Analysis
-
max time kernel
152s -
max time network
167s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
01/11/2023, 14:23
Behavioral task
behavioral1
Sample
NEAS.ed92a586b58f66727c5b5e4c451e8040.exe
Resource
win7-20231023-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.ed92a586b58f66727c5b5e4c451e8040.exe
Resource
win10v2004-20231023-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
NEAS.ed92a586b58f66727c5b5e4c451e8040.exe
-
Size
374KB
-
MD5
ed92a586b58f66727c5b5e4c451e8040
-
SHA1
c6e0015ca1f15143914f5c0d8844f16b3fbb8edc
-
SHA256
3f3b6f3befa704ae854741cd94abdd793df4a15c0756bf21bc26329e0cbbd5d3
-
SHA512
93c4fe0042c7453623eeaad47c6e287518d37b6127fe4c6853f90fb307f8c3e113ad952b9dc29f28e93cb51f18135fcaaf7eb4e38a5f366f37ee2b76320a0dfe
-
SSDEEP
6144:H7r2F2fQQh+zn+Eu6QnFw5+0pU8oStTf3runG/qoxfIkeI1SHkF63lngMBdkw8Zd:2F2fQQME6uidyzwr6AxfLeI1Su63lgMY
Score
10/10
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Lfaqcclf.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jchaoe32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ilglgfjd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hfkdkqeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jmlkpgia.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Pdngpo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Blnjecfl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hgpbhmna.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kfndlphp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Mhenpk32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Apjdikqd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Oohkai32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Lmdbooik.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ikhghi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jokiig32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Flcfnn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jjcqffkm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Fjpoio32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Gaglma32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oqhoeb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Nqnofkkj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Dickplko.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kokbpe32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jphkfc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Maoakaip.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Knmkak32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Beippj32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gndpkp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Aemjjeek.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cpcila32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bdhkchlg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bpjkbcbe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Epgpajdp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fjcjpb32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cnpbgajc.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eeailhme.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mihbpalh.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kinefp32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jjgkab32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Fmmffhnk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Lhdqml32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Foakpc32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ogajid32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kdophj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Qhekaejj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Hhehkepj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cpcnhbjj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jpfnqc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Nocphd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Mfhgcbfo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Dmknog32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Imbhiial.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jeolckne.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ijmapm32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mehafq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Fpbpmhjb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jjcqffkm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ejglcq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jchaoe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Addahh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ldjodh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ibjqlj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kkihedld.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ogdofo32.exe -
Malware Backdoor - Berbew 64 IoCs
Berbew is a malware infection classified as a 'backdoor' Trojan. This malicious program's primary function is to cause chain infections - it can download/install additional malware such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/files/0x0008000000022cb5-6.dat family_berbew behavioral2/files/0x0008000000022cb5-8.dat family_berbew behavioral2/files/0x0006000000022cd7-14.dat family_berbew behavioral2/files/0x0006000000022cd7-16.dat family_berbew behavioral2/files/0x0006000000022cd9-22.dat family_berbew behavioral2/files/0x0006000000022cd9-23.dat family_berbew behavioral2/files/0x0006000000022cdb-30.dat family_berbew behavioral2/files/0x0006000000022cdb-32.dat family_berbew behavioral2/files/0x0006000000022ce2-33.dat family_berbew behavioral2/files/0x0006000000022ce2-38.dat family_berbew behavioral2/files/0x0006000000022ce2-39.dat family_berbew behavioral2/files/0x0006000000022ce4-46.dat family_berbew behavioral2/files/0x0006000000022ce4-48.dat family_berbew behavioral2/files/0x0006000000022ce6-54.dat family_berbew behavioral2/files/0x0006000000022ce6-56.dat family_berbew behavioral2/files/0x0006000000022ce8-62.dat family_berbew behavioral2/files/0x0006000000022ce8-64.dat family_berbew behavioral2/files/0x0006000000022cea-70.dat family_berbew behavioral2/files/0x0006000000022cea-71.dat family_berbew behavioral2/files/0x0006000000022cf1-79.dat family_berbew behavioral2/files/0x0006000000022cf1-78.dat family_berbew behavioral2/files/0x0007000000022cf3-86.dat family_berbew behavioral2/files/0x0007000000022cf3-88.dat family_berbew behavioral2/files/0x0006000000022cf5-94.dat family_berbew behavioral2/files/0x0006000000022cf5-96.dat family_berbew behavioral2/files/0x0006000000022cf7-101.dat family_berbew behavioral2/files/0x0006000000022cf7-104.dat family_berbew behavioral2/files/0x0006000000022cfb-105.dat family_berbew behavioral2/files/0x0006000000022cfb-110.dat family_berbew behavioral2/files/0x0006000000022cfb-112.dat family_berbew behavioral2/files/0x0007000000022cfd-118.dat family_berbew behavioral2/files/0x0007000000022cfd-120.dat family_berbew behavioral2/files/0x0007000000022cff-125.dat family_berbew behavioral2/files/0x0007000000022cff-128.dat family_berbew behavioral2/files/0x0008000000022d01-129.dat family_berbew behavioral2/files/0x0008000000022d01-134.dat family_berbew behavioral2/files/0x0008000000022d01-136.dat family_berbew behavioral2/files/0x0008000000022d04-142.dat family_berbew behavioral2/files/0x0008000000022d04-144.dat family_berbew behavioral2/files/0x0006000000022d06-150.dat family_berbew behavioral2/files/0x0006000000022d06-152.dat family_berbew behavioral2/files/0x0006000000022d08-158.dat family_berbew behavioral2/files/0x0006000000022d08-160.dat family_berbew behavioral2/files/0x0006000000022d0a-166.dat family_berbew behavioral2/files/0x0006000000022d0a-168.dat family_berbew behavioral2/files/0x0006000000022d0c-174.dat family_berbew behavioral2/files/0x0006000000022d0c-176.dat family_berbew behavioral2/files/0x0006000000022d0e-182.dat family_berbew behavioral2/files/0x0006000000022d0e-184.dat family_berbew behavioral2/files/0x0006000000022d10-185.dat family_berbew behavioral2/files/0x0006000000022d10-190.dat family_berbew behavioral2/files/0x0006000000022d10-192.dat family_berbew behavioral2/files/0x0006000000022d12-194.dat family_berbew behavioral2/files/0x0006000000022d12-198.dat family_berbew behavioral2/files/0x0006000000022d12-200.dat family_berbew behavioral2/files/0x0006000000022d16-206.dat family_berbew behavioral2/files/0x0006000000022d16-208.dat family_berbew behavioral2/files/0x0007000000022ce1-214.dat family_berbew behavioral2/files/0x0007000000022ce1-216.dat family_berbew behavioral2/files/0x0006000000022d18-217.dat family_berbew behavioral2/files/0x0006000000022d18-222.dat family_berbew behavioral2/files/0x0006000000022d18-224.dat family_berbew behavioral2/files/0x0006000000022d1a-230.dat family_berbew behavioral2/files/0x0006000000022d1a-232.dat family_berbew -
Executes dropped EXE 64 IoCs
pid Process 4492 Oqhoeb32.exe 804 Obqanjdb.exe 2344 Pfccogfc.exe 3008 Pfepdg32.exe 3448 Qclmck32.exe 1372 Aimogakj.exe 4408 Apjdikqd.exe 3028 Afhfaddk.exe 3440 Bmggingc.exe 1256 Cmpjoloh.exe 2240 Cgklmacf.exe 4716 Ckidcpjl.exe 3860 Dickplko.exe 4056 Enjfli32.exe 1804 Fkgillpj.exe 4240 Fcbnpnme.exe 3864 Fqikob32.exe 1040 Hcjmhk32.exe 2276 Iecmhlhb.exe 552 Jjgkab32.exe 1388 Jeolckne.exe 2044 Kblpcndd.exe 1848 Kocphojh.exe 2404 Lddble32.exe 3596 Lkqgno32.exe 1284 Ncmaai32.exe 4048 Oohkai32.exe 4936 Pdngpo32.exe 4856 Apimodmh.exe 3320 Acgfec32.exe 1896 Bfhofnpp.exe 2272 Bfjllnnm.exe 5056 Blnjecfl.exe 4488 Cbmlmmjd.exe 4864 Cpcila32.exe 3952 Dlqpaafg.exe 3740 Dlcmgqdd.exe 228 Emeffcid.exe 1332 Ecanojgl.exe 3816 Egdqph32.exe 3112 Flcfnn32.exe 3336 Gqmnpk32.exe 1616 Ijmapm32.exe 2072 Lkppchfi.exe 2296 Lhdqml32.exe 2368 Mehafq32.exe 1764 Maoakaip.exe 3912 Meljappg.exe 812 Mgngih32.exe 3644 Nkgoke32.exe 2012 Oolnabal.exe 3296 Qhekaejj.exe 4272 Bbpeghpe.exe 1268 Beaohcmf.exe 224 Becknc32.exe 4564 Chkjpm32.exe 3856 Deokja32.exe 2232 Dfngcdhi.exe 4500 Dlbfmjqi.exe 4700 Eeaqfo32.exe 4608 Ehbihj32.exe 3004 Foakpc32.exe 3344 Fhllni32.exe 1996 Fgmllpng.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Bleoga32.dll Ieoapl32.exe File created C:\Windows\SysWOW64\Ihcclb32.exe Iajkohmj.exe File created C:\Windows\SysWOW64\Kdalni32.exe Kkihedld.exe File created C:\Windows\SysWOW64\Kiomnk32.exe Kbedaand.exe File opened for modification C:\Windows\SysWOW64\Anccjp32.exe Mldhacpj.exe File created C:\Windows\SysWOW64\Jihgnf32.dll Nnpjdfpb.exe File opened for modification C:\Windows\SysWOW64\Jmlkpgia.exe Jphkfc32.exe File created C:\Windows\SysWOW64\Gqmnpk32.exe Gqkajk32.exe File opened for modification C:\Windows\SysWOW64\Glajeiml.exe Gehbio32.exe File created C:\Windows\SysWOW64\Bbhoko32.dll Imbhiial.exe File opened for modification C:\Windows\SysWOW64\Hfeoijbi.exe Hgpbhmna.exe File opened for modification C:\Windows\SysWOW64\Ajnmjp32.exe Anccjp32.exe File created C:\Windows\SysWOW64\Cggpfa32.exe Bnehgmob.exe File opened for modification C:\Windows\SysWOW64\Gffkpa32.exe Gplbcgbg.exe File created C:\Windows\SysWOW64\Fbgbione.exe Elccpife.exe File created C:\Windows\SysWOW64\Afhfaddk.exe Apjdikqd.exe File created C:\Windows\SysWOW64\Cpcila32.exe Cbmlmmjd.exe File opened for modification C:\Windows\SysWOW64\Kiomnk32.exe Kbedaand.exe File opened for modification C:\Windows\SysWOW64\Limioiia.exe Kjqfmn32.exe File opened for modification C:\Windows\SysWOW64\Mcdepd32.exe Ldjodh32.exe File opened for modification C:\Windows\SysWOW64\Ghadjkhh.exe Gaglma32.exe File created C:\Windows\SysWOW64\Qnbhhd32.dll Ghdaokfe.exe File created C:\Windows\SysWOW64\Dlqpaafg.exe Cpcila32.exe File created C:\Windows\SysWOW64\Egdqph32.exe Ecanojgl.exe File opened for modification C:\Windows\SysWOW64\Egelgoah.exe Dmknog32.exe File created C:\Windows\SysWOW64\Anmqigke.dll Kpanmb32.exe File created C:\Windows\SysWOW64\Cmefomdo.dll Phiekaql.exe File created C:\Windows\SysWOW64\Pdofgooa.dll Hnpognhd.exe File opened for modification C:\Windows\SysWOW64\Gcdkdpih.exe Fblldn32.exe File created C:\Windows\SysWOW64\Icnmcc32.dll Fnkdpgnh.exe File opened for modification C:\Windows\SysWOW64\Iehkpmgl.exe Ikbfbdgf.exe File opened for modification C:\Windows\SysWOW64\Beippj32.exe Bnnklg32.exe File created C:\Windows\SysWOW64\Eliecc32.exe Ebpqjmpd.exe File opened for modification C:\Windows\SysWOW64\Hmlicp32.exe Hejono32.exe File opened for modification C:\Windows\SysWOW64\Fkgillpj.exe Enjfli32.exe File created C:\Windows\SysWOW64\Mfkcec32.dll Ijcecgnl.exe File created C:\Windows\SysWOW64\Eeailhme.exe Eliecc32.exe File created C:\Windows\SysWOW64\Lnoalehl.exe Kgeiokao.exe File created C:\Windows\SysWOW64\Cefked32.dll Oolnabal.exe File created C:\Windows\SysWOW64\Kaogacia.dll Lfaqcclf.exe File created C:\Windows\SysWOW64\Bbappaql.dll Ejglcq32.exe File opened for modification C:\Windows\SysWOW64\Qhekaejj.exe Oolnabal.exe File created C:\Windows\SysWOW64\Cemcqcgi.exe Blkkaohc.exe File opened for modification C:\Windows\SysWOW64\Enjfli32.exe Dickplko.exe File opened for modification C:\Windows\SysWOW64\Ehklmd32.exe Ejglcq32.exe File created C:\Windows\SysWOW64\Pinpojcj.dll Hocjaj32.exe File created C:\Windows\SysWOW64\Dickplko.exe Ckidcpjl.exe File created C:\Windows\SysWOW64\Iecmhlhb.exe Hcjmhk32.exe File created C:\Windows\SysWOW64\Ipohpdbb.exe Ihcclb32.exe File created C:\Windows\SysWOW64\Imbhiial.exe Ipohpdbb.exe File created C:\Windows\SysWOW64\Kdlcbjfj.exe Jfalhgni.exe File created C:\Windows\SysWOW64\Pfepdg32.exe Pfccogfc.exe File created C:\Windows\SysWOW64\Mnailf32.dll Oknnanhj.exe File created C:\Windows\SysWOW64\Fnchgmkg.dll Kbedaand.exe File created C:\Windows\SysWOW64\Eglbhnkp.exe Embdofop.exe File created C:\Windows\SysWOW64\Mjfoja32.exe Mfhgcbfo.exe File created C:\Windows\SysWOW64\Hfncib32.dll Mldhacpj.exe File created C:\Windows\SysWOW64\Nnpjdfpb.exe Moajmk32.exe File created C:\Windows\SysWOW64\Anccjp32.exe Mldhacpj.exe File created C:\Windows\SysWOW64\Kblpcndd.exe Jeolckne.exe File created C:\Windows\SysWOW64\Hocjaj32.exe Gaoihfoo.exe File opened for modification C:\Windows\SysWOW64\Kpgoolbl.exe Jfokff32.exe File opened for modification C:\Windows\SysWOW64\Gaoihfoo.exe Gogjflhf.exe File created C:\Windows\SysWOW64\Aldeap32.exe Aaoadg32.exe -
Program crash 2 IoCs
pid pid_target Process procid_target 6516 5596 WerFault.exe 363 5944 5596 WerFault.exe 363 -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cfkeihph.dll" Pfepdg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Onifpodl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Gffkpa32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Kblpcndd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Lpelqj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Blfnimde.dll" Gehbio32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Hfkdkqeo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Plifea32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Aemjjeek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Mcdepd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 NEAS.ed92a586b58f66727c5b5e4c451e8040.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ipekmlhg.dll" Bfjllnnm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Hhehkepj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmlngh32.dll" Eejcki32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ieoapl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Jobfdl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Maeaajpl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" NEAS.ed92a586b58f66727c5b5e4c451e8040.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Maoakaip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Icgdelol.dll" Ljhchc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Kbedaand.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfdahb32.dll" Bkjpkg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Cnpbgajc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Gaoihfoo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Hgdlcm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Daejcd32.dll" Cggpfa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Lnoalehl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Denlgq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Majoikof.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node NEAS.ed92a586b58f66727c5b5e4c451e8040.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Cgklmacf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lamgof32.dll" Jeolckne.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bkjbah32.dll" Kblpcndd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhkmohka.dll" Lkppchfi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Iecmhlhb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Npajmk32.dll" Beippj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ddpgfjhm.dll" Ibjqlj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ikmcccpb.dll" Kkihedld.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Hhehkepj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Lnikmjdm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Bodano32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cajbli32.dll" Eliecc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhcbdkfh.dll" Eeailhme.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Knmkak32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ipohpdbb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Denlgq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdkpjeba.dll" Cbmlmmjd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Jihngboe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Plgkpj32.dll" Jobfdl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Abdagi32.dll" Acgfec32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Kokbpe32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Egelgoah.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Glajeiml.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Gccmaack.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aphigedp.dll" Ehklmd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gqnajlid.dll" Kfndlphp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Jmlkpgia.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Hfeoijbi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Eeailhme.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Gogjflhf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Igmjhnej.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Dfngcdhi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Phiekaql.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Gmkibl32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5088 wrote to memory of 4492 5088 NEAS.ed92a586b58f66727c5b5e4c451e8040.exe 89 PID 5088 wrote to memory of 4492 5088 NEAS.ed92a586b58f66727c5b5e4c451e8040.exe 89 PID 5088 wrote to memory of 4492 5088 NEAS.ed92a586b58f66727c5b5e4c451e8040.exe 89 PID 4492 wrote to memory of 804 4492 Oqhoeb32.exe 90 PID 4492 wrote to memory of 804 4492 Oqhoeb32.exe 90 PID 4492 wrote to memory of 804 4492 Oqhoeb32.exe 90 PID 804 wrote to memory of 2344 804 Obqanjdb.exe 91 PID 804 wrote to memory of 2344 804 Obqanjdb.exe 91 PID 804 wrote to memory of 2344 804 Obqanjdb.exe 91 PID 2344 wrote to memory of 3008 2344 Pfccogfc.exe 92 PID 2344 wrote to memory of 3008 2344 Pfccogfc.exe 92 PID 2344 wrote to memory of 3008 2344 Pfccogfc.exe 92 PID 3008 wrote to memory of 3448 3008 Pfepdg32.exe 93 PID 3008 wrote to memory of 3448 3008 Pfepdg32.exe 93 PID 3008 wrote to memory of 3448 3008 Pfepdg32.exe 93 PID 3448 wrote to memory of 1372 3448 Qclmck32.exe 94 PID 3448 wrote to memory of 1372 3448 Qclmck32.exe 94 PID 3448 wrote to memory of 1372 3448 Qclmck32.exe 94 PID 1372 wrote to memory of 4408 1372 Aimogakj.exe 95 PID 1372 wrote to memory of 4408 1372 Aimogakj.exe 95 PID 1372 wrote to memory of 4408 1372 Aimogakj.exe 95 PID 4408 wrote to memory of 3028 4408 Apjdikqd.exe 96 PID 4408 wrote to memory of 3028 4408 Apjdikqd.exe 96 PID 4408 wrote to memory of 3028 4408 Apjdikqd.exe 96 PID 3028 wrote to memory of 3440 3028 Afhfaddk.exe 98 PID 3028 wrote to memory of 3440 3028 Afhfaddk.exe 98 PID 3028 wrote to memory of 3440 3028 Afhfaddk.exe 98 PID 3440 wrote to memory of 1256 3440 Bmggingc.exe 99 PID 3440 wrote to memory of 1256 3440 Bmggingc.exe 99 PID 3440 wrote to memory of 1256 3440 Bmggingc.exe 99 PID 1256 wrote to memory of 2240 1256 Cmpjoloh.exe 100 PID 1256 wrote to memory of 2240 1256 Cmpjoloh.exe 100 PID 1256 wrote to memory of 2240 1256 Cmpjoloh.exe 100 PID 2240 wrote to memory of 4716 2240 Cgklmacf.exe 101 PID 2240 wrote to memory of 4716 2240 Cgklmacf.exe 101 PID 2240 wrote to memory of 4716 2240 Cgklmacf.exe 101 PID 4716 wrote to memory of 3860 4716 Ckidcpjl.exe 102 PID 4716 wrote to memory of 3860 4716 Ckidcpjl.exe 102 PID 4716 wrote to memory of 3860 4716 Ckidcpjl.exe 102 PID 3860 wrote to memory of 4056 3860 Dickplko.exe 104 PID 3860 wrote to memory of 4056 3860 Dickplko.exe 104 PID 3860 wrote to memory of 4056 3860 Dickplko.exe 104 PID 4056 wrote to memory of 1804 4056 Enjfli32.exe 105 PID 4056 wrote to memory of 1804 4056 Enjfli32.exe 105 PID 4056 wrote to memory of 1804 4056 Enjfli32.exe 105 PID 1804 wrote to memory of 4240 1804 Fkgillpj.exe 106 PID 1804 wrote to memory of 4240 1804 Fkgillpj.exe 106 PID 1804 wrote to memory of 4240 1804 Fkgillpj.exe 106 PID 4240 wrote to memory of 3864 4240 Fcbnpnme.exe 107 PID 4240 wrote to memory of 3864 4240 Fcbnpnme.exe 107 PID 4240 wrote to memory of 3864 4240 Fcbnpnme.exe 107 PID 3864 wrote to memory of 1040 3864 Fqikob32.exe 108 PID 3864 wrote to memory of 1040 3864 Fqikob32.exe 108 PID 3864 wrote to memory of 1040 3864 Fqikob32.exe 108 PID 1040 wrote to memory of 2276 1040 Hcjmhk32.exe 109 PID 1040 wrote to memory of 2276 1040 Hcjmhk32.exe 109 PID 1040 wrote to memory of 2276 1040 Hcjmhk32.exe 109 PID 2276 wrote to memory of 552 2276 Iecmhlhb.exe 110 PID 2276 wrote to memory of 552 2276 Iecmhlhb.exe 110 PID 2276 wrote to memory of 552 2276 Iecmhlhb.exe 110 PID 552 wrote to memory of 1388 552 Jjgkab32.exe 111 PID 552 wrote to memory of 1388 552 Jjgkab32.exe 111 PID 552 wrote to memory of 1388 552 Jjgkab32.exe 111 PID 1388 wrote to memory of 2044 1388 Jeolckne.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.ed92a586b58f66727c5b5e4c451e8040.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.ed92a586b58f66727c5b5e4c451e8040.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Windows\SysWOW64\Oqhoeb32.exeC:\Windows\system32\Oqhoeb32.exe2⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Windows\SysWOW64\Obqanjdb.exeC:\Windows\system32\Obqanjdb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Windows\SysWOW64\Pfccogfc.exeC:\Windows\system32\Pfccogfc.exe4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Windows\SysWOW64\Pfepdg32.exeC:\Windows\system32\Pfepdg32.exe5⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Windows\SysWOW64\Qclmck32.exeC:\Windows\system32\Qclmck32.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Windows\SysWOW64\Aimogakj.exeC:\Windows\system32\Aimogakj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Windows\SysWOW64\Apjdikqd.exeC:\Windows\system32\Apjdikqd.exe8⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Windows\SysWOW64\Afhfaddk.exeC:\Windows\system32\Afhfaddk.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Windows\SysWOW64\Bmggingc.exeC:\Windows\system32\Bmggingc.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Windows\SysWOW64\Cmpjoloh.exeC:\Windows\system32\Cmpjoloh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Windows\SysWOW64\Cgklmacf.exeC:\Windows\system32\Cgklmacf.exe12⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Windows\SysWOW64\Ckidcpjl.exeC:\Windows\system32\Ckidcpjl.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Windows\SysWOW64\Dickplko.exeC:\Windows\system32\Dickplko.exe14⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Windows\SysWOW64\Enjfli32.exeC:\Windows\system32\Enjfli32.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Windows\SysWOW64\Fkgillpj.exeC:\Windows\system32\Fkgillpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Windows\SysWOW64\Fcbnpnme.exeC:\Windows\system32\Fcbnpnme.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Windows\SysWOW64\Fqikob32.exeC:\Windows\system32\Fqikob32.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Windows\SysWOW64\Hcjmhk32.exeC:\Windows\system32\Hcjmhk32.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Windows\SysWOW64\Iecmhlhb.exeC:\Windows\system32\Iecmhlhb.exe20⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Windows\SysWOW64\Jjgkab32.exeC:\Windows\system32\Jjgkab32.exe21⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Windows\SysWOW64\Jeolckne.exeC:\Windows\system32\Jeolckne.exe22⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Windows\SysWOW64\Kblpcndd.exeC:\Windows\system32\Kblpcndd.exe23⤵
- Executes dropped EXE
- Modifies registry class
PID:2044 -
C:\Windows\SysWOW64\Kocphojh.exeC:\Windows\system32\Kocphojh.exe24⤵
- Executes dropped EXE
PID:1848 -
C:\Windows\SysWOW64\Lddble32.exeC:\Windows\system32\Lddble32.exe25⤵
- Executes dropped EXE
PID:2404 -
C:\Windows\SysWOW64\Lkqgno32.exeC:\Windows\system32\Lkqgno32.exe26⤵
- Executes dropped EXE
PID:3596 -
C:\Windows\SysWOW64\Ncmaai32.exeC:\Windows\system32\Ncmaai32.exe27⤵
- Executes dropped EXE
PID:1284 -
C:\Windows\SysWOW64\Oohkai32.exeC:\Windows\system32\Oohkai32.exe28⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:4048 -
C:\Windows\SysWOW64\Pdngpo32.exeC:\Windows\system32\Pdngpo32.exe29⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:4936 -
C:\Windows\SysWOW64\Apimodmh.exeC:\Windows\system32\Apimodmh.exe30⤵
- Executes dropped EXE
PID:4856 -
C:\Windows\SysWOW64\Acgfec32.exeC:\Windows\system32\Acgfec32.exe31⤵
- Executes dropped EXE
- Modifies registry class
PID:3320 -
C:\Windows\SysWOW64\Bfhofnpp.exeC:\Windows\system32\Bfhofnpp.exe32⤵
- Executes dropped EXE
PID:1896 -
C:\Windows\SysWOW64\Bfjllnnm.exeC:\Windows\system32\Bfjllnnm.exe33⤵
- Executes dropped EXE
- Modifies registry class
PID:2272 -
C:\Windows\SysWOW64\Blnjecfl.exeC:\Windows\system32\Blnjecfl.exe34⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:5056 -
C:\Windows\SysWOW64\Cbmlmmjd.exeC:\Windows\system32\Cbmlmmjd.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:4488 -
C:\Windows\SysWOW64\Cpcila32.exeC:\Windows\system32\Cpcila32.exe36⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:4864 -
C:\Windows\SysWOW64\Dlqpaafg.exeC:\Windows\system32\Dlqpaafg.exe37⤵
- Executes dropped EXE
PID:3952 -
C:\Windows\SysWOW64\Dlcmgqdd.exeC:\Windows\system32\Dlcmgqdd.exe38⤵
- Executes dropped EXE
PID:3740 -
C:\Windows\SysWOW64\Emeffcid.exeC:\Windows\system32\Emeffcid.exe39⤵
- Executes dropped EXE
PID:228 -
C:\Windows\SysWOW64\Ecanojgl.exeC:\Windows\system32\Ecanojgl.exe40⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1332 -
C:\Windows\SysWOW64\Egdqph32.exeC:\Windows\system32\Egdqph32.exe41⤵
- Executes dropped EXE
PID:3816 -
C:\Windows\SysWOW64\Flcfnn32.exeC:\Windows\system32\Flcfnn32.exe42⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:3112 -
C:\Windows\SysWOW64\Gqkajk32.exeC:\Windows\system32\Gqkajk32.exe43⤵
- Drops file in System32 directory
PID:2848 -
C:\Windows\SysWOW64\Gqmnpk32.exeC:\Windows\system32\Gqmnpk32.exe44⤵
- Executes dropped EXE
PID:3336 -
C:\Windows\SysWOW64\Ijmapm32.exeC:\Windows\system32\Ijmapm32.exe45⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1616 -
C:\Windows\SysWOW64\Lkppchfi.exeC:\Windows\system32\Lkppchfi.exe46⤵
- Executes dropped EXE
- Modifies registry class
PID:2072 -
C:\Windows\SysWOW64\Lhdqml32.exeC:\Windows\system32\Lhdqml32.exe47⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2296 -
C:\Windows\SysWOW64\Mehafq32.exeC:\Windows\system32\Mehafq32.exe48⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2368 -
C:\Windows\SysWOW64\Maoakaip.exeC:\Windows\system32\Maoakaip.exe49⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:1764 -
C:\Windows\SysWOW64\Meljappg.exeC:\Windows\system32\Meljappg.exe50⤵
- Executes dropped EXE
PID:3912 -
C:\Windows\SysWOW64\Mgngih32.exeC:\Windows\system32\Mgngih32.exe51⤵
- Executes dropped EXE
PID:812 -
C:\Windows\SysWOW64\Nkgoke32.exeC:\Windows\system32\Nkgoke32.exe52⤵
- Executes dropped EXE
PID:3644 -
C:\Windows\SysWOW64\Oolnabal.exeC:\Windows\system32\Oolnabal.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2012 -
C:\Windows\SysWOW64\Qhekaejj.exeC:\Windows\system32\Qhekaejj.exe54⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:3296 -
C:\Windows\SysWOW64\Bbpeghpe.exeC:\Windows\system32\Bbpeghpe.exe55⤵
- Executes dropped EXE
PID:4272 -
C:\Windows\SysWOW64\Beaohcmf.exeC:\Windows\system32\Beaohcmf.exe56⤵
- Executes dropped EXE
PID:1268 -
C:\Windows\SysWOW64\Becknc32.exeC:\Windows\system32\Becknc32.exe57⤵
- Executes dropped EXE
PID:224 -
C:\Windows\SysWOW64\Chkjpm32.exeC:\Windows\system32\Chkjpm32.exe58⤵
- Executes dropped EXE
PID:4564 -
C:\Windows\SysWOW64\Deokja32.exeC:\Windows\system32\Deokja32.exe59⤵
- Executes dropped EXE
PID:3856 -
C:\Windows\SysWOW64\Dfngcdhi.exeC:\Windows\system32\Dfngcdhi.exe60⤵
- Executes dropped EXE
- Modifies registry class
PID:2232 -
C:\Windows\SysWOW64\Dlbfmjqi.exeC:\Windows\system32\Dlbfmjqi.exe61⤵
- Executes dropped EXE
PID:4500 -
C:\Windows\SysWOW64\Eeaqfo32.exeC:\Windows\system32\Eeaqfo32.exe62⤵
- Executes dropped EXE
PID:4700 -
C:\Windows\SysWOW64\Ehbihj32.exeC:\Windows\system32\Ehbihj32.exe63⤵
- Executes dropped EXE
PID:4608 -
C:\Windows\SysWOW64\Foakpc32.exeC:\Windows\system32\Foakpc32.exe64⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:3004 -
C:\Windows\SysWOW64\Fhllni32.exeC:\Windows\system32\Fhllni32.exe65⤵
- Executes dropped EXE
PID:3344 -
C:\Windows\SysWOW64\Fgmllpng.exeC:\Windows\system32\Fgmllpng.exe66⤵
- Executes dropped EXE
PID:1996 -
C:\Windows\SysWOW64\Gccmaack.exeC:\Windows\system32\Gccmaack.exe67⤵
- Modifies registry class
PID:4112 -
C:\Windows\SysWOW64\Ggilgn32.exeC:\Windows\system32\Ggilgn32.exe68⤵PID:4752
-
C:\Windows\SysWOW64\Hlhaee32.exeC:\Windows\system32\Hlhaee32.exe69⤵PID:3348
-
C:\Windows\SysWOW64\Hgpbhmna.exeC:\Windows\system32\Hgpbhmna.exe70⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:1204 -
C:\Windows\SysWOW64\Hfeoijbi.exeC:\Windows\system32\Hfeoijbi.exe71⤵
- Modifies registry class
PID:8 -
C:\Windows\SysWOW64\Hgdlcm32.exeC:\Windows\system32\Hgdlcm32.exe72⤵
- Modifies registry class
PID:1464 -
C:\Windows\SysWOW64\Hhehkepj.exeC:\Windows\system32\Hhehkepj.exe73⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:1308 -
C:\Windows\SysWOW64\Ifihdi32.exeC:\Windows\system32\Ifihdi32.exe74⤵PID:4704
-
C:\Windows\SysWOW64\Ijlkfg32.exeC:\Windows\system32\Ijlkfg32.exe75⤵PID:1404
-
C:\Windows\SysWOW64\Jmopmalc.exeC:\Windows\system32\Jmopmalc.exe76⤵PID:4356
-
C:\Windows\SysWOW64\Jjcqffkm.exeC:\Windows\system32\Jjcqffkm.exe77⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4848 -
C:\Windows\SysWOW64\Jihngboe.exeC:\Windows\system32\Jihngboe.exe78⤵
- Modifies registry class
PID:1800 -
C:\Windows\SysWOW64\Jobfdl32.exeC:\Windows\system32\Jobfdl32.exe79⤵
- Modifies registry class
PID:3044 -
C:\Windows\SysWOW64\Jjhjae32.exeC:\Windows\system32\Jjhjae32.exe80⤵PID:2856
-
C:\Windows\SysWOW64\Jfokff32.exeC:\Windows\system32\Jfokff32.exe81⤵
- Drops file in System32 directory
PID:4208 -
C:\Windows\SysWOW64\Kpgoolbl.exeC:\Windows\system32\Kpgoolbl.exe82⤵PID:1936
-
C:\Windows\SysWOW64\Lmdbooik.exeC:\Windows\system32\Lmdbooik.exe83⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4596 -
C:\Windows\SysWOW64\Ljhchc32.exeC:\Windows\system32\Ljhchc32.exe84⤵
- Modifies registry class
PID:1408 -
C:\Windows\SysWOW64\Lpelqj32.exeC:\Windows\system32\Lpelqj32.exe85⤵
- Modifies registry class
PID:5160 -
C:\Windows\SysWOW64\Lfaqcclf.exeC:\Windows\system32\Lfaqcclf.exe86⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:5204 -
C:\Windows\SysWOW64\Lmkipncc.exeC:\Windows\system32\Lmkipncc.exe87⤵PID:5248
-
C:\Windows\SysWOW64\Midfjnge.exeC:\Windows\system32\Midfjnge.exe88⤵PID:5292
-
C:\Windows\SysWOW64\Mfhgcbfo.exeC:\Windows\system32\Mfhgcbfo.exe89⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:5336 -
C:\Windows\SysWOW64\Mjfoja32.exeC:\Windows\system32\Mjfoja32.exe90⤵PID:5380
-
C:\Windows\SysWOW64\Maeaajpl.exeC:\Windows\system32\Maeaajpl.exe91⤵
- Modifies registry class
PID:5424 -
C:\Windows\SysWOW64\Npcaie32.exeC:\Windows\system32\Npcaie32.exe92⤵PID:5460
-
C:\Windows\SysWOW64\Ogmiepcf.exeC:\Windows\system32\Ogmiepcf.exe93⤵PID:5516
-
C:\Windows\SysWOW64\Oknnanhj.exeC:\Windows\system32\Oknnanhj.exe94⤵
- Drops file in System32 directory
PID:5556 -
C:\Windows\SysWOW64\Ogdofo32.exeC:\Windows\system32\Ogdofo32.exe95⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5608 -
C:\Windows\SysWOW64\Phiekaql.exeC:\Windows\system32\Phiekaql.exe96⤵
- Drops file in System32 directory
- Modifies registry class
PID:5656 -
C:\Windows\SysWOW64\Qkcackeb.exeC:\Windows\system32\Qkcackeb.exe97⤵PID:5696
-
C:\Windows\SysWOW64\Bkjpkg32.exeC:\Windows\system32\Bkjpkg32.exe98⤵
- Modifies registry class
PID:5748 -
C:\Windows\SysWOW64\Cicjokll.exeC:\Windows\system32\Cicjokll.exe99⤵PID:5784
-
C:\Windows\SysWOW64\Cnpbgajc.exeC:\Windows\system32\Cnpbgajc.exe100⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:5844 -
C:\Windows\SysWOW64\Djipbbne.exeC:\Windows\system32\Djipbbne.exe101⤵PID:5900
-
C:\Windows\SysWOW64\Eejcki32.exeC:\Windows\system32\Eejcki32.exe102⤵
- Modifies registry class
PID:5940 -
C:\Windows\SysWOW64\Ejglcq32.exeC:\Windows\system32\Ejglcq32.exe103⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:5988 -
C:\Windows\SysWOW64\Ehklmd32.exeC:\Windows\system32\Ehklmd32.exe104⤵
- Modifies registry class
PID:6036 -
C:\Windows\SysWOW64\Ebpqjmpd.exeC:\Windows\system32\Ebpqjmpd.exe105⤵
- Drops file in System32 directory
PID:6080 -
C:\Windows\SysWOW64\Eliecc32.exeC:\Windows\system32\Eliecc32.exe106⤵
- Drops file in System32 directory
- Modifies registry class
PID:6120 -
C:\Windows\SysWOW64\Eeailhme.exeC:\Windows\system32\Eeailhme.exe107⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:5124 -
C:\Windows\SysWOW64\Ejnbdp32.exeC:\Windows\system32\Ejnbdp32.exe108⤵PID:5184
-
C:\Windows\SysWOW64\Eiobbgcl.exeC:\Windows\system32\Eiobbgcl.exe109⤵PID:3588
-
C:\Windows\SysWOW64\Fjpoio32.exeC:\Windows\system32\Fjpoio32.exe110⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1380 -
C:\Windows\SysWOW64\Facjlhil.exeC:\Windows\system32\Facjlhil.exe111⤵PID:5348
-
C:\Windows\SysWOW64\Gogjflhf.exeC:\Windows\system32\Gogjflhf.exe112⤵
- Drops file in System32 directory
- Modifies registry class
PID:5524 -
C:\Windows\SysWOW64\Gaoihfoo.exeC:\Windows\system32\Gaoihfoo.exe113⤵
- Drops file in System32 directory
- Modifies registry class
PID:5572 -
C:\Windows\SysWOW64\Hocjaj32.exeC:\Windows\system32\Hocjaj32.exe114⤵
- Drops file in System32 directory
PID:5640 -
C:\Windows\SysWOW64\Ikhghi32.exeC:\Windows\system32\Ikhghi32.exe115⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1556 -
C:\Windows\SysWOW64\Ifnkeb32.exeC:\Windows\system32\Ifnkeb32.exe116⤵PID:972
-
C:\Windows\SysWOW64\Jokiig32.exeC:\Windows\system32\Jokiig32.exe117⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4492 -
C:\Windows\SysWOW64\Jchaoe32.exeC:\Windows\system32\Jchaoe32.exe118⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5756 -
C:\Windows\SysWOW64\Kfndlphp.exeC:\Windows\system32\Kfndlphp.exe119⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:3852 -
C:\Windows\SysWOW64\Kbedaand.exeC:\Windows\system32\Kbedaand.exe120⤵
- Drops file in System32 directory
- Modifies registry class
PID:5884 -
C:\Windows\SysWOW64\Kiomnk32.exeC:\Windows\system32\Kiomnk32.exe121⤵PID:1272
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-