Analysis
-
max time kernel
203s -
max time network
200s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
11/11/2023, 05:50
Behavioral task
behavioral1
Sample
NEAS.721b90d70ac6e6c3e785e42c87cc5d00.exe
Resource
win7-20231020-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.721b90d70ac6e6c3e785e42c87cc5d00.exe
Resource
win10v2004-20231020-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
NEAS.721b90d70ac6e6c3e785e42c87cc5d00.exe
-
Size
240KB
-
MD5
721b90d70ac6e6c3e785e42c87cc5d00
-
SHA1
10722ccd159eed5bbd87e6fb0955f3c56790394a
-
SHA256
9717e35388283658ab07ad96ebed8d19973829c2cfc6a2b8e33dc87389d5568b
-
SHA512
c5d9fe26af0b6cfb04772d298b44b4b236e81cc7555d8ee3e3a5c07b5a874489c4277de71aed88a1cb0de9b6ce8b1b4e7b3122ea323916d277a5c5450485deed
-
SSDEEP
6144:j1O+9oyA9GRdst34quvo5EcAJN+SYSUZCb6M3W8DStQUkA1FiHwSD:j1O+9S9ymt3jx5tycSly8DSUA1YHVD
Score
10/10
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iaifbg32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fmkqknci.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oenljoji.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mhhcgk32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Miipochm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ioeineap.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Opnbjk32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pmgmonma.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Jpfnqc32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ldnbdnlc.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Alplfpbp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Hfoflj32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hoaocf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Gggfme32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ppepkmhi.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Onmfcb32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Agdcja32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cfhhml32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hjoeoo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Opfedb32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iaiddajo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Qhfcbfdl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Apgqie32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eljchpnl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pkfjmfld.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Kphdma32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Hmioicek.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gcqhcgqi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Bmbngd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Bhhiocdg.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Niqnli32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Clgkmm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Clqncl32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lnldeg32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ocbhjjqn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gqagkjne.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hmlbij32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Mfmphg32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Afeban32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ppkopail.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Oiagcg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Cpcila32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Amibqhed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Hfajlp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Appaangd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mqdcga32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Gganjh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ggicbe32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ffcedd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Fanbll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Jmnomk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Jcanfakf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Lnjgpgkf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Pdlbpldg.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gmpcmkaa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Kgbljkca.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Mhenpk32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oiagcg32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hhhdpd32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jpfnqc32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Clqncl32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nhfohifo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ohhlnidl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Lnldeg32.exe -
Malware Backdoor - Berbew 64 IoCs
Berbew is a malware infection classified as a 'backdoor' Trojan. This malicious program's primary function is to cause chain infections - it can download/install additional malware such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/memory/1212-0-0x0000000000400000-0x0000000000442000-memory.dmp family_berbew behavioral2/files/0x0007000000022e2a-6.dat family_berbew behavioral2/memory/3508-7-0x0000000000400000-0x0000000000442000-memory.dmp family_berbew behavioral2/files/0x0007000000022e2a-8.dat family_berbew behavioral2/files/0x0006000000022e37-14.dat family_berbew behavioral2/files/0x0006000000022e37-15.dat family_berbew behavioral2/memory/1640-16-0x0000000000400000-0x0000000000442000-memory.dmp family_berbew behavioral2/files/0x0006000000022e39-22.dat family_berbew behavioral2/memory/3676-23-0x0000000000400000-0x0000000000442000-memory.dmp family_berbew behavioral2/files/0x0006000000022e39-24.dat family_berbew behavioral2/files/0x0006000000022e3b-30.dat family_berbew behavioral2/memory/112-31-0x0000000000400000-0x0000000000442000-memory.dmp family_berbew behavioral2/files/0x0006000000022e3b-32.dat family_berbew behavioral2/files/0x0006000000022e3d-38.dat family_berbew behavioral2/memory/2076-40-0x0000000000400000-0x0000000000442000-memory.dmp family_berbew behavioral2/files/0x0006000000022e3d-39.dat family_berbew behavioral2/files/0x0006000000022e3f-46.dat family_berbew behavioral2/files/0x0006000000022e3f-48.dat family_berbew behavioral2/memory/4092-47-0x0000000000400000-0x0000000000442000-memory.dmp family_berbew behavioral2/files/0x0006000000022e41-54.dat family_berbew behavioral2/files/0x0006000000022e41-56.dat family_berbew behavioral2/memory/1788-55-0x0000000000400000-0x0000000000442000-memory.dmp family_berbew behavioral2/files/0x0006000000022e43-63.dat family_berbew behavioral2/memory/4868-64-0x0000000000400000-0x0000000000442000-memory.dmp family_berbew behavioral2/files/0x0006000000022e43-62.dat family_berbew behavioral2/files/0x0006000000022e45-70.dat family_berbew behavioral2/memory/4732-71-0x0000000000400000-0x0000000000442000-memory.dmp family_berbew behavioral2/files/0x0006000000022e45-72.dat family_berbew behavioral2/files/0x0008000000022e2e-78.dat family_berbew behavioral2/files/0x0008000000022e2e-80.dat family_berbew behavioral2/memory/4272-79-0x0000000000400000-0x0000000000442000-memory.dmp family_berbew behavioral2/files/0x0006000000022e49-86.dat family_berbew behavioral2/memory/3288-87-0x0000000000400000-0x0000000000442000-memory.dmp family_berbew behavioral2/files/0x0006000000022e49-88.dat family_berbew behavioral2/files/0x0006000000022e4b-95.dat family_berbew behavioral2/files/0x0006000000022e4b-94.dat family_berbew behavioral2/memory/3824-100-0x0000000000400000-0x0000000000442000-memory.dmp family_berbew behavioral2/files/0x0006000000022e4d-102.dat family_berbew behavioral2/memory/4356-103-0x0000000000400000-0x0000000000442000-memory.dmp family_berbew behavioral2/files/0x0006000000022e4d-104.dat family_berbew behavioral2/files/0x0006000000022e4f-110.dat family_berbew behavioral2/memory/3020-112-0x0000000000400000-0x0000000000442000-memory.dmp family_berbew behavioral2/files/0x0006000000022e4f-111.dat family_berbew behavioral2/files/0x0006000000022e51-119.dat family_berbew behavioral2/files/0x0006000000022e51-118.dat family_berbew behavioral2/memory/884-124-0x0000000000400000-0x0000000000442000-memory.dmp family_berbew behavioral2/files/0x0006000000022e54-126.dat family_berbew behavioral2/memory/1664-127-0x0000000000400000-0x0000000000442000-memory.dmp family_berbew behavioral2/files/0x0006000000022e54-128.dat family_berbew behavioral2/files/0x0006000000022e56-134.dat family_berbew behavioral2/files/0x0006000000022e56-135.dat family_berbew behavioral2/memory/4208-136-0x0000000000400000-0x0000000000442000-memory.dmp family_berbew behavioral2/files/0x0006000000022e58-142.dat family_berbew behavioral2/memory/376-143-0x0000000000400000-0x0000000000442000-memory.dmp family_berbew behavioral2/files/0x0006000000022e58-144.dat family_berbew behavioral2/files/0x0006000000022e5a-145.dat family_berbew behavioral2/files/0x0006000000022e5a-150.dat family_berbew behavioral2/memory/3920-152-0x0000000000400000-0x0000000000442000-memory.dmp family_berbew behavioral2/files/0x0006000000022e5a-151.dat family_berbew behavioral2/files/0x0006000000022e5c-158.dat family_berbew behavioral2/memory/2504-160-0x0000000000400000-0x0000000000442000-memory.dmp family_berbew behavioral2/files/0x0006000000022e5c-159.dat family_berbew behavioral2/files/0x0006000000022e5e-166.dat family_berbew behavioral2/files/0x0006000000022e5e-168.dat family_berbew -
Executes dropped EXE 64 IoCs
pid Process 3508 Aijlgkjq.exe 1640 Aealll32.exe 3676 Apgqie32.exe 112 Apimodmh.exe 2076 Ammnhilb.exe 4092 Afeban32.exe 1788 Bblcfo32.exe 4868 Bldgoeog.exe 4732 Bihhhi32.exe 4272 Bmfqngcg.exe 3288 Bbcignbo.exe 3824 Bcbeqaia.exe 4356 Blnjecfl.exe 3020 Cplckbmc.exe 884 Cmpcdfll.exe 1664 Cfhhml32.exe 4208 Cfjeckpj.exe 376 Cpcila32.exe 3920 Dmifkecb.exe 2504 Dmnpfd32.exe 4520 Didqkeeq.exe 1660 Dmbiackg.exe 4872 Egknji32.exe 4036 Edoncm32.exe 1628 Eljchpnl.exe 4724 Enllgbcl.exe 3176 Flaiho32.exe 1320 Flcfnn32.exe 4248 Fjgfgbek.exe 904 Fgkfqgce.exe 1372 Fcbgfhii.exe 3108 Fdadpk32.exe 4484 Gnjhhpgl.exe 3872 Ggbmafnm.exe 1864 Gdfmkjlg.exe 3832 Gfgjbb32.exe 2884 Gqmnpk32.exe 4120 Gggfme32.exe 4100 Ggicbe32.exe 2528 Gqagkjne.exe 4976 Hnehdo32.exe 2124 Hgnlmdcp.exe 2428 Hdbmfhbi.exe 4436 Hjoeoo32.exe 3732 Hddilh32.exe 2572 Hjabdo32.exe 2828 Hcifmdeo.exe 4560 Iqdmghnp.exe 3576 Ijmapm32.exe 1892 Iebfmfdg.exe 4580 Iaifbg32.exe 4820 Icgbob32.exe 952 Jakchf32.exe 1668 Elgohj32.exe 2768 Mmbopm32.exe 2952 Ckcbaf32.exe 3668 Nfcoekhe.exe 4012 Ofdhlh32.exe 5060 Omnqhbap.exe 2304 Oplmdnpc.exe 3588 Offeahhp.exe 3196 Pidamcgd.exe 2344 Pdjeklfj.exe 4128 Pkdngf32.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Lgfkaf32.dll Koekpi32.exe File created C:\Windows\SysWOW64\Eoeeekec.dll Kgbljkca.exe File created C:\Windows\SysWOW64\Obdbqm32.exe Opfedb32.exe File created C:\Windows\SysWOW64\Jdhllo32.dll Ngeaej32.exe File opened for modification C:\Windows\SysWOW64\Bblcfo32.exe Afeban32.exe File opened for modification C:\Windows\SysWOW64\Gqmnpk32.exe Gfgjbb32.exe File created C:\Windows\SysWOW64\Pnfkihaf.dll Hjabdo32.exe File created C:\Windows\SysWOW64\Pnhqicgm.dll Joikdk32.exe File opened for modification C:\Windows\SysWOW64\Iaiddajo.exe Ijolhg32.exe File created C:\Windows\SysWOW64\Bhcpbp32.dll Jmnomk32.exe File created C:\Windows\SysWOW64\Fdadpk32.exe Fcbgfhii.exe File created C:\Windows\SysWOW64\Mmbopm32.exe Elgohj32.exe File created C:\Windows\SysWOW64\Pdhklgnf.exe Pagbklae.exe File created C:\Windows\SysWOW64\Mpqkfn32.exe Mmbojb32.exe File opened for modification C:\Windows\SysWOW64\Ndcmgk32.exe Nmiejamq.exe File created C:\Windows\SysWOW64\Amibqhed.exe Qpmfklbq.exe File created C:\Windows\SysWOW64\Negoaj32.exe Nnmfdpni.exe File opened for modification C:\Windows\SysWOW64\Oiagcg32.exe Obgofmjb.exe File created C:\Windows\SysWOW64\Fdpabflk.dll Ngikpjml.exe File created C:\Windows\SysWOW64\Ngfcnfol.exe Naijfoad.exe File opened for modification C:\Windows\SysWOW64\Apgqie32.exe Aealll32.exe File created C:\Windows\SysWOW64\Dpkgac32.dll Dmifkecb.exe File created C:\Windows\SysWOW64\Coilnkdh.dll Ngekmf32.exe File created C:\Windows\SysWOW64\Hikfbeod.exe Hcnnjoam.exe File opened for modification C:\Windows\SysWOW64\Miipochm.exe Mhhcgk32.exe File opened for modification C:\Windows\SysWOW64\Nfomng32.exe Mfmphg32.exe File created C:\Windows\SysWOW64\Ogbbjd32.exe Omjnao32.exe File opened for modification C:\Windows\SysWOW64\Ckcbaf32.exe Mmbopm32.exe File created C:\Windows\SysWOW64\Hjdcfp32.exe Gmpcmkaa.exe File created C:\Windows\SysWOW64\Ofnnhj32.dll Imbhiial.exe File created C:\Windows\SysWOW64\Kekcjc32.dll Mniafbfn.exe File opened for modification C:\Windows\SysWOW64\Apmhbf32.exe Agdcja32.exe File opened for modification C:\Windows\SysWOW64\Offeahhp.exe Oplmdnpc.exe File created C:\Windows\SysWOW64\Pidamcgd.exe Offeahhp.exe File created C:\Windows\SysWOW64\Pmgmonma.exe Oanodnip.exe File opened for modification C:\Windows\SysWOW64\Mhhcgk32.exe Mpqkfn32.exe File opened for modification C:\Windows\SysWOW64\Lnjgpgkf.exe Lgpocm32.exe File opened for modification C:\Windows\SysWOW64\Bpodhf32.exe Akblpo32.exe File opened for modification C:\Windows\SysWOW64\Kgbljkca.exe Kphdma32.exe File created C:\Windows\SysWOW64\Picchg32.exe Ppkopail.exe File created C:\Windows\SysWOW64\Bdmbfb32.dll Negoaj32.exe File created C:\Windows\SysWOW64\Eknpbiaa.dll Cpjmok32.exe File opened for modification C:\Windows\SysWOW64\Hfemkdbm.exe Idnfal32.exe File opened for modification C:\Windows\SysWOW64\Fjcjpb32.exe Fpnfbi32.exe File created C:\Windows\SysWOW64\Ikbphn32.exe Imnoni32.exe File created C:\Windows\SysWOW64\Mnaghb32.exe Mhenpk32.exe File created C:\Windows\SysWOW64\Fpikla32.dll Idnfal32.exe File opened for modification C:\Windows\SysWOW64\Omnqhbap.exe Ofdhlh32.exe File opened for modification C:\Windows\SysWOW64\Mqhmbqlh.exe Mgphjk32.exe File created C:\Windows\SysWOW64\Mildeifp.dll Aofjhd32.exe File opened for modification C:\Windows\SysWOW64\Jdhpba32.exe Jolhjj32.exe File opened for modification C:\Windows\SysWOW64\Kdpfbp32.exe Kkgbjkac.exe File created C:\Windows\SysWOW64\Benoof32.dll Ijolhg32.exe File opened for modification C:\Windows\SysWOW64\Bihhhi32.exe Bldgoeog.exe File created C:\Windows\SysWOW64\Nqdfipld.dll Ecblbi32.exe File opened for modification C:\Windows\SysWOW64\Lnanadfi.exe Lnoalehl.exe File created C:\Windows\SysWOW64\Ldkfno32.exe Lnanadfi.exe File created C:\Windows\SysWOW64\Abcgii32.exe Alioloje.exe File created C:\Windows\SysWOW64\Clafagah.dll Lnjgpgkf.exe File created C:\Windows\SysWOW64\Nblipdgh.dll Fcbgfhii.exe File created C:\Windows\SysWOW64\Qpmfklbq.exe Qibmoa32.exe File created C:\Windows\SysWOW64\Klohlg32.dll Enfcjb32.exe File created C:\Windows\SysWOW64\Bocjdiol.exe Bhibgo32.exe File opened for modification C:\Windows\SysWOW64\Hmkiqn32.exe Cbbnim32.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Npjpkn32.dll" Flaiho32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Abdbef32.dll" Coqnmkpd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Oooodcci.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Mlqjlmjp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ggjgofkd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Naoplkpo.dll" Nnmfdpni.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifogknee.dll" Hegmec32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Nfomng32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Hjoeoo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Obdbqm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Abcgii32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Mffjgh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Hhhdpd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nflbhm32.dll" Gganjh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmlngkld.dll" Mnmmmbll.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Offeahhp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Oijqbh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Bhblfpng.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Obhnaa32.dll" Iojbid32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Apmhbf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Opfjmg32.dll" Fqiiamjp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fqpldehd.dll" Mhpeelnd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Oijqbh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Apimodmh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ongijo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Hfacai32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Himjjb32.dll" Apmhbf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oenkifmo.dll" Bpaanfce.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bjhkmnga.dll" Ndcmgk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Bmfqngcg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Clafagah.dll" Lnjgpgkf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oljpld32.dll" Ocbhjjqn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Bcbeqaia.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nhpoieid.dll" Eopjakkg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Kdfmcobk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Hoaocf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjhcpe32.dll" Qhfcbfdl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pbdbhepf.dll" Lchfch32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Dmbiackg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lhjafhlf.dll" Ppepkmhi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Opfedb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Dmnpfd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ffihqa32.dll" Kphdma32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Aofjhd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Igfhbb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgjcohao.dll" Nkmmbe32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Eglkmh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Mmcnlc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ljbnpbkl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Gggfme32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Nbdijpjh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpikla32.dll" Idnfal32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dojahakp.dll" Bmfqngcg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Gdfmkjlg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Niqnli32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Naijfoad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jgmhaapa.dll" Fjgfgbek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Mlqjlmjp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dpkgac32.dll" Dmifkecb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Loecgfjf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ljmlmh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Domkqq32.dll" Hdbmfhbi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Hmlbij32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Obdbqm32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1212 wrote to memory of 3508 1212 NEAS.721b90d70ac6e6c3e785e42c87cc5d00.exe 87 PID 1212 wrote to memory of 3508 1212 NEAS.721b90d70ac6e6c3e785e42c87cc5d00.exe 87 PID 1212 wrote to memory of 3508 1212 NEAS.721b90d70ac6e6c3e785e42c87cc5d00.exe 87 PID 3508 wrote to memory of 1640 3508 Aijlgkjq.exe 88 PID 3508 wrote to memory of 1640 3508 Aijlgkjq.exe 88 PID 3508 wrote to memory of 1640 3508 Aijlgkjq.exe 88 PID 1640 wrote to memory of 3676 1640 Aealll32.exe 89 PID 1640 wrote to memory of 3676 1640 Aealll32.exe 89 PID 1640 wrote to memory of 3676 1640 Aealll32.exe 89 PID 3676 wrote to memory of 112 3676 Apgqie32.exe 90 PID 3676 wrote to memory of 112 3676 Apgqie32.exe 90 PID 3676 wrote to memory of 112 3676 Apgqie32.exe 90 PID 112 wrote to memory of 2076 112 Apimodmh.exe 91 PID 112 wrote to memory of 2076 112 Apimodmh.exe 91 PID 112 wrote to memory of 2076 112 Apimodmh.exe 91 PID 2076 wrote to memory of 4092 2076 Ammnhilb.exe 92 PID 2076 wrote to memory of 4092 2076 Ammnhilb.exe 92 PID 2076 wrote to memory of 4092 2076 Ammnhilb.exe 92 PID 4092 wrote to memory of 1788 4092 Afeban32.exe 93 PID 4092 wrote to memory of 1788 4092 Afeban32.exe 93 PID 4092 wrote to memory of 1788 4092 Afeban32.exe 93 PID 1788 wrote to memory of 4868 1788 Bblcfo32.exe 94 PID 1788 wrote to memory of 4868 1788 Bblcfo32.exe 94 PID 1788 wrote to memory of 4868 1788 Bblcfo32.exe 94 PID 4868 wrote to memory of 4732 4868 Bldgoeog.exe 95 PID 4868 wrote to memory of 4732 4868 Bldgoeog.exe 95 PID 4868 wrote to memory of 4732 4868 Bldgoeog.exe 95 PID 4732 wrote to memory of 4272 4732 Bihhhi32.exe 96 PID 4732 wrote to memory of 4272 4732 Bihhhi32.exe 96 PID 4732 wrote to memory of 4272 4732 Bihhhi32.exe 96 PID 4272 wrote to memory of 3288 4272 Bmfqngcg.exe 97 PID 4272 wrote to memory of 3288 4272 Bmfqngcg.exe 97 PID 4272 wrote to memory of 3288 4272 Bmfqngcg.exe 97 PID 3288 wrote to memory of 3824 3288 Bbcignbo.exe 98 PID 3288 wrote to memory of 3824 3288 Bbcignbo.exe 98 PID 3288 wrote to memory of 3824 3288 Bbcignbo.exe 98 PID 3824 wrote to memory of 4356 3824 Bcbeqaia.exe 99 PID 3824 wrote to memory of 4356 3824 Bcbeqaia.exe 99 PID 3824 wrote to memory of 4356 3824 Bcbeqaia.exe 99 PID 4356 wrote to memory of 3020 4356 Blnjecfl.exe 100 PID 4356 wrote to memory of 3020 4356 Blnjecfl.exe 100 PID 4356 wrote to memory of 3020 4356 Blnjecfl.exe 100 PID 3020 wrote to memory of 884 3020 Cplckbmc.exe 102 PID 3020 wrote to memory of 884 3020 Cplckbmc.exe 102 PID 3020 wrote to memory of 884 3020 Cplckbmc.exe 102 PID 884 wrote to memory of 1664 884 Cmpcdfll.exe 103 PID 884 wrote to memory of 1664 884 Cmpcdfll.exe 103 PID 884 wrote to memory of 1664 884 Cmpcdfll.exe 103 PID 1664 wrote to memory of 4208 1664 Cfhhml32.exe 104 PID 1664 wrote to memory of 4208 1664 Cfhhml32.exe 104 PID 1664 wrote to memory of 4208 1664 Cfhhml32.exe 104 PID 4208 wrote to memory of 376 4208 Cfjeckpj.exe 105 PID 4208 wrote to memory of 376 4208 Cfjeckpj.exe 105 PID 4208 wrote to memory of 376 4208 Cfjeckpj.exe 105 PID 376 wrote to memory of 3920 376 Cpcila32.exe 106 PID 376 wrote to memory of 3920 376 Cpcila32.exe 106 PID 376 wrote to memory of 3920 376 Cpcila32.exe 106 PID 3920 wrote to memory of 2504 3920 Dmifkecb.exe 107 PID 3920 wrote to memory of 2504 3920 Dmifkecb.exe 107 PID 3920 wrote to memory of 2504 3920 Dmifkecb.exe 107 PID 2504 wrote to memory of 4520 2504 Dmnpfd32.exe 109 PID 2504 wrote to memory of 4520 2504 Dmnpfd32.exe 109 PID 2504 wrote to memory of 4520 2504 Dmnpfd32.exe 109 PID 4520 wrote to memory of 1660 4520 Didqkeeq.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.721b90d70ac6e6c3e785e42c87cc5d00.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.721b90d70ac6e6c3e785e42c87cc5d00.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Windows\SysWOW64\Aijlgkjq.exeC:\Windows\system32\Aijlgkjq.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Windows\SysWOW64\Aealll32.exeC:\Windows\system32\Aealll32.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Windows\SysWOW64\Apgqie32.exeC:\Windows\system32\Apgqie32.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\Windows\SysWOW64\Apimodmh.exeC:\Windows\system32\Apimodmh.exe5⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:112 -
C:\Windows\SysWOW64\Ammnhilb.exeC:\Windows\system32\Ammnhilb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Windows\SysWOW64\Afeban32.exeC:\Windows\system32\Afeban32.exe7⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Windows\SysWOW64\Bblcfo32.exeC:\Windows\system32\Bblcfo32.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Windows\SysWOW64\Bldgoeog.exeC:\Windows\system32\Bldgoeog.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Windows\SysWOW64\Bihhhi32.exeC:\Windows\system32\Bihhhi32.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Windows\SysWOW64\Bmfqngcg.exeC:\Windows\system32\Bmfqngcg.exe11⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Windows\SysWOW64\Bbcignbo.exeC:\Windows\system32\Bbcignbo.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Windows\SysWOW64\Bcbeqaia.exeC:\Windows\system32\Bcbeqaia.exe13⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Windows\SysWOW64\Blnjecfl.exeC:\Windows\system32\Blnjecfl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Windows\SysWOW64\Cplckbmc.exeC:\Windows\system32\Cplckbmc.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Windows\SysWOW64\Cmpcdfll.exeC:\Windows\system32\Cmpcdfll.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Windows\SysWOW64\Cfhhml32.exeC:\Windows\system32\Cfhhml32.exe17⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Windows\SysWOW64\Cfjeckpj.exeC:\Windows\system32\Cfjeckpj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Windows\SysWOW64\Cpcila32.exeC:\Windows\system32\Cpcila32.exe19⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:376 -
C:\Windows\SysWOW64\Dmifkecb.exeC:\Windows\system32\Dmifkecb.exe20⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Windows\SysWOW64\Dmnpfd32.exeC:\Windows\system32\Dmnpfd32.exe21⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Windows\SysWOW64\Didqkeeq.exeC:\Windows\system32\Didqkeeq.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Windows\SysWOW64\Dmbiackg.exeC:\Windows\system32\Dmbiackg.exe23⤵
- Executes dropped EXE
- Modifies registry class
PID:1660 -
C:\Windows\SysWOW64\Egknji32.exeC:\Windows\system32\Egknji32.exe24⤵
- Executes dropped EXE
PID:4872 -
C:\Windows\SysWOW64\Edoncm32.exeC:\Windows\system32\Edoncm32.exe25⤵
- Executes dropped EXE
PID:4036 -
C:\Windows\SysWOW64\Eljchpnl.exeC:\Windows\system32\Eljchpnl.exe26⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1628 -
C:\Windows\SysWOW64\Enllgbcl.exeC:\Windows\system32\Enllgbcl.exe27⤵
- Executes dropped EXE
PID:4724 -
C:\Windows\SysWOW64\Flaiho32.exeC:\Windows\system32\Flaiho32.exe28⤵
- Executes dropped EXE
- Modifies registry class
PID:3176 -
C:\Windows\SysWOW64\Flcfnn32.exeC:\Windows\system32\Flcfnn32.exe29⤵
- Executes dropped EXE
PID:1320 -
C:\Windows\SysWOW64\Fjgfgbek.exeC:\Windows\system32\Fjgfgbek.exe30⤵
- Executes dropped EXE
- Modifies registry class
PID:4248 -
C:\Windows\SysWOW64\Fgkfqgce.exeC:\Windows\system32\Fgkfqgce.exe31⤵
- Executes dropped EXE
PID:904 -
C:\Windows\SysWOW64\Fcbgfhii.exeC:\Windows\system32\Fcbgfhii.exe32⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1372 -
C:\Windows\SysWOW64\Fdadpk32.exeC:\Windows\system32\Fdadpk32.exe33⤵
- Executes dropped EXE
PID:3108 -
C:\Windows\SysWOW64\Gnjhhpgl.exeC:\Windows\system32\Gnjhhpgl.exe34⤵
- Executes dropped EXE
PID:4484 -
C:\Windows\SysWOW64\Ggbmafnm.exeC:\Windows\system32\Ggbmafnm.exe35⤵
- Executes dropped EXE
PID:3872 -
C:\Windows\SysWOW64\Gdfmkjlg.exeC:\Windows\system32\Gdfmkjlg.exe36⤵
- Executes dropped EXE
- Modifies registry class
PID:1864 -
C:\Windows\SysWOW64\Gfgjbb32.exeC:\Windows\system32\Gfgjbb32.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3832 -
C:\Windows\SysWOW64\Gqmnpk32.exeC:\Windows\system32\Gqmnpk32.exe38⤵
- Executes dropped EXE
PID:2884 -
C:\Windows\SysWOW64\Gggfme32.exeC:\Windows\system32\Gggfme32.exe39⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:4120 -
C:\Windows\SysWOW64\Ggicbe32.exeC:\Windows\system32\Ggicbe32.exe40⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:4100 -
C:\Windows\SysWOW64\Gqagkjne.exeC:\Windows\system32\Gqagkjne.exe41⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2528 -
C:\Windows\SysWOW64\Hnehdo32.exeC:\Windows\system32\Hnehdo32.exe42⤵
- Executes dropped EXE
PID:4976 -
C:\Windows\SysWOW64\Hgnlmdcp.exeC:\Windows\system32\Hgnlmdcp.exe43⤵
- Executes dropped EXE
PID:2124 -
C:\Windows\SysWOW64\Hdbmfhbi.exeC:\Windows\system32\Hdbmfhbi.exe44⤵
- Executes dropped EXE
- Modifies registry class
PID:2428 -
C:\Windows\SysWOW64\Hjoeoo32.exeC:\Windows\system32\Hjoeoo32.exe45⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:4436 -
C:\Windows\SysWOW64\Hddilh32.exeC:\Windows\system32\Hddilh32.exe46⤵
- Executes dropped EXE
PID:3732 -
C:\Windows\SysWOW64\Hjabdo32.exeC:\Windows\system32\Hjabdo32.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2572 -
C:\Windows\SysWOW64\Hcifmdeo.exeC:\Windows\system32\Hcifmdeo.exe48⤵
- Executes dropped EXE
PID:2828 -
C:\Windows\SysWOW64\Iqdmghnp.exeC:\Windows\system32\Iqdmghnp.exe49⤵
- Executes dropped EXE
PID:4560 -
C:\Windows\SysWOW64\Ijmapm32.exeC:\Windows\system32\Ijmapm32.exe50⤵
- Executes dropped EXE
PID:3576 -
C:\Windows\SysWOW64\Iebfmfdg.exeC:\Windows\system32\Iebfmfdg.exe51⤵
- Executes dropped EXE
PID:1892 -
C:\Windows\SysWOW64\Iaifbg32.exeC:\Windows\system32\Iaifbg32.exe52⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:4580 -
C:\Windows\SysWOW64\Icgbob32.exeC:\Windows\system32\Icgbob32.exe53⤵
- Executes dropped EXE
PID:4820 -
C:\Windows\SysWOW64\Jakchf32.exeC:\Windows\system32\Jakchf32.exe54⤵
- Executes dropped EXE
PID:952 -
C:\Windows\SysWOW64\Elgohj32.exeC:\Windows\system32\Elgohj32.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1668 -
C:\Windows\SysWOW64\Mmbopm32.exeC:\Windows\system32\Mmbopm32.exe56⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2768 -
C:\Windows\SysWOW64\Ckcbaf32.exeC:\Windows\system32\Ckcbaf32.exe57⤵
- Executes dropped EXE
PID:2952 -
C:\Windows\SysWOW64\Nfcoekhe.exeC:\Windows\system32\Nfcoekhe.exe58⤵
- Executes dropped EXE
PID:3668 -
C:\Windows\SysWOW64\Ofdhlh32.exeC:\Windows\system32\Ofdhlh32.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4012 -
C:\Windows\SysWOW64\Omnqhbap.exeC:\Windows\system32\Omnqhbap.exe60⤵
- Executes dropped EXE
PID:5060 -
C:\Windows\SysWOW64\Oplmdnpc.exeC:\Windows\system32\Oplmdnpc.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2304 -
C:\Windows\SysWOW64\Offeahhp.exeC:\Windows\system32\Offeahhp.exe62⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:3588 -
C:\Windows\SysWOW64\Pidamcgd.exeC:\Windows\system32\Pidamcgd.exe63⤵
- Executes dropped EXE
PID:3196 -
C:\Windows\SysWOW64\Pdjeklfj.exeC:\Windows\system32\Pdjeklfj.exe64⤵
- Executes dropped EXE
PID:2344 -
C:\Windows\SysWOW64\Pkdngf32.exeC:\Windows\system32\Pkdngf32.exe65⤵
- Executes dropped EXE
PID:4128 -
C:\Windows\SysWOW64\Pdlbpldg.exeC:\Windows\system32\Pdlbpldg.exe66⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3864 -
C:\Windows\SysWOW64\Pkfjmfld.exeC:\Windows\system32\Pkfjmfld.exe67⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2432 -
C:\Windows\SysWOW64\Ppccemjk.exeC:\Windows\system32\Ppccemjk.exe68⤵PID:4544
-
C:\Windows\SysWOW64\Pgmkbg32.exeC:\Windows\system32\Pgmkbg32.exe69⤵PID:4856
-
C:\Windows\SysWOW64\Ppepkmhi.exeC:\Windows\system32\Ppepkmhi.exe70⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:3328 -
C:\Windows\SysWOW64\Qibmoa32.exeC:\Windows\system32\Qibmoa32.exe71⤵
- Drops file in System32 directory
PID:1824 -
C:\Windows\SysWOW64\Qpmfklbq.exeC:\Windows\system32\Qpmfklbq.exe72⤵
- Drops file in System32 directory
PID:232 -
C:\Windows\SysWOW64\Amibqhed.exeC:\Windows\system32\Amibqhed.exe73⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2176 -
C:\Windows\SysWOW64\Eopjakkg.exeC:\Windows\system32\Eopjakkg.exe74⤵
- Modifies registry class
PID:4084 -
C:\Windows\SysWOW64\Eqpfknbj.exeC:\Windows\system32\Eqpfknbj.exe75⤵PID:4596
-
C:\Windows\SysWOW64\Ecnbgian.exeC:\Windows\system32\Ecnbgian.exe76⤵PID:392
-
C:\Windows\SysWOW64\Eflocepa.exeC:\Windows\system32\Eflocepa.exe77⤵PID:2936
-
C:\Windows\SysWOW64\Eqbcqnph.exeC:\Windows\system32\Eqbcqnph.exe78⤵PID:5048
-
C:\Windows\SysWOW64\Eglkmh32.exeC:\Windows\system32\Eglkmh32.exe79⤵
- Modifies registry class
PID:3340 -
C:\Windows\SysWOW64\Enfcjb32.exeC:\Windows\system32\Enfcjb32.exe80⤵
- Drops file in System32 directory
PID:3744 -
C:\Windows\SysWOW64\Ecblbi32.exeC:\Windows\system32\Ecblbi32.exe81⤵
- Drops file in System32 directory
PID:3832 -
C:\Windows\SysWOW64\Fmkqknci.exeC:\Windows\system32\Fmkqknci.exe82⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3084 -
C:\Windows\SysWOW64\Ffcedd32.exeC:\Windows\system32\Ffcedd32.exe83⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4176 -
C:\Windows\SysWOW64\Fqiiamjp.exeC:\Windows\system32\Fqiiamjp.exe84⤵
- Modifies registry class
PID:1304 -
C:\Windows\SysWOW64\Fgcang32.exeC:\Windows\system32\Fgcang32.exe85⤵PID:2612
-
C:\Windows\SysWOW64\Fnmjkahi.exeC:\Windows\system32\Fnmjkahi.exe86⤵PID:5072
-
C:\Windows\SysWOW64\Fpnfbi32.exeC:\Windows\system32\Fpnfbi32.exe87⤵
- Drops file in System32 directory
PID:3536 -
C:\Windows\SysWOW64\Fjcjpb32.exeC:\Windows\system32\Fjcjpb32.exe88⤵PID:1320
-
C:\Windows\SysWOW64\Fanbll32.exeC:\Windows\system32\Fanbll32.exe89⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2116 -
C:\Windows\SysWOW64\Fjfgealk.exeC:\Windows\system32\Fjfgealk.exe90⤵PID:4272
-
C:\Windows\SysWOW64\Ggjgofkd.exeC:\Windows\system32\Ggjgofkd.exe91⤵
- Modifies registry class
PID:2720 -
C:\Windows\SysWOW64\Gcqhcgqi.exeC:\Windows\system32\Gcqhcgqi.exe92⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2456 -
C:\Windows\SysWOW64\Gceaofmc.exeC:\Windows\system32\Gceaofmc.exe93⤵PID:2948
-
C:\Windows\SysWOW64\Gffkpa32.exeC:\Windows\system32\Gffkpa32.exe94⤵PID:3076
-
C:\Windows\SysWOW64\Gmpcmkaa.exeC:\Windows\system32\Gmpcmkaa.exe95⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:1628 -
C:\Windows\SysWOW64\Hjdcfp32.exeC:\Windows\system32\Hjdcfp32.exe96⤵PID:3176
-
C:\Windows\SysWOW64\Hhhdpd32.exeC:\Windows\system32\Hhhdpd32.exe97⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:1372 -
C:\Windows\SysWOW64\Hnblmnfa.exeC:\Windows\system32\Hnblmnfa.exe98⤵PID:808
-
C:\Windows\SysWOW64\Hpchdf32.exeC:\Windows\system32\Hpchdf32.exe99⤵PID:4624
-
C:\Windows\SysWOW64\Hmginjki.exeC:\Windows\system32\Hmginjki.exe100⤵PID:3004
-
C:\Windows\SysWOW64\Hhmmkcko.exeC:\Windows\system32\Hhmmkcko.exe101⤵PID:4584
-
C:\Windows\SysWOW64\Hmifcjif.exeC:\Windows\system32\Hmifcjif.exe102⤵PID:4984
-
C:\Windows\SysWOW64\Hfajlp32.exeC:\Windows\system32\Hfajlp32.exe103⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:436 -
C:\Windows\SysWOW64\Hmlbij32.exeC:\Windows\system32\Hmlbij32.exe104⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:4456 -
C:\Windows\SysWOW64\Ifdgaond.exeC:\Windows\system32\Ifdgaond.exe105⤵PID:1584
-
C:\Windows\SysWOW64\Imnoni32.exeC:\Windows\system32\Imnoni32.exe106⤵
- Drops file in System32 directory
PID:4064 -
C:\Windows\SysWOW64\Ikbphn32.exeC:\Windows\system32\Ikbphn32.exe107⤵PID:3440
-
C:\Windows\SysWOW64\Ihfpabbd.exeC:\Windows\system32\Ihfpabbd.exe108⤵PID:1388
-
C:\Windows\SysWOW64\Imbhiial.exeC:\Windows\system32\Imbhiial.exe109⤵
- Drops file in System32 directory
PID:3800 -
C:\Windows\SysWOW64\Ihhmgaqb.exeC:\Windows\system32\Ihhmgaqb.exe110⤵PID:3492
-
C:\Windows\SysWOW64\Imeeohoi.exeC:\Windows\system32\Imeeohoi.exe111⤵PID:4600
-
C:\Windows\SysWOW64\Ikifhm32.exeC:\Windows\system32\Ikifhm32.exe112⤵PID:2236
-
C:\Windows\SysWOW64\Jpfnqc32.exeC:\Windows\system32\Jpfnqc32.exe113⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5100 -
C:\Windows\SysWOW64\Jkkbnl32.exeC:\Windows\system32\Jkkbnl32.exe114⤵PID:3932
-
C:\Windows\SysWOW64\Jphkfc32.exeC:\Windows\system32\Jphkfc32.exe115⤵PID:3524
-
C:\Windows\SysWOW64\Joikdk32.exeC:\Windows\system32\Joikdk32.exe116⤵
- Drops file in System32 directory
PID:904 -
C:\Windows\SysWOW64\Jdfcla32.exeC:\Windows\system32\Jdfcla32.exe117⤵PID:1788
-
C:\Windows\SysWOW64\Jolhjj32.exeC:\Windows\system32\Jolhjj32.exe118⤵
- Drops file in System32 directory
PID:2956 -
C:\Windows\SysWOW64\Jdhpba32.exeC:\Windows\system32\Jdhpba32.exe119⤵PID:1880
-
C:\Windows\SysWOW64\Jkbhok32.exeC:\Windows\system32\Jkbhok32.exe120⤵PID:3628
-
C:\Windows\SysWOW64\Jpoagb32.exeC:\Windows\system32\Jpoagb32.exe121⤵PID:4416
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-