2d45b31902893eb774a3e6b0c16c5a38cb5865a53c13bb43c88283fdeabc5ab4

Analysis

max time kernel
0s
max time network
56s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
02/01/2024, 15:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eb2229f3a33be0dcc0742711080acad6.exe
Size

422KB
MD5

eb2229f3a33be0dcc0742711080acad6
SHA1

37649c2c1ce8830d04f8d937a88d8396261b5154
SHA256

2d45b31902893eb774a3e6b0c16c5a38cb5865a53c13bb43c88283fdeabc5ab4
SHA512

2aa8adc3fe4184a7561e2032830b5b9d19599ce8451ffa02330e0506e39c3f58cb3dd54ce314140c6325484ca4456191504075f74dd52a6454942313d4cac22e
SSDEEP

6144:tzEU6A/babO6FSPnvZU1AF+6FSPnvZhDYsKKo6FSPnvZU1AF+6FSPnvZq:tAU6MGaXgA4XfczXgA4XA

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 18 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkepnjng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mncmjfmk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	eb2229f3a33be0dcc0742711080acad6.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgghhlhq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mnapdf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mamleegg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdkhapfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgghhlhq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mdkhapfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mkepnjng.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mncmjfmk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgidml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgidml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	eb2229f3a33be0dcc0742711080acad6.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjeddggd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mjeddggd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnapdf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mamleegg.exe

Executes dropped EXE 9 IoCs

pid	Process
2060	Mgghhlhq.exe
3976	Mjeddggd.exe
4076	Mnapdf32.exe
3092	Mamleegg.exe
3684	Mdkhapfj.exe
2644	Mgidml32.exe
2932	Mkepnjng.exe
4420	Mncmjfmk.exe
3900	Mpaifalo.exe

Drops file in System32 directory 27 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Mjeddggd.exe	Mgghhlhq.exe
File created	C:\Windows\SysWOW64\Pdgdjjem.dll	Mjeddggd.exe
File created	C:\Windows\SysWOW64\Mgidml32.exe	Mdkhapfj.exe
File opened for modification	C:\Windows\SysWOW64\Mkepnjng.exe	Mgidml32.exe
File created	C:\Windows\SysWOW64\Agbnmibj.dll	eb2229f3a33be0dcc0742711080acad6.exe
File opened for modification	C:\Windows\SysWOW64\Mnapdf32.exe	Mjeddggd.exe
File opened for modification	C:\Windows\SysWOW64\Mgghhlhq.exe	eb2229f3a33be0dcc0742711080acad6.exe
File created	C:\Windows\SysWOW64\Mamleegg.exe	Mnapdf32.exe
File opened for modification	C:\Windows\SysWOW64\Mjeddggd.exe	Mgghhlhq.exe
File created	C:\Windows\SysWOW64\Mnapdf32.exe	Mjeddggd.exe
File opened for modification	C:\Windows\SysWOW64\Mamleegg.exe	Mnapdf32.exe
File created	C:\Windows\SysWOW64\Cnacjn32.dll	Mdkhapfj.exe
File created	C:\Windows\SysWOW64\Ciiqgjgg.dll	Mkepnjng.exe
File created	C:\Windows\SysWOW64\Jjblifaf.dll	Mgghhlhq.exe
File created	C:\Windows\SysWOW64\Mkepnjng.exe	Mgidml32.exe
File created	C:\Windows\SysWOW64\Fnelfilp.dll	Mncmjfmk.exe
File created	C:\Windows\SysWOW64\Njcqqgjb.dll	Mamleegg.exe
File created	C:\Windows\SysWOW64\Mpaifalo.exe	Mncmjfmk.exe
File opened for modification	C:\Windows\SysWOW64\Mdkhapfj.exe	Mamleegg.exe
File opened for modification	C:\Windows\SysWOW64\Mgidml32.exe	Mdkhapfj.exe
File created	C:\Windows\SysWOW64\Mncmjfmk.exe	Mkepnjng.exe
File opened for modification	C:\Windows\SysWOW64\Mncmjfmk.exe	Mkepnjng.exe
File opened for modification	C:\Windows\SysWOW64\Mpaifalo.exe	Mncmjfmk.exe
File created	C:\Windows\SysWOW64\Mgghhlhq.exe	eb2229f3a33be0dcc0742711080acad6.exe
File created	C:\Windows\SysWOW64\Jgengpmj.dll	Mnapdf32.exe
File created	C:\Windows\SysWOW64\Mdkhapfj.exe	Mamleegg.exe
File created	C:\Windows\SysWOW64\Qcldhk32.dll	Mgidml32.exe

Program crash 1 IoCs

pid	pid_target	Process
1712	3712	WerFault.exe

Modifies registry class 30 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	eb2229f3a33be0dcc0742711080acad6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cnacjn32.dll"	Mdkhapfj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mdkhapfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mgidml32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mkepnjng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mjeddggd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mamleegg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qcldhk32.dll"	Mgidml32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mgghhlhq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mgghhlhq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mncmjfmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mncmjfmk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	eb2229f3a33be0dcc0742711080acad6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	eb2229f3a33be0dcc0742711080acad6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mjeddggd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fnelfilp.dll"	Mncmjfmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Agbnmibj.dll"	eb2229f3a33be0dcc0742711080acad6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjblifaf.dll"	Mgghhlhq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jgengpmj.dll"	Mnapdf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mdkhapfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mkepnjng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdgdjjem.dll"	Mjeddggd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mnapdf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Njcqqgjb.dll"	Mamleegg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mgidml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mnapdf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mamleegg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ciiqgjgg.dll"	Mkepnjng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	eb2229f3a33be0dcc0742711080acad6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	eb2229f3a33be0dcc0742711080acad6.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 4468 wrote to memory of 2060	4468	eb2229f3a33be0dcc0742711080acad6.exe	47
PID 4468 wrote to memory of 2060	4468	eb2229f3a33be0dcc0742711080acad6.exe	47
PID 4468 wrote to memory of 2060	4468	eb2229f3a33be0dcc0742711080acad6.exe	47
PID 2060 wrote to memory of 3976	2060	Mgghhlhq.exe	46
PID 2060 wrote to memory of 3976	2060	Mgghhlhq.exe	46
PID 2060 wrote to memory of 3976	2060	Mgghhlhq.exe	46
PID 3976 wrote to memory of 4076	3976	Mjeddggd.exe	15
PID 3976 wrote to memory of 4076	3976	Mjeddggd.exe	15
PID 3976 wrote to memory of 4076	3976	Mjeddggd.exe	15
PID 4076 wrote to memory of 3092	4076	Mnapdf32.exe	45
PID 4076 wrote to memory of 3092	4076	Mnapdf32.exe	45
PID 4076 wrote to memory of 3092	4076	Mnapdf32.exe	45
PID 3092 wrote to memory of 3684	3092	Mamleegg.exe	44
PID 3092 wrote to memory of 3684	3092	Mamleegg.exe	44
PID 3092 wrote to memory of 3684	3092	Mamleegg.exe	44
PID 3684 wrote to memory of 2644	3684	Mdkhapfj.exe	43
PID 3684 wrote to memory of 2644	3684	Mdkhapfj.exe	43
PID 3684 wrote to memory of 2644	3684	Mdkhapfj.exe	43
PID 2644 wrote to memory of 2932	2644	Mgidml32.exe	42
PID 2644 wrote to memory of 2932	2644	Mgidml32.exe	42
PID 2644 wrote to memory of 2932	2644	Mgidml32.exe	42
PID 2932 wrote to memory of 4420	2932	Mkepnjng.exe	40
PID 2932 wrote to memory of 4420	2932	Mkepnjng.exe	40
PID 2932 wrote to memory of 4420	2932	Mkepnjng.exe	40
PID 4420 wrote to memory of 3900	4420	Mncmjfmk.exe	39
PID 4420 wrote to memory of 3900	4420	Mncmjfmk.exe	39
PID 4420 wrote to memory of 3900	4420	Mncmjfmk.exe	39

C:\Users\Admin\AppData\Local\Temp\eb2229f3a33be0dcc0742711080acad6.exe
"C:\Users\Admin\AppData\Local\Temp\eb2229f3a33be0dcc0742711080acad6.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4468
- C:\Windows\SysWOW64\Mgghhlhq.exe
  C:\Windows\system32\Mgghhlhq.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2060

C:\Windows\SysWOW64\Mnapdf32.exe
C:\Windows\system32\Mnapdf32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4076
- C:\Windows\SysWOW64\Mamleegg.exe
  C:\Windows\system32\Mamleegg.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3092

C:\Windows\SysWOW64\Mpdelajl.exe
C:\Windows\system32\Mpdelajl.exe
1⤵
PID:2348
- C:\Windows\SysWOW64\Mcbahlip.exe
  C:\Windows\system32\Mcbahlip.exe
  2⤵
  PID:2168

C:\Windows\SysWOW64\Nqfbaq32.exe
C:\Windows\system32\Nqfbaq32.exe
1⤵
PID:536
- C:\Windows\SysWOW64\Ngpjnkpf.exe
  C:\Windows\system32\Ngpjnkpf.exe
  2⤵
  PID:3772
- - C:\Windows\SysWOW64\Njogjfoj.exe
    C:\Windows\system32\Njogjfoj.exe
    3⤵
    PID:5112

C:\Windows\SysWOW64\Njcpee32.exe
C:\Windows\system32\Njcpee32.exe
1⤵
PID:3528
- C:\Windows\SysWOW64\Nbkhfc32.exe
  C:\Windows\system32\Nbkhfc32.exe
  2⤵
  PID:1924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3712 -ip 3712
1⤵
PID:2124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3712 -s 400
1⤵
- Program crash
PID:1712

C:\Windows\SysWOW64\Nkcmohbg.exe
C:\Windows\system32\Nkcmohbg.exe
1⤵
PID:3712

C:\Windows\SysWOW64\Ncldnkae.exe
C:\Windows\system32\Ncldnkae.exe
1⤵
PID:4236

C:\Windows\SysWOW64\Ncihikcg.exe
C:\Windows\system32\Ncihikcg.exe
1⤵
PID:1004

C:\Windows\SysWOW64\Nqklmpdd.exe
C:\Windows\system32\Nqklmpdd.exe
1⤵
PID:4336

C:\Windows\SysWOW64\Njacpf32.exe
C:\Windows\system32\Njacpf32.exe
1⤵
PID:1752

C:\Windows\SysWOW64\Ncgkcl32.exe
C:\Windows\system32\Ncgkcl32.exe
1⤵
PID:2796

C:\Windows\SysWOW64\Nafokcol.exe
C:\Windows\system32\Nafokcol.exe
1⤵
PID:2676

C:\Windows\SysWOW64\Njljefql.exe
C:\Windows\system32\Njljefql.exe
1⤵
PID:1036

C:\Windows\SysWOW64\Mgnnhk32.exe
C:\Windows\system32\Mgnnhk32.exe
1⤵
PID:1644

C:\Windows\SysWOW64\Mnfipekh.exe
C:\Windows\system32\Mnfipekh.exe
1⤵
PID:3008

C:\Windows\SysWOW64\Mjjmog32.exe
C:\Windows\system32\Mjjmog32.exe
1⤵
PID:1916

C:\Windows\SysWOW64\Mglack32.exe
C:\Windows\system32\Mglack32.exe
1⤵
PID:4588

C:\Windows\SysWOW64\Mcpebmkb.exe
C:\Windows\system32\Mcpebmkb.exe
1⤵
PID:2704

C:\Windows\SysWOW64\Mpaifalo.exe
C:\Windows\system32\Mpaifalo.exe
1⤵
- Executes dropped EXE
PID:3900

C:\Windows\SysWOW64\Mncmjfmk.exe
C:\Windows\system32\Mncmjfmk.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4420

C:\Windows\SysWOW64\Mkepnjng.exe
C:\Windows\system32\Mkepnjng.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2932

C:\Windows\SysWOW64\Mgidml32.exe
C:\Windows\system32\Mgidml32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2644

C:\Windows\SysWOW64\Mdkhapfj.exe
C:\Windows\system32\Mdkhapfj.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3684

C:\Windows\SysWOW64\Mjeddggd.exe
C:\Windows\system32\Mjeddggd.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Mamleegg.exe

Filesize
37KB

MD5
9970916ef605ad65e93e07a61e9f7998

SHA1
06ea18da5c229a01a6f85cd8c10af1f1c09d37a4

SHA256
8e0cf8023f3aedc3bb3d7ed4adfe8a8666674a13760564b0638a0b7ff3ad37e2

SHA512
3e929c054097f2f78e34403502c99de2c731739f74aa81b41acd7e1339853e4b5ac536993c17ff482862bffd5d5add208dd5020e8b25d00b4e757f55a23da575

Download Submit
C:\Windows\SysWOW64\Mamleegg.exe

Filesize
58KB

MD5
95b6d3ee4390aefa6efcb303901d4a4b

SHA1
11500e908b65a39c245189109febda26578243ee

SHA256
83e13cb9e7d355850799b572f36ead62b8d5d63910b20e639b66d6912bfed243

SHA512
c62eecae7367fd47567cff3c9ce50545cf57156398c2280332e290c8d1ebf5247575dfd072d3648bb1f92e166e3f966416a0b47f14078a32b04686d758b1235c

Download Submit
C:\Windows\SysWOW64\Mcbahlip.exe

Filesize
47KB

MD5
1d4ed175737fd2cf5d85a90a93fa1177

SHA1
6383004e0ed60c4122b997e6f1a2388076ab4545

SHA256
e5a3391058d87cccb8be1ed4abb323c08ffc5656bcfc9157b33647f8934a1701

SHA512
177541cbfb29b8385539bdd0b9f88fe4fbf1053228b42862b8d0dbda3a073cffd7ef00a030ae7d40e75e0276dd6982d70f95aba9ae916085149f6810ce7a5019

Download Submit
C:\Windows\SysWOW64\Mcbahlip.exe

Filesize
12KB

MD5
dd1938fbe6ae1fc2f7921c24c1038079

SHA1
0af27baee913b72b38b22b00fdca3363a3c18def

SHA256
ed741bfce14af05493bcc1f91bc388a3a9990c808903681e948e5e466704e338

SHA512
3cdf9e51ebd3784072bc13711e6235e2f7b026e49394928a7b9155bfdb89256ed3f26de9ac43cb7879b604e4195b9c97394270bdbb2be2691c7206731127da26

Download Submit
C:\Windows\SysWOW64\Mcpebmkb.exe

Filesize
43KB

MD5
47b8605d7520838789cd7ea2fb5a9bd6

SHA1
a78f05a3311044577c71ae12ef5b6d9811b1b4bb

SHA256
98e94c98a93e808ddec3f11a4d22e7b3863e35648973a739b234477b164e748b

SHA512
a8ffd67e8a8b56d204973a01ff235af8a419bff6be406c6c549c76fd6c4e972e8f74390daf93c55b98025d4994ba5b089e162724e6da189dc254f48430672df9

Download Submit
C:\Windows\SysWOW64\Mcpebmkb.exe

Filesize
53KB

MD5
5fb139646e27059c82b196ed059dbb4e

SHA1
8b7b2b360cb164afa6ce0d247f8538cac14ead85

SHA256
9c1b1a61c5204b900038516f5d495cff3eee88ab987e4dc636728cf451b7cf78

SHA512
a3c9a78a500552fb3b8865c5704c93eff2f78e0f955dacf86336f8aef9912d83c380b34f35eee40cdd3ef972c99c679fe77d3de17e4e298e3997fb0e1f4fd294

Download Submit
C:\Windows\SysWOW64\Mcpebmkb.exe

Filesize
21KB

MD5
a4b8be3b4ae10681e19eeb17142438fd

SHA1
7ddb976a16215bad5bd1760847829c04d5c6ccc1

SHA256
022af53d8573b7b34de7b0a3fe31cda1313f37f62781edc041b50470b0b934c7

SHA512
61b6fee995c2c783dd46d4ae5fa52f0a98637c821502d2489b60bc465a21c599a693c85d942b9d7130fa9254b166d4b92e6b42c47679532f9aea9a60ebb2e404

Download Submit
C:\Windows\SysWOW64\Mdkhapfj.exe

Filesize
12KB

MD5
288b631f9335000e2ec6d186fb9449c0

SHA1
71707c339b4a8162af6485710423542e371fa0bd

SHA256
dd96273626fb32d8a013358b7aa403fdee5fad638e6daa2b244c1b977c2f7927

SHA512
26a74f9b4711565d18ffcb030a2e4f59d3433cc30999098fed82a7242acbe212ffc3705bbc67399022ba1eeb91597c0e685b1f2882f672a2b3201ffdb533b104

Download Submit
C:\Windows\SysWOW64\Mdkhapfj.exe

Filesize
47KB

MD5
6c485c78d7e6e6a425ee55f0b91aac27

SHA1
1a7c35b8d0f80599c83c398b6c2ee3ea211e8d80

SHA256
91c2a143f3dd8f8cdd103c940e07d4bd6ba1c00c08bf228f930d8e98bc2bf70f

SHA512
1b4c6f87792f76a9ffd033c3a02e8816def6d23c1d12412bf654926b9f008f697238857a634f00195f022d4ce87cba03380d9711f224adbefb5be73583365fc8

Download Submit
C:\Windows\SysWOW64\Mdkhapfj.exe

Filesize
77KB

MD5
c0abbaf139501c02609c1e3e17fe6260

SHA1
1bf0ae62957817105d16e1ad9f5193468f19f40e

SHA256
d56b57c359192df2b07633a64a5eaf85a5083db889e2b48cbc96a634618fceda

SHA512
8bc6be2f1f5f09e3e55c4e4945219912ee8ff02ee68a3808278e4592348212790614553f9abbd83519d83e0b1a72362b9f56af15a2e26b6c7907a9826f6baba3

Download Submit
C:\Windows\SysWOW64\Mgghhlhq.exe

Filesize
78KB

MD5
2e654295f9d39931276309620435e01f

SHA1
6b87d90eda0bc7d686d79083c019e18de36f191a

SHA256
7e385eb1f578ed2eae24c09883c3191bbdd92ff56adca378904ccbc1891ef1cf

SHA512
1387776e463d410ad996bfd87c995e9362cec1d451454a0c9ff103286cefb9d5e7068c5e3bb7369acdc72bc892a3d8f9ede4ccee3613f7670e9489eed7618c10

Download Submit
C:\Windows\SysWOW64\Mgghhlhq.exe

Filesize
32KB

MD5
c32c29db4b1d648db3b64d64c4092503

SHA1
5b15cce082e11804028edf184439e31e75124860

SHA256
3b304cbc9d71eea2e6764b4f0ce368a49df7c888b539568c5d37f5608c8f95a5

SHA512
60d49b62fb10ee5e64a48712cca11dfbaf7e8d52a0a1cb5c334b4b2245daee60bb8cd3992ee666bc300a21de8fcea5db21bf3f84c358bee2203df0fd32251d34

Download Submit
C:\Windows\SysWOW64\Mgidml32.exe

Filesize
50KB

MD5
805b22ac3bb562a5baf4223cd0e1b80a

SHA1
3bfb52a35f9095346becc9f352d6e5048ee0d124

SHA256
4dae4943a0eb022cdc7fd5cf98716d76492521f748b4b3deb61c3565d4af0c0d

SHA512
75c5c3b2ee7e55a054b3613acd8967bb6250b9e467c55bf2e0d3f9c0f97ad410e9dfd5c96f6b8023e0fe8b4db913e58aa5d0556961060cc1a9f8bc021d77fa3e

Download Submit
C:\Windows\SysWOW64\Mgidml32.exe

Filesize
21KB

MD5
14ea9f753c912df311029716b3439f36

SHA1
daeebc24eecaa493cc0e5f4242b2b037efbe9f48

SHA256
b11b2e41be40b9e6faef9ba94dc5946ff3379d55c7faf3903641b7b99addbf39

SHA512
c84e18c7b79c22b6227a1d51480c49059ad8439e06865b71b6abe3777652d45bcb228b7a6afb8d951909123e3c73a86ea0833b7aacd647c89845828fe16582c1

Download Submit
C:\Windows\SysWOW64\Mglack32.exe

Filesize
35KB

MD5
0c6b318aa5244d4a058b3a267e4c3c56

SHA1
9c0f57850e5c593275dce372fca61de045b56645

SHA256
280a90bc454d0873d9d84148578ed963111e40d844685219a5e9fb72ec83d453

SHA512
ab29f0673aa156541d0827dfdf3a2f3545d52388c53149ab13ab64add92cc23234929b929e12fdc79a858bf61ac0af55a71b256bc0252971faf54b03753a0f2c

Download Submit
C:\Windows\SysWOW64\Mglack32.exe

Filesize
34KB

MD5
c79ca1431ee750f5b6f511b1f1524dd0

SHA1
5a226b9f02c19109e8b17d12883e298701fc6fd7

SHA256
2bbe3824dc6c3a09e89b7fe2298ca70407eb15efb401c0ec5ab0ae3cbfbd13eb

SHA512
d4fe7f3a6d7f69983e5d79446c45a94c7b6cb38fb09d3a06e6817b787a4be08d64bff4cad8c45ce98d698ca17a2dddf19a04acde84192478b6dc094c8337831a

Download Submit
C:\Windows\SysWOW64\Mgnnhk32.exe

Filesize
31KB

MD5
658670a75b7d00c4a10e95e380791ba2

SHA1
31dff3b03753f5ee62336cd0fcb90bd02ad2e260

SHA256
81ad50387a72b2d2518a1980bb4b220515f75bb1f61a80ac93ee1e3a5d89ddcc

SHA512
a37405f3e64e3f67b8745e3d886c6055eed3d0f36709e0da6a783f70d4630231faba4a336fbd2568475aa330e3193211764ec4ccb888e77e57ae489b570cc4f4

Download Submit
C:\Windows\SysWOW64\Mgnnhk32.exe

Filesize
37KB

MD5
a250b0b91d672a200524e703141f8fe0

SHA1
973673535eeedf5e97472fd17ac057f1596a17af

SHA256
621e74c9da067f7235d908dcf829c18730590607e7ca89f0b6c40da14fee9282

SHA512
64a8743056ae03f361dc18e1e057a0f52e0aecb6d69f80a2f5124382c85ea47602dcdf1ddfb6d1bb8722df86849e5ccaa8edddb9af26aa3de13fa72b8d932f8b

Download Submit
C:\Windows\SysWOW64\Mjeddggd.exe

Filesize
71KB

MD5
7d14ca163b6601ed54fbaee17870fc06

SHA1
dd0bab8128dbf4812a1373922b36a4bf87b533d7

SHA256
0b8ef50f3016afff275daa31827e3fed3a8354c40f7f6bcfc2c0c24d9020bef2

SHA512
c9cca9580eb00c3ea91fb01cac6f3989c95fe52c7b16af9941a032a3803df4c0b569829f0828b9a0a254572704ac430be6233ef995a6120936ac7a8319c25ed7

Download Submit
C:\Windows\SysWOW64\Mjeddggd.exe

Filesize
101KB

MD5
4b15171826b365462609cbe081b0d036

SHA1
53242d1ce59c01a1c7d6f339a1cb474ce1394a8e

SHA256
fdd1a7943155de9c48e6473428fe5b220ab1af52e5823412f023b3b79f37f0cc

SHA512
cdc38a620d152a403db8426c653fc535b89f614f800988bee0e8dd746105b4858221ae387a53ca8a9565786285e865a885396b1a170587a297526258586a4ddb

Download Submit
C:\Windows\SysWOW64\Mjjmog32.exe

Filesize
72KB

MD5
73348935e2edf44c3e85c82b4b45ac6f

SHA1
aad221693526bb0bafba759f8a94f3ae16ecd92d

SHA256
1100cce5a80a56929c7c7ec65c9a825419edc3fb28bea050abb8f4f45761840f

SHA512
5a44901e91ebac4f95c24560a882c65247e273db3529ac5605c76fa9c6dda524b4b9f07ad799c835a8ded8985cf6478cef195bc9c127e397eb42e655aacb6cbb

Download Submit
C:\Windows\SysWOW64\Mjjmog32.exe

Filesize
45KB

MD5
4cc379bbbf74ceb20d5646768bedd0b7

SHA1
28d085b72746013d6930d68009db0073c5ac3614

SHA256
288789e5231bc2642fb334cee52defa5d7e49ce2e1fedc57f6e95993fc465f5c

SHA512
9fbe3dea4f82f1d50753678b2c9c7e6cf1a1b13d29a6a64ce4a080d8a4531bb62ed784a52a98a090c008250ad5abe5c2facd567b5a118ba070069bb69d962dc8

Download Submit
C:\Windows\SysWOW64\Mkepnjng.exe

Filesize
39KB

MD5
23ef61bdd3452161cbfcdb9cd03114bd

SHA1
4a1d25df379b9dd726e9fcf25279ae00b116f05b

SHA256
4693bcbb6dd6b501158c6b62ae468b216dbe71e9db3b75821a982b951ad8badb

SHA512
43bb97b807e97b5cb4bfd2ec16a9fb935057a3673b2d1dfa9440e4f06fc2eddc55b28165bc12c6d8c218e28328f101699c92a1d2b0bdc8a652d2ec93f1185ef4

Download Submit
C:\Windows\SysWOW64\Mkepnjng.exe

Filesize
31KB

MD5
48e398b34f302d991d6dd619974af01a

SHA1
182d699021c6007af481098113e8173f2741df1e

SHA256
f8b94229dde9085415b5fc7170a949c19e8b8eb78a1703902517baff76178449

SHA512
43ab02a56b3f1f19b626092dd96996cf5be8c41bb8a3a7fa5d714dc8beb8a0f1fae18b21a637d85e145314476115eabc1c0c7894966a7811b3a9511a94b58d34

Download Submit
C:\Windows\SysWOW64\Mnapdf32.exe

Filesize
50KB

MD5
0d0e92240386c0812b542da84c6ad45e

SHA1
ab0f2276b53ff9545e7ae793bec9f332e5ebe157

SHA256
4fe9a8d1e640d01aef30362ac4cfdca4a664b2db77dce348a55e0f1ae014f558

SHA512
13fb186bb1e4973faef396afc165e6f50b5c19f00c441d9ae0f53af4528099d50aba362989b47f07eff65177fc06b60df0977478d781ad2152282c17a3009fde

Download Submit
C:\Windows\SysWOW64\Mnapdf32.exe

Filesize
89KB

MD5
8946acae84140e2a9dcc0046135f5d57

SHA1
00bfb58872acfa4822d4422226bd338fe0c7868c

SHA256
496b7ab749e58e81448468fb49697e2339c5ece4490e4da3569bdea755769b0d

SHA512
e3343fd318d2a9ce8547f53350e1f767d1754017f97757a8cf3062231fd6b558305b90e9a3d148078fc52d4d027a1973d27102f4821e5cc72a97eb4ec96621e9

Download Submit
C:\Windows\SysWOW64\Mnapdf32.exe

Filesize
73KB

MD5
26fd6d9e42fc6ec72bd728c3a28f860d

SHA1
384837e1854ee3e036a7f088c71fe0d621930867

SHA256
081fb7340598d3e021ab14ae7028ced706791415ce9aa15054c58b5f12913fb4

SHA512
2f664672fb54b92dc89bd944f5551e57b40d0f49dd0a6d98e4d748f6a8da0ca0a66165fabe02dc810ebed0997a87d7782e394139119ada45767e9b1f43c2abfa

Download Submit
C:\Windows\SysWOW64\Mncmjfmk.exe

Filesize
57KB

MD5
d17d70e11df1feea68bc9d54376447e2

SHA1
d5768cef97b8d14ea31ddc64688c05cca564cf35

SHA256
59627722d0696be197ec9dc94a535fab6d02310db77e58f5af9e3597baf84a1b

SHA512
b3f3241199c4e325fd558c7ba4799357896c34b5f3af85c45549b4f1b9bf16735fa8ff6276ae5362dc76b5a46ef125451b3edcaeeef38d9cab3f5ca5fdd02a74

Download Submit
C:\Windows\SysWOW64\Mncmjfmk.exe

Filesize
34KB

MD5
f90b38f8f0f1fc4c6a4529a5374e7898

SHA1
7d622db11c377b726d731c97e33ddb954d08d9bb

SHA256
533b4aedd64f8ce75493f9f8bbf095bf2ca3ce2b6a854f7d56438b3af0954422

SHA512
64d33413692e99da9d1fc730eca5d8b1153b3d51e3879c41f13512deedc065b3cf22244d2a79aba511d77be2f99d8cf0925d317fdb38d5812f44625d15999b3e

Download Submit
C:\Windows\SysWOW64\Mnfipekh.exe

Filesize
92KB

MD5
71fbfe4db66851d668e05d693a034099

SHA1
7db47cb5421dca384ca729600daf369d6c43150a

SHA256
cef846c9f9fb98390211cb5ced89d2ecb714a04ce6810bd7456a8bb4dd270b4b

SHA512
9599335c08afb8bf98d56876078d62f42cce38cc11687e168e746ce891c9966ad745754e588d58bd47fbdebb7c6462643a490be9932f4c042c758292082c4870

Download Submit
C:\Windows\SysWOW64\Mnfipekh.exe

Filesize
60KB

MD5
911cf2188043bad05a02e02d105f2219

SHA1
0bf57c350e40d625fc6b4487cf16a52b19baaa50

SHA256
a70e8e343306ca3f0c53c34a8ddc23cedfd31cebe4812580017abc7d14e8c6b7

SHA512
08cf3d6f625af682ac0f0a41eb3e8014661988c2b635d7234c9b6894ddd49cc8fd40265d97094071ff7b14c56166380ea4e1ea9fc8c2e62cb05d3a57e291d92b

Download Submit
C:\Windows\SysWOW64\Mpaifalo.exe

Filesize
60KB

MD5
872ee47a77fa7b5cfced2837943b0aff

SHA1
d358c648a4e19b75a7e0aa2f0d2c795ab6c5aa36

SHA256
3b021e48059468b0cdcb68d48d45da222b070bff0052a14d98700eb58be10028

SHA512
b5a3caa133fbe8c17f0e890cc540c253e5bb144e91cdc1a2abd52f24c5034119789c78b20402cbb28eb414ba9d8600e398be431e0df47de299bc94d9c6c38fd7

Download Submit
C:\Windows\SysWOW64\Mpaifalo.exe

Filesize
48KB

MD5
8c0b68626c58c0ac7ab2f19a5832a54a

SHA1
780861e0182af2ba52fd4128a8c1a9cf23a3cf87

SHA256
8849556b18ad927bee9af5ae8054f694a4d877515bf43f419e96392893ff0d5d

SHA512
3cd2ba1aa45a130fe0d2c45ae2874eaebb462c65ba89a7351ddb438e6f02d4ec29b260845f3b872c5adebf9c9f6efff50eeb39e44f573414d8bc50d29be3bac3

Download Submit
C:\Windows\SysWOW64\Mpdelajl.exe

Filesize
35KB

MD5
85cd96be6cd7725435c9cef3a960dab1

SHA1
13867d40cbfd61b54514cfa5f008835cf8007307

SHA256
aa0974869728ba41ab6bd4ea6addd44be301bd8652b69cf5a3a16e1d6f1e3846

SHA512
dc16f8e81e718de876f483f7ffb079153cea0758bd04b8c57d892ad5afa9ed4c420738f8544d687efd1af33987b1d637b01b7bca87375aca60c00b951379be1b

Download Submit
C:\Windows\SysWOW64\Mpdelajl.exe

Filesize
43KB

MD5
71f077260ce32287217f753067efc617

SHA1
304dbfe7abb85cd59db4921e3a85221f626edab7

SHA256
26676e5db95c3637058e88a3d87847d2a4736e40a5f7dcb4a377ea12c4c4ed59

SHA512
19f990a1ec2570c2cf48e4b89432cf8f77bdc1a4302d90de9fdc1795a38f2b9e2da86b7fdbe66f89a59025be0408bfe1dbed8ce08caaa70ff02803289c68b44b

Download Submit
C:\Windows\SysWOW64\Nafokcol.exe

Filesize
36KB

MD5
47cde474ae3b4c9d1c71f92a37e23e0a

SHA1
1cb8461f1c48077c53e7383872eaf33743d904ce

SHA256
3f891b201946e05f8d779d6cc47f350e6b9d695347ac522236eef6ae73e33e3d

SHA512
f94acb102ec3d671b185d7e4c3bef3970e5a68a139dcd2a3f4ebf6a559ae752762120cac8e00875b9c29ce9ebf036657f9aa76b1d655993f377af93ea7f6e266

Download Submit
C:\Windows\SysWOW64\Nafokcol.exe

Filesize
24KB

MD5
dafbb5a06a41c25e4cce1cf0151b88db

SHA1
43ea170a54a495a1eda4cde73d12c0f9b15e9722

SHA256
201e4ed871d4298c0760b8176a5a42bb7d46491e5507a040b4acec4ffe10f043

SHA512
3b8ba9947344cb377d92246e0038318f5e8847cf09aa348725e421333c4c73ed2da86be1257152dd475fe94d5a3fe279fcf14350584d5a854b2b958c334b96c0

Download Submit
C:\Windows\SysWOW64\Nbkhfc32.exe

Filesize
25KB

MD5
0261a9da1e2c053db7a4a96dbffe853b

SHA1
bccc634528742a290e4a0c0e69442c97d092cbba

SHA256
c8841511ce81515f6abec618f576c25d97f85a44c3897df1df3ba51d3048dea6

SHA512
e5b5d60bc7ea8cde842e9f093b2b6ee253c3e24cd9e4a2561662d3e0fe18e9dd0249bc911a1ea4cb2535292d6fcd38ed855f0addb12153a9634970eaf62191d5

Download Submit
C:\Windows\SysWOW64\Nbkhfc32.exe

Filesize
12KB

MD5
0e464464fc3bf6514d167c1e422863d5

SHA1
3289fdea61cd714f7257ba68e4b1dedbed983629

SHA256
746ce9fde3ad9b636caf2a26f8162f323c5e67d0e944992997a73a60af084b48

SHA512
2796ea5d768489b8c4d2572dec2bb4262bf2cecc8ccd059182aca997c375b3c061a488c60a422871e76d33865214e82bba18fc34bb5b435d3a10b5b0f3702541

Download Submit
C:\Windows\SysWOW64\Ncgkcl32.exe

Filesize
26KB

MD5
86ae5fd00de5a8a2acfb486f719ee8e0

SHA1
233b3e29959cec3db4f31e4abfb6e5a1e079b8e1

SHA256
b961ad2a01c7e287e08099e35aa7f828a7ff5c89ce4db2c212ff97cb389aa0bc

SHA512
44a12f8de621fee95d12cb349519944c75443c15f54caa0c9da1e6ede620951489bd4b7e1e1bb446f2b357ff420bf3ac6bff34d751fafe3e7ace1140b6f0854f

Download Submit
C:\Windows\SysWOW64\Ncgkcl32.exe

Filesize
11KB

MD5
fc42a4ad05b8706667f90001b7360f18

SHA1
81c17593055ce46f560f4cd04ef199a055d1de3e

SHA256
a1e7b116017fa7ef1c2be0b91278f69817b90a55a4519e09bcb54fade4766545

SHA512
df983eb5f51cf6e5b1dae03aa2325542454afece23168f9bf9f0287c6ba45e20309699699fbcce944d872cb142b0d4c3039368b443b012cae4e9c59dd2c3b97b

Download Submit
C:\Windows\SysWOW64\Ncihikcg.exe

Filesize
18KB

MD5
dd33ed641acbd4263b8d2c05e7b95f0f

SHA1
128625f80317feb555a1bcac4dd3320919dfa118

SHA256
0c8dd281845cd88435a5680c84b91c8c461f12e2ecb95cb5bfbb685b29c4723e

SHA512
50c3bbb81ad81a0c82794a41fb6d48c182319f52465c2b348b3227df587e0a8817c100b91a8b349f8c409b92f7883c604a82a03d4b411c9e55704d1c9be5033c

Download Submit
C:\Windows\SysWOW64\Ncihikcg.exe

Filesize
32KB

MD5
988ea5d10eb4e0bcc605c0f53f4bfda6

SHA1
2528573c50bcb4275fb6136f677904134116d2b3

SHA256
1a9db756f087382faf5180dc950ff344fd4fb2e470c9be81d2b3cee3fd9233db

SHA512
9bc1017423549ae90863dc349c31c3ca724da0c1676dbc55d54903c96dd827a72f347a8d638bb34a876fa85f29a2e06729f47d529e00b728adf42fcd9c7e3124

Download Submit
C:\Windows\SysWOW64\Ncldnkae.exe

Filesize
10KB

MD5
b8a40fbbee97545845463ef99d963a79

SHA1
22204432843b0a6bab70e6f2d77741e1fcc5309f

SHA256
c7e8baea3304b1b267e87600658b0de3e4c49e958d6e105571bf2447df0ff0aa

SHA512
c04ae01a53e35fc6857294b1e86fcc3b35a1a271a93bf5ce277055ce70275e7f4c5d598fa385835711f17e89dae56585feb6b0e597cb99833f324509d8f92ca4

Download Submit
C:\Windows\SysWOW64\Ncldnkae.exe

Filesize
19KB

MD5
f9d2f229fe02fba9895a7caf32895ae6

SHA1
bb1d7656ae66c2412d3e2f59ad7c4706cab435f3

SHA256
c59b10d9a3b48e36dc2b6dac6caba86980cd3767921c744fb555a27f49837c77

SHA512
db41fe59acbc69960248b2936df6239039905bdee1c5185808fde05d6c28b4c86e09b6b037c751a441b78a6b3d94ea1234e86bd5200968a046e1526523b933ab

Download Submit
C:\Windows\SysWOW64\Ngpjnkpf.exe

Filesize
29KB

MD5
a20748719007718cc265041069bcb0cd

SHA1
f6e9f97be0c9e64770e6d3be113d8a252cb90b49

SHA256
38197a90c2d88b1a693413f48d56859bf441a49a6bbecbde169fcc1cb93c044e

SHA512
c458d958fe917a7ce72ed52802dfcf271ed6b7fdf4b443d08139ffbf72991308919295b0e57fff49a8f0d594ec0b5404322b338009bb4278d306ecbb24a11a9e

Download Submit
C:\Windows\SysWOW64\Ngpjnkpf.exe

Filesize
44KB

MD5
c03e669c03b7a3912044e6acae9cdd5c

SHA1
024cebe776a6a5c836c10dd3330ef7de630d6865

SHA256
e048a7bfed43f49b35ffdd28499fd8a3e31839fea97a33ddc7223aea14624e6c

SHA512
5d510cc0634f86217b9d463531d7c3b50d83b9b1e987ad08328b2ea1602ef7965a79bf2e2284ac9a74e9655f445088430d2ee33fa7bab27e41d09a98b08ecb6d

Download Submit
C:\Windows\SysWOW64\Njacpf32.exe

Filesize
42KB

MD5
defc4a90d681f892a6f0a3b0e80973b3

SHA1
4120589ca04dcf38b02ee998b25f3bd679ff4f7a

SHA256
1ad19684c657294f53a350acca6425d515e7c70ccd4d20d18deff8b8d7e659cc

SHA512
d9cb216b061bf4a596439fb869e9c802cbdf2c0cf907fc4be7150c1e28d7ac3856add13592746ad122bcf574567afa38396808d840827b13b08d7b3dd4afb672

Download Submit
C:\Windows\SysWOW64\Njacpf32.exe

Filesize
17KB

MD5
67dfb5f58fcc7ac924c23982df8ef8c2

SHA1
08958d0995ce1ccad68cd20d5bce0920eeb81eb7

SHA256
54eb6ca6afe568afeb0317d22ebf18fb96825e27fdc8f71672736fae240c294c

SHA512
45a8c0feb342ade0257a853f1eb2155a86596e8729b5d1f2a872b3053d074dafbc4b26429f8d96a7a1373794a0f9b903306eabe5987c4de5ab5908bc46ae402d

Download Submit
C:\Windows\SysWOW64\Njcpee32.exe

Filesize
18KB

MD5
42567af7556c6ef39c1a444f7d795a7f

SHA1
8e09a5b66a3caf285aaedef286798291561b3b6e

SHA256
5783f08ebe8ef31d8c3544721d06d14ba44333d3018fbc8a36bac77c0a75aff9

SHA512
a5f9770f2773a4ab971eb8553470a6fcc05249180100ee9fd893da2bdd84630f2494225fd55abb7031c7f322008e919d77d85b173d8c96690641ded83d87f241

Download Submit
C:\Windows\SysWOW64\Njcpee32.exe

Filesize
45KB

MD5
36536a123f386e1688453488b94a2a64

SHA1
93acc8f722ade3410be28ce2423c2de1a99dcfca

SHA256
72f206daf585b3bbbf52a8016a871b83f744a81214c2d7a2215d1cd85e4f008b

SHA512
2271758cf7c6d6a660a2cec2fc824db47c86f7468d127f9ce7dc05ae7bfd5a844849e44e708a9f3631eae068f3f5d77f3fd05be02bbc9566801d693a868a1773

Download Submit
C:\Windows\SysWOW64\Njcpee32.exe

Filesize
15KB

MD5
029ac38e5d579b5b4793c6964ccba475

SHA1
cd311a3c5f748595f90a7ea8803b47c9a6d54cb9

SHA256
8222918028a7f8b8002b4fcf1b86ed0d5e77a14cc8e14020fa7d1e64076febbb

SHA512
0a809e18db1151dc03248f1b17284a7a89918147e28169c6051bb9618bd1a86f843562736785e238bfa13a34cde4546c60ea6b2566acd3781703f517990fe496

Download Submit
C:\Windows\SysWOW64\Njljefql.exe

Filesize
24KB

MD5
64bf550737a4977460465f8c02d9df33

SHA1
17e9ebd19fd15d37717cd3e39b7b4fb79afccc95

SHA256
9b17c55c69de16e4dbb2d7879b08783138da9f0b9461ab666c6d15e17e907081

SHA512
705d44c55ec0b105ba6722dca64dbd5b261a63e5d093230012f0b9576f71a5042958d8debb5d48312e84a9a84f8f3ab824f36ce88b7555a70720d35d2c03e3d7

Download Submit
C:\Windows\SysWOW64\Njljefql.exe

Filesize
31KB

MD5
45a72e04b352c178745c3f46a59f2ed2

SHA1
67c65c9f3a1007d156c7c52d5b769a6b909509f3

SHA256
ad1013ca98c9e4a14dda939f3992d2b553adee2d09073f67a4ef6d21c894658a

SHA512
3070e5de432f48779157cc1a8cd14955edaa03d7584d8e295bb2adeb86253bac59fef51ecf4acdaaede088a52a52bfef3fa0eba720626ebf0c2a6d989a0b28bf

Download Submit
C:\Windows\SysWOW64\Njogjfoj.exe

Filesize
43KB

MD5
1dd519c76e1c23d06976a4af7592934a

SHA1
1c2252df9cc9950750c56ce567550b5bf775f662

SHA256
b78372afc73fb97e2a0bc9c89caf83463d8b98dac9488ad2a3ec8c639d5809e8

SHA512
3f9a705173280640949d336bfd83fd4769c631a740fa819e07ae6623d93f51a7ef79fc3ad121cce56051033cc5235e20dabc59a3f558cae782de6fc199a8d08f

Download Submit
C:\Windows\SysWOW64\Njogjfoj.exe

Filesize
19KB

MD5
0973ed1c89a08ebdb1d7877772f06e1b

SHA1
9bd7988172c0231cba206a2fa917378ed12671ea

SHA256
3113778c02506868cda7e6dcfb6ce46c23135102cf039be2af357c36843a4894

SHA512
ce7d94cd2ac7056552c5d1d35071a0a7abff5c0d30e2df865cf32e533ce3efe71d3ddc5c27fe7463763d2647b8fcaf9f431b73685405e13519b5adedd3ac0524

Download Submit
C:\Windows\SysWOW64\Nkcmohbg.exe

Filesize
36KB

MD5
1f903763245440c0d65a2bdb986b4b2d

SHA1
960bc335a078730fcfc5b95f48d32d69ead82321

SHA256
679f4f059bd146e3ee82290578a919384f9b9e1f34dca797a7d2c3160ac7d3db

SHA512
9e57c3749705d2bc073ab3d8efe71e9202c5f11c09658b31fbd85e986380797c80e20b76f0e957ee51045c5351bc80be799003f5a4d6d02e6661b9b6b8d36651

Download Submit
C:\Windows\SysWOW64\Nkcmohbg.exe

Filesize
15KB

MD5
c801d9be386d01febfbe263318a78569

SHA1
da7bc31df69e4789a77cb0494d272e0cec8ff657

SHA256
fab5c99dd47896cab1837a4a6641e367634f1b0139a63d3a1317ed636d002003

SHA512
35dca42d738ea4daa00c5196b36f8fa69d17706ffc357bb17da593a8003f06ac4d556b3bd85655ae3fd1fbd236cb052bde71ab16a21c6a1d95dc3ed7dfc64d21

Download Submit
C:\Windows\SysWOW64\Nqfbaq32.exe

Filesize
19KB

MD5
f5bafe145bfca3dde5aeaf3cc8308477

SHA1
0d9392ead1667073fb52e66843ce6effe733ad34

SHA256
549f3612cc28368c7a5968bc1d1c7bf41c0e5b538d7ea4e331b2698d56b204d8

SHA512
a005bb64d608aac67cc6db544631045b0bdce115eb3aa491e94a2f3865e0ffea2a5a3795ea71ab01caadba8057068f36531cbe1f23b13a1c0e976461b9702d1e

Download Submit
C:\Windows\SysWOW64\Nqfbaq32.exe

Filesize
11KB

MD5
0f515cdc161c8114f9e9e1b585df4804

SHA1
515a5b2df17b5e5fe07543171024a4e9e85632c7

SHA256
96924b09108ab1938e8b023f4325e98cb9ef87693e53ed678bba8dad8a259bb4

SHA512
71b749b9114bd2af400ab5d01abea031267de53f1cd90d7718c2cea165f6235d4a2a87c4c6e2aac3be4c5b720d53dfd91ce8f0e3a54225b1c6ec92dbe6f4bfad

Download Submit
C:\Windows\SysWOW64\Nqklmpdd.exe

Filesize
44KB

MD5
1658aeb3988bda0f9dd416b08e12004e

SHA1
3cbd9f197838f5f65b6dd8c96ff43065efeabfa1

SHA256
2f367e61680ef52ea5f191a7fd5e5370af385754dd25710fa7bef7700bf1cf9d

SHA512
e16a0ce46e19b345a9563e88747e88c9a5deff22903fdfe1fbd42bfdec62720b2f74937a170679bf3e9217e5249634d23c494d89d504dce0b6fe8669aa0bf5ae

Download Submit
C:\Windows\SysWOW64\Nqklmpdd.exe

Filesize
13KB

MD5
7662e1c3302102ec5f42ee3ee0751ec8

SHA1
23cecdbf416dd36fcf057aa0e4404b4b100b0e85

SHA256
42a1c469b70b21414db960438612a901ae8db39e04706b0e55d90bedd886a396

SHA512
936fff8c90c471b8952036e36fc428d7759192f13810c4a3aeaea8806762656f0c4a118bc224a2b9de33cd06fc67dfd638e9b2ff67d82fef5b5716eb1393957e

Download Submit
C:\Windows\SysWOW64\Nqklmpdd.exe

Filesize
28KB

MD5
1c9e24ff21f82b91a78576211aa5a72d

SHA1
a2993f593a1df3d874a849b48f6c8b25c726cb94

SHA256
edcf20c7e25d8f93142605dfbf17edf5d2ca38d261506ff99a0fd65327e1dd62

SHA512
51edaca2cb3f0abe0e78dc9152f2ae06414346c2ad8b44eef03678c5edd1048deea3f832a655b85d1a1ffc6f1a95f8ddd92949adda35a2892ac04ae574368807

Download Submit
memory/536-143-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/536-257-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1004-200-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1004-243-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1036-259-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1036-136-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1644-261-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1644-128-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1752-184-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1752-248-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1916-269-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1916-95-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1924-216-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1924-240-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2060-8-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2060-292-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2168-120-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2168-265-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2348-111-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2348-264-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2644-281-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2644-52-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2676-168-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2676-250-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2704-80-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2704-274-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2796-252-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2796-176-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2932-280-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2932-56-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3008-267-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3008-104-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3092-31-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3092-287-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3528-208-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3528-242-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3684-40-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3684-290-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3712-232-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3712-236-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3772-255-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3772-152-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3900-71-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3900-279-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3976-289-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3976-15-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4076-27-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4076-288-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4236-238-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4236-224-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4336-192-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4336-245-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4420-64-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4420-276-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4468-291-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4468-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4588-270-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4588-88-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5112-253-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5112-160-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads