Analysis
-
max time kernel
137s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
01-11-2023 18:14
Behavioral task
behavioral1
Sample
NEAS.de630a4bae0e6464c1a4c055cce7e53d_JC.exe
Resource
win7-20231020-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.de630a4bae0e6464c1a4c055cce7e53d_JC.exe
Resource
win10v2004-20231023-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
NEAS.de630a4bae0e6464c1a4c055cce7e53d_JC.exe
-
Size
368KB
-
MD5
de630a4bae0e6464c1a4c055cce7e53d
-
SHA1
b020142f4610d127d4a0bd30950111a688dec851
-
SHA256
f964d6e2c042ea7317a6db5618e43f78f1cedcfc772051053ed01c78d66e33b6
-
SHA512
99f59c1eca8bb214aa2e89b176b124fd9fc95d0d82ed9707eccc4e8d2f698c4f5d037cedb0034df89c9ad7c074214e44a8d26247a5939e978c131872ccaa983b
-
SSDEEP
6144:P2aVJrVaa8E4f9FIUpOVw86CmOJfTo9FIUIhrcflDMxy9FIUpOVw86CmOJfTo9Fv:P2kzaKaAD6RrI1+lDMEAD6Rr2NWL
Score
10/10
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ilibdmgp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ifcben32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aggpfkjj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jflnafno.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Clbdpc32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fpckjlje.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gfjfhbpb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Odkcpi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Jekjcaef.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Mbdiknlb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" WerFault.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fbaahf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Glqkefff.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ehndnh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ilibdmgp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jfkhfmdm.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dajnol32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nhbmnj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ophjdehd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Bcbeqaia.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cdnelpod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Fcmnkh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Nmlhaa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Iibccgep.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Caageq32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mhckcgpj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Beaecjab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Lagepl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Hqfqfj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Affikdfn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gbkdod32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nlcidopb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Apimodmh.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hdicggla.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pdmdnadc.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ncjdki32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Pcdqhecd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Deidjf32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad WerFault.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Qpbgnecp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Gojnfb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Eojiqb32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kplmliko.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Pafkgphl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bmdkcnie.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nhlfoodc.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cnpibh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Cjfclcpg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Fkemfl32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Odkcpi32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pfdbpjmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Nhfoocaa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Jniood32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Eejcki32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bknlbhhe.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cepadh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eepkkefp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Jepjhg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Pdqcenmg.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cboibm32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Meljappg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Bdeiqgkj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Odifjipd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ehifak32.exe -
Malware Backdoor - Berbew 64 IoCs
Berbew is a malware infection classified as a 'backdoor' Trojan. This malicious program's primary function is to cause chain infections - it can download/install additional malware such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/files/0x0008000000022d59-6.dat family_berbew behavioral2/files/0x0008000000022d59-8.dat family_berbew behavioral2/files/0x0007000000022d5f-14.dat family_berbew behavioral2/files/0x0007000000022d5f-15.dat family_berbew behavioral2/files/0x0007000000022d6b-22.dat family_berbew behavioral2/files/0x0007000000022d6b-24.dat family_berbew behavioral2/files/0x0006000000022d7f-30.dat family_berbew behavioral2/files/0x0006000000022d7f-32.dat family_berbew behavioral2/files/0x0006000000022d82-39.dat family_berbew behavioral2/files/0x0006000000022d82-38.dat family_berbew behavioral2/files/0x0006000000022d84-46.dat family_berbew behavioral2/files/0x0006000000022d84-48.dat family_berbew behavioral2/files/0x0006000000022d87-54.dat family_berbew behavioral2/files/0x0006000000022d87-56.dat family_berbew behavioral2/files/0x0006000000022d89-57.dat family_berbew behavioral2/files/0x0006000000022d89-62.dat family_berbew behavioral2/files/0x0006000000022d89-64.dat family_berbew behavioral2/files/0x0006000000022d8b-72.dat family_berbew behavioral2/files/0x0006000000022d8d-78.dat family_berbew behavioral2/files/0x0006000000022d8b-70.dat family_berbew behavioral2/files/0x0006000000022d8d-80.dat family_berbew behavioral2/files/0x0006000000022d8f-86.dat family_berbew behavioral2/files/0x0006000000022d8f-88.dat family_berbew behavioral2/files/0x0006000000022d91-95.dat family_berbew behavioral2/files/0x0006000000022d91-94.dat family_berbew behavioral2/files/0x0006000000022d93-102.dat family_berbew behavioral2/files/0x0006000000022d93-104.dat family_berbew behavioral2/files/0x0006000000022d97-118.dat family_berbew behavioral2/files/0x0006000000022d95-112.dat family_berbew behavioral2/files/0x0006000000022d97-119.dat family_berbew behavioral2/files/0x0006000000022d95-110.dat family_berbew behavioral2/files/0x0006000000022d99-127.dat family_berbew behavioral2/files/0x0006000000022d99-126.dat family_berbew behavioral2/files/0x0006000000022d9b-134.dat family_berbew behavioral2/files/0x0006000000022d9b-135.dat family_berbew behavioral2/files/0x0006000000022d9d-142.dat family_berbew behavioral2/files/0x0006000000022d9d-144.dat family_berbew behavioral2/files/0x0006000000022d9f-150.dat family_berbew behavioral2/files/0x0006000000022d9f-152.dat family_berbew behavioral2/files/0x0006000000022da1-159.dat family_berbew behavioral2/files/0x0006000000022da1-158.dat family_berbew behavioral2/files/0x0006000000022da3-167.dat family_berbew behavioral2/files/0x0006000000022da5-174.dat family_berbew behavioral2/files/0x0006000000022da5-176.dat family_berbew behavioral2/files/0x0006000000022da3-166.dat family_berbew behavioral2/files/0x0006000000022da7-182.dat family_berbew behavioral2/files/0x0006000000022da9-190.dat family_berbew behavioral2/files/0x0006000000022da9-192.dat family_berbew behavioral2/files/0x0006000000022da7-183.dat family_berbew behavioral2/files/0x0006000000022dab-198.dat family_berbew behavioral2/files/0x0006000000022dab-199.dat family_berbew behavioral2/files/0x0006000000022dad-201.dat family_berbew behavioral2/files/0x0006000000022dad-206.dat family_berbew behavioral2/files/0x0006000000022dad-208.dat family_berbew behavioral2/files/0x0006000000022daf-214.dat family_berbew behavioral2/files/0x0006000000022daf-216.dat family_berbew behavioral2/files/0x0006000000022db1-222.dat family_berbew behavioral2/files/0x0006000000022db1-223.dat family_berbew behavioral2/files/0x0006000000022db3-230.dat family_berbew behavioral2/files/0x0006000000022db3-231.dat family_berbew behavioral2/files/0x0006000000022db5-238.dat family_berbew behavioral2/files/0x0006000000022db5-239.dat family_berbew behavioral2/files/0x0006000000022db7-246.dat family_berbew behavioral2/files/0x0006000000022db7-248.dat family_berbew -
Executes dropped EXE 64 IoCs
pid Process 1380 Fbgihaji.exe 4004 Gidnkkpc.exe 3560 Gmfplibd.exe 1292 Gmimai32.exe 4684 Hipmfjee.exe 1460 Hefnkkkj.exe 4728 Hoaojp32.exe 1176 Hemdlj32.exe 2368 Ibaeen32.exe 2436 Ifomll32.exe 3100 Iipfmggc.exe 1304 Iibccgep.exe 1936 Ilcldb32.exe 5024 Jlgepanl.exe 2932 Jepjhg32.exe 3668 Jpenfp32.exe 4504 Jniood32.exe 4336 Ocgbld32.exe 3120 Oakbehfe.exe 3656 Ojfcdnjc.exe 868 Ocohmc32.exe 4304 Opeiadfg.exe 3036 Ppgegd32.exe 776 Pmlfqh32.exe 2312 Pdhkcb32.exe 3008 Ppolhcnm.exe 228 Pdmdnadc.exe 3536 Qodeajbg.exe 3160 Qdaniq32.exe 4340 Aaenbd32.exe 4620 Ahaceo32.exe 2616 Aggpfkjj.exe 1088 Aaoaic32.exe 4204 Bdojjo32.exe 3444 Bpfkpp32.exe 4856 Bmjkic32.exe 4000 Bknlbhhe.exe 1108 Bhblllfo.exe 2408 Cggimh32.exe 4052 Caageq32.exe 1604 Cgnomg32.exe 4104 Cpfcfmlp.exe 2472 Cogddd32.exe 3524 Dhphmj32.exe 5040 Dnmaea32.exe 4756 Ddgibkpc.exe 408 Dolmodpi.exe 3844 Dggbcf32.exe 1632 Damfao32.exe 1140 Dkekjdck.exe 2972 Dbocfo32.exe 5048 Dkhgod32.exe 2576 Edplhjhi.exe 4492 Ekjded32.exe 2904 Ehndnh32.exe 2912 Eqiibjlj.exe 2844 Eojiqb32.exe 844 Edgbii32.exe 2272 Eqncnj32.exe 4736 Fqppci32.exe 4440 Fkfcqb32.exe 816 Fdnhih32.exe 4532 Foclgq32.exe 4628 Fgoakc32.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Ljgmjm32.dll Omdieb32.exe File created C:\Windows\SysWOW64\Mdpagc32.exe Mcoepkdo.exe File opened for modification C:\Windows\SysWOW64\Nheqnpjk.exe Nchhfild.exe File created C:\Windows\SysWOW64\Qkakhakq.exe Pfdbpjmi.exe File created C:\Windows\SysWOW64\Mfmpob32.exe Mmdlflki.exe File opened for modification C:\Windows\SysWOW64\Ekjded32.exe Edplhjhi.exe File created C:\Windows\SysWOW64\Njbgmjgl.exe Nciopppp.exe File opened for modification C:\Windows\SysWOW64\Decmjjie.exe Djmima32.exe File created C:\Windows\SysWOW64\Kofljo32.dll Nqmojd32.exe File created C:\Windows\SysWOW64\Doklblnq.dll Aiabhj32.exe File created C:\Windows\SysWOW64\Edakimoo.exe Eepkkefp.exe File created C:\Windows\SysWOW64\Gknohl32.dll Chddpn32.exe File created C:\Windows\SysWOW64\Goadfa32.exe Gjdknjep.exe File opened for modification C:\Windows\SysWOW64\Ckoifgmb.exe Cbfema32.exe File created C:\Windows\SysWOW64\Gmfplibd.exe Gidnkkpc.exe File created C:\Windows\SysWOW64\Lolcnman.exe Ldfoad32.exe File opened for modification C:\Windows\SysWOW64\Hbihjifh.exe Hajkqfoe.exe File opened for modification C:\Windows\SysWOW64\Edgbii32.exe Eojiqb32.exe File opened for modification C:\Windows\SysWOW64\Klmnkdal.exe Kahinkaf.exe File created C:\Windows\SysWOW64\Gdfmgqph.dll Bcpika32.exe File opened for modification C:\Windows\SysWOW64\Mehafq32.exe Lkbmih32.exe File created C:\Windows\SysWOW64\Gidnkkpc.exe Fbgihaji.exe File opened for modification C:\Windows\SysWOW64\Hhckeeam.exe Hgbonm32.exe File created C:\Windows\SysWOW64\Amoppdld.dll Bbfmgd32.exe File opened for modification C:\Windows\SysWOW64\Qkakhakq.exe Pfdbpjmi.exe File created C:\Windows\SysWOW64\Hjabdo32.exe Hddilh32.exe File created C:\Windows\SysWOW64\Oonlfo32.exe Ofegni32.exe File opened for modification C:\Windows\SysWOW64\Cpljehpo.exe Bdeiqgkj.exe File created C:\Windows\SysWOW64\Gdmkfp32.dll Djgdkk32.exe File created C:\Windows\SysWOW64\Fjinnekj.dll Fqbeoc32.exe File opened for modification C:\Windows\SysWOW64\Kjpgmj32.exe Kagbdenk.exe File opened for modification C:\Windows\SysWOW64\Najagp32.exe Nhbmnj32.exe File opened for modification C:\Windows\SysWOW64\Onmahojj.exe Ohpiphlb.exe File created C:\Windows\SysWOW64\Cpljehpo.exe Bdeiqgkj.exe File created C:\Windows\SysWOW64\Cmnegipj.dll Piolkm32.exe File created C:\Windows\SysWOW64\Klambq32.dll Fqppci32.exe File opened for modification C:\Windows\SysWOW64\Eejcki32.exe Elaobdmm.exe File created C:\Windows\SysWOW64\Dahcld32.dll Iipfmggc.exe File created C:\Windows\SysWOW64\Fpckjlje.exe Ffnglc32.exe File created C:\Windows\SysWOW64\Flghognq.exe Fempbm32.exe File created C:\Windows\SysWOW64\Gojnfb32.exe Ggoiap32.exe File created C:\Windows\SysWOW64\Dabhomea.exe Djipbbne.exe File created C:\Windows\SysWOW64\Ilphdlqh.exe Iajdgcab.exe File created C:\Windows\SysWOW64\Acbmjcgd.exe Aimhmkgn.exe File opened for modification C:\Windows\SysWOW64\Nockkcjg.exe Nhicoi32.exe File created C:\Windows\SysWOW64\Cpdnjd32.dll Abdfkj32.exe File opened for modification C:\Windows\SysWOW64\Efopjbjg.exe Ehnpmkbg.exe File created C:\Windows\SysWOW64\Ifcmmg32.dll Dhcfleff.exe File created C:\Windows\SysWOW64\Daphho32.dll Nlcidopb.exe File opened for modification C:\Windows\SysWOW64\Gmfplibd.exe Gidnkkpc.exe File created C:\Windows\SysWOW64\Dbppnnac.dll Jmopmalc.exe File created C:\Windows\SysWOW64\Pfojdh32.exe Pqbala32.exe File created C:\Windows\SysWOW64\Khdoqefq.exe Klmnkdal.exe File opened for modification C:\Windows\SysWOW64\Odifjipd.exe Oolnabal.exe File created C:\Windows\SysWOW64\Efjgpc32.exe Ehifak32.exe File created C:\Windows\SysWOW64\Lancko32.exe Llqjbhdc.exe File created C:\Windows\SysWOW64\Noehac32.exe Ndpcdjho.exe File created C:\Windows\SysWOW64\Japjfm32.dll Khdoqefq.exe File created C:\Windows\SysWOW64\Ifoglp32.dll Qpbgnecp.exe File opened for modification C:\Windows\SysWOW64\Bmidnm32.exe Dhcfleff.exe File created C:\Windows\SysWOW64\Nncoaq32.exe Nhffijdm.exe File opened for modification C:\Windows\SysWOW64\Nciopppp.exe Mhckcgpj.exe File created C:\Windows\SysWOW64\Ebpmamlm.dll Kejloi32.exe File opened for modification C:\Windows\SysWOW64\Pdqcenmg.exe Okfbgiij.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 6416 6276 WerFault.exe 710 -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Kahinkaf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jkkdccim.dll" Nmlhaa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Baampdgc.dll" Fbdehlip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ijpepcfj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Bpdfpmoo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Aggpfkjj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Fgoakc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fkdjqkoj.dll" Gpmomo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Mbibfm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bepjbf32.dll" Nfihbk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Fjeplijj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Mklfjm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Najjmjkg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Agcdnjcl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Bjhgke32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lciibdmj.dll" Hemdlj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Nbebbk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dhfhohgp.dll" Kbjbnnfg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ldfoad32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Hpaqqdjj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Fkfcqb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hkidlkmq.dll" Odljjo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Nhffijdm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Damfao32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Gbhhieao.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Flfbcndo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Biplma32.dll" Foakpc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Niojoeel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ggccllai.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Mcoepkdo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Bipnihgi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cnnnfkal.dll" Fkmjaa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mondkfmh.dll" Cboibm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Cppelkeb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Cepadh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Okkalnjm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Gmimai32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fgcodk32.dll" Koajmepf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dccfme32.dll" Ccdihbgg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gcfcio32.dll" Kmbfiokn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 NEAS.de630a4bae0e6464c1a4c055cce7e53d_JC.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Oqhoeb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Imfdaigj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Pbapom32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jclnjo32.dll" Ncpeaoih.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ffmnibme.dll" Nhbciqln.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpbibenl.dll" Dmbiackg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Onmahojj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Fcmnkh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Adepji32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cmkehhpn.dll" Hjlhipbc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pndjmkng.dll" Bikeni32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aceomp32.dll" Kgemahmg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Kmbfiokn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hkfoel32.dll" Ocohmc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Mjidgkog.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Afhfaddk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Aeopfl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Fdadpk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Bdojjo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Gghdaa32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Hlmchoan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nmdkcj32.dll" Lancko32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Filclgic.dll" Gmfplibd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3676 wrote to memory of 1380 3676 NEAS.de630a4bae0e6464c1a4c055cce7e53d_JC.exe 84 PID 3676 wrote to memory of 1380 3676 NEAS.de630a4bae0e6464c1a4c055cce7e53d_JC.exe 84 PID 3676 wrote to memory of 1380 3676 NEAS.de630a4bae0e6464c1a4c055cce7e53d_JC.exe 84 PID 1380 wrote to memory of 4004 1380 Fbgihaji.exe 85 PID 1380 wrote to memory of 4004 1380 Fbgihaji.exe 85 PID 1380 wrote to memory of 4004 1380 Fbgihaji.exe 85 PID 4004 wrote to memory of 3560 4004 Gidnkkpc.exe 86 PID 4004 wrote to memory of 3560 4004 Gidnkkpc.exe 86 PID 4004 wrote to memory of 3560 4004 Gidnkkpc.exe 86 PID 3560 wrote to memory of 1292 3560 Gmfplibd.exe 87 PID 3560 wrote to memory of 1292 3560 Gmfplibd.exe 87 PID 3560 wrote to memory of 1292 3560 Gmfplibd.exe 87 PID 1292 wrote to memory of 4684 1292 Gmimai32.exe 88 PID 1292 wrote to memory of 4684 1292 Gmimai32.exe 88 PID 1292 wrote to memory of 4684 1292 Gmimai32.exe 88 PID 4684 wrote to memory of 1460 4684 Hipmfjee.exe 89 PID 4684 wrote to memory of 1460 4684 Hipmfjee.exe 89 PID 4684 wrote to memory of 1460 4684 Hipmfjee.exe 89 PID 1460 wrote to memory of 4728 1460 Hefnkkkj.exe 90 PID 1460 wrote to memory of 4728 1460 Hefnkkkj.exe 90 PID 1460 wrote to memory of 4728 1460 Hefnkkkj.exe 90 PID 4728 wrote to memory of 1176 4728 Hoaojp32.exe 91 PID 4728 wrote to memory of 1176 4728 Hoaojp32.exe 91 PID 4728 wrote to memory of 1176 4728 Hoaojp32.exe 91 PID 1176 wrote to memory of 2368 1176 Hemdlj32.exe 92 PID 1176 wrote to memory of 2368 1176 Hemdlj32.exe 92 PID 1176 wrote to memory of 2368 1176 Hemdlj32.exe 92 PID 2368 wrote to memory of 2436 2368 Ibaeen32.exe 93 PID 2368 wrote to memory of 2436 2368 Ibaeen32.exe 93 PID 2368 wrote to memory of 2436 2368 Ibaeen32.exe 93 PID 2436 wrote to memory of 3100 2436 Ifomll32.exe 94 PID 2436 wrote to memory of 3100 2436 Ifomll32.exe 94 PID 2436 wrote to memory of 3100 2436 Ifomll32.exe 94 PID 3100 wrote to memory of 1304 3100 Iipfmggc.exe 95 PID 3100 wrote to memory of 1304 3100 Iipfmggc.exe 95 PID 3100 wrote to memory of 1304 3100 Iipfmggc.exe 95 PID 1304 wrote to memory of 1936 1304 Iibccgep.exe 96 PID 1304 wrote to memory of 1936 1304 Iibccgep.exe 96 PID 1304 wrote to memory of 1936 1304 Iibccgep.exe 96 PID 1936 wrote to memory of 5024 1936 Ilcldb32.exe 97 PID 1936 wrote to memory of 5024 1936 Ilcldb32.exe 97 PID 1936 wrote to memory of 5024 1936 Ilcldb32.exe 97 PID 5024 wrote to memory of 2932 5024 Jlgepanl.exe 98 PID 5024 wrote to memory of 2932 5024 Jlgepanl.exe 98 PID 5024 wrote to memory of 2932 5024 Jlgepanl.exe 98 PID 2932 wrote to memory of 3668 2932 Jepjhg32.exe 99 PID 2932 wrote to memory of 3668 2932 Jepjhg32.exe 99 PID 2932 wrote to memory of 3668 2932 Jepjhg32.exe 99 PID 3668 wrote to memory of 4504 3668 Jpenfp32.exe 100 PID 3668 wrote to memory of 4504 3668 Jpenfp32.exe 100 PID 3668 wrote to memory of 4504 3668 Jpenfp32.exe 100 PID 4504 wrote to memory of 4336 4504 Jniood32.exe 101 PID 4504 wrote to memory of 4336 4504 Jniood32.exe 101 PID 4504 wrote to memory of 4336 4504 Jniood32.exe 101 PID 4336 wrote to memory of 3120 4336 Ocgbld32.exe 102 PID 4336 wrote to memory of 3120 4336 Ocgbld32.exe 102 PID 4336 wrote to memory of 3120 4336 Ocgbld32.exe 102 PID 3120 wrote to memory of 3656 3120 Oakbehfe.exe 103 PID 3120 wrote to memory of 3656 3120 Oakbehfe.exe 103 PID 3120 wrote to memory of 3656 3120 Oakbehfe.exe 103 PID 3656 wrote to memory of 868 3656 Ojfcdnjc.exe 104 PID 3656 wrote to memory of 868 3656 Ojfcdnjc.exe 104 PID 3656 wrote to memory of 868 3656 Ojfcdnjc.exe 104 PID 868 wrote to memory of 4304 868 Ocohmc32.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.de630a4bae0e6464c1a4c055cce7e53d_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.de630a4bae0e6464c1a4c055cce7e53d_JC.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\Windows\SysWOW64\Fbgihaji.exeC:\Windows\system32\Fbgihaji.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Windows\SysWOW64\Gidnkkpc.exeC:\Windows\system32\Gidnkkpc.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Windows\SysWOW64\Gmfplibd.exeC:\Windows\system32\Gmfplibd.exe4⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Windows\SysWOW64\Gmimai32.exeC:\Windows\system32\Gmimai32.exe5⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Windows\SysWOW64\Hipmfjee.exeC:\Windows\system32\Hipmfjee.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Windows\SysWOW64\Hefnkkkj.exeC:\Windows\system32\Hefnkkkj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Windows\SysWOW64\Hoaojp32.exeC:\Windows\system32\Hoaojp32.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Windows\SysWOW64\Hemdlj32.exeC:\Windows\system32\Hemdlj32.exe9⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Windows\SysWOW64\Ibaeen32.exeC:\Windows\system32\Ibaeen32.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Windows\SysWOW64\Ifomll32.exeC:\Windows\system32\Ifomll32.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Windows\SysWOW64\Iipfmggc.exeC:\Windows\system32\Iipfmggc.exe12⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Windows\SysWOW64\Iibccgep.exeC:\Windows\system32\Iibccgep.exe13⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Windows\SysWOW64\Ilcldb32.exeC:\Windows\system32\Ilcldb32.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\SysWOW64\Jlgepanl.exeC:\Windows\system32\Jlgepanl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Windows\SysWOW64\Jepjhg32.exeC:\Windows\system32\Jepjhg32.exe16⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Windows\SysWOW64\Jpenfp32.exeC:\Windows\system32\Jpenfp32.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Windows\SysWOW64\Jniood32.exeC:\Windows\system32\Jniood32.exe18⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Windows\SysWOW64\Ocgbld32.exeC:\Windows\system32\Ocgbld32.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Windows\SysWOW64\Oakbehfe.exeC:\Windows\system32\Oakbehfe.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Windows\SysWOW64\Ojfcdnjc.exeC:\Windows\system32\Ojfcdnjc.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Windows\SysWOW64\Ocohmc32.exeC:\Windows\system32\Ocohmc32.exe22⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Windows\SysWOW64\Opeiadfg.exeC:\Windows\system32\Opeiadfg.exe23⤵
- Executes dropped EXE
PID:4304 -
C:\Windows\SysWOW64\Ppgegd32.exeC:\Windows\system32\Ppgegd32.exe24⤵
- Executes dropped EXE
PID:3036 -
C:\Windows\SysWOW64\Pmlfqh32.exeC:\Windows\system32\Pmlfqh32.exe25⤵
- Executes dropped EXE
PID:776 -
C:\Windows\SysWOW64\Pdhkcb32.exeC:\Windows\system32\Pdhkcb32.exe26⤵
- Executes dropped EXE
PID:2312 -
C:\Windows\SysWOW64\Ppolhcnm.exeC:\Windows\system32\Ppolhcnm.exe27⤵
- Executes dropped EXE
PID:3008 -
C:\Windows\SysWOW64\Pdmdnadc.exeC:\Windows\system32\Pdmdnadc.exe28⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:228 -
C:\Windows\SysWOW64\Qodeajbg.exeC:\Windows\system32\Qodeajbg.exe29⤵
- Executes dropped EXE
PID:3536 -
C:\Windows\SysWOW64\Qdaniq32.exeC:\Windows\system32\Qdaniq32.exe30⤵
- Executes dropped EXE
PID:3160 -
C:\Windows\SysWOW64\Aaenbd32.exeC:\Windows\system32\Aaenbd32.exe31⤵
- Executes dropped EXE
PID:4340 -
C:\Windows\SysWOW64\Ahaceo32.exeC:\Windows\system32\Ahaceo32.exe32⤵
- Executes dropped EXE
PID:4620 -
C:\Windows\SysWOW64\Aggpfkjj.exeC:\Windows\system32\Aggpfkjj.exe33⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:2616 -
C:\Windows\SysWOW64\Aaoaic32.exeC:\Windows\system32\Aaoaic32.exe34⤵
- Executes dropped EXE
PID:1088 -
C:\Windows\SysWOW64\Bdojjo32.exeC:\Windows\system32\Bdojjo32.exe35⤵
- Executes dropped EXE
- Modifies registry class
PID:4204 -
C:\Windows\SysWOW64\Bpfkpp32.exeC:\Windows\system32\Bpfkpp32.exe36⤵
- Executes dropped EXE
PID:3444 -
C:\Windows\SysWOW64\Bmjkic32.exeC:\Windows\system32\Bmjkic32.exe37⤵
- Executes dropped EXE
PID:4856 -
C:\Windows\SysWOW64\Bknlbhhe.exeC:\Windows\system32\Bknlbhhe.exe38⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:4000 -
C:\Windows\SysWOW64\Bhblllfo.exeC:\Windows\system32\Bhblllfo.exe39⤵
- Executes dropped EXE
PID:1108 -
C:\Windows\SysWOW64\Cggimh32.exeC:\Windows\system32\Cggimh32.exe40⤵
- Executes dropped EXE
PID:2408 -
C:\Windows\SysWOW64\Caageq32.exeC:\Windows\system32\Caageq32.exe41⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:4052 -
C:\Windows\SysWOW64\Cgnomg32.exeC:\Windows\system32\Cgnomg32.exe42⤵
- Executes dropped EXE
PID:1604 -
C:\Windows\SysWOW64\Cpfcfmlp.exeC:\Windows\system32\Cpfcfmlp.exe43⤵
- Executes dropped EXE
PID:4104 -
C:\Windows\SysWOW64\Cogddd32.exeC:\Windows\system32\Cogddd32.exe44⤵
- Executes dropped EXE
PID:2472 -
C:\Windows\SysWOW64\Dhphmj32.exeC:\Windows\system32\Dhphmj32.exe45⤵
- Executes dropped EXE
PID:3524 -
C:\Windows\SysWOW64\Dnmaea32.exeC:\Windows\system32\Dnmaea32.exe46⤵
- Executes dropped EXE
PID:5040 -
C:\Windows\SysWOW64\Ddgibkpc.exeC:\Windows\system32\Ddgibkpc.exe47⤵
- Executes dropped EXE
PID:4756 -
C:\Windows\SysWOW64\Dolmodpi.exeC:\Windows\system32\Dolmodpi.exe48⤵
- Executes dropped EXE
PID:408 -
C:\Windows\SysWOW64\Dggbcf32.exeC:\Windows\system32\Dggbcf32.exe49⤵
- Executes dropped EXE
PID:3844 -
C:\Windows\SysWOW64\Damfao32.exeC:\Windows\system32\Damfao32.exe50⤵
- Executes dropped EXE
- Modifies registry class
PID:1632 -
C:\Windows\SysWOW64\Dkekjdck.exeC:\Windows\system32\Dkekjdck.exe51⤵
- Executes dropped EXE
PID:1140 -
C:\Windows\SysWOW64\Dbocfo32.exeC:\Windows\system32\Dbocfo32.exe52⤵
- Executes dropped EXE
PID:2972 -
C:\Windows\SysWOW64\Dkhgod32.exeC:\Windows\system32\Dkhgod32.exe53⤵
- Executes dropped EXE
PID:5048 -
C:\Windows\SysWOW64\Edplhjhi.exeC:\Windows\system32\Edplhjhi.exe54⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2576 -
C:\Windows\SysWOW64\Ekjded32.exeC:\Windows\system32\Ekjded32.exe55⤵
- Executes dropped EXE
PID:4492 -
C:\Windows\SysWOW64\Ehndnh32.exeC:\Windows\system32\Ehndnh32.exe56⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2904 -
C:\Windows\SysWOW64\Eqiibjlj.exeC:\Windows\system32\Eqiibjlj.exe57⤵
- Executes dropped EXE
PID:2912 -
C:\Windows\SysWOW64\Eojiqb32.exeC:\Windows\system32\Eojiqb32.exe58⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:2844 -
C:\Windows\SysWOW64\Edgbii32.exeC:\Windows\system32\Edgbii32.exe59⤵
- Executes dropped EXE
PID:844 -
C:\Windows\SysWOW64\Eqncnj32.exeC:\Windows\system32\Eqncnj32.exe60⤵
- Executes dropped EXE
PID:2272 -
C:\Windows\SysWOW64\Fqppci32.exeC:\Windows\system32\Fqppci32.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4736 -
C:\Windows\SysWOW64\Fkfcqb32.exeC:\Windows\system32\Fkfcqb32.exe62⤵
- Executes dropped EXE
- Modifies registry class
PID:4440 -
C:\Windows\SysWOW64\Fdnhih32.exeC:\Windows\system32\Fdnhih32.exe63⤵
- Executes dropped EXE
PID:816 -
C:\Windows\SysWOW64\Foclgq32.exeC:\Windows\system32\Foclgq32.exe64⤵
- Executes dropped EXE
PID:4532 -
C:\Windows\SysWOW64\Fgoakc32.exeC:\Windows\system32\Fgoakc32.exe65⤵
- Executes dropped EXE
- Modifies registry class
PID:4628 -
C:\Windows\SysWOW64\Fbdehlip.exeC:\Windows\system32\Fbdehlip.exe66⤵
- Modifies registry class
PID:3760 -
C:\Windows\SysWOW64\Fkmjaa32.exeC:\Windows\system32\Fkmjaa32.exe67⤵
- Modifies registry class
PID:4708 -
C:\Windows\SysWOW64\Gpmomo32.exeC:\Windows\system32\Gpmomo32.exe68⤵
- Modifies registry class
PID:2652 -
C:\Windows\SysWOW64\Gghdaa32.exeC:\Windows\system32\Gghdaa32.exe69⤵
- Modifies registry class
PID:1504 -
C:\Windows\SysWOW64\Gaqhjggp.exeC:\Windows\system32\Gaqhjggp.exe70⤵PID:4220
-
C:\Windows\SysWOW64\Gngeik32.exeC:\Windows\system32\Gngeik32.exe71⤵PID:4424
-
C:\Windows\SysWOW64\Hpfbcn32.exeC:\Windows\system32\Hpfbcn32.exe72⤵PID:2964
-
C:\Windows\SysWOW64\Hlmchoan.exeC:\Windows\system32\Hlmchoan.exe73⤵
- Modifies registry class
PID:3268 -
C:\Windows\SysWOW64\Hajkqfoe.exeC:\Windows\system32\Hajkqfoe.exe74⤵
- Drops file in System32 directory
PID:1068 -
C:\Windows\SysWOW64\Hbihjifh.exeC:\Windows\system32\Hbihjifh.exe75⤵PID:1500
-
C:\Windows\SysWOW64\Hnphoj32.exeC:\Windows\system32\Hnphoj32.exe76⤵PID:420
-
C:\Windows\SysWOW64\Hifmmb32.exeC:\Windows\system32\Hifmmb32.exe77⤵PID:4136
-
C:\Windows\SysWOW64\Haaaaeim.exeC:\Windows\system32\Haaaaeim.exe78⤵PID:3340
-
C:\Windows\SysWOW64\Ilfennic.exeC:\Windows\system32\Ilfennic.exe79⤵PID:3772
-
C:\Windows\SysWOW64\Ieojgc32.exeC:\Windows\system32\Ieojgc32.exe80⤵PID:3056
-
C:\Windows\SysWOW64\Ilibdmgp.exeC:\Windows\system32\Ilibdmgp.exe81⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2056 -
C:\Windows\SysWOW64\Ibcjqgnm.exeC:\Windows\system32\Ibcjqgnm.exe82⤵PID:3984
-
C:\Windows\SysWOW64\Ihpcinld.exeC:\Windows\system32\Ihpcinld.exe83⤵PID:1420
-
C:\Windows\SysWOW64\Iahgad32.exeC:\Windows\system32\Iahgad32.exe84⤵PID:1248
-
C:\Windows\SysWOW64\Ihbponja.exeC:\Windows\system32\Ihbponja.exe85⤵PID:4380
-
C:\Windows\SysWOW64\Iajdgcab.exeC:\Windows\system32\Iajdgcab.exe86⤵
- Drops file in System32 directory
PID:3488 -
C:\Windows\SysWOW64\Ilphdlqh.exeC:\Windows\system32\Ilphdlqh.exe87⤵PID:5128
-
C:\Windows\SysWOW64\Iamamcop.exeC:\Windows\system32\Iamamcop.exe88⤵PID:5176
-
C:\Windows\SysWOW64\Jlbejloe.exeC:\Windows\system32\Jlbejloe.exe89⤵PID:5220
-
C:\Windows\SysWOW64\Jekjcaef.exeC:\Windows\system32\Jekjcaef.exe90⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5300 -
C:\Windows\SysWOW64\Jpegkj32.exeC:\Windows\system32\Jpegkj32.exe91⤵PID:5344
-
C:\Windows\SysWOW64\Jeapcq32.exeC:\Windows\system32\Jeapcq32.exe92⤵PID:5392
-
C:\Windows\SysWOW64\Jllhpkfk.exeC:\Windows\system32\Jllhpkfk.exe93⤵PID:5432
-
C:\Windows\SysWOW64\Kedlip32.exeC:\Windows\system32\Kedlip32.exe94⤵PID:5484
-
C:\Windows\SysWOW64\Kolabf32.exeC:\Windows\system32\Kolabf32.exe95⤵PID:5532
-
C:\Windows\SysWOW64\Kibeoo32.exeC:\Windows\system32\Kibeoo32.exe96⤵PID:5568
-
C:\Windows\SysWOW64\Kplmliko.exeC:\Windows\system32\Kplmliko.exe97⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5612 -
C:\Windows\SysWOW64\Kidben32.exeC:\Windows\system32\Kidben32.exe98⤵PID:5660
-
C:\Windows\SysWOW64\Koajmepf.exeC:\Windows\system32\Koajmepf.exe99⤵
- Modifies registry class
PID:5700 -
C:\Windows\SysWOW64\Kpqggh32.exeC:\Windows\system32\Kpqggh32.exe100⤵PID:5748
-
C:\Windows\SysWOW64\Kabcopmg.exeC:\Windows\system32\Kabcopmg.exe101⤵PID:5792
-
C:\Windows\SysWOW64\Khlklj32.exeC:\Windows\system32\Khlklj32.exe102⤵PID:5836
-
C:\Windows\SysWOW64\Kofdhd32.exeC:\Windows\system32\Kofdhd32.exe103⤵PID:5880
-
C:\Windows\SysWOW64\Lhnhajba.exeC:\Windows\system32\Lhnhajba.exe104⤵PID:5924
-
C:\Windows\SysWOW64\Lcclncbh.exeC:\Windows\system32\Lcclncbh.exe105⤵PID:5972
-
C:\Windows\SysWOW64\Lhqefjpo.exeC:\Windows\system32\Lhqefjpo.exe106⤵PID:6016
-
C:\Windows\SysWOW64\Ljpaqmgb.exeC:\Windows\system32\Ljpaqmgb.exe107⤵PID:6060
-
C:\Windows\SysWOW64\Lchfib32.exeC:\Windows\system32\Lchfib32.exe108⤵PID:6104
-
C:\Windows\SysWOW64\Llqjbhdc.exeC:\Windows\system32\Llqjbhdc.exe109⤵
- Drops file in System32 directory
PID:5028 -
C:\Windows\SysWOW64\Lancko32.exeC:\Windows\system32\Lancko32.exe110⤵
- Modifies registry class
PID:5164 -
C:\Windows\SysWOW64\Lhgkgijg.exeC:\Windows\system32\Lhgkgijg.exe111⤵PID:5228
-
C:\Windows\SysWOW64\Lcmodajm.exeC:\Windows\system32\Lcmodajm.exe112⤵PID:5336
-
C:\Windows\SysWOW64\Mjggal32.exeC:\Windows\system32\Mjggal32.exe113⤵PID:5412
-
C:\Windows\SysWOW64\Modpib32.exeC:\Windows\system32\Modpib32.exe114⤵PID:5472
-
C:\Windows\SysWOW64\Mjidgkog.exeC:\Windows\system32\Mjidgkog.exe115⤵
- Modifies registry class
PID:5560 -
C:\Windows\SysWOW64\Mbdiknlb.exeC:\Windows\system32\Mbdiknlb.exe116⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5624 -
C:\Windows\SysWOW64\Mjlalkmd.exeC:\Windows\system32\Mjlalkmd.exe117⤵PID:5684
-
C:\Windows\SysWOW64\Mcdeeq32.exeC:\Windows\system32\Mcdeeq32.exe118⤵PID:5768
-
C:\Windows\SysWOW64\Mhanngbl.exeC:\Windows\system32\Mhanngbl.exe119⤵PID:5848
-
C:\Windows\SysWOW64\Mbibfm32.exeC:\Windows\system32\Mbibfm32.exe120⤵
- Modifies registry class
PID:5908 -
C:\Windows\SysWOW64\Mhckcgpj.exeC:\Windows\system32\Mhckcgpj.exe121⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:5984
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-