:\Windows\SysWOW64\Hmdlhk32.exeC:\Windows\system32\Hmdlhk32.exe65⤵
- Executes dropped EXE
PID:3888 -
C:\Windows\SysWOW64\Ipohpdbb.exeC:\Windows\system32\Ipohpdbb.exe66⤵PID:1692
-
C:\Windows\SysWOW64\Ipcakd32.exeC:\Windows\system32\Ipcakd32.exe67⤵PID:4984
-
C:\Windows\SysWOW64\Jphkfc32.exeC:\Windows\system32\Jphkfc32.exe68⤵PID:2688
-
C:\Windows\SysWOW64\Joikdk32.exeC:\Windows\system32\Joikdk32.exe69⤵PID:4744
-
C:\Windows\SysWOW64\Jhdlbp32.exeC:\Windows\system32\Jhdlbp32.exe70⤵
- Drops file in System32 directory
PID:4820 -
C:\Windows\SysWOW64\Jondojna.exeC:\Windows\system32\Jondojna.exe71⤵PID:4668
-
C:\Windows\SysWOW64\Jdkmgali.exeC:\Windows\system32\Jdkmgali.exe72⤵PID:2100
-
C:\Windows\SysWOW64\Knldfe32.exeC:\Windows\system32\Knldfe32.exe73⤵PID:1128
-
C:\Windows\SysWOW64\Mhpeelnd.exeC:\Windows\system32\Mhpeelnd.exe74⤵
- Drops file in System32 directory
PID:324 -
C:\Windows\SysWOW64\Mnaghb32.exeC:\Windows\system32\Mnaghb32.exe75⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:260 -
C:\Windows\SysWOW64\Nnfpcada.exeC:\Windows\system32\Nnfpcada.exe76⤵PID:3524
-
C:\Windows\SysWOW64\Nqgiel32.exeC:\Windows\system32\Nqgiel32.exe77⤵PID:2984
-
C:\Windows\SysWOW64\Nohicdia.exeC:\Windows\system32\Nohicdia.exe78⤵PID:1492
-
C:\Windows\SysWOW64\Nbkojo32.exeC:\Windows\system32\Nbkojo32.exe79⤵PID:1436
-
C:\Windows\SysWOW64\Oabiak32.exeC:\Windows\system32\Oabiak32.exe80⤵PID:180
-
C:\Windows\SysWOW64\Opdiobod.exeC:\Windows\system32\Opdiobod.exe81⤵PID:3824
-
C:\Windows\SysWOW64\Oeqagi32.exeC:\Windows\system32\Oeqagi32.exe82⤵PID:3448
-
C:\Windows\SysWOW64\Onifpodl.exeC:\Windows\system32\Onifpodl.exe83⤵PID:2652
-
C:\Windows\SysWOW64\Oecnmi32.exeC:\Windows\system32\Oecnmi32.exe84⤵
- Modifies registry class
PID:3484 -
C:\Windows\SysWOW64\Olmficce.exeC:\Windows\system32\Olmficce.exe85⤵PID:2440
-
C:\Windows\SysWOW64\Obgofmjb.exeC:\Windows\system32\Obgofmjb.exe86⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5124 -
C:\Windows\SysWOW64\Alplfpbp.exeC:\Windows\system32\Alplfpbp.exe87⤵PID:5172
-
C:\Windows\SysWOW64\Abjdbj32.exeC:\Windows\system32\Abjdbj32.exe88⤵PID:5216
-
C:\Windows\SysWOW64\Aiclodaj.exeC:\Windows\system32\Aiclodaj.exe89⤵PID:5256
-
C:\Windows\SysWOW64\Apndloif.exeC:\Windows\system32\Apndloif.exe90⤵PID:5300
-
C:\Windows\SysWOW64\Aejmdegn.exeC:\Windows\system32\Aejmdegn.exe91⤵PID:5348
-
C:\Windows\SysWOW64\Appaangd.exeC:\Windows\system32\Appaangd.exe92⤵PID:5388
-
C:\Windows\SysWOW64\Aihfjd32.exeC:\Windows\system32\Aihfjd32.exe93⤵PID:5440
-
C:\Windows\SysWOW64\Aoenbkll.exeC:\Windows\system32\Aoenbkll.exe94⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5492 -
C:\Windows\SysWOW64\Befmpdmq.exeC:\Windows\system32\Befmpdmq.exe95⤵PID:5536
-
C:\Windows\SysWOW64\Bpnncl32.exeC:\Windows\system32\Bpnncl32.exe96⤵
- Modifies registry class
PID:5584 -
C:\Windows\SysWOW64\Cikkga32.exeC:\Windows\system32\Cikkga32.exe97⤵PID:5620
-
C:\Windows\SysWOW64\Cafpkc32.exeC:\Windows\system32\Cafpkc32.exe98⤵PID:5676
-
C:\Windows\SysWOW64\Dapcab32.exeC:\Windows\system32\Dapcab32.exe99⤵PID:5716
-
C:\Windows\SysWOW64\Docckfai.exeC:\Windows\system32\Docckfai.exe100⤵
- Modifies registry class
PID:5760 -
C:\Windows\SysWOW64\Denlgq32.exeC:\Windows\system32\Denlgq32.exe101⤵
- Drops file in System32 directory
PID:5804 -
C:\Windows\SysWOW64\Dpcpei32.exeC:\Windows\system32\Dpcpei32.exe102⤵PID:5864
-
C:\Windows\SysWOW64\Dhqaokcd.exeC:\Windows\system32\Dhqaokcd.exe103⤵PID:5908
-
C:\Windows\SysWOW64\Ecfeldcj.exeC:\Windows\system32\Ecfeldcj.exe104⤵PID:5952
-
C:\Windows\SysWOW64\Ejbknnid.exeC:\Windows\system32\Ejbknnid.exe105⤵PID:5996
-
C:\Windows\SysWOW64\Eoocfegl.exeC:\Windows\system32\Eoocfegl.exe106⤵PID:6040
-
C:\Windows\SysWOW64\Ejegdngb.exeC:\Windows\system32\Ejegdngb.exe107⤵PID:6084
-
C:\Windows\SysWOW64\Eqopqh32.exeC:\Windows\system32\Eqopqh32.exe108⤵
- Modifies registry class
PID:6132 -
C:\Windows\SysWOW64\Ffbnin32.exeC:\Windows\system32\Ffbnin32.exe109⤵PID:5160
-
C:\Windows\SysWOW64\Fmmffhnk.exeC:\Windows\system32\Fmmffhnk.exe110⤵PID:5244
-
C:\Windows\SysWOW64\Gqdbbelf.exeC:\Windows\system32\Gqdbbelf.exe111⤵PID:5408
-
C:\Windows\SysWOW64\Hcidoo32.exeC:\Windows\system32\Hcidoo32.exe112⤵PID:5524
-
C:\Windows\SysWOW64\Hfoflj32.exeC:\Windows\system32\Hfoflj32.exe113⤵PID:5628
-
C:\Windows\SysWOW64\Hfacai32.exeC:\Windows\system32\Hfacai32.exe114⤵
- Drops file in System32 directory
PID:5700 -
C:\Windows\SysWOW64\Icedkn32.exeC:\Windows\system32\Icedkn32.exe115⤵
- Drops file in System32 directory
PID:5788 -
C:\Windows\SysWOW64\Impeib32.exeC:\Windows\system32\Impeib32.exe116⤵PID:5872
-
C:\Windows\SysWOW64\Ibmmbj32.exeC:\Windows\system32\Ibmmbj32.exe117⤵PID:5936
-
C:\Windows\SysWOW64\Imbaobmp.exeC:\Windows\system32\Imbaobmp.exe118⤵PID:6004
-
C:\Windows\SysWOW64\Iiibdc32.exeC:\Windows\system32\Iiibdc32.exe119⤵PID:6080
-
C:\Windows\SysWOW64\Ibagmiie.exeC:\Windows\system32\Ibagmiie.exe120⤵PID:6140
-
C:\Windows\SysWOW64\Jabgkpad.exeC:\Windows\system32\Jabgkpad.exe121⤵PID:5264
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-