e44bc2fcaed65f5022531a79d7dd2282dfa09e3f774970ace07620d8625f3a66

Analysis

max time kernel
169s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
17-11-2023 05:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.2d7ac521126722f68325575d9e81f100.exe
Size

1.7MB
MD5

2d7ac521126722f68325575d9e81f100
SHA1

9fb961b22af0bd87e8c5ddc2166d3f7b52668e36
SHA256

e44bc2fcaed65f5022531a79d7dd2282dfa09e3f774970ace07620d8625f3a66
SHA512

18c48f2e34e2d741551a83874c3899868d772f41f3ec1e0b3c126cfeab273b2b2732d169538bc4df4a4c2a3873ce5a103096d1371ba384a42cbfb109430f6d04
SSDEEP

24576:miq5h3q5hL6X1q5h3q5hM5Dgq5h3q5hL6X1q5h3q5h:96KI6

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 62 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Elaobdmm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcnmin32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Imkbnf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nmfcok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kqphfe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Phajna32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jekjcaef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ljaoeini.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Keifdpif.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Elaobdmm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocohmc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Npbceggm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nmfcok32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pahpee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lcnmin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kclgmq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kqphfe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kolabf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lllagh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Abbiej32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	NEAS.2d7ac521126722f68325575d9e81f100.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldgccb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lclpdncg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fmkqpkla.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oclkgccf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gngeik32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hbenoi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Flcfnn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Flcfnn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ldgccb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eangjkkd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dlmegd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oclkgccf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Phajna32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nggnadib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ocohmc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jekjcaef.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jgeghp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ljaoeini.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Keifdpif.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	NEAS.2d7ac521126722f68325575d9e81f100.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Npbceggm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gngeik32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jemfhacc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Abbiej32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dlmegd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Imkbnf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kedlip32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kclgmq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lclpdncg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jemfhacc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jgeghp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hbenoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kolabf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pahpee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eangjkkd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgbefe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgbefe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nggnadib.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kedlip32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lllagh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fmkqpkla.exe

Executes dropped EXE 30 IoCs

pid	Process
2276	Jgeghp32.exe
4380	Kclgmq32.exe
3212	Kqphfe32.exe
4524	Ljaoeini.exe
2132	Ldgccb32.exe
3624	Lclpdncg.exe
2456	Lcnmin32.exe
2184	Fmkqpkla.exe
556	Imkbnf32.exe
400	Mgbefe32.exe
1788	Nggnadib.exe
1576	Npbceggm.exe
2956	Nmfcok32.exe
3744	Oclkgccf.exe
740	Ocohmc32.exe
1552	Phajna32.exe
220	Gngeik32.exe
1120	Hbenoi32.exe
4420	Jekjcaef.exe
4300	Kedlip32.exe
1548	Kolabf32.exe
4024	Keifdpif.exe
1232	Lllagh32.exe
4172	Flcfnn32.exe
3568	Abbiej32.exe
4396	Pahpee32.exe
1008	Dlmegd32.exe
3428	Elaobdmm.exe
4540	Eangjkkd.exe
4452	Eldlhckj.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Ljaoeini.exe	Kqphfe32.exe
File created	C:\Windows\SysWOW64\Lcnmin32.exe	Lclpdncg.exe
File opened for modification	C:\Windows\SysWOW64\Gngeik32.exe	Phajna32.exe
File opened for modification	C:\Windows\SysWOW64\Kolabf32.exe	Kedlip32.exe
File created	C:\Windows\SysWOW64\Oidodncg.dll	Abbiej32.exe
File created	C:\Windows\SysWOW64\Eldlhckj.exe	Eangjkkd.exe
File opened for modification	C:\Windows\SysWOW64\Mgbefe32.exe	Imkbnf32.exe
File opened for modification	C:\Windows\SysWOW64\Kclgmq32.exe	Jgeghp32.exe
File opened for modification	C:\Windows\SysWOW64\Kqphfe32.exe	Kclgmq32.exe
File opened for modification	C:\Windows\SysWOW64\Nggnadib.exe	Mgbefe32.exe
File created	C:\Windows\SysWOW64\Oclkgccf.exe	Nmfcok32.exe
File created	C:\Windows\SysWOW64\Ehfomc32.dll	Kedlip32.exe
File created	C:\Windows\SysWOW64\Flcfnn32.exe	Lllagh32.exe
File opened for modification	C:\Windows\SysWOW64\Jgeghp32.exe	NEAS.2d7ac521126722f68325575d9e81f100.exe
File created	C:\Windows\SysWOW64\Lclpdncg.exe	Ldgccb32.exe
File created	C:\Windows\SysWOW64\Mgbefe32.exe	Imkbnf32.exe
File created	C:\Windows\SysWOW64\Gfkcaoef.dll	Nggnadib.exe
File created	C:\Windows\SysWOW64\Dbdjofbi.dll	Ocohmc32.exe
File created	C:\Windows\SysWOW64\Gngeik32.exe	Phajna32.exe
File created	C:\Windows\SysWOW64\Ajiqfi32.dll	Gngeik32.exe
File created	C:\Windows\SysWOW64\Abbiej32.exe	Flcfnn32.exe
File created	C:\Windows\SysWOW64\Bchign32.dll	Lclpdncg.exe
File created	C:\Windows\SysWOW64\Imkbnf32.exe	Fmkqpkla.exe
File created	C:\Windows\SysWOW64\Fdahdiml.dll	Fmkqpkla.exe
File opened for modification	C:\Windows\SysWOW64\Npbceggm.exe	Nggnadib.exe
File created	C:\Windows\SysWOW64\Ocgeag32.dll	Nmfcok32.exe
File opened for modification	C:\Windows\SysWOW64\Phajna32.exe	Ocohmc32.exe
File created	C:\Windows\SysWOW64\Lllagh32.exe	Keifdpif.exe
File created	C:\Windows\SysWOW64\Iophkojl.dll	Jgeghp32.exe
File opened for modification	C:\Windows\SysWOW64\Ljaoeini.exe	Kqphfe32.exe
File opened for modification	C:\Windows\SysWOW64\Imkbnf32.exe	Fmkqpkla.exe
File created	C:\Windows\SysWOW64\Ocohmc32.exe	Oclkgccf.exe
File created	C:\Windows\SysWOW64\Hbenoi32.exe	Gngeik32.exe
File opened for modification	C:\Windows\SysWOW64\Eangjkkd.exe	Elaobdmm.exe
File created	C:\Windows\SysWOW64\Jgeghp32.exe	NEAS.2d7ac521126722f68325575d9e81f100.exe
File created	C:\Windows\SysWOW64\Npbceggm.exe	Nggnadib.exe
File opened for modification	C:\Windows\SysWOW64\Pahpee32.exe	Abbiej32.exe
File opened for modification	C:\Windows\SysWOW64\Dlmegd32.exe	Pahpee32.exe
File created	C:\Windows\SysWOW64\Ejljgqdp.dll	NEAS.2d7ac521126722f68325575d9e81f100.exe
File created	C:\Windows\SysWOW64\Nmfcok32.exe	Npbceggm.exe
File created	C:\Windows\SysWOW64\Phajna32.exe	Ocohmc32.exe
File created	C:\Windows\SysWOW64\Jekjcaef.exe	Hbenoi32.exe
File created	C:\Windows\SysWOW64\Khnhommq.dll	Jemfhacc.exe
File created	C:\Windows\SysWOW64\Ppcjmk32.dll	Flcfnn32.exe
File created	C:\Windows\SysWOW64\Pahpee32.exe	Abbiej32.exe
File opened for modification	C:\Windows\SysWOW64\Lclpdncg.exe	Ldgccb32.exe
File created	C:\Windows\SysWOW64\Fkccgodj.dll	Lcnmin32.exe
File opened for modification	C:\Windows\SysWOW64\Jekjcaef.exe	Hbenoi32.exe
File created	C:\Windows\SysWOW64\Iaejqcdo.dll	Hbenoi32.exe
File created	C:\Windows\SysWOW64\Keifdpif.exe	Kolabf32.exe
File created	C:\Windows\SysWOW64\Jlbdab32.dll	Ldgccb32.exe
File opened for modification	C:\Windows\SysWOW64\Lcnmin32.exe	Lclpdncg.exe
File created	C:\Windows\SysWOW64\Fmkqpkla.exe	Lcnmin32.exe
File opened for modification	C:\Windows\SysWOW64\Fmkqpkla.exe	Lcnmin32.exe
File created	C:\Windows\SysWOW64\Jihiic32.dll	Mgbefe32.exe
File opened for modification	C:\Windows\SysWOW64\Hbenoi32.exe	Gngeik32.exe
File created	C:\Windows\SysWOW64\Kedlip32.exe	Jemfhacc.exe
File opened for modification	C:\Windows\SysWOW64\Abbiej32.exe	Flcfnn32.exe
File created	C:\Windows\SysWOW64\Nnahhegq.dll	Oclkgccf.exe
File created	C:\Windows\SysWOW64\Dgpamjnb.dll	Phajna32.exe
File created	C:\Windows\SysWOW64\Kolabf32.exe	Kedlip32.exe
File opened for modification	C:\Windows\SysWOW64\Flcfnn32.exe	Lllagh32.exe
File opened for modification	C:\Windows\SysWOW64\Lllagh32.exe	Keifdpif.exe
File created	C:\Windows\SysWOW64\Kqphfe32.exe	Kclgmq32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1108	4452	WerFault.exe	125

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jekjcaef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Abbiej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Edcijq32.dll"	Pahpee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jhhgefed.dll"	Dlmegd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Imkbnf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ldgccb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fkccgodj.dll"	Lcnmin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fmkqpkla.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akkeajoj.dll"	Imkbnf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jihiic32.dll"	Mgbefe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ocgeag32.dll"	Nmfcok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nmfcok32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	NEAS.2d7ac521126722f68325575d9e81f100.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Npbceggm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nnahhegq.dll"	Oclkgccf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iaejqcdo.dll"	Hbenoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehfomc32.dll"	Kedlip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Foaeccgp.dll"	Elaobdmm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Npbceggm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jemfhacc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Keifdpif.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lllagh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Flcfnn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ajiqfi32.dll"	Gngeik32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehkljb32.dll"	Ljaoeini.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bchign32.dll"	Lclpdncg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lclpdncg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ofkhpmpa.dll"	Npbceggm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hbenoi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	NEAS.2d7ac521126722f68325575d9e81f100.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kqphfe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mgbefe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nggnadib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Phajna32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pahpee32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jgeghp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jgeghp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kclgmq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kqphfe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fdahdiml.dll"	Fmkqpkla.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nmfcok32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ocohmc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Phajna32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	NEAS.2d7ac521126722f68325575d9e81f100.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dlmegd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mgbefe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oclkgccf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oclkgccf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eiidnkam.dll"	Kolabf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lllagh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Apleaenp.dll"	Eangjkkd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Inmabofh.dll"	Kclgmq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dgpamjnb.dll"	Phajna32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ieicjl32.dll"	Jekjcaef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kolabf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dlmegd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fmkqpkla.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Elaobdmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hbenoi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lclpdncg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lcnmin32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gngeik32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jemfhacc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Keifdpif.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2276	2416	NEAS.2d7ac521126722f68325575d9e81f100.exe	86
PID 2416 wrote to memory of 2276	2416	NEAS.2d7ac521126722f68325575d9e81f100.exe	86
PID 2416 wrote to memory of 2276	2416	NEAS.2d7ac521126722f68325575d9e81f100.exe	86
PID 2276 wrote to memory of 4380	2276	Jgeghp32.exe	87
PID 2276 wrote to memory of 4380	2276	Jgeghp32.exe	87
PID 2276 wrote to memory of 4380	2276	Jgeghp32.exe	87
PID 4380 wrote to memory of 3212	4380	Kclgmq32.exe	88
PID 4380 wrote to memory of 3212	4380	Kclgmq32.exe	88
PID 4380 wrote to memory of 3212	4380	Kclgmq32.exe	88
PID 3212 wrote to memory of 4524	3212	Kqphfe32.exe	89
PID 3212 wrote to memory of 4524	3212	Kqphfe32.exe	89
PID 3212 wrote to memory of 4524	3212	Kqphfe32.exe	89
PID 4524 wrote to memory of 2132	4524	Ljaoeini.exe	91
PID 4524 wrote to memory of 2132	4524	Ljaoeini.exe	91
PID 4524 wrote to memory of 2132	4524	Ljaoeini.exe	91
PID 2132 wrote to memory of 3624	2132	Ldgccb32.exe	92
PID 2132 wrote to memory of 3624	2132	Ldgccb32.exe	92
PID 2132 wrote to memory of 3624	2132	Ldgccb32.exe	92
PID 3624 wrote to memory of 2456	3624	Lclpdncg.exe	94
PID 3624 wrote to memory of 2456	3624	Lclpdncg.exe	94
PID 3624 wrote to memory of 2456	3624	Lclpdncg.exe	94
PID 2456 wrote to memory of 2184	2456	Lcnmin32.exe	96
PID 2456 wrote to memory of 2184	2456	Lcnmin32.exe	96
PID 2456 wrote to memory of 2184	2456	Lcnmin32.exe	96
PID 2184 wrote to memory of 556	2184	Fmkqpkla.exe	98
PID 2184 wrote to memory of 556	2184	Fmkqpkla.exe	98
PID 2184 wrote to memory of 556	2184	Fmkqpkla.exe	98
PID 556 wrote to memory of 400	556	Imkbnf32.exe	100
PID 556 wrote to memory of 400	556	Imkbnf32.exe	100
PID 556 wrote to memory of 400	556	Imkbnf32.exe	100
PID 400 wrote to memory of 1788	400	Mgbefe32.exe	101
PID 400 wrote to memory of 1788	400	Mgbefe32.exe	101
PID 400 wrote to memory of 1788	400	Mgbefe32.exe	101
PID 1788 wrote to memory of 1576	1788	Nggnadib.exe	102
PID 1788 wrote to memory of 1576	1788	Nggnadib.exe	102
PID 1788 wrote to memory of 1576	1788	Nggnadib.exe	102
PID 1576 wrote to memory of 2956	1576	Npbceggm.exe	104
PID 1576 wrote to memory of 2956	1576	Npbceggm.exe	104
PID 1576 wrote to memory of 2956	1576	Npbceggm.exe	104
PID 2956 wrote to memory of 3744	2956	Nmfcok32.exe	105
PID 2956 wrote to memory of 3744	2956	Nmfcok32.exe	105
PID 2956 wrote to memory of 3744	2956	Nmfcok32.exe	105
PID 3744 wrote to memory of 740	3744	Oclkgccf.exe	106
PID 3744 wrote to memory of 740	3744	Oclkgccf.exe	106
PID 3744 wrote to memory of 740	3744	Oclkgccf.exe	106
PID 740 wrote to memory of 1552	740	Ocohmc32.exe	107
PID 740 wrote to memory of 1552	740	Ocohmc32.exe	107
PID 740 wrote to memory of 1552	740	Ocohmc32.exe	107
PID 1552 wrote to memory of 220	1552	Phajna32.exe	108
PID 1552 wrote to memory of 220	1552	Phajna32.exe	108
PID 1552 wrote to memory of 220	1552	Phajna32.exe	108
PID 220 wrote to memory of 1120	220	Gngeik32.exe	109
PID 220 wrote to memory of 1120	220	Gngeik32.exe	109
PID 220 wrote to memory of 1120	220	Gngeik32.exe	109
PID 1120 wrote to memory of 4420	1120	Hbenoi32.exe	111
PID 1120 wrote to memory of 4420	1120	Hbenoi32.exe	111
PID 1120 wrote to memory of 4420	1120	Hbenoi32.exe	111
PID 4792 wrote to memory of 4300	4792	Jemfhacc.exe	113
PID 4792 wrote to memory of 4300	4792	Jemfhacc.exe	113
PID 4792 wrote to memory of 4300	4792	Jemfhacc.exe	113
PID 4300 wrote to memory of 1548	4300	Kedlip32.exe	114
PID 4300 wrote to memory of 1548	4300	Kedlip32.exe	114
PID 4300 wrote to memory of 1548	4300	Kedlip32.exe	114
PID 1548 wrote to memory of 4024	1548	Kolabf32.exe	115

C:\Users\Admin\AppData\Local\Temp\NEAS.2d7ac521126722f68325575d9e81f100.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.2d7ac521126722f68325575d9e81f100.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\SysWOW64\Jgeghp32.exe
  C:\Windows\system32\Jgeghp32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2276
- - C:\Windows\SysWOW64\Kclgmq32.exe
    C:\Windows\system32\Kclgmq32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4380
  - - C:\Windows\SysWOW64\Kqphfe32.exe
      C:\Windows\system32\Kqphfe32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3212
    - - C:\Windows\SysWOW64\Ljaoeini.exe
        
        C:\Windows\system32\Ljaoeini.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4524
      - C:\Windows\SysWOW64\Ldgccb32.exe
        
        C:\Windows\system32\Ldgccb32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2132
        
        C:\Windows\SysWOW64\Lclpdncg.exe
        
        C:\Windows\system32\Lclpdncg.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3624
        
        C:\Windows\SysWOW64\Lcnmin32.exe
        
        C:\Windows\system32\Lcnmin32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2456
        
        C:\Windows\SysWOW64\Fmkqpkla.exe
        
        C:\Windows\system32\Fmkqpkla.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2184
        
        C:\Windows\SysWOW64\Imkbnf32.exe
        
        C:\Windows\system32\Imkbnf32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:556
        
        C:\Windows\SysWOW64\Mgbefe32.exe
        
        C:\Windows\system32\Mgbefe32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:400
        
        C:\Windows\SysWOW64\Nggnadib.exe
        
        C:\Windows\system32\Nggnadib.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1788
        
        C:\Windows\SysWOW64\Npbceggm.exe
        
        C:\Windows\system32\Npbceggm.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1576
        
        C:\Windows\SysWOW64\Nmfcok32.exe
        
        C:\Windows\system32\Nmfcok32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2956
        
        C:\Windows\SysWOW64\Oclkgccf.exe
        
        C:\Windows\system32\Oclkgccf.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3744
        
        C:\Windows\SysWOW64\Ocohmc32.exe
        
        C:\Windows\system32\Ocohmc32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:740
        
        C:\Windows\SysWOW64\Phajna32.exe
        
        C:\Windows\system32\Phajna32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1552
        
        C:\Windows\SysWOW64\Gngeik32.exe
        
        C:\Windows\system32\Gngeik32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:220
        
        C:\Windows\SysWOW64\Hbenoi32.exe
        
        C:\Windows\system32\Hbenoi32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1120
        
        C:\Windows\SysWOW64\Jekjcaef.exe
        
        C:\Windows\system32\Jekjcaef.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4420
        
        C:\Windows\SysWOW64\Jemfhacc.exe
        
        C:\Windows\system32\Jemfhacc.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4792
        
        C:\Windows\SysWOW64\Kedlip32.exe
        
        C:\Windows\system32\Kedlip32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4300
        
        C:\Windows\SysWOW64\Kolabf32.exe
        
        C:\Windows\system32\Kolabf32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1548
        
        C:\Windows\SysWOW64\Keifdpif.exe
        
        C:\Windows\system32\Keifdpif.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4024
        
        C:\Windows\SysWOW64\Lllagh32.exe
        
        C:\Windows\system32\Lllagh32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1232
        
        C:\Windows\SysWOW64\Flcfnn32.exe
        
        C:\Windows\system32\Flcfnn32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4172
        
        C:\Windows\SysWOW64\Abbiej32.exe
        
        C:\Windows\system32\Abbiej32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3568
        
        C:\Windows\SysWOW64\Pahpee32.exe
        
        C:\Windows\system32\Pahpee32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4396
        
        C:\Windows\SysWOW64\Dlmegd32.exe
        
        C:\Windows\system32\Dlmegd32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1008
        
        C:\Windows\SysWOW64\Elaobdmm.exe
        
        C:\Windows\system32\Elaobdmm.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3428
        
        C:\Windows\SysWOW64\Eangjkkd.exe
        
        C:\Windows\system32\Eangjkkd.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4540
        
        C:\Windows\SysWOW64\Eldlhckj.exe
        
        C:\Windows\system32\Eldlhckj.exe
        32⤵
        Executes dropped EXE
        
        PID:4452
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 408
        33⤵
        Program crash
        
        PID:1108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4452 -ip 4452
1⤵
PID:3292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Abbiej32.exe

Filesize
1.7MB

MD5
99c1409ebdd762fb317ad5a83efcf88b

SHA1
2ea259423c948e8b983fdbb7c6a892fdda89716f

SHA256
1e0b5cedc648f8b418a0e7f0506c55b78f2014c5c5607a4a99d4f86bdca5323a

SHA512
179c881f2ef35cd45daa40229dfb4c83d259900af077f9d6d8013c4e81562b800e6c7d4442922df688fbfd1a33c3e4006747bb65cff613f47714f9bb3e26e606

Download Submit
C:\Windows\SysWOW64\Abbiej32.exe

Filesize
1.7MB

MD5
91795140c303d530d8469220b6d8a802

SHA1
2169e70ad6d844f9abe1b850fc70bd7199bed3a5

SHA256
81aef6d45dfb8866fe981570cde961ed13eb2074f866f26a78e3221bd1714830

SHA512
2984cfbf52192093bed275c19423ce3b0913f0d03431fe29e53c0f29aa3377c1aa24ce801971895c112e86302e1b379252705242fed0005fdf6462010de124cf

Download Submit
C:\Windows\SysWOW64\Abbiej32.exe

Filesize
1.7MB

MD5
91795140c303d530d8469220b6d8a802

SHA1
2169e70ad6d844f9abe1b850fc70bd7199bed3a5

SHA256
81aef6d45dfb8866fe981570cde961ed13eb2074f866f26a78e3221bd1714830

SHA512
2984cfbf52192093bed275c19423ce3b0913f0d03431fe29e53c0f29aa3377c1aa24ce801971895c112e86302e1b379252705242fed0005fdf6462010de124cf

Download Submit
C:\Windows\SysWOW64\Dlmegd32.exe

Filesize
1.7MB

MD5
020f87f7a5effa8e290e0fa82413c5ba

SHA1
673ab1a2b821c528a3c6ad46c116e15023837163

SHA256
6ce262d7ceae140700fc839ee210e5a1b9c11919c86771440a4cbad5e7e54972

SHA512
1c213cdc3693e3525de966191ff4ae93b256898035d29f9aaa87517b9a864940ad8402dcf6016742d20fbd19b59d832a4ffbc091012647f7830131c4f0719e7a

Download Submit
C:\Windows\SysWOW64\Dlmegd32.exe

Filesize
1.7MB

MD5
020f87f7a5effa8e290e0fa82413c5ba

SHA1
673ab1a2b821c528a3c6ad46c116e15023837163

SHA256
6ce262d7ceae140700fc839ee210e5a1b9c11919c86771440a4cbad5e7e54972

SHA512
1c213cdc3693e3525de966191ff4ae93b256898035d29f9aaa87517b9a864940ad8402dcf6016742d20fbd19b59d832a4ffbc091012647f7830131c4f0719e7a

Download Submit
C:\Windows\SysWOW64\Eangjkkd.exe

Filesize
1.7MB

MD5
63674fafe9a0bd347b034690762a3a6b

SHA1
f0c3ffa6c0b04d77065d43936540e827ce84df1b

SHA256
11adc08cfbe2389eba371578f71ab19cf394d69fae6212a73be46921145a4446

SHA512
46de4f739188d3dd486732b4fa802c0fe6868469fdf87d2454f2bca51407ced2c9ae10ad1bd15359e79c31be09fdfbf175c89e85751f5eb182fe6a31f48d63f7

Download Submit
C:\Windows\SysWOW64\Eangjkkd.exe

Filesize
1.7MB

MD5
63674fafe9a0bd347b034690762a3a6b

SHA1
f0c3ffa6c0b04d77065d43936540e827ce84df1b

SHA256
11adc08cfbe2389eba371578f71ab19cf394d69fae6212a73be46921145a4446

SHA512
46de4f739188d3dd486732b4fa802c0fe6868469fdf87d2454f2bca51407ced2c9ae10ad1bd15359e79c31be09fdfbf175c89e85751f5eb182fe6a31f48d63f7

Download Submit
C:\Windows\SysWOW64\Elaobdmm.exe

Filesize
1.7MB

MD5
6404afd5866ed67e481772b6dbfa6325

SHA1
8973a0f6e4a0f4698437d6ac0152d161737e6a1d

SHA256
d7b72a232923710c350fcd507c91c09fa8599f5b7d981585b2444f46ba0c6be4

SHA512
2bee9d83420087c3ac0439f667f5bdf6faccf49252e13607a6ae89c3d18987f9727e710101b60f0c1cc9622fe94a0d11a1c2131cdcc051550581a43a2470427b

Download Submit
C:\Windows\SysWOW64\Elaobdmm.exe

Filesize
1.7MB

MD5
6404afd5866ed67e481772b6dbfa6325

SHA1
8973a0f6e4a0f4698437d6ac0152d161737e6a1d

SHA256
d7b72a232923710c350fcd507c91c09fa8599f5b7d981585b2444f46ba0c6be4

SHA512
2bee9d83420087c3ac0439f667f5bdf6faccf49252e13607a6ae89c3d18987f9727e710101b60f0c1cc9622fe94a0d11a1c2131cdcc051550581a43a2470427b

Download Submit
C:\Windows\SysWOW64\Eldlhckj.exe

Filesize
1.7MB

MD5
d4b42f697c5cc44cc67434ad1121af38

SHA1
892d3bc8aa19b92913067b3be549fa39e5e2f0a7

SHA256
fa246b8eda52244062cf31ad7ffe21227caa2e557285dfd04290a4059ccb7f19

SHA512
9131d98ec35067e1c100b3597457ff1029a70b483e1706611f22e45301948b343b2188c19ff6496336dfaf1f36a65ae67c8762e2c99c7ee229b7ecb593176bb7

Download Submit
C:\Windows\SysWOW64\Eldlhckj.exe

Filesize
1.7MB

MD5
d4b42f697c5cc44cc67434ad1121af38

SHA1
892d3bc8aa19b92913067b3be549fa39e5e2f0a7

SHA256
fa246b8eda52244062cf31ad7ffe21227caa2e557285dfd04290a4059ccb7f19

SHA512
9131d98ec35067e1c100b3597457ff1029a70b483e1706611f22e45301948b343b2188c19ff6496336dfaf1f36a65ae67c8762e2c99c7ee229b7ecb593176bb7

Download Submit
C:\Windows\SysWOW64\Flcfnn32.exe

Filesize
1.7MB

MD5
99c1409ebdd762fb317ad5a83efcf88b

SHA1
2ea259423c948e8b983fdbb7c6a892fdda89716f

SHA256
1e0b5cedc648f8b418a0e7f0506c55b78f2014c5c5607a4a99d4f86bdca5323a

SHA512
179c881f2ef35cd45daa40229dfb4c83d259900af077f9d6d8013c4e81562b800e6c7d4442922df688fbfd1a33c3e4006747bb65cff613f47714f9bb3e26e606

Download Submit
C:\Windows\SysWOW64\Flcfnn32.exe

Filesize
1.7MB

MD5
99c1409ebdd762fb317ad5a83efcf88b

SHA1
2ea259423c948e8b983fdbb7c6a892fdda89716f

SHA256
1e0b5cedc648f8b418a0e7f0506c55b78f2014c5c5607a4a99d4f86bdca5323a

SHA512
179c881f2ef35cd45daa40229dfb4c83d259900af077f9d6d8013c4e81562b800e6c7d4442922df688fbfd1a33c3e4006747bb65cff613f47714f9bb3e26e606

Download Submit
C:\Windows\SysWOW64\Fmkqpkla.exe

Filesize
1.7MB

MD5
f75f670695e962a3e3fb084c42660a35

SHA1
a75091de08dc76824e22b9ab19326700892ef73a

SHA256
2c71fcd83cca8fa11e57f050d548988df5cc0a97e1d627da2aec8ebf3edb3c71

SHA512
2013f8ecff7bf816377f17df2b19cac305edbbb23e30b0b3edb5e2fcd00671157906b94a76fd839307da3bf8774d44ffb7d239d24dc5ad5a54470d06830eb087

Download Submit
C:\Windows\SysWOW64\Fmkqpkla.exe

Filesize
1.7MB

MD5
f75f670695e962a3e3fb084c42660a35

SHA1
a75091de08dc76824e22b9ab19326700892ef73a

SHA256
2c71fcd83cca8fa11e57f050d548988df5cc0a97e1d627da2aec8ebf3edb3c71

SHA512
2013f8ecff7bf816377f17df2b19cac305edbbb23e30b0b3edb5e2fcd00671157906b94a76fd839307da3bf8774d44ffb7d239d24dc5ad5a54470d06830eb087

Download Submit
C:\Windows\SysWOW64\Gngeik32.exe

Filesize
1.7MB

MD5
421be8af38a1f9fdebd435f95900aa76

SHA1
37ca8b6bac015b24f18849ac6511bb31886ced77

SHA256
a603aa2a9a845516c4a27c0560f62999fdc771bf61fce1396bb5bee9ff4e5cf9

SHA512
9d9682b35da6f701701ec16a50a200cc68da8c8e00457583355d959c443c5b3a63203824ad3cb4ca3955970c5a2e4941c04cdb8056c9a4d8a7f89b907322442b

Download Submit
C:\Windows\SysWOW64\Gngeik32.exe

Filesize
1.7MB

MD5
421be8af38a1f9fdebd435f95900aa76

SHA1
37ca8b6bac015b24f18849ac6511bb31886ced77

SHA256
a603aa2a9a845516c4a27c0560f62999fdc771bf61fce1396bb5bee9ff4e5cf9

SHA512
9d9682b35da6f701701ec16a50a200cc68da8c8e00457583355d959c443c5b3a63203824ad3cb4ca3955970c5a2e4941c04cdb8056c9a4d8a7f89b907322442b

Download Submit
C:\Windows\SysWOW64\Hbenoi32.exe

Filesize
1.7MB

MD5
f1bfba99cb085a5df73e9f74b692ba89

SHA1
5b411cdfaec9c63d7f5fae044539feeb038f3c65

SHA256
2a37172c41769dd8ebf2d92a47f3d1af405ed73a091defb08f4b90e0b0f1cc6b

SHA512
6a0422684b9572ec2f5842819f27d00a282464d381fd1e0e9e46c31ca0d68d21a97ccf6658f12ba7df35152b22d2be1582bf2f0cb7850687559c49ef1c6f1c86

Download Submit
C:\Windows\SysWOW64\Hbenoi32.exe

Filesize
1.7MB

MD5
f1bfba99cb085a5df73e9f74b692ba89

SHA1
5b411cdfaec9c63d7f5fae044539feeb038f3c65

SHA256
2a37172c41769dd8ebf2d92a47f3d1af405ed73a091defb08f4b90e0b0f1cc6b

SHA512
6a0422684b9572ec2f5842819f27d00a282464d381fd1e0e9e46c31ca0d68d21a97ccf6658f12ba7df35152b22d2be1582bf2f0cb7850687559c49ef1c6f1c86

Download Submit
C:\Windows\SysWOW64\Imkbnf32.exe

Filesize
1.7MB

MD5
19b9d3a8c02ec8987c525b41244a616d

SHA1
6e51245701993547772275e9d25cf2487f54f744

SHA256
788fcd5e53c7199f2c46baa2177e79b6146520d75f07518f61092cb69863383a

SHA512
bfa1e531d2905a5ebe1c64f2de50517d9997fae0dea41035168060ce0059774e3934d23ac54d122af60d69e0eeadae9fb04486a11050283f13aed689f1770b5b

Download Submit
C:\Windows\SysWOW64\Imkbnf32.exe

Filesize
1.7MB

MD5
19b9d3a8c02ec8987c525b41244a616d

SHA1
6e51245701993547772275e9d25cf2487f54f744

SHA256
788fcd5e53c7199f2c46baa2177e79b6146520d75f07518f61092cb69863383a

SHA512
bfa1e531d2905a5ebe1c64f2de50517d9997fae0dea41035168060ce0059774e3934d23ac54d122af60d69e0eeadae9fb04486a11050283f13aed689f1770b5b

Download Submit
C:\Windows\SysWOW64\Jekjcaef.exe

Filesize
1.7MB

MD5
399f083e26bb1cf14ea3755b20199751

SHA1
53df12def1b73c5be0b919e4f947b21b425940d5

SHA256
9cd11c35a78a2011487090d2d120e1e41d80f76bd507e483dc87220c2c4e60fd

SHA512
f8b659ecbabb4b2e42edee3470c8a359c89e86b0f71ace0eeba0c637fe120af07ff6432e95d3e576105bda4bd62e17605f6df9b36fb8a7436a3072af590ee25f

Download Submit
C:\Windows\SysWOW64\Jgeghp32.exe

Filesize
1.7MB

MD5
4cc1c4772c593ae1314c83a0c8d2aa5a

SHA1
f66f76f3f25833787cc8b99360869d73f8cde62c

SHA256
4b657177aa5112429ed90ccd61f107ae77938e0a386fa66a288cf571e94c9347

SHA512
77ad86d4f212173dfec34464e4ccef4185bed75aed51553a8998df004047cee356fe8fa6db163c2ff3b9f5ae192c12ba81958301934410fd591adc8e06f7e286

Download Submit
C:\Windows\SysWOW64\Jgeghp32.exe

Filesize
1.7MB

MD5
4cc1c4772c593ae1314c83a0c8d2aa5a

SHA1
f66f76f3f25833787cc8b99360869d73f8cde62c

SHA256
4b657177aa5112429ed90ccd61f107ae77938e0a386fa66a288cf571e94c9347

SHA512
77ad86d4f212173dfec34464e4ccef4185bed75aed51553a8998df004047cee356fe8fa6db163c2ff3b9f5ae192c12ba81958301934410fd591adc8e06f7e286

Download Submit
C:\Windows\SysWOW64\Kclgmq32.exe

Filesize
1.7MB

MD5
44a7ee23fa9e826506ff7aa7402dd9da

SHA1
6b41f417a465f7960acd329b8d769a8f8a39bfe5

SHA256
b5e6b48d0718b64870a19dec40b5a6a2c4c58cd19071d2cee106538ef3f24526

SHA512
2d258deb119d8778b1b8b46ce6db3e0e187dd3b2e3bcbf313328e2cf327aca19b31d73ab9e48a52c4880701d9e36456f8e7683faa26bb7eace4d8a95a3a13d71

Download Submit
C:\Windows\SysWOW64\Kclgmq32.exe

Filesize
1.7MB

MD5
44a7ee23fa9e826506ff7aa7402dd9da

SHA1
6b41f417a465f7960acd329b8d769a8f8a39bfe5

SHA256
b5e6b48d0718b64870a19dec40b5a6a2c4c58cd19071d2cee106538ef3f24526

SHA512
2d258deb119d8778b1b8b46ce6db3e0e187dd3b2e3bcbf313328e2cf327aca19b31d73ab9e48a52c4880701d9e36456f8e7683faa26bb7eace4d8a95a3a13d71

Download Submit
C:\Windows\SysWOW64\Kedlip32.exe

Filesize
1.7MB

MD5
c35955ed409705b5638d9aae0000410c

SHA1
a4a622a3b7a761f3ba030a63c262a665031aba83

SHA256
b8ad8719ea3ce27b7aced59a7b8d189746cc7e7b910575578861920c2265da79

SHA512
cd8777659ac199d3d670bb2b5d097d4b3a8255458d760f6da56b69b0130c5d02bdd7444dc5c22a1efd2253a4cf849704528e1f90b7a3b25ce6d0b986303adc9e

Download Submit
C:\Windows\SysWOW64\Kedlip32.exe

Filesize
1.7MB

MD5
c35955ed409705b5638d9aae0000410c

SHA1
a4a622a3b7a761f3ba030a63c262a665031aba83

SHA256
b8ad8719ea3ce27b7aced59a7b8d189746cc7e7b910575578861920c2265da79

SHA512
cd8777659ac199d3d670bb2b5d097d4b3a8255458d760f6da56b69b0130c5d02bdd7444dc5c22a1efd2253a4cf849704528e1f90b7a3b25ce6d0b986303adc9e

Download Submit
C:\Windows\SysWOW64\Keifdpif.exe

Filesize
1.7MB

MD5
8e15b217f76c938fca1fe7dd382fc2f9

SHA1
35238368effa2127a6b0220cc87603807814a043

SHA256
e6b51bed97a0d37c732d80a96023647d64d67be8e61de83e6de45c634d0a3efc

SHA512
2a09fb9ff9474308c0f1899946d7922f0d4d0707c07c359ab0fdab910d7238ad2791eb950bb744f5c25964157db2b90f7cfe4e41213e80f471a99153e846585c

Download Submit
C:\Windows\SysWOW64\Keifdpif.exe

Filesize
1.7MB

MD5
8e15b217f76c938fca1fe7dd382fc2f9

SHA1
35238368effa2127a6b0220cc87603807814a043

SHA256
e6b51bed97a0d37c732d80a96023647d64d67be8e61de83e6de45c634d0a3efc

SHA512
2a09fb9ff9474308c0f1899946d7922f0d4d0707c07c359ab0fdab910d7238ad2791eb950bb744f5c25964157db2b90f7cfe4e41213e80f471a99153e846585c

Download Submit
C:\Windows\SysWOW64\Kolabf32.exe

Filesize
1.7MB

MD5
98d47186a5089a24187667b7ca7706e8

SHA1
b71597ad57184a22524717d455df7f9d8ea30ae0

SHA256
dc5fcdd6a6f023007ab7ccc6fc87198a588af8f0c0c915d8f96c312c6de04c71

SHA512
5a329f06ce100aae2b8ea8bb11e89bfc57fc2963a26798e530c00ef6c96af6664d544a09f4a7825e6761ab688d27029eac4bfc6b6aad6bf60da294465538eaa3

Download Submit
C:\Windows\SysWOW64\Kolabf32.exe

Filesize
1.7MB

MD5
98d47186a5089a24187667b7ca7706e8

SHA1
b71597ad57184a22524717d455df7f9d8ea30ae0

SHA256
dc5fcdd6a6f023007ab7ccc6fc87198a588af8f0c0c915d8f96c312c6de04c71

SHA512
5a329f06ce100aae2b8ea8bb11e89bfc57fc2963a26798e530c00ef6c96af6664d544a09f4a7825e6761ab688d27029eac4bfc6b6aad6bf60da294465538eaa3

Download Submit
C:\Windows\SysWOW64\Kqphfe32.exe

Filesize
1.7MB

MD5
066a358ec496ad1d74578265639b3020

SHA1
6f9f7fd68574590d0693e232386778a6b7122ff6

SHA256
56e64a227bfd4e76c407847682b99fac49e052752368317f8d6d6ddbbe189123

SHA512
ac4a9aa8871c4dae324633c5f3da2caac9b3c6583f14bd98bedea873194fc5893be880fb1e4428bdc82464860d9748e47f9664b58bc9dfe37e67d0fe33b0675c

Download Submit
C:\Windows\SysWOW64\Kqphfe32.exe

Filesize
1.7MB

MD5
066a358ec496ad1d74578265639b3020

SHA1
6f9f7fd68574590d0693e232386778a6b7122ff6

SHA256
56e64a227bfd4e76c407847682b99fac49e052752368317f8d6d6ddbbe189123

SHA512
ac4a9aa8871c4dae324633c5f3da2caac9b3c6583f14bd98bedea873194fc5893be880fb1e4428bdc82464860d9748e47f9664b58bc9dfe37e67d0fe33b0675c

Download Submit
C:\Windows\SysWOW64\Lclpdncg.exe

Filesize
1.7MB

MD5
06f40e451b0cb52a90ebc6addfe918aa

SHA1
805af79104fba6e84f40607d531e111ab31efb69

SHA256
0dde89182fc8174af19ebffd9da4639a11136eb38e67d0920f4c341c016976bf

SHA512
1f693eff797677fb90118dc3609bc464d3ab048fc94f9cb6dca6becd211ffca6c44674ef397847bc4a4e82ecdd60c2a954d7f3f4d2f57a99e347e18404773de1

Download Submit
C:\Windows\SysWOW64\Lclpdncg.exe

Filesize
1.7MB

MD5
06f40e451b0cb52a90ebc6addfe918aa

SHA1
805af79104fba6e84f40607d531e111ab31efb69

SHA256
0dde89182fc8174af19ebffd9da4639a11136eb38e67d0920f4c341c016976bf

SHA512
1f693eff797677fb90118dc3609bc464d3ab048fc94f9cb6dca6becd211ffca6c44674ef397847bc4a4e82ecdd60c2a954d7f3f4d2f57a99e347e18404773de1

Download Submit
C:\Windows\SysWOW64\Lcnmin32.exe

Filesize
1.7MB

MD5
4414b363716ceee0c0dbf0ed12bee8a8

SHA1
297b91d6af2e20a2ef45b573a14c80c776e2ede6

SHA256
2ccf4de0fe0f72a0c0365b59313a2b6a1b5e0c2fe538b8a5baf7da4c14e02ac8

SHA512
e39c873d6ac23dd1713d08dbcb2f6a0edff83080a406076237dc66a5df8b7fb3c7a2e278066fd99edc61c46975ccfc0736560e6a6cefd2bb15849745b35d0366

Download Submit
C:\Windows\SysWOW64\Lcnmin32.exe

Filesize
1.7MB

MD5
4414b363716ceee0c0dbf0ed12bee8a8

SHA1
297b91d6af2e20a2ef45b573a14c80c776e2ede6

SHA256
2ccf4de0fe0f72a0c0365b59313a2b6a1b5e0c2fe538b8a5baf7da4c14e02ac8

SHA512
e39c873d6ac23dd1713d08dbcb2f6a0edff83080a406076237dc66a5df8b7fb3c7a2e278066fd99edc61c46975ccfc0736560e6a6cefd2bb15849745b35d0366

Download Submit
C:\Windows\SysWOW64\Ldgccb32.exe

Filesize
1.7MB

MD5
4897f77ed1dbe5754ae13f479fd190b3

SHA1
c50f9437c3017be13b678e403f4b1a8f0b4a1f61

SHA256
69a0139e06cf8061533dfa547951fbe208cfc9524db5c0bd9631e48909721dbc

SHA512
3eba0670dc72e4cb740408db7338e4660376053964642b3eb8aa05105f67955bf241631497f68442f48592460a235aa9640555f4b02c69223bd96307e9f098b7

Download Submit
C:\Windows\SysWOW64\Ldgccb32.exe

Filesize
1.7MB

MD5
4897f77ed1dbe5754ae13f479fd190b3

SHA1
c50f9437c3017be13b678e403f4b1a8f0b4a1f61

SHA256
69a0139e06cf8061533dfa547951fbe208cfc9524db5c0bd9631e48909721dbc

SHA512
3eba0670dc72e4cb740408db7338e4660376053964642b3eb8aa05105f67955bf241631497f68442f48592460a235aa9640555f4b02c69223bd96307e9f098b7

Download Submit
C:\Windows\SysWOW64\Ljaoeini.exe

Filesize
1.7MB

MD5
c4a71eeba971f9c039f9474704d40b25

SHA1
da448601daf88c0962a52e0b9697fa6e7bf4c4d1

SHA256
63aad7b0ff5aeb371057ccdfdf855220d6c1d96b8555707bc535650aefcffb9d

SHA512
eeeb28e31bbb96fd115a60a083ca2cde7eb2900b7eca00f5764aa1aed6a966fcb1516ea068f193fc089e51d65c59ed85b6a9dbb34525fd03a9a4a633d8f49187

Download Submit
C:\Windows\SysWOW64\Ljaoeini.exe

Filesize
1.7MB

MD5
c4a71eeba971f9c039f9474704d40b25

SHA1
da448601daf88c0962a52e0b9697fa6e7bf4c4d1

SHA256
63aad7b0ff5aeb371057ccdfdf855220d6c1d96b8555707bc535650aefcffb9d

SHA512
eeeb28e31bbb96fd115a60a083ca2cde7eb2900b7eca00f5764aa1aed6a966fcb1516ea068f193fc089e51d65c59ed85b6a9dbb34525fd03a9a4a633d8f49187

Download Submit
C:\Windows\SysWOW64\Lllagh32.exe

Filesize
1.7MB

MD5
d4aa57cb492122c43489630d5dbfd823

SHA1
136b6e5083169b98cdba8bfe75167450e7815cac

SHA256
4e6957ceaa5da102f8471356b8d6dc3dae702014abbf971a0de063d4f28fc900

SHA512
e966f3dee3ea55eb425198ea00e68274d6b712a7865f881629798870b8b3f796156a83a36255676162d930f3beb5ba0a7ef0c47f2afa0fd751eb84888743bad9

Download Submit
C:\Windows\SysWOW64\Lllagh32.exe

Filesize
1.7MB

MD5
d4aa57cb492122c43489630d5dbfd823

SHA1
136b6e5083169b98cdba8bfe75167450e7815cac

SHA256
4e6957ceaa5da102f8471356b8d6dc3dae702014abbf971a0de063d4f28fc900

SHA512
e966f3dee3ea55eb425198ea00e68274d6b712a7865f881629798870b8b3f796156a83a36255676162d930f3beb5ba0a7ef0c47f2afa0fd751eb84888743bad9

Download Submit
C:\Windows\SysWOW64\Mgbefe32.exe

Filesize
1.7MB

MD5
3d6c59b1568d4ad5838776589a43074e

SHA1
dea58f777f65234b4027958de5a8b559b3095036

SHA256
70282e0fdddcb702168186b9d1200a66fe34aa67ec03b99fcde88f2cc9b278b8

SHA512
8d228e812a68bfc8c2b24c7cade24540b507baff1e4f5ff2f75282643d303cdd3def8f76e6297d75fea98e18cdb8f3bc712a88b19fe60f6256d2f674571d209d

Download Submit
C:\Windows\SysWOW64\Mgbefe32.exe

Filesize
1.7MB

MD5
3d6c59b1568d4ad5838776589a43074e

SHA1
dea58f777f65234b4027958de5a8b559b3095036

SHA256
70282e0fdddcb702168186b9d1200a66fe34aa67ec03b99fcde88f2cc9b278b8

SHA512
8d228e812a68bfc8c2b24c7cade24540b507baff1e4f5ff2f75282643d303cdd3def8f76e6297d75fea98e18cdb8f3bc712a88b19fe60f6256d2f674571d209d

Download Submit
C:\Windows\SysWOW64\Nggnadib.exe

Filesize
1.7MB

MD5
fb6f21c7d33ab6e776fbe1bdac76fa43

SHA1
1b9d420690b11930ab97ac88132b605552c4fe21

SHA256
402a6b46861f3206d10d7461094b4a153b64f30610d0f4723c2ed0f1227d09a1

SHA512
c49f598345b109c20780ce7b865b1e4c429f37249cd5d600af6d934f5fdf5182a43e4d4472a42bf22f0f36f3d083576deebdc202d4910820f7a13200e247b358

Download Submit
C:\Windows\SysWOW64\Nggnadib.exe

Filesize
1.7MB

MD5
fb6f21c7d33ab6e776fbe1bdac76fa43

SHA1
1b9d420690b11930ab97ac88132b605552c4fe21

SHA256
402a6b46861f3206d10d7461094b4a153b64f30610d0f4723c2ed0f1227d09a1

SHA512
c49f598345b109c20780ce7b865b1e4c429f37249cd5d600af6d934f5fdf5182a43e4d4472a42bf22f0f36f3d083576deebdc202d4910820f7a13200e247b358

Download Submit
C:\Windows\SysWOW64\Nmfcok32.exe

Filesize
1.7MB

MD5
7f9ac503bb3814f257b516557baced02

SHA1
f755a2c0728f68101cca40a98f4fb724db65b66c

SHA256
624fea607c92516389167c92afab9f734427b28a3ace34fb8af7775e3086aefb

SHA512
d10ed5b5c9765ca5252b45fab7ce819afb8823f8c9b49c9d27ec1de3cf30938651ba30ba7ed46fbaf5f435c554fe0f9525ea9d49844bf14803af6d96cca983ad

Download Submit
C:\Windows\SysWOW64\Nmfcok32.exe

Filesize
1.7MB

MD5
7f9ac503bb3814f257b516557baced02

SHA1
f755a2c0728f68101cca40a98f4fb724db65b66c

SHA256
624fea607c92516389167c92afab9f734427b28a3ace34fb8af7775e3086aefb

SHA512
d10ed5b5c9765ca5252b45fab7ce819afb8823f8c9b49c9d27ec1de3cf30938651ba30ba7ed46fbaf5f435c554fe0f9525ea9d49844bf14803af6d96cca983ad

Download Submit
C:\Windows\SysWOW64\Npbceggm.exe

Filesize
1.7MB

MD5
db4fbed6e70f1e72f8fc9b9ee015a928

SHA1
aebd5bd342cf49692015dd1cd8933116817d1084

SHA256
f5c95c2d475e87f49200962df4c8b42d6eb4ffd663dc80d2a1461a244ec0e15e

SHA512
667e6c25bbcea844c8f7f98cfd625d0d83c9032f1eada7ec58be157cf1171aa43619a25285072d5eb77126dc9045dee7d276c40b3550f83836ac44a0bc7da90e

Download Submit
C:\Windows\SysWOW64\Npbceggm.exe

Filesize
1.7MB

MD5
db4fbed6e70f1e72f8fc9b9ee015a928

SHA1
aebd5bd342cf49692015dd1cd8933116817d1084

SHA256
f5c95c2d475e87f49200962df4c8b42d6eb4ffd663dc80d2a1461a244ec0e15e

SHA512
667e6c25bbcea844c8f7f98cfd625d0d83c9032f1eada7ec58be157cf1171aa43619a25285072d5eb77126dc9045dee7d276c40b3550f83836ac44a0bc7da90e

Download Submit
C:\Windows\SysWOW64\Oclkgccf.exe

Filesize
1.7MB

MD5
c92e2dc66679f8dee96a47f5298a2192

SHA1
c78f8ea6acaae19d1ac8f8353783bf315b93800e

SHA256
b8073bc81d115b2f4e6d27fc09296e042821462d3bf56ca9cd6d4642c36b0ec5

SHA512
0c18ad74e38dc1d06c6bf4f60e18fecb2ba810a9ef08e4764824c91db53859b00b8ce238ab398dd444eda89c7b91069912bcbefba8cb0b8759d03ebb0db739b5

Download Submit
C:\Windows\SysWOW64\Oclkgccf.exe

Filesize
1.7MB

MD5
c92e2dc66679f8dee96a47f5298a2192

SHA1
c78f8ea6acaae19d1ac8f8353783bf315b93800e

SHA256
b8073bc81d115b2f4e6d27fc09296e042821462d3bf56ca9cd6d4642c36b0ec5

SHA512
0c18ad74e38dc1d06c6bf4f60e18fecb2ba810a9ef08e4764824c91db53859b00b8ce238ab398dd444eda89c7b91069912bcbefba8cb0b8759d03ebb0db739b5

Download Submit
C:\Windows\SysWOW64\Ocohmc32.exe

Filesize
1.7MB

MD5
1a31a2d3695e137520e72160997ab3bf

SHA1
db8f6f6af75d57714a1f5e676e5e44ad973b6773

SHA256
340eea266ff4463f834a06c9bb0b2d0988c8cabecb3674ebda6bb108fcfb82dd

SHA512
35ac710298cc1804d7689e2ea6722281b01a72d82ad950f70a581faf66fbb3bc8fb701f554515b3c4a426d4610be6d909eaff3ecfb06d43d77b0532d51b94c84

Download Submit
C:\Windows\SysWOW64\Ocohmc32.exe

Filesize
1.7MB

MD5
1a31a2d3695e137520e72160997ab3bf

SHA1
db8f6f6af75d57714a1f5e676e5e44ad973b6773

SHA256
340eea266ff4463f834a06c9bb0b2d0988c8cabecb3674ebda6bb108fcfb82dd

SHA512
35ac710298cc1804d7689e2ea6722281b01a72d82ad950f70a581faf66fbb3bc8fb701f554515b3c4a426d4610be6d909eaff3ecfb06d43d77b0532d51b94c84

Download Submit
C:\Windows\SysWOW64\Pahpee32.exe

Filesize
1.7MB

MD5
99a270f32958ec3f5de166f56a282d9a

SHA1
024de72b4a9deb1297ff14783a32f0e15e56c3cb

SHA256
304e9f6c9c1d47f93fb82f4f84e4ab8fc125666ef2dbdd9710c9f4a76c62b76b

SHA512
75a1c972004228d36602fa95185ddfc7fc5d4127c09013ccc0f274aea0645a14b38d72b01e32dfb8434d2f8bcfeba476a50bc7e94a6163cc0ecd6af0ec5bba7c

Download Submit
C:\Windows\SysWOW64\Pahpee32.exe

Filesize
1.7MB

MD5
99a270f32958ec3f5de166f56a282d9a

SHA1
024de72b4a9deb1297ff14783a32f0e15e56c3cb

SHA256
304e9f6c9c1d47f93fb82f4f84e4ab8fc125666ef2dbdd9710c9f4a76c62b76b

SHA512
75a1c972004228d36602fa95185ddfc7fc5d4127c09013ccc0f274aea0645a14b38d72b01e32dfb8434d2f8bcfeba476a50bc7e94a6163cc0ecd6af0ec5bba7c

Download Submit
C:\Windows\SysWOW64\Phajna32.exe

Filesize
1.7MB

MD5
13721ccbada114159d42a7fa420a49e9

SHA1
5acc544d29483f464399fc6561ef8f31d3d85af1

SHA256
4a1aa08b9cd8df4f1e1d9b873160be6cf3d96b5481624e9c5df0c58c789fb1bf

SHA512
a0e9a427d5f2f5ee1d2a14bd034679dd43dbff50f59bc80b056ef56e2e9566e064a4eb7ec26fb5788d2f23890c0c6d8ee45c432b83178d330dcc55798b16f866

Download Submit
C:\Windows\SysWOW64\Phajna32.exe

Filesize
1.7MB

MD5
13721ccbada114159d42a7fa420a49e9

SHA1
5acc544d29483f464399fc6561ef8f31d3d85af1

SHA256
4a1aa08b9cd8df4f1e1d9b873160be6cf3d96b5481624e9c5df0c58c789fb1bf

SHA512
a0e9a427d5f2f5ee1d2a14bd034679dd43dbff50f59bc80b056ef56e2e9566e064a4eb7ec26fb5788d2f23890c0c6d8ee45c432b83178d330dcc55798b16f866

Download Submit
memory/220-146-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/220-210-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/400-198-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/400-88-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/556-80-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/556-197-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/740-130-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/740-203-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1008-307-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1120-160-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1232-236-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1232-342-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1548-215-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1548-181-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1552-145-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1576-104-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1576-200-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1788-98-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1788-199-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2132-45-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2132-75-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2184-156-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2184-65-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2276-13-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2416-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2416-54-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2416-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2456-57-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2456-141-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2956-111-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2956-201-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3212-24-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3212-73-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3428-315-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3568-285-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3568-353-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3624-49-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3624-76-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3744-120-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3744-202-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4024-188-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4024-216-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4024-338-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4172-350-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4172-267-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4300-178-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4380-72-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4380-16-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4396-295-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4396-355-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4420-162-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4420-212-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4452-327-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4524-37-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4540-323-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4792-163-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4792-213-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads