Analysis
-
max time kernel
141s -
max time network
181s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
16/11/2023, 23:24
Behavioral task
behavioral1
Sample
NEAS.f5e442e6945d30c986049140f9e2b930.exe
Resource
win7-20231025-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.f5e442e6945d30c986049140f9e2b930.exe
Resource
win10v2004-20231023-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
NEAS.f5e442e6945d30c986049140f9e2b930.exe
-
Size
128KB
-
MD5
f5e442e6945d30c986049140f9e2b930
-
SHA1
6344adebe235c26459d268f2e86eb31b81abb1ea
-
SHA256
aa666491dabec0d29280b85c58592bd90fb18e0e0b606a4e6e8a4c0263aa9dea
-
SHA512
3822350ad9619c3ab517d6dbea38d63c7e984960ca218f576676430694700f7422b454b44fb5efec05746c199d7bacfdeb37f42bb543ff7ee6933a02a2d99d0d
-
SSDEEP
1536:yR0caUAJAs/N3SddfFFxlcq5JzbMRszVnKlAhXMZcWiqgF72S7f/QuMXi1oHk3C6:13JA0Ncxcq/kSXMmW2wS7IrHrYj
Score
10/10
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jjmhie32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Igomeb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Mpiejkql.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bhfmic32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Cdmfebnk.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nqaipgal.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Noeaaqlq.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dkmebh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Gdglfqjd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Okgabpgg.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bcahgh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Anobaa32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cocjbkna.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iejlih32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Okgabpgg.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bfbahcfc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jlclnhho.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gmfpgmil.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Qqcjnell.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iqmincia.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Knabne32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kdophj32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lalchm32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Meefhl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bkmmkj32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kjnbhkqp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hidpbf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Inpclnnj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kpfonnab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jbmehf32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Afpjoaeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Olidijjf.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gkdhcqcj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Olgnlb32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bkmmkj32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fdccka32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Eqalfgll.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qcepem32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jijhom32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Llngmeja.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ihknibbo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Onnmmipj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jepjbm32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ecoahmhd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ganppk32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lnkedd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Hlnqfanb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Odhipp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jekqgnno.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ihknibbo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Knabne32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dnpdom32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kjeiij32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Coqnmkpd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Iandjg32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hpomme32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mhmmchpd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hlcjaq32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Blgiphni.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kchdfpen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Khkbcopl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Hbcklkee.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Mjqjbn32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Efdjqeni.exe -
Malware Backdoor - Berbew 64 IoCs
Berbew is a malware infection classified as a 'backdoor' Trojan. This malicious program's primary function is to cause chain infections - it can download/install additional malware such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/files/0x0007000000022ce4-6.dat family_berbew behavioral2/files/0x0007000000022ce4-7.dat family_berbew behavioral2/files/0x0007000000022ce6-14.dat family_berbew behavioral2/files/0x0007000000022ce6-16.dat family_berbew behavioral2/files/0x0008000000022ce8-22.dat family_berbew behavioral2/files/0x0008000000022ce8-24.dat family_berbew behavioral2/files/0x0008000000022ceb-30.dat family_berbew behavioral2/files/0x0008000000022ceb-32.dat family_berbew behavioral2/files/0x0006000000022ced-33.dat family_berbew behavioral2/files/0x0006000000022ced-38.dat family_berbew behavioral2/files/0x0006000000022ced-39.dat family_berbew behavioral2/files/0x0006000000022cef-46.dat family_berbew behavioral2/files/0x0006000000022cef-47.dat family_berbew behavioral2/files/0x0006000000022cf1-54.dat family_berbew behavioral2/files/0x0006000000022cf1-55.dat family_berbew behavioral2/files/0x0006000000022cf3-62.dat family_berbew behavioral2/files/0x0006000000022cf3-64.dat family_berbew behavioral2/files/0x0006000000022cf5-65.dat family_berbew behavioral2/files/0x0006000000022cf5-70.dat family_berbew behavioral2/files/0x0006000000022cf5-71.dat family_berbew behavioral2/files/0x0006000000022cf7-78.dat family_berbew behavioral2/files/0x0006000000022cf7-80.dat family_berbew behavioral2/files/0x0006000000022cf9-81.dat family_berbew behavioral2/files/0x0006000000022cf9-86.dat family_berbew behavioral2/files/0x0006000000022cf9-88.dat family_berbew behavioral2/files/0x0006000000022cfb-94.dat family_berbew behavioral2/files/0x0006000000022cfb-96.dat family_berbew behavioral2/files/0x0006000000022cfd-97.dat family_berbew behavioral2/files/0x0006000000022cfd-102.dat family_berbew behavioral2/files/0x0006000000022cfd-104.dat family_berbew behavioral2/files/0x0006000000022cff-110.dat family_berbew behavioral2/files/0x0006000000022cff-112.dat family_berbew behavioral2/files/0x0006000000022d01-118.dat family_berbew behavioral2/files/0x0006000000022d01-120.dat family_berbew behavioral2/files/0x0006000000022d05-126.dat family_berbew behavioral2/files/0x0006000000022d05-128.dat family_berbew behavioral2/files/0x0006000000022d08-134.dat family_berbew behavioral2/files/0x0006000000022d08-135.dat family_berbew behavioral2/files/0x0006000000022d0a-142.dat family_berbew behavioral2/files/0x0006000000022d0a-143.dat family_berbew behavioral2/files/0x0006000000022d0d-150.dat family_berbew behavioral2/files/0x0006000000022d0d-151.dat family_berbew behavioral2/files/0x0007000000022d0f-158.dat family_berbew behavioral2/files/0x0007000000022d0f-159.dat family_berbew behavioral2/files/0x0006000000022d11-166.dat family_berbew behavioral2/files/0x0006000000022d11-167.dat family_berbew behavioral2/files/0x0006000000022d13-169.dat family_berbew behavioral2/files/0x0006000000022d13-174.dat family_berbew behavioral2/files/0x0006000000022d13-175.dat family_berbew behavioral2/files/0x0006000000022d15-182.dat family_berbew behavioral2/files/0x0006000000022d15-183.dat family_berbew behavioral2/files/0x0006000000022d17-190.dat family_berbew behavioral2/files/0x0006000000022d17-191.dat family_berbew behavioral2/files/0x0006000000022d1a-198.dat family_berbew behavioral2/files/0x0006000000022d1a-200.dat family_berbew behavioral2/files/0x0006000000022d1c-206.dat family_berbew behavioral2/files/0x0006000000022d1c-207.dat family_berbew behavioral2/files/0x0006000000022d1e-214.dat family_berbew behavioral2/files/0x0006000000022d1e-215.dat family_berbew behavioral2/files/0x0006000000022d20-222.dat family_berbew behavioral2/files/0x0006000000022d20-223.dat family_berbew behavioral2/files/0x0006000000022d2a-230.dat family_berbew behavioral2/files/0x0006000000022d2a-231.dat family_berbew behavioral2/files/0x0006000000022d2d-238.dat family_berbew -
Executes dropped EXE 64 IoCs
pid Process 1376 Olidijjf.exe 4852 Bidlqhgc.exe 320 Cjlbag32.exe 1580 Dlcaca32.exe 4444 Egiohh32.exe 4372 Ffeaichg.exe 4376 Gmfpgmil.exe 3452 Gfcnka32.exe 1844 Hjfplo32.exe 2204 Ifdgaond.exe 1180 Iandjg32.exe 824 Jkplilgk.exe 1560 Khkbcopl.exe 3356 Lnhdbc32.exe 4460 Mbkfcabb.exe 2220 Oapllk32.exe 1484 Aldeap32.exe 1780 Boldcj32.exe 3828 Clihcm32.exe 2376 Dlgddkpc.exe 4296 Dpemjifi.exe 4336 Eqalfgll.exe 2600 Emhmkh32.exe 3984 Fiajfi32.exe 456 Gpgbna32.exe 3520 Gmmome32.exe 1496 Hidpbf32.exe 4496 Hfhqkk32.exe 3728 Hbcklkee.exe 2680 Iippne32.exe 1752 Impeib32.exe 2156 Idnfal32.exe 2980 Jjmhie32.exe 3640 Jbhmnhcm.exe 1128 Jbkjcgaj.exe 3620 Kkdnjd32.exe 3956 Kdophj32.exe 3488 Kgbepdpf.exe 3076 Lckbje32.exe 2288 Lalchm32.exe 1724 Lkgdfb32.exe 3612 Mddbjg32.exe 1444 Mjqjbn32.exe 2956 Mkpglqgj.exe 4252 Nqaipgal.exe 4560 Nkgmmpab.exe 4108 Nqfbkf32.exe 488 Ncihbaie.exe 1800 Okjbimal.exe 4696 Qcepem32.exe 1732 Bbbpnc32.exe 1736 Ckpjob32.exe 752 Dampal32.exe 2852 Ecjhmm32.exe 3712 Eleikb32.exe 4684 Ecoahmhd.exe 4348 Gfimpfmj.exe 4380 Goconkah.exe 4456 Hicihp32.exe 2216 Hmabnnhg.exe 3436 Iehfno32.exe 4936 Jijhom32.exe 3868 Jpdqlgdc.exe 4620 Jmknkk32.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Lkgnhn32.dll Inpclnnj.exe File created C:\Windows\SysWOW64\Mpgbleck.dll Lhhchi32.exe File opened for modification C:\Windows\SysWOW64\Hhiacb32.exe Haoighmd.exe File created C:\Windows\SysWOW64\Mpgelq32.dll Cobkbhgk.exe File created C:\Windows\SysWOW64\Jkplilgk.exe Iandjg32.exe File opened for modification C:\Windows\SysWOW64\Mjqjbn32.exe Mddbjg32.exe File created C:\Windows\SysWOW64\Mkhepqnd.dll Agbkfood.exe File opened for modification C:\Windows\SysWOW64\Jbmehf32.exe Iqmincia.exe File opened for modification C:\Windows\SysWOW64\Qejkfp32.exe Qkegiggl.exe File created C:\Windows\SysWOW64\Gmjlfbjj.dll Kgkfhngo.exe File created C:\Windows\SysWOW64\Jpobdp32.dll Mnhdae32.exe File opened for modification C:\Windows\SysWOW64\Boldcj32.exe Aldeap32.exe File created C:\Windows\SysWOW64\Pofhnlcl.dll Hmabnnhg.exe File created C:\Windows\SysWOW64\Bgibqqei.dll Lbjeei32.exe File opened for modification C:\Windows\SysWOW64\Kengqo32.exe Kjhccf32.exe File created C:\Windows\SysWOW64\Eekkllpk.dll Qejkfp32.exe File created C:\Windows\SysWOW64\Mdiqpp32.dll Knlknigf.exe File created C:\Windows\SysWOW64\Mddbjg32.exe Lkgdfb32.exe File opened for modification C:\Windows\SysWOW64\Meadgc32.exe Mlipomli.exe File created C:\Windows\SysWOW64\Haoighmd.exe Hgieipmo.exe File created C:\Windows\SysWOW64\Gpqjaanf.exe Gkdaij32.exe File created C:\Windows\SysWOW64\Jndenjmo.exe Jcoapami.exe File created C:\Windows\SysWOW64\Fmnfoa32.dll Afpjoaeo.exe File opened for modification C:\Windows\SysWOW64\Dnhgcgbi.exe Cpdgjc32.exe File opened for modification C:\Windows\SysWOW64\Kjhccf32.exe Kiggln32.exe File opened for modification C:\Windows\SysWOW64\Naodbm32.exe Nhfpjghi.exe File created C:\Windows\SysWOW64\Fdjmci32.dll Efhlan32.exe File created C:\Windows\SysWOW64\Gkdaij32.exe Gpnmka32.exe File created C:\Windows\SysWOW64\Ogoane32.dll Aeaagoaj.exe File created C:\Windows\SysWOW64\Pceife32.dll Lqjqab32.exe File created C:\Windows\SysWOW64\Llngmeja.exe Kdcbic32.exe File created C:\Windows\SysWOW64\Ongamagn.dll Gpodfh32.exe File created C:\Windows\SysWOW64\Nhkief32.exe Nbnpmp32.exe File created C:\Windows\SysWOW64\Flinddpj.exe Fbajlo32.exe File opened for modification C:\Windows\SysWOW64\Dpemjifi.exe Dlgddkpc.exe File created C:\Windows\SysWOW64\Lookln32.dll Lgmnqmam.exe File created C:\Windows\SysWOW64\Emikje32.dll Koaaaaip.exe File opened for modification C:\Windows\SysWOW64\Moiphnde.exe Mnhdae32.exe File opened for modification C:\Windows\SysWOW64\Bgnfpp32.exe Bmeagjbo.exe File opened for modification C:\Windows\SysWOW64\Impeib32.exe Iippne32.exe File created C:\Windows\SysWOW64\Ghkebd32.exe Gaqmej32.exe File created C:\Windows\SysWOW64\Mpqmcoei.dll Knabne32.exe File created C:\Windows\SysWOW64\Fbajlo32.exe Efhlan32.exe File created C:\Windows\SysWOW64\Nggddfag.dll Iejlih32.exe File created C:\Windows\SysWOW64\Okeifa32.dll Oepipo32.exe File created C:\Windows\SysWOW64\Qlejnqbj.exe Qaofphbd.exe File opened for modification C:\Windows\SysWOW64\Ohhnln32.exe Oopjchnh.exe File created C:\Windows\SysWOW64\Dnajjfjo.exe Dojqcjgi.exe File created C:\Windows\SysWOW64\Jjmhie32.exe Idnfal32.exe File opened for modification C:\Windows\SysWOW64\Ihknibbo.exe Iaaflh32.exe File opened for modification C:\Windows\SysWOW64\Bcahgh32.exe Bjicnbba.exe File created C:\Windows\SysWOW64\Onnmmipj.exe Odhipp32.exe File created C:\Windows\SysWOW64\Lgmnqmam.exe Lmdihgkl.exe File created C:\Windows\SysWOW64\Nipedokm.exe Nojagf32.exe File created C:\Windows\SysWOW64\Ohhnln32.exe Oopjchnh.exe File created C:\Windows\SysWOW64\Nophma32.dll Amhlpb32.exe File created C:\Windows\SysWOW64\Jpenoe32.exe Jepjbm32.exe File created C:\Windows\SysWOW64\Idnfal32.exe Impeib32.exe File created C:\Windows\SysWOW64\Ecjhmm32.exe Dampal32.exe File opened for modification C:\Windows\SysWOW64\Jianpl32.exe Jmknkk32.exe File created C:\Windows\SysWOW64\Ampfba32.dll Hhiacb32.exe File opened for modification C:\Windows\SysWOW64\Ipcomo32.exe Igkkdigp.exe File opened for modification C:\Windows\SysWOW64\Onnmmipj.exe Odhipp32.exe File created C:\Windows\SysWOW64\Khkbcopl.exe Jkplilgk.exe -
Program crash 2 IoCs
pid pid_target Process procid_target 5284 848 WerFault.exe 398 5128 848 WerFault.exe 398 -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Eecdcckf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qckcoi32.dll" Bemqcngl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Cdmfebnk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Okjbimal.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ecoahmhd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hakbkc32.dll" Hocqkc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgkoag32.dll" Meefhl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Enkdjkep.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Kdophj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Lkgdfb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Lkgdfb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Qqcjnell.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Piifki32.dll" Ifdgaond.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Kdophj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kpepglmk.dll" Jepjbm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Bphgoe32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Agbkfood.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Akcjel32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Dnhgcgbi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Eqalfgll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Jijhom32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnbaba32.dll" Cjecjahd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Fdepaa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jieoac32.dll" Omnqcfig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eekkllpk.dll" Qejkfp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fglalp32.dll" Bphgoe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Kdcbic32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Bjicnbba.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Nkgmmpab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hgjfklli.dll" Eleikb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Nhfpjghi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Iejlih32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Miomnaip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Mpiejkql.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ganppk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Jncfmgfi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Dampal32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Emhngp32.dll" Ipeehhhb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aqhopg32.dll" Lnjgpgkf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Bfcompnj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dqlodlcc.dll" Mpiejkql.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ggmock32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Cpkddd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Pmmelo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Khknaa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Emojjn32.dll" Kdcbic32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Lhijcohe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Foemfdkp.dll" Hlcjaq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bmaejnbe.dll" Miomnaip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Beahon32.dll" Nbnpmp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ejhnmcpc.dll" Kchdfpen.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Oapllk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Dpemjifi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Jepjbm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nbpiochc.dll" Bcahgh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Fipkch32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nncqojmh.dll" Gpgbna32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Flqeap32.dll" Lhijcohe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mdpmkhmc.dll" Aqjpod32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Illiee32.dll" Jhgneqha.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Bhfmic32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ichkpb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mnfmcl32.dll" Lkgdfb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Mbpdkabl.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4556 wrote to memory of 1376 4556 NEAS.f5e442e6945d30c986049140f9e2b930.exe 91 PID 4556 wrote to memory of 1376 4556 NEAS.f5e442e6945d30c986049140f9e2b930.exe 91 PID 4556 wrote to memory of 1376 4556 NEAS.f5e442e6945d30c986049140f9e2b930.exe 91 PID 1376 wrote to memory of 4852 1376 Olidijjf.exe 92 PID 1376 wrote to memory of 4852 1376 Olidijjf.exe 92 PID 1376 wrote to memory of 4852 1376 Olidijjf.exe 92 PID 4852 wrote to memory of 320 4852 Bidlqhgc.exe 93 PID 4852 wrote to memory of 320 4852 Bidlqhgc.exe 93 PID 4852 wrote to memory of 320 4852 Bidlqhgc.exe 93 PID 320 wrote to memory of 1580 320 Cjlbag32.exe 94 PID 320 wrote to memory of 1580 320 Cjlbag32.exe 94 PID 320 wrote to memory of 1580 320 Cjlbag32.exe 94 PID 1580 wrote to memory of 4444 1580 Dlcaca32.exe 95 PID 1580 wrote to memory of 4444 1580 Dlcaca32.exe 95 PID 1580 wrote to memory of 4444 1580 Dlcaca32.exe 95 PID 4444 wrote to memory of 4372 4444 Egiohh32.exe 96 PID 4444 wrote to memory of 4372 4444 Egiohh32.exe 96 PID 4444 wrote to memory of 4372 4444 Egiohh32.exe 96 PID 4372 wrote to memory of 4376 4372 Ffeaichg.exe 97 PID 4372 wrote to memory of 4376 4372 Ffeaichg.exe 97 PID 4372 wrote to memory of 4376 4372 Ffeaichg.exe 97 PID 4376 wrote to memory of 3452 4376 Gmfpgmil.exe 98 PID 4376 wrote to memory of 3452 4376 Gmfpgmil.exe 98 PID 4376 wrote to memory of 3452 4376 Gmfpgmil.exe 98 PID 3452 wrote to memory of 1844 3452 Gfcnka32.exe 99 PID 3452 wrote to memory of 1844 3452 Gfcnka32.exe 99 PID 3452 wrote to memory of 1844 3452 Gfcnka32.exe 99 PID 1844 wrote to memory of 2204 1844 Hjfplo32.exe 100 PID 1844 wrote to memory of 2204 1844 Hjfplo32.exe 100 PID 1844 wrote to memory of 2204 1844 Hjfplo32.exe 100 PID 2204 wrote to memory of 1180 2204 Ifdgaond.exe 101 PID 2204 wrote to memory of 1180 2204 Ifdgaond.exe 101 PID 2204 wrote to memory of 1180 2204 Ifdgaond.exe 101 PID 1180 wrote to memory of 824 1180 Iandjg32.exe 102 PID 1180 wrote to memory of 824 1180 Iandjg32.exe 102 PID 1180 wrote to memory of 824 1180 Iandjg32.exe 102 PID 824 wrote to memory of 1560 824 Jkplilgk.exe 103 PID 824 wrote to memory of 1560 824 Jkplilgk.exe 103 PID 824 wrote to memory of 1560 824 Jkplilgk.exe 103 PID 1560 wrote to memory of 3356 1560 Khkbcopl.exe 104 PID 1560 wrote to memory of 3356 1560 Khkbcopl.exe 104 PID 1560 wrote to memory of 3356 1560 Khkbcopl.exe 104 PID 3356 wrote to memory of 4460 3356 Lnhdbc32.exe 106 PID 3356 wrote to memory of 4460 3356 Lnhdbc32.exe 106 PID 3356 wrote to memory of 4460 3356 Lnhdbc32.exe 106 PID 4460 wrote to memory of 2220 4460 Mbkfcabb.exe 108 PID 4460 wrote to memory of 2220 4460 Mbkfcabb.exe 108 PID 4460 wrote to memory of 2220 4460 Mbkfcabb.exe 108 PID 2220 wrote to memory of 1484 2220 Oapllk32.exe 109 PID 2220 wrote to memory of 1484 2220 Oapllk32.exe 109 PID 2220 wrote to memory of 1484 2220 Oapllk32.exe 109 PID 1484 wrote to memory of 1780 1484 Aldeap32.exe 110 PID 1484 wrote to memory of 1780 1484 Aldeap32.exe 110 PID 1484 wrote to memory of 1780 1484 Aldeap32.exe 110 PID 1780 wrote to memory of 3828 1780 Boldcj32.exe 111 PID 1780 wrote to memory of 3828 1780 Boldcj32.exe 111 PID 1780 wrote to memory of 3828 1780 Boldcj32.exe 111 PID 3828 wrote to memory of 2376 3828 Clihcm32.exe 112 PID 3828 wrote to memory of 2376 3828 Clihcm32.exe 112 PID 3828 wrote to memory of 2376 3828 Clihcm32.exe 112 PID 2376 wrote to memory of 4296 2376 Dlgddkpc.exe 113 PID 2376 wrote to memory of 4296 2376 Dlgddkpc.exe 113 PID 2376 wrote to memory of 4296 2376 Dlgddkpc.exe 113 PID 4296 wrote to memory of 4336 4296 Dpemjifi.exe 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.f5e442e6945d30c986049140f9e2b930.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.f5e442e6945d30c986049140f9e2b930.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Windows\SysWOW64\Olidijjf.exeC:\Windows\system32\Olidijjf.exe2⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Windows\SysWOW64\Bidlqhgc.exeC:\Windows\system32\Bidlqhgc.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Windows\SysWOW64\Cjlbag32.exeC:\Windows\system32\Cjlbag32.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320 -
C:\Windows\SysWOW64\Dlcaca32.exeC:\Windows\system32\Dlcaca32.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Windows\SysWOW64\Egiohh32.exeC:\Windows\system32\Egiohh32.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Windows\SysWOW64\Ffeaichg.exeC:\Windows\system32\Ffeaichg.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Windows\SysWOW64\Gmfpgmil.exeC:\Windows\system32\Gmfpgmil.exe8⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Windows\SysWOW64\Gfcnka32.exeC:\Windows\system32\Gfcnka32.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Windows\SysWOW64\Hjfplo32.exeC:\Windows\system32\Hjfplo32.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Windows\SysWOW64\Ifdgaond.exeC:\Windows\system32\Ifdgaond.exe11⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Windows\SysWOW64\Iandjg32.exeC:\Windows\system32\Iandjg32.exe12⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Windows\SysWOW64\Jkplilgk.exeC:\Windows\system32\Jkplilgk.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Windows\SysWOW64\Khkbcopl.exeC:\Windows\system32\Khkbcopl.exe14⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Windows\SysWOW64\Lnhdbc32.exeC:\Windows\system32\Lnhdbc32.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Windows\SysWOW64\Mbkfcabb.exeC:\Windows\system32\Mbkfcabb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Windows\SysWOW64\Oapllk32.exeC:\Windows\system32\Oapllk32.exe17⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Windows\SysWOW64\Aldeap32.exeC:\Windows\system32\Aldeap32.exe18⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Windows\SysWOW64\Boldcj32.exeC:\Windows\system32\Boldcj32.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Windows\SysWOW64\Clihcm32.exeC:\Windows\system32\Clihcm32.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Windows\SysWOW64\Dlgddkpc.exeC:\Windows\system32\Dlgddkpc.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Windows\SysWOW64\Dpemjifi.exeC:\Windows\system32\Dpemjifi.exe22⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Windows\SysWOW64\Eqalfgll.exeC:\Windows\system32\Eqalfgll.exe23⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:4336 -
C:\Windows\SysWOW64\Emhmkh32.exeC:\Windows\system32\Emhmkh32.exe24⤵
- Executes dropped EXE
PID:2600 -
C:\Windows\SysWOW64\Fiajfi32.exeC:\Windows\system32\Fiajfi32.exe25⤵
- Executes dropped EXE
PID:3984 -
C:\Windows\SysWOW64\Gpgbna32.exeC:\Windows\system32\Gpgbna32.exe26⤵
- Executes dropped EXE
- Modifies registry class
PID:456 -
C:\Windows\SysWOW64\Gmmome32.exeC:\Windows\system32\Gmmome32.exe27⤵
- Executes dropped EXE
PID:3520 -
C:\Windows\SysWOW64\Hidpbf32.exeC:\Windows\system32\Hidpbf32.exe28⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1496 -
C:\Windows\SysWOW64\Hfhqkk32.exeC:\Windows\system32\Hfhqkk32.exe29⤵
- Executes dropped EXE
PID:4496 -
C:\Windows\SysWOW64\Hbcklkee.exeC:\Windows\system32\Hbcklkee.exe30⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:3728 -
C:\Windows\SysWOW64\Iippne32.exeC:\Windows\system32\Iippne32.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2680 -
C:\Windows\SysWOW64\Impeib32.exeC:\Windows\system32\Impeib32.exe32⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1752 -
C:\Windows\SysWOW64\Idnfal32.exeC:\Windows\system32\Idnfal32.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2156 -
C:\Windows\SysWOW64\Jjmhie32.exeC:\Windows\system32\Jjmhie32.exe34⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2980 -
C:\Windows\SysWOW64\Jbhmnhcm.exeC:\Windows\system32\Jbhmnhcm.exe35⤵
- Executes dropped EXE
PID:3640 -
C:\Windows\SysWOW64\Jbkjcgaj.exeC:\Windows\system32\Jbkjcgaj.exe36⤵
- Executes dropped EXE
PID:1128 -
C:\Windows\SysWOW64\Kkdnjd32.exeC:\Windows\system32\Kkdnjd32.exe37⤵
- Executes dropped EXE
PID:3620 -
C:\Windows\SysWOW64\Kdophj32.exeC:\Windows\system32\Kdophj32.exe38⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:3956 -
C:\Windows\SysWOW64\Kgbepdpf.exeC:\Windows\system32\Kgbepdpf.exe39⤵
- Executes dropped EXE
PID:3488 -
C:\Windows\SysWOW64\Lckbje32.exeC:\Windows\system32\Lckbje32.exe40⤵
- Executes dropped EXE
PID:3076 -
C:\Windows\SysWOW64\Lalchm32.exeC:\Windows\system32\Lalchm32.exe41⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2288 -
C:\Windows\SysWOW64\Lkgdfb32.exeC:\Windows\system32\Lkgdfb32.exe42⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:1724 -
C:\Windows\SysWOW64\Mddbjg32.exeC:\Windows\system32\Mddbjg32.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3612 -
C:\Windows\SysWOW64\Mjqjbn32.exeC:\Windows\system32\Mjqjbn32.exe44⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1444 -
C:\Windows\SysWOW64\Mkpglqgj.exeC:\Windows\system32\Mkpglqgj.exe45⤵
- Executes dropped EXE
PID:2956 -
C:\Windows\SysWOW64\Nqaipgal.exeC:\Windows\system32\Nqaipgal.exe46⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:4252 -
C:\Windows\SysWOW64\Nkgmmpab.exeC:\Windows\system32\Nkgmmpab.exe47⤵
- Executes dropped EXE
- Modifies registry class
PID:4560 -
C:\Windows\SysWOW64\Nqfbkf32.exeC:\Windows\system32\Nqfbkf32.exe48⤵
- Executes dropped EXE
PID:4108 -
C:\Windows\SysWOW64\Ncihbaie.exeC:\Windows\system32\Ncihbaie.exe49⤵
- Executes dropped EXE
PID:488 -
C:\Windows\SysWOW64\Okjbimal.exeC:\Windows\system32\Okjbimal.exe50⤵
- Executes dropped EXE
- Modifies registry class
PID:1800 -
C:\Windows\SysWOW64\Qcepem32.exeC:\Windows\system32\Qcepem32.exe51⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:4696 -
C:\Windows\SysWOW64\Bbbpnc32.exeC:\Windows\system32\Bbbpnc32.exe52⤵
- Executes dropped EXE
PID:1732 -
C:\Windows\SysWOW64\Ckpjob32.exeC:\Windows\system32\Ckpjob32.exe53⤵
- Executes dropped EXE
PID:1736 -
C:\Windows\SysWOW64\Dampal32.exeC:\Windows\system32\Dampal32.exe54⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:752 -
C:\Windows\SysWOW64\Ecjhmm32.exeC:\Windows\system32\Ecjhmm32.exe55⤵
- Executes dropped EXE
PID:2852 -
C:\Windows\SysWOW64\Eleikb32.exeC:\Windows\system32\Eleikb32.exe56⤵
- Executes dropped EXE
- Modifies registry class
PID:3712 -
C:\Windows\SysWOW64\Ecoahmhd.exeC:\Windows\system32\Ecoahmhd.exe57⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:4684 -
C:\Windows\SysWOW64\Gfimpfmj.exeC:\Windows\system32\Gfimpfmj.exe58⤵
- Executes dropped EXE
PID:4348 -
C:\Windows\SysWOW64\Goconkah.exeC:\Windows\system32\Goconkah.exe59⤵
- Executes dropped EXE
PID:4380 -
C:\Windows\SysWOW64\Hicihp32.exeC:\Windows\system32\Hicihp32.exe60⤵
- Executes dropped EXE
PID:4456 -
C:\Windows\SysWOW64\Hmabnnhg.exeC:\Windows\system32\Hmabnnhg.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2216 -
C:\Windows\SysWOW64\Iehfno32.exeC:\Windows\system32\Iehfno32.exe62⤵
- Executes dropped EXE
PID:3436 -
C:\Windows\SysWOW64\Jijhom32.exeC:\Windows\system32\Jijhom32.exe63⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:4936 -
C:\Windows\SysWOW64\Jpdqlgdc.exeC:\Windows\system32\Jpdqlgdc.exe64⤵
- Executes dropped EXE
PID:3868 -
C:\Windows\SysWOW64\Jmknkk32.exeC:\Windows\system32\Jmknkk32.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4620 -
C:\Windows\SysWOW64\Jianpl32.exeC:\Windows\system32\Jianpl32.exe66⤵PID:2624
-
C:\Windows\SysWOW64\Kdcbic32.exeC:\Windows\system32\Kdcbic32.exe67⤵
- Drops file in System32 directory
- Modifies registry class
PID:3184 -
C:\Windows\SysWOW64\Llngmeja.exeC:\Windows\system32\Llngmeja.exe68⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:896 -
C:\Windows\SysWOW64\Lfckjnjh.exeC:\Windows\system32\Lfckjnjh.exe69⤵PID:4768
-
C:\Windows\SysWOW64\Llpcceho.exeC:\Windows\system32\Llpcceho.exe70⤵PID:2604
-
C:\Windows\SysWOW64\Liddligi.exeC:\Windows\system32\Liddligi.exe71⤵PID:4648
-
C:\Windows\SysWOW64\Lmdihgkl.exeC:\Windows\system32\Lmdihgkl.exe72⤵
- Drops file in System32 directory
PID:2272 -
C:\Windows\SysWOW64\Lgmnqmam.exeC:\Windows\system32\Lgmnqmam.exe73⤵
- Drops file in System32 directory
PID:2440 -
C:\Windows\SysWOW64\Mgfqgkib.exeC:\Windows\system32\Mgfqgkib.exe74⤵PID:1100
-
C:\Windows\SysWOW64\Nenjng32.exeC:\Windows\system32\Nenjng32.exe75⤵PID:4028
-
C:\Windows\SysWOW64\Opmaaodc.exeC:\Windows\system32\Opmaaodc.exe76⤵PID:5212
-
C:\Windows\SysWOW64\Pmmelo32.exeC:\Windows\system32\Pmmelo32.exe77⤵
- Modifies registry class
PID:5252 -
C:\Windows\SysWOW64\Pfgfkd32.exeC:\Windows\system32\Pfgfkd32.exe78⤵PID:5356
-
C:\Windows\SysWOW64\Bfcompnj.exeC:\Windows\system32\Bfcompnj.exe79⤵
- Modifies registry class
PID:5396 -
C:\Windows\SysWOW64\Eecdcckf.exeC:\Windows\system32\Eecdcckf.exe80⤵
- Modifies registry class
PID:5436 -
C:\Windows\SysWOW64\Hocqkc32.exeC:\Windows\system32\Hocqkc32.exe81⤵
- Modifies registry class
PID:5536 -
C:\Windows\SysWOW64\Inpclnnj.exeC:\Windows\system32\Inpclnnj.exe82⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:5584 -
C:\Windows\SysWOW64\Iejlih32.exeC:\Windows\system32\Iejlih32.exe83⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:5640 -
C:\Windows\SysWOW64\Jgjekc32.exeC:\Windows\system32\Jgjekc32.exe84⤵PID:5692
-
C:\Windows\SysWOW64\Khhalafg.exeC:\Windows\system32\Khhalafg.exe85⤵PID:5728
-
C:\Windows\SysWOW64\Knbiil32.exeC:\Windows\system32\Knbiil32.exe86⤵PID:5772
-
C:\Windows\SysWOW64\Khknaa32.exeC:\Windows\system32\Khknaa32.exe87⤵
- Modifies registry class
PID:5812 -
C:\Windows\SysWOW64\Kijjldkh.exeC:\Windows\system32\Kijjldkh.exe88⤵PID:5852
-
C:\Windows\SysWOW64\Kfnkeh32.exeC:\Windows\system32\Kfnkeh32.exe89⤵PID:5896
-
C:\Windows\SysWOW64\Kpfonnab.exeC:\Windows\system32\Kpfonnab.exe90⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5944 -
C:\Windows\SysWOW64\Lbjeei32.exeC:\Windows\system32\Lbjeei32.exe91⤵
- Drops file in System32 directory
PID:5988 -
C:\Windows\SysWOW64\Lhfmmp32.exeC:\Windows\system32\Lhfmmp32.exe92⤵PID:6032
-
C:\Windows\SysWOW64\Lhijcohe.exeC:\Windows\system32\Lhijcohe.exe93⤵
- Modifies registry class
PID:6076 -
C:\Windows\SysWOW64\Llgcin32.exeC:\Windows\system32\Llgcin32.exe94⤵PID:6120
-
C:\Windows\SysWOW64\Mlipomli.exeC:\Windows\system32\Mlipomli.exe95⤵
- Drops file in System32 directory
PID:4428 -
C:\Windows\SysWOW64\Meadgc32.exeC:\Windows\system32\Meadgc32.exe96⤵PID:4304
-
C:\Windows\SysWOW64\Mojhphij.exeC:\Windows\system32\Mojhphij.exe97⤵PID:4224
-
C:\Windows\SysWOW64\Miomnaip.exeC:\Windows\system32\Miomnaip.exe98⤵
- Modifies registry class
PID:4700 -
C:\Windows\SysWOW64\Mpiejkql.exeC:\Windows\system32\Mpiejkql.exe99⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:5240 -
C:\Windows\SysWOW64\Mplapkoj.exeC:\Windows\system32\Mplapkoj.exe100⤵PID:5404
-
C:\Windows\SysWOW64\Mehjhbma.exeC:\Windows\system32\Mehjhbma.exe101⤵PID:1848
-
C:\Windows\SysWOW64\Nohdaf32.exeC:\Windows\system32\Nohdaf32.exe102⤵PID:1952
-
C:\Windows\SysWOW64\Nojagf32.exeC:\Windows\system32\Nojagf32.exe103⤵
- Drops file in System32 directory
PID:5496 -
C:\Windows\SysWOW64\Nipedokm.exeC:\Windows\system32\Nipedokm.exe104⤵PID:1988
-
C:\Windows\SysWOW64\Opjnai32.exeC:\Windows\system32\Opjnai32.exe105⤵PID:4104
-
C:\Windows\SysWOW64\Ohebek32.exeC:\Windows\system32\Ohebek32.exe106⤵PID:5604
-
C:\Windows\SysWOW64\Ocopncke.exeC:\Windows\system32\Ocopncke.exe107⤵PID:5608
-
C:\Windows\SysWOW64\Oiihkncb.exeC:\Windows\system32\Oiihkncb.exe108⤵PID:5684
-
C:\Windows\SysWOW64\Oofacdaj.exeC:\Windows\system32\Oofacdaj.exe109⤵PID:5664
-
C:\Windows\SysWOW64\Oepipo32.exeC:\Windows\system32\Oepipo32.exe110⤵
- Drops file in System32 directory
PID:5804 -
C:\Windows\SysWOW64\Pfdbknda.exeC:\Windows\system32\Pfdbknda.exe111⤵PID:5868
-
C:\Windows\SysWOW64\Qgkeep32.exeC:\Windows\system32\Qgkeep32.exe112⤵PID:5916
-
C:\Windows\SysWOW64\Qqcjnell.exeC:\Windows\system32\Qqcjnell.exe113⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:6028 -
C:\Windows\SysWOW64\Agbkfood.exeC:\Windows\system32\Agbkfood.exe114⤵
- Drops file in System32 directory
- Modifies registry class
PID:6060 -
C:\Windows\SysWOW64\Aqjpod32.exeC:\Windows\system32\Aqjpod32.exe115⤵
- Modifies registry class
PID:1856 -
C:\Windows\SysWOW64\Cjcmognb.exeC:\Windows\system32\Cjcmognb.exe116⤵PID:3748
-
C:\Windows\SysWOW64\Efdjqeni.exeC:\Windows\system32\Efdjqeni.exe117⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5236 -
C:\Windows\SysWOW64\Fpagdj32.exeC:\Windows\system32\Fpagdj32.exe118⤵PID:5380
-
C:\Windows\SysWOW64\Fdamph32.exeC:\Windows\system32\Fdamph32.exe119⤵PID:3048
-
C:\Windows\SysWOW64\Gpodfh32.exeC:\Windows\system32\Gpodfh32.exe120⤵
- Drops file in System32 directory
PID:2472 -
C:\Windows\SysWOW64\Gkdhcqcj.exeC:\Windows\system32\Gkdhcqcj.exe121⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1340
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-