Analysis
-
max time kernel
138s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
04/11/2023, 10:31
Behavioral task
behavioral1
Sample
NEAS.9630ea12bdec72a4e0fa1c8782604820_JC.exe
Resource
win7-20231023-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.9630ea12bdec72a4e0fa1c8782604820_JC.exe
Resource
win10v2004-20231023-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
NEAS.9630ea12bdec72a4e0fa1c8782604820_JC.exe
-
Size
120KB
-
MD5
9630ea12bdec72a4e0fa1c8782604820
-
SHA1
35c68149393f3476e29036c95a00a575bc9403f6
-
SHA256
68e4e21fbddaade34200c46ea4467dacf108bfa4b201974d00936e1f6fb8ed9a
-
SHA512
763b5d60ca93890368cc7b56204c1337072efc196aa498aab8f8ce87d48c33716ad977589d3b86fcecc0b9870ed33ed0287a6d3a9e2ae9cf511208cb5d344ad6
-
SSDEEP
3072:GPiUIprU2ZuNd1vWobeS203H/6TC+qF1SsB1bw4AVRrd9:QilrU2ZO3GS9C81NBy9
Score
10/10
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hgebnc32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gpjfng32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Epjfehbd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Locnlmoe.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cpmqoqbp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hnblmnfa.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hebkid32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Joobdfei.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Opjponbf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Opjponbf.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Acdeneij.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gjgmpkfl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ppphkq32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bknidbhi.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bfghlhmd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lcealh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Joobdfei.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Nfjeej32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nbbnbemf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Hldgkiki.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ibojgikg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Abodhpic.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Gjhdkajh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Hgnlmdcp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Hkgnalep.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bnobfn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Glompi32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Edlann32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Poeahaib.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hmjmnpmb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nmmqgo32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Biolkc32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bajqpe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Nfchjddj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Amblpikl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Nqgiel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ninafj32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nalgbi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Gjmmfq32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Piepnfnj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jjoeoedo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ijdnka32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Iapjeq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Pnmjomlg.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kaajfe32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gfnnel32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Loiong32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Lbqdmodg.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Epgpajdp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Mnmmmbll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Qpkppbho.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Clihcm32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cofndo32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dokqfl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Knbinhfl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cnjbbl32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kkhidaeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Nbepdfnc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Njceqili.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hnfehm32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cefega32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Bcpdidol.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jhdcmf32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pbahgbfc.exe -
Malware Backdoor - Berbew 64 IoCs
Berbew is a malware infection classified as a 'backdoor' Trojan. This malicious program's primary function is to cause chain infections - it can download/install additional malware such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/files/0x0006000000022cce-6.dat family_berbew behavioral2/files/0x0006000000022cce-8.dat family_berbew behavioral2/files/0x0006000000022cd0-14.dat family_berbew behavioral2/files/0x0006000000022cd0-16.dat family_berbew behavioral2/files/0x0006000000022cd2-22.dat family_berbew behavioral2/files/0x0006000000022cd2-24.dat family_berbew behavioral2/files/0x0006000000022cd6-30.dat family_berbew behavioral2/files/0x0006000000022cd6-32.dat family_berbew behavioral2/files/0x0006000000022cd9-38.dat family_berbew behavioral2/files/0x0006000000022cd9-40.dat family_berbew behavioral2/files/0x0006000000022cdb-46.dat family_berbew behavioral2/files/0x0006000000022cdb-48.dat family_berbew behavioral2/files/0x0006000000022cdd-54.dat family_berbew behavioral2/files/0x0006000000022cdd-56.dat family_berbew behavioral2/files/0x0007000000022cd8-57.dat family_berbew behavioral2/files/0x0007000000022cd8-62.dat family_berbew behavioral2/files/0x0007000000022cd8-64.dat family_berbew behavioral2/files/0x0006000000022ce0-70.dat family_berbew behavioral2/files/0x0006000000022ce0-72.dat family_berbew behavioral2/files/0x0006000000022ce2-79.dat family_berbew behavioral2/files/0x0006000000022ce2-78.dat family_berbew behavioral2/files/0x0006000000022ce4-85.dat family_berbew behavioral2/files/0x0006000000022ce4-88.dat family_berbew behavioral2/files/0x0006000000022ce6-89.dat family_berbew behavioral2/files/0x0006000000022ce6-94.dat family_berbew behavioral2/files/0x0006000000022ce6-96.dat family_berbew behavioral2/files/0x0006000000022ce8-102.dat family_berbew behavioral2/files/0x0006000000022ce8-104.dat family_berbew behavioral2/files/0x0006000000022cea-110.dat family_berbew behavioral2/files/0x0006000000022cea-112.dat family_berbew behavioral2/files/0x0006000000022cec-113.dat family_berbew behavioral2/files/0x0006000000022cec-118.dat family_berbew behavioral2/files/0x0006000000022cec-120.dat family_berbew behavioral2/files/0x0006000000022cee-126.dat family_berbew behavioral2/files/0x0006000000022cee-128.dat family_berbew behavioral2/files/0x0006000000022cf0-133.dat family_berbew behavioral2/files/0x0006000000022cf0-136.dat family_berbew behavioral2/files/0x0006000000022cf2-137.dat family_berbew behavioral2/files/0x0006000000022cf2-142.dat family_berbew behavioral2/files/0x0006000000022cf2-144.dat family_berbew behavioral2/files/0x0006000000022cf4-150.dat family_berbew behavioral2/files/0x0006000000022cf4-152.dat family_berbew behavioral2/files/0x0006000000022cf6-158.dat family_berbew behavioral2/files/0x0006000000022cf6-160.dat family_berbew behavioral2/files/0x0006000000022cf8-161.dat family_berbew behavioral2/files/0x0006000000022cf8-166.dat family_berbew behavioral2/files/0x0006000000022cf8-168.dat family_berbew behavioral2/files/0x0006000000022cfa-174.dat family_berbew behavioral2/files/0x0006000000022cfa-175.dat family_berbew behavioral2/files/0x0006000000022cfc-182.dat family_berbew behavioral2/files/0x0006000000022cfc-184.dat family_berbew behavioral2/files/0x0006000000022cfe-190.dat family_berbew behavioral2/files/0x0006000000022cfe-191.dat family_berbew behavioral2/files/0x0006000000022d00-198.dat family_berbew behavioral2/files/0x0006000000022d00-200.dat family_berbew behavioral2/files/0x0006000000022d02-206.dat family_berbew behavioral2/files/0x0006000000022d02-207.dat family_berbew behavioral2/files/0x0006000000022d05-214.dat family_berbew behavioral2/files/0x0006000000022d05-216.dat family_berbew behavioral2/files/0x0006000000022d07-217.dat family_berbew behavioral2/files/0x0006000000022d07-222.dat family_berbew behavioral2/files/0x0006000000022d07-224.dat family_berbew behavioral2/files/0x0006000000022d09-230.dat family_berbew behavioral2/files/0x0006000000022d09-232.dat family_berbew -
Executes dropped EXE 64 IoCs
pid Process 4156 Hnkhjdle.exe 3892 Iabglnco.exe 4208 Jeolckne.exe 4520 Klmnkdal.exe 1776 Klbgfc32.exe 2344 Klgqabib.exe 2132 Laffpi32.exe 2056 Moalil32.exe 536 Mdpagc32.exe 2004 Mohbjkgp.exe 3748 Mkocol32.exe 2280 Ndlacapp.exe 2312 Nbbnbemf.exe 3884 Ofdqcc32.exe 1796 Odljjo32.exe 2120 Qifbll32.exe 4876 Aeopfl32.exe 3204 Apkjddke.exe 1552 Bimach32.exe 3340 Cifdjg32.exe 336 Dedkogqm.exe 1204 Dcmedk32.exe 1312 Edlann32.exe 3304 Epeohn32.exe 2192 Ellpmolj.exe 384 Ecidpiad.exe 4292 Fpoaom32.exe 4984 Fjlpbb32.exe 4256 Gddqejni.exe 4884 Ggdigekj.exe 2188 Gmdoel32.exe 1616 Hgnlmdcp.exe 3804 Hnmnengg.exe 1416 Hgebnc32.exe 1612 Ifjoop32.exe 3116 Icqmncof.exe 2204 Jffokn32.exe 1632 Jjfdfl32.exe 4252 Kebodc32.exe 2788 Kaioidkh.exe 2384 Knbinhfl.exe 3152 Loiong32.exe 4348 Ldhdlnli.exe 3792 Loniiflo.exe 5036 Mmcfkc32.exe 4588 Mgbpdgap.exe 3316 Nonbqd32.exe 3724 Oeopnmoa.exe 2980 Ohdbkh32.exe 3168 Ogjpld32.exe 2576 Pkhhbbck.exe 2772 Poeahaib.exe 1164 Pnmjomlg.exe 3296 Qnbdjl32.exe 3468 Afnefieo.exe 512 Bfghlhmd.exe 3372 Bpfcelml.exe 4816 Ceehcc32.exe 4976 Chfaenfb.exe 3944 Cpbbak32.exe 4680 Dolinf32.exe 3684 Dfemdcba.exe 5072 Ebokodfc.exe 1184 Eedmlo32.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Dpeefhck.dll Jffokn32.exe File opened for modification C:\Windows\SysWOW64\Ciqmjkno.exe Cgaqphgl.exe File created C:\Windows\SysWOW64\Onccdj32.dll Djpfbahm.exe File created C:\Windows\SysWOW64\Iacepmik.exe Iemdkl32.exe File opened for modification C:\Windows\SysWOW64\Ppnbpg32.exe Oefamoma.exe File created C:\Windows\SysWOW64\Hdaajd32.exe Hmginjki.exe File created C:\Windows\SysWOW64\Okbglp32.dll Algbfo32.exe File opened for modification C:\Windows\SysWOW64\Jeolckne.exe Iabglnco.exe File created C:\Windows\SysWOW64\Fkanbk32.dll Fjnjjlog.exe File opened for modification C:\Windows\SysWOW64\Hfniikha.exe Glchjedc.exe File created C:\Windows\SysWOW64\Iecmlknh.dll Cjabgm32.exe File opened for modification C:\Windows\SysWOW64\Dqbadf32.exe Dgjmkqke.exe File opened for modification C:\Windows\SysWOW64\Nbepdfnc.exe Nkkggl32.exe File created C:\Windows\SysWOW64\Ipldpo32.exe Ifcpgiji.exe File created C:\Windows\SysWOW64\Cmmbgpmq.dll Nbjhph32.exe File opened for modification C:\Windows\SysWOW64\Mgbpdgap.exe Mmcfkc32.exe File created C:\Windows\SysWOW64\Hfpjlgdl.dll Hpnhoqmi.exe File created C:\Windows\SysWOW64\Jbccbi32.exe Jikojcaa.exe File created C:\Windows\SysWOW64\Kekdfb32.dll Amgekh32.exe File created C:\Windows\SysWOW64\Hgcccmnm.dll Mkbcbp32.exe File created C:\Windows\SysWOW64\Midign32.dll Hjhfgi32.exe File created C:\Windows\SysWOW64\Odaiodbp.exe Okiefn32.exe File created C:\Windows\SysWOW64\Ojfbof32.dll Lbqdmodg.exe File opened for modification C:\Windows\SysWOW64\Mkbcbp32.exe Majoikof.exe File opened for modification C:\Windows\SysWOW64\Dedkogqm.exe Cifdjg32.exe File created C:\Windows\SysWOW64\Mdpagc32.exe Moalil32.exe File created C:\Windows\SysWOW64\Nbjhlcmm.dll Dedkogqm.exe File created C:\Windows\SysWOW64\Ohcakk32.dll Fgcjea32.exe File created C:\Windows\SysWOW64\Phmnfp32.exe Pncanhaf.exe File opened for modification C:\Windows\SysWOW64\Hnkhjdle.exe NEAS.9630ea12bdec72a4e0fa1c8782604820_JC.exe File opened for modification C:\Windows\SysWOW64\Ihlgan32.exe Iocchhof.exe File opened for modification C:\Windows\SysWOW64\Lmcldhfp.exe Kjnihnmd.exe File created C:\Windows\SysWOW64\Gaccbaeq.exe Flaaok32.exe File created C:\Windows\SysWOW64\Hldlmc32.dll Jdgjgh32.exe File created C:\Windows\SysWOW64\Epgpajdp.exe Eodclj32.exe File opened for modification C:\Windows\SysWOW64\Kpepmkjl.exe Kgmlde32.exe File opened for modification C:\Windows\SysWOW64\Cifdjg32.exe Bimach32.exe File created C:\Windows\SysWOW64\Dmabgl32.dll Apkjddke.exe File created C:\Windows\SysWOW64\Epeohn32.exe Edlann32.exe File opened for modification C:\Windows\SysWOW64\Gmdoel32.exe Ggdigekj.exe File created C:\Windows\SysWOW64\Hhlnjpdi.exe Hkgnalep.exe File created C:\Windows\SysWOW64\Lmcldhfp.exe Kjnihnmd.exe File opened for modification C:\Windows\SysWOW64\Nmmqgo32.exe Nfchjddj.exe File created C:\Windows\SysWOW64\Abodhpic.exe Amblpikl.exe File created C:\Windows\SysWOW64\Fncnpk32.dll Jeolckne.exe File opened for modification C:\Windows\SysWOW64\Pjalpida.exe Peddhb32.exe File opened for modification C:\Windows\SysWOW64\Gfnnel32.exe Gjgmpkfl.exe File created C:\Windows\SysWOW64\Mkepgp32.exe Mpoljg32.exe File created C:\Windows\SysWOW64\Cgaqphgl.exe Bgodjiio.exe File opened for modification C:\Windows\SysWOW64\Ongijo32.exe Oabiak32.exe File opened for modification C:\Windows\SysWOW64\Ejiqom32.exe Ejgdim32.exe File opened for modification C:\Windows\SysWOW64\Hjhfgi32.exe Hpbajp32.exe File created C:\Windows\SysWOW64\Hchbkneg.dll Amdiei32.exe File created C:\Windows\SysWOW64\Hknhkonb.dll Ciqmjkno.exe File created C:\Windows\SysWOW64\Minbgdmm.dll Kadnfkji.exe File opened for modification C:\Windows\SysWOW64\Benjkijd.exe Bcmqin32.exe File opened for modification C:\Windows\SysWOW64\Dhlhcl32.exe Dlegokbe.exe File created C:\Windows\SysWOW64\Abkejc32.dll Bpfcelml.exe File created C:\Windows\SysWOW64\Clnkig32.dll Ifihdi32.exe File created C:\Windows\SysWOW64\Ehpidjlh.dll Hhbdko32.exe File opened for modification C:\Windows\SysWOW64\Lcbmlbig.exe Lbcabo32.exe File opened for modification C:\Windows\SysWOW64\Ccipelcf.exe Cjlbag32.exe File created C:\Windows\SysWOW64\Efgehe32.exe Emoaopnf.exe File created C:\Windows\SysWOW64\Qoecli32.dll Ppkopail.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 9120 8884 WerFault.exe 526 -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Lngmhm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Aqbfaa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Kmhlijpm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjlobkie.dll" Eljknl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Palkgi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jpfbco32.dll" Qfanbpjg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ipilln32.dll" Fakfglhm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Hpgkeodo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Lkpnec32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nbjhlcmm.dll" Dedkogqm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nlaakbkm.dll" Phpklp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Loaafnah.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ofnhfbjl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ldhdlnli.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Jdgjgh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Oflkqc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Mcdepd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Peddhb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cfbknl32.dll" Icqmncof.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ngjdppnh.dll" Almifk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Dlcaca32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ebcfnmcb.dll" Fcikhace.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mmdgbd32.dll" Lcbikd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Lmcldhfp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Bcmqin32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Gjhdkajh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Jknocljn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cqoecpej.dll" Gablgk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jgcnomaa.dll" Klgqabib.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Odljjo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ppnbpg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Epgpajdp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Hlfcqh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Hfacai32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Njjmil32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifoglp32.dll" Qifbll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mogimj32.dll" Libido32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Hnfehm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Dlegokbe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfdqdf32.dll" Hppedpkf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Jfffcf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ofdqcc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Glchjedc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Gpgihh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Jhdlbp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Djeopjhd.dll" Cgaqphgl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Enakjn32.dll" Olidijjf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dnpiedch.dll" Hnblmnfa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Fbiooolb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Iapjeq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehcnpj32.dll" Djalnkbo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cjakkgha.dll" Amblpikl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qnoeacho.dll" Kaajfe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Hnmnengg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Kebodc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pqdako32.dll" Lmcldhfp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Hfacai32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Gfcgpkhk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Gfcgpkhk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Hppedpkf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Kgmlde32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Cjabgm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pnfbpbof.dll" Lilbdcfe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Dokqfl32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3452 wrote to memory of 4156 3452 NEAS.9630ea12bdec72a4e0fa1c8782604820_JC.exe 89 PID 3452 wrote to memory of 4156 3452 NEAS.9630ea12bdec72a4e0fa1c8782604820_JC.exe 89 PID 3452 wrote to memory of 4156 3452 NEAS.9630ea12bdec72a4e0fa1c8782604820_JC.exe 89 PID 4156 wrote to memory of 3892 4156 Hnkhjdle.exe 90 PID 4156 wrote to memory of 3892 4156 Hnkhjdle.exe 90 PID 4156 wrote to memory of 3892 4156 Hnkhjdle.exe 90 PID 3892 wrote to memory of 4208 3892 Iabglnco.exe 91 PID 3892 wrote to memory of 4208 3892 Iabglnco.exe 91 PID 3892 wrote to memory of 4208 3892 Iabglnco.exe 91 PID 4208 wrote to memory of 4520 4208 Jeolckne.exe 92 PID 4208 wrote to memory of 4520 4208 Jeolckne.exe 92 PID 4208 wrote to memory of 4520 4208 Jeolckne.exe 92 PID 4520 wrote to memory of 1776 4520 Klmnkdal.exe 93 PID 4520 wrote to memory of 1776 4520 Klmnkdal.exe 93 PID 4520 wrote to memory of 1776 4520 Klmnkdal.exe 93 PID 1776 wrote to memory of 2344 1776 Klbgfc32.exe 94 PID 1776 wrote to memory of 2344 1776 Klbgfc32.exe 94 PID 1776 wrote to memory of 2344 1776 Klbgfc32.exe 94 PID 2344 wrote to memory of 2132 2344 Klgqabib.exe 95 PID 2344 wrote to memory of 2132 2344 Klgqabib.exe 95 PID 2344 wrote to memory of 2132 2344 Klgqabib.exe 95 PID 2132 wrote to memory of 2056 2132 Laffpi32.exe 96 PID 2132 wrote to memory of 2056 2132 Laffpi32.exe 96 PID 2132 wrote to memory of 2056 2132 Laffpi32.exe 96 PID 2056 wrote to memory of 536 2056 Moalil32.exe 97 PID 2056 wrote to memory of 536 2056 Moalil32.exe 97 PID 2056 wrote to memory of 536 2056 Moalil32.exe 97 PID 536 wrote to memory of 2004 536 Mdpagc32.exe 98 PID 536 wrote to memory of 2004 536 Mdpagc32.exe 98 PID 536 wrote to memory of 2004 536 Mdpagc32.exe 98 PID 2004 wrote to memory of 3748 2004 Mohbjkgp.exe 99 PID 2004 wrote to memory of 3748 2004 Mohbjkgp.exe 99 PID 2004 wrote to memory of 3748 2004 Mohbjkgp.exe 99 PID 3748 wrote to memory of 2280 3748 Mkocol32.exe 100 PID 3748 wrote to memory of 2280 3748 Mkocol32.exe 100 PID 3748 wrote to memory of 2280 3748 Mkocol32.exe 100 PID 2280 wrote to memory of 2312 2280 Ndlacapp.exe 101 PID 2280 wrote to memory of 2312 2280 Ndlacapp.exe 101 PID 2280 wrote to memory of 2312 2280 Ndlacapp.exe 101 PID 2312 wrote to memory of 3884 2312 Nbbnbemf.exe 102 PID 2312 wrote to memory of 3884 2312 Nbbnbemf.exe 102 PID 2312 wrote to memory of 3884 2312 Nbbnbemf.exe 102 PID 3884 wrote to memory of 1796 3884 Ofdqcc32.exe 103 PID 3884 wrote to memory of 1796 3884 Ofdqcc32.exe 103 PID 3884 wrote to memory of 1796 3884 Ofdqcc32.exe 103 PID 1796 wrote to memory of 2120 1796 Odljjo32.exe 104 PID 1796 wrote to memory of 2120 1796 Odljjo32.exe 104 PID 1796 wrote to memory of 2120 1796 Odljjo32.exe 104 PID 2120 wrote to memory of 4876 2120 Qifbll32.exe 105 PID 2120 wrote to memory of 4876 2120 Qifbll32.exe 105 PID 2120 wrote to memory of 4876 2120 Qifbll32.exe 105 PID 4876 wrote to memory of 3204 4876 Aeopfl32.exe 106 PID 4876 wrote to memory of 3204 4876 Aeopfl32.exe 106 PID 4876 wrote to memory of 3204 4876 Aeopfl32.exe 106 PID 3204 wrote to memory of 1552 3204 Apkjddke.exe 107 PID 3204 wrote to memory of 1552 3204 Apkjddke.exe 107 PID 3204 wrote to memory of 1552 3204 Apkjddke.exe 107 PID 1552 wrote to memory of 3340 1552 Bimach32.exe 108 PID 1552 wrote to memory of 3340 1552 Bimach32.exe 108 PID 1552 wrote to memory of 3340 1552 Bimach32.exe 108 PID 3340 wrote to memory of 336 3340 Cifdjg32.exe 109 PID 3340 wrote to memory of 336 3340 Cifdjg32.exe 109 PID 3340 wrote to memory of 336 3340 Cifdjg32.exe 109 PID 336 wrote to memory of 1204 336 Dedkogqm.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.9630ea12bdec72a4e0fa1c8782604820_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.9630ea12bdec72a4e0fa1c8782604820_JC.exe"1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Windows\SysWOW64\Hnkhjdle.exeC:\Windows\system32\Hnkhjdle.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Windows\SysWOW64\Iabglnco.exeC:\Windows\system32\Iabglnco.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Windows\SysWOW64\Jeolckne.exeC:\Windows\system32\Jeolckne.exe4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Windows\SysWOW64\Klmnkdal.exeC:\Windows\system32\Klmnkdal.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Windows\SysWOW64\Klbgfc32.exeC:\Windows\system32\Klbgfc32.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Windows\SysWOW64\Klgqabib.exeC:\Windows\system32\Klgqabib.exe7⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Windows\SysWOW64\Laffpi32.exeC:\Windows\system32\Laffpi32.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Windows\SysWOW64\Moalil32.exeC:\Windows\system32\Moalil32.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Windows\SysWOW64\Mdpagc32.exeC:\Windows\system32\Mdpagc32.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Windows\SysWOW64\Mohbjkgp.exeC:\Windows\system32\Mohbjkgp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Windows\SysWOW64\Mkocol32.exeC:\Windows\system32\Mkocol32.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Windows\SysWOW64\Ndlacapp.exeC:\Windows\system32\Ndlacapp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Windows\SysWOW64\Nbbnbemf.exeC:\Windows\system32\Nbbnbemf.exe14⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Windows\SysWOW64\Ofdqcc32.exeC:\Windows\system32\Ofdqcc32.exe15⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Windows\SysWOW64\Odljjo32.exeC:\Windows\system32\Odljjo32.exe16⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Windows\SysWOW64\Qifbll32.exeC:\Windows\system32\Qifbll32.exe17⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Windows\SysWOW64\Aeopfl32.exeC:\Windows\system32\Aeopfl32.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Windows\SysWOW64\Apkjddke.exeC:\Windows\system32\Apkjddke.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Windows\SysWOW64\Bimach32.exeC:\Windows\system32\Bimach32.exe20⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Windows\SysWOW64\Cifdjg32.exeC:\Windows\system32\Cifdjg32.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Windows\SysWOW64\Dedkogqm.exeC:\Windows\system32\Dedkogqm.exe22⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:336 -
C:\Windows\SysWOW64\Dcmedk32.exeC:\Windows\system32\Dcmedk32.exe23⤵
- Executes dropped EXE
PID:1204 -
C:\Windows\SysWOW64\Edlann32.exeC:\Windows\system32\Edlann32.exe24⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:1312 -
C:\Windows\SysWOW64\Epeohn32.exeC:\Windows\system32\Epeohn32.exe25⤵
- Executes dropped EXE
PID:3304 -
C:\Windows\SysWOW64\Ellpmolj.exeC:\Windows\system32\Ellpmolj.exe26⤵
- Executes dropped EXE
PID:2192 -
C:\Windows\SysWOW64\Ecidpiad.exeC:\Windows\system32\Ecidpiad.exe27⤵
- Executes dropped EXE
PID:384 -
C:\Windows\SysWOW64\Fpoaom32.exeC:\Windows\system32\Fpoaom32.exe28⤵
- Executes dropped EXE
PID:4292 -
C:\Windows\SysWOW64\Fjlpbb32.exeC:\Windows\system32\Fjlpbb32.exe29⤵
- Executes dropped EXE
PID:4984 -
C:\Windows\SysWOW64\Gddqejni.exeC:\Windows\system32\Gddqejni.exe30⤵
- Executes dropped EXE
PID:4256 -
C:\Windows\SysWOW64\Ggdigekj.exeC:\Windows\system32\Ggdigekj.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4884 -
C:\Windows\SysWOW64\Gmdoel32.exeC:\Windows\system32\Gmdoel32.exe32⤵
- Executes dropped EXE
PID:2188 -
C:\Windows\SysWOW64\Hgnlmdcp.exeC:\Windows\system32\Hgnlmdcp.exe33⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1616 -
C:\Windows\SysWOW64\Hnmnengg.exeC:\Windows\system32\Hnmnengg.exe34⤵
- Executes dropped EXE
- Modifies registry class
PID:3804 -
C:\Windows\SysWOW64\Hgebnc32.exeC:\Windows\system32\Hgebnc32.exe35⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1416 -
C:\Windows\SysWOW64\Ifjoop32.exeC:\Windows\system32\Ifjoop32.exe36⤵
- Executes dropped EXE
PID:1612 -
C:\Windows\SysWOW64\Icqmncof.exeC:\Windows\system32\Icqmncof.exe37⤵
- Executes dropped EXE
- Modifies registry class
PID:3116 -
C:\Windows\SysWOW64\Jffokn32.exeC:\Windows\system32\Jffokn32.exe38⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2204 -
C:\Windows\SysWOW64\Jjfdfl32.exeC:\Windows\system32\Jjfdfl32.exe39⤵
- Executes dropped EXE
PID:1632 -
C:\Windows\SysWOW64\Kebodc32.exeC:\Windows\system32\Kebodc32.exe40⤵
- Executes dropped EXE
- Modifies registry class
PID:4252 -
C:\Windows\SysWOW64\Kaioidkh.exeC:\Windows\system32\Kaioidkh.exe41⤵
- Executes dropped EXE
PID:2788 -
C:\Windows\SysWOW64\Knbinhfl.exeC:\Windows\system32\Knbinhfl.exe42⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2384 -
C:\Windows\SysWOW64\Loiong32.exeC:\Windows\system32\Loiong32.exe43⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:3152 -
C:\Windows\SysWOW64\Ldhdlnli.exeC:\Windows\system32\Ldhdlnli.exe44⤵
- Executes dropped EXE
- Modifies registry class
PID:4348 -
C:\Windows\SysWOW64\Loniiflo.exeC:\Windows\system32\Loniiflo.exe45⤵
- Executes dropped EXE
PID:3792 -
C:\Windows\SysWOW64\Mmcfkc32.exeC:\Windows\system32\Mmcfkc32.exe46⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5036 -
C:\Windows\SysWOW64\Mgbpdgap.exeC:\Windows\system32\Mgbpdgap.exe47⤵
- Executes dropped EXE
PID:4588 -
C:\Windows\SysWOW64\Nonbqd32.exeC:\Windows\system32\Nonbqd32.exe48⤵
- Executes dropped EXE
PID:3316 -
C:\Windows\SysWOW64\Oeopnmoa.exeC:\Windows\system32\Oeopnmoa.exe49⤵
- Executes dropped EXE
PID:3724 -
C:\Windows\SysWOW64\Ohdbkh32.exeC:\Windows\system32\Ohdbkh32.exe50⤵
- Executes dropped EXE
PID:2980 -
C:\Windows\SysWOW64\Ogjpld32.exeC:\Windows\system32\Ogjpld32.exe51⤵
- Executes dropped EXE
PID:3168 -
C:\Windows\SysWOW64\Pkhhbbck.exeC:\Windows\system32\Pkhhbbck.exe52⤵
- Executes dropped EXE
PID:2576 -
C:\Windows\SysWOW64\Poeahaib.exeC:\Windows\system32\Poeahaib.exe53⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2772 -
C:\Windows\SysWOW64\Pnmjomlg.exeC:\Windows\system32\Pnmjomlg.exe54⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1164 -
C:\Windows\SysWOW64\Qnbdjl32.exeC:\Windows\system32\Qnbdjl32.exe55⤵
- Executes dropped EXE
PID:3296 -
C:\Windows\SysWOW64\Afnefieo.exeC:\Windows\system32\Afnefieo.exe56⤵
- Executes dropped EXE
PID:3468 -
C:\Windows\SysWOW64\Bfghlhmd.exeC:\Windows\system32\Bfghlhmd.exe57⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:512 -
C:\Windows\SysWOW64\Bpfcelml.exeC:\Windows\system32\Bpfcelml.exe58⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3372 -
C:\Windows\SysWOW64\Ceehcc32.exeC:\Windows\system32\Ceehcc32.exe59⤵
- Executes dropped EXE
PID:4816 -
C:\Windows\SysWOW64\Chfaenfb.exeC:\Windows\system32\Chfaenfb.exe60⤵
- Executes dropped EXE
PID:4976 -
C:\Windows\SysWOW64\Cpbbak32.exeC:\Windows\system32\Cpbbak32.exe61⤵
- Executes dropped EXE
PID:3944 -
C:\Windows\SysWOW64\Dolinf32.exeC:\Windows\system32\Dolinf32.exe62⤵
- Executes dropped EXE
PID:4680 -
C:\Windows\SysWOW64\Dfemdcba.exeC:\Windows\system32\Dfemdcba.exe63⤵
- Executes dropped EXE
PID:3684 -
C:\Windows\SysWOW64\Ebokodfc.exeC:\Windows\system32\Ebokodfc.exe64⤵
- Executes dropped EXE
PID:5072 -
C:\Windows\SysWOW64\Eedmlo32.exeC:\Windows\system32\Eedmlo32.exe65⤵
- Executes dropped EXE
PID:1184 -
C:\Windows\SysWOW64\Fgcjea32.exeC:\Windows\system32\Fgcjea32.exe66⤵
- Drops file in System32 directory
PID:640 -
C:\Windows\SysWOW64\Fhefmjlp.exeC:\Windows\system32\Fhefmjlp.exe67⤵PID:2516
-
C:\Windows\SysWOW64\Fcodfa32.exeC:\Windows\system32\Fcodfa32.exe68⤵PID:212
-
C:\Windows\SysWOW64\Fikihlmj.exeC:\Windows\system32\Fikihlmj.exe69⤵PID:3784
-
C:\Windows\SysWOW64\Gojnfb32.exeC:\Windows\system32\Gojnfb32.exe70⤵PID:724
-
C:\Windows\SysWOW64\Gchflq32.exeC:\Windows\system32\Gchflq32.exe71⤵PID:4656
-
C:\Windows\SysWOW64\Glchjedc.exeC:\Windows\system32\Glchjedc.exe72⤵
- Drops file in System32 directory
- Modifies registry class
PID:2196 -
C:\Windows\SysWOW64\Hfniikha.exeC:\Windows\system32\Hfniikha.exe73⤵PID:3972
-
C:\Windows\SysWOW64\Hcipcnac.exeC:\Windows\system32\Hcipcnac.exe74⤵PID:3800
-
C:\Windows\SysWOW64\Hladlc32.exeC:\Windows\system32\Hladlc32.exe75⤵PID:2036
-
C:\Windows\SysWOW64\Ifihdi32.exeC:\Windows\system32\Ifihdi32.exe76⤵
- Drops file in System32 directory
PID:4564 -
C:\Windows\SysWOW64\Igkadlcd.exeC:\Windows\system32\Igkadlcd.exe77⤵PID:4388
-
C:\Windows\SysWOW64\Jckeokan.exeC:\Windows\system32\Jckeokan.exe78⤵PID:3048
-
C:\Windows\SysWOW64\Jflnafno.exeC:\Windows\system32\Jflnafno.exe79⤵PID:3044
-
C:\Windows\SysWOW64\Kfaglf32.exeC:\Windows\system32\Kfaglf32.exe80⤵PID:3228
-
C:\Windows\SysWOW64\Kpilekqj.exeC:\Windows\system32\Kpilekqj.exe81⤵PID:2060
-
C:\Windows\SysWOW64\Kiaqnagj.exeC:\Windows\system32\Kiaqnagj.exe82⤵PID:4456
-
C:\Windows\SysWOW64\Kfeagefd.exeC:\Windows\system32\Kfeagefd.exe83⤵PID:1516
-
C:\Windows\SysWOW64\Kciaqi32.exeC:\Windows\system32\Kciaqi32.exe84⤵PID:1248
-
C:\Windows\SysWOW64\Kanbjn32.exeC:\Windows\system32\Kanbjn32.exe85⤵PID:4236
-
C:\Windows\SysWOW64\Liifnp32.exeC:\Windows\system32\Liifnp32.exe86⤵PID:3100
-
C:\Windows\SysWOW64\Labkempb.exeC:\Windows\system32\Labkempb.exe87⤵PID:2284
-
C:\Windows\SysWOW64\Ljmmcbdp.exeC:\Windows\system32\Ljmmcbdp.exe88⤵PID:4188
-
C:\Windows\SysWOW64\Lcealh32.exeC:\Windows\system32\Lcealh32.exe89⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1260 -
C:\Windows\SysWOW64\Libido32.exeC:\Windows\system32\Libido32.exe90⤵
- Modifies registry class
PID:5172 -
C:\Windows\SysWOW64\Mjafoapj.exeC:\Windows\system32\Mjafoapj.exe91⤵PID:5232
-
C:\Windows\SysWOW64\Njmejp32.exeC:\Windows\system32\Njmejp32.exe92⤵PID:5276
-
C:\Windows\SysWOW64\Nplkhf32.exeC:\Windows\system32\Nplkhf32.exe93⤵PID:5320
-
C:\Windows\SysWOW64\Nkboeobh.exeC:\Windows\system32\Nkboeobh.exe94⤵PID:5360
-
C:\Windows\SysWOW64\Nalgbi32.exeC:\Windows\system32\Nalgbi32.exe95⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5404 -
C:\Windows\SysWOW64\Nkdlkope.exeC:\Windows\system32\Nkdlkope.exe96⤵PID:5452
-
C:\Windows\SysWOW64\Niihlkdm.exeC:\Windows\system32\Niihlkdm.exe97⤵PID:5496
-
C:\Windows\SysWOW64\Npcaie32.exeC:\Windows\system32\Npcaie32.exe98⤵PID:5536
-
C:\Windows\SysWOW64\Okiefn32.exeC:\Windows\system32\Okiefn32.exe99⤵
- Drops file in System32 directory
PID:5584 -
C:\Windows\SysWOW64\Odaiodbp.exeC:\Windows\system32\Odaiodbp.exe100⤵PID:5632
-
C:\Windows\SysWOW64\Phfhfa32.exeC:\Windows\system32\Phfhfa32.exe101⤵PID:5676
-
C:\Windows\SysWOW64\Pncanhaf.exeC:\Windows\system32\Pncanhaf.exe102⤵
- Drops file in System32 directory
PID:5724 -
C:\Windows\SysWOW64\Phmnfp32.exeC:\Windows\system32\Phmnfp32.exe103⤵PID:5768
-
C:\Windows\SysWOW64\Phpklp32.exeC:\Windows\system32\Phpklp32.exe104⤵
- Modifies registry class
PID:5812 -
C:\Windows\SysWOW64\Qpkppbho.exeC:\Windows\system32\Qpkppbho.exe105⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5856 -
C:\Windows\SysWOW64\Ahgamo32.exeC:\Windows\system32\Ahgamo32.exe106⤵PID:5896
-
C:\Windows\SysWOW64\Aqbfaa32.exeC:\Windows\system32\Aqbfaa32.exe107⤵
- Modifies registry class
PID:5944 -
C:\Windows\SysWOW64\Bqkigp32.exeC:\Windows\system32\Bqkigp32.exe108⤵PID:5996
-
C:\Windows\SysWOW64\Bqnemp32.exeC:\Windows\system32\Bqnemp32.exe109⤵PID:6040
-
C:\Windows\SysWOW64\Bbbkbbkg.exeC:\Windows\system32\Bbbkbbkg.exe110⤵PID:6084
-
C:\Windows\SysWOW64\Bgodjiio.exeC:\Windows\system32\Bgodjiio.exe111⤵
- Drops file in System32 directory
PID:6120 -
C:\Windows\SysWOW64\Cgaqphgl.exeC:\Windows\system32\Cgaqphgl.exe112⤵
- Drops file in System32 directory
- Modifies registry class
PID:2128 -
C:\Windows\SysWOW64\Ciqmjkno.exeC:\Windows\system32\Ciqmjkno.exe113⤵
- Drops file in System32 directory
PID:5200 -
C:\Windows\SysWOW64\Cbiabq32.exeC:\Windows\system32\Cbiabq32.exe114⤵PID:5264
-
C:\Windows\SysWOW64\Cbknhqbl.exeC:\Windows\system32\Cbknhqbl.exe115⤵PID:5344
-
C:\Windows\SysWOW64\Ciefek32.exeC:\Windows\system32\Ciefek32.exe116⤵PID:5416
-
C:\Windows\SysWOW64\Cnboma32.exeC:\Windows\system32\Cnboma32.exe117⤵PID:5484
-
C:\Windows\SysWOW64\Cigcjj32.exeC:\Windows\system32\Cigcjj32.exe118⤵PID:5548
-
C:\Windows\SysWOW64\Djpfbahm.exeC:\Windows\system32\Djpfbahm.exe119⤵
- Drops file in System32 directory
PID:5596 -
C:\Windows\SysWOW64\Deejpjgc.exeC:\Windows\system32\Deejpjgc.exe120⤵PID:5656
-
C:\Windows\SysWOW64\Ebpqjmpd.exeC:\Windows\system32\Ebpqjmpd.exe121⤵PID:5736
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-