98af8f7b7a0794c214b7e7b53d979e13f7206a8840c3019a6b3b36d2291f2b6e

Analysis

max time kernel
28s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
07/01/2024, 20:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b7020099d211484485635278470cbbb5.exe
Size 113KB
Sample240107-y53gbaeff3
SHA256 98af8f7b7a0794c214b7e7b53d979e13f7206a8840c3019a6b3b36d2291f2b6e
MD5 b7020099d211484485635278470cbbb5
SHA1 eabde3a09c84f695c5db6024d23a4df286a2139c
SHA512 5e210de050c8a74e7601a7734944d26bf766fb69e0174d6b683b3fd6b2a5509d0627a65e7e32d90c70b3af7b7120bf7b456fb545b6b5a83273f3e9988b9a56b0
SSDEEP 3072:esAkMmgdGZTO1ROuGkZFfFSebHWrH8wTW0:zEQO1A7otSeWrP
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

backdoor dropper persistence trojan

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 20 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngjbaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njinmf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nabfjpak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ebhglj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Maggnali.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nelfeo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nhmofj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kcpahpmd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nelfeo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njinmf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	b7020099d211484485635278470cbbb5.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ebhglj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Maggnali.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kcpahpmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ngjbaj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nabfjpak.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nhmofj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	b7020099d211484485635278470cbbb5.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kjepjkhf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kjepjkhf.exe

Malware Dropper & Backdoor - Berbew 64 IoCs

Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.

backdoor trojan dropper

resource	yara_rule
behavioral2/memory/2120-0-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/memory/2268-8-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/files/0x0007000000023248-7.dat	family_berbew
behavioral2/files/0x000600000002324d-14.dat	family_berbew
behavioral2/files/0x000600000002324d-15.dat	family_berbew
behavioral2/memory/4544-16-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/memory/4932-25-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/files/0x000600000002324f-22.dat	family_berbew
behavioral2/memory/3504-40-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/memory/3760-95-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/memory/3480-111-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/memory/900-104-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/memory/2316-88-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/memory/964-80-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/memory/536-72-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/memory/1644-63-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/memory/2800-56-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/memory/1944-48-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/memory/2932-31-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/memory/216-119-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/memory/2312-192-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/memory/5060-200-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/memory/4168-248-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/memory/556-256-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/memory/2036-265-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/memory/2788-268-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/memory/1112-274-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/memory/2168-240-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/memory/1596-232-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/memory/3176-224-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/memory/428-216-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/memory/3048-207-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/memory/3984-184-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/memory/4892-176-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/memory/1564-172-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/memory/716-164-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/memory/1660-156-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/memory/384-144-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/memory/852-140-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/memory/220-127-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/memory/2708-284-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/memory/3164-308-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/memory/3788-311-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/memory/5200-328-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/memory/5280-340-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/memory/5484-374-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/memory/5524-376-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/memory/5564-382-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/memory/5644-398-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/memory/5768-412-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/memory/5728-406-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/memory/5688-404-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/files/0x00060000000232cf-449.dat	family_berbew
behavioral2/memory/5992-442-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/memory/5948-440-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/memory/5912-430-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/memory/5856-424-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/files/0x000300000002272c-419.dat	family_berbew
behavioral2/memory/5816-418-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/memory/5604-388-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/memory/5444-364-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/memory/5404-358-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/memory/5360-356-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/memory/5320-350-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew

Executes dropped EXE 10 IoCs

pid	Process
2268	Ebhglj32.exe
4544	Kjepjkhf.exe
4932	Kcpahpmd.exe
2932	Maggnali.exe
3504	Nelfeo32.exe
1944	Ngjbaj32.exe
2800	Njinmf32.exe
1644	Nabfjpak.exe
536	Nhmofj32.exe
964	Nnfgcd32.exe

Drops file in System32 directory 30 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Nhmofj32.exe	Nabfjpak.exe
File created	C:\Windows\SysWOW64\Nnfgcd32.exe	Nhmofj32.exe
File created	C:\Windows\SysWOW64\Ebhglj32.exe	b7020099d211484485635278470cbbb5.exe
File created	C:\Windows\SysWOW64\Njinmf32.exe	Ngjbaj32.exe
File opened for modification	C:\Windows\SysWOW64\Njinmf32.exe	Ngjbaj32.exe
File opened for modification	C:\Windows\SysWOW64\Ebhglj32.exe	b7020099d211484485635278470cbbb5.exe
File created	C:\Windows\SysWOW64\Hleoiomo.dll	Ebhglj32.exe
File created	C:\Windows\SysWOW64\Fjcgfjdk.dll	Nelfeo32.exe
File created	C:\Windows\SysWOW64\Fkemhahj.dll	Nhmofj32.exe
File created	C:\Windows\SysWOW64\Bgeemcfc.dll	Maggnali.exe
File opened for modification	C:\Windows\SysWOW64\Nabfjpak.exe	Njinmf32.exe
File opened for modification	C:\Windows\SysWOW64\Nhmofj32.exe	Nabfjpak.exe
File created	C:\Windows\SysWOW64\Kjepjkhf.exe	Ebhglj32.exe
File created	C:\Windows\SysWOW64\Ngjbaj32.exe	Nelfeo32.exe
File opened for modification	C:\Windows\SysWOW64\Ngjbaj32.exe	Nelfeo32.exe
File created	C:\Windows\SysWOW64\Jjgobjmp.dll	Njinmf32.exe
File opened for modification	C:\Windows\SysWOW64\Nnfgcd32.exe	Nhmofj32.exe
File opened for modification	C:\Windows\SysWOW64\Kjepjkhf.exe	Ebhglj32.exe
File created	C:\Windows\SysWOW64\Gicbkkca.dll	Kjepjkhf.exe
File created	C:\Windows\SysWOW64\Nelfeo32.exe	Maggnali.exe
File opened for modification	C:\Windows\SysWOW64\Maggnali.exe	Kcpahpmd.exe
File opened for modification	C:\Windows\SysWOW64\Nelfeo32.exe	Maggnali.exe
File created	C:\Windows\SysWOW64\Jlpncq32.dll	Ngjbaj32.exe
File created	C:\Windows\SysWOW64\Nabfjpak.exe	Njinmf32.exe
File created	C:\Windows\SysWOW64\Onlche32.dll	Nabfjpak.exe
File created	C:\Windows\SysWOW64\Fpjqcaao.dll	b7020099d211484485635278470cbbb5.exe
File created	C:\Windows\SysWOW64\Kcpahpmd.exe	Kjepjkhf.exe
File created	C:\Windows\SysWOW64\Maggnali.exe	Kcpahpmd.exe
File opened for modification	C:\Windows\SysWOW64\Kcpahpmd.exe	Kjepjkhf.exe
File created	C:\Windows\SysWOW64\Mohjdmko.dll	Kcpahpmd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6396	6148	WerFault.exe	236

Modifies registry class 33 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kjepjkhf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mohjdmko.dll"	Kcpahpmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bgeemcfc.dll"	Maggnali.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Maggnali.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	b7020099d211484485635278470cbbb5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nelfeo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ngjbaj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Njinmf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nabfjpak.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	b7020099d211484485635278470cbbb5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ngjbaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fkemhahj.dll"	Nhmofj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	b7020099d211484485635278470cbbb5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kjepjkhf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Onlche32.dll"	Nabfjpak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nhmofj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hleoiomo.dll"	Ebhglj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kcpahpmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Maggnali.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fjcgfjdk.dll"	Nelfeo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ebhglj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpjqcaao.dll"	b7020099d211484485635278470cbbb5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ebhglj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kcpahpmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjgobjmp.dll"	Njinmf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Njinmf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	b7020099d211484485635278470cbbb5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	b7020099d211484485635278470cbbb5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gicbkkca.dll"	Kjepjkhf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nelfeo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlpncq32.dll"	Ngjbaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nabfjpak.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nhmofj32.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 2268	2120	b7020099d211484485635278470cbbb5.exe	90
PID 2120 wrote to memory of 2268	2120	b7020099d211484485635278470cbbb5.exe	90
PID 2120 wrote to memory of 2268	2120	b7020099d211484485635278470cbbb5.exe	90
PID 2268 wrote to memory of 4544	2268	Ebhglj32.exe	91
PID 2268 wrote to memory of 4544	2268	Ebhglj32.exe	91
PID 2268 wrote to memory of 4544	2268	Ebhglj32.exe	91
PID 4544 wrote to memory of 4932	4544	Kjepjkhf.exe	92
PID 4544 wrote to memory of 4932	4544	Kjepjkhf.exe	92
PID 4544 wrote to memory of 4932	4544	Kjepjkhf.exe	92
PID 4932 wrote to memory of 2932	4932	Kcpahpmd.exe	104
PID 4932 wrote to memory of 2932	4932	Kcpahpmd.exe	104
PID 4932 wrote to memory of 2932	4932	Kcpahpmd.exe	104
PID 2932 wrote to memory of 3504	2932	Maggnali.exe	102
PID 2932 wrote to memory of 3504	2932	Maggnali.exe	102
PID 2932 wrote to memory of 3504	2932	Maggnali.exe	102
PID 3504 wrote to memory of 1944	3504	Nelfeo32.exe	101
PID 3504 wrote to memory of 1944	3504	Nelfeo32.exe	101
PID 3504 wrote to memory of 1944	3504	Nelfeo32.exe	101
PID 1944 wrote to memory of 2800	1944	Ngjbaj32.exe	93
PID 1944 wrote to memory of 2800	1944	Ngjbaj32.exe	93
PID 1944 wrote to memory of 2800	1944	Ngjbaj32.exe	93
PID 2800 wrote to memory of 1644	2800	Njinmf32.exe	100
PID 2800 wrote to memory of 1644	2800	Njinmf32.exe	100
PID 2800 wrote to memory of 1644	2800	Njinmf32.exe	100
PID 1644 wrote to memory of 536	1644	Nabfjpak.exe	94
PID 1644 wrote to memory of 536	1644	Nabfjpak.exe	94
PID 1644 wrote to memory of 536	1644	Nabfjpak.exe	94
PID 536 wrote to memory of 964	536	Nhmofj32.exe	99
PID 536 wrote to memory of 964	536	Nhmofj32.exe	99
PID 536 wrote to memory of 964	536	Nhmofj32.exe	99

C:\Users\Admin\AppData\Local\Temp\b7020099d211484485635278470cbbb5.exe
"C:\Users\Admin\AppData\Local\Temp\b7020099d211484485635278470cbbb5.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Windows\SysWOW64\Ebhglj32.exe
  C:\Windows\system32\Ebhglj32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2268
- - C:\Windows\SysWOW64\Kjepjkhf.exe
    C:\Windows\system32\Kjepjkhf.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4544
  - - C:\Windows\SysWOW64\Kcpahpmd.exe
      C:\Windows\system32\Kcpahpmd.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4932
    - - C:\Windows\SysWOW64\Maggnali.exe
        
        C:\Windows\system32\Maggnali.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2932

C:\Windows\SysWOW64\Njinmf32.exe
C:\Windows\system32\Njinmf32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Windows\SysWOW64\Nabfjpak.exe
  C:\Windows\system32\Nabfjpak.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1644

C:\Windows\SysWOW64\Nhmofj32.exe
C:\Windows\system32\Nhmofj32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:536
- C:\Windows\SysWOW64\Nnfgcd32.exe
  C:\Windows\system32\Nnfgcd32.exe
  2⤵
  - Executes dropped EXE
  PID:964

C:\Windows\SysWOW64\Njmhhefi.exe
C:\Windows\system32\Njmhhefi.exe
1⤵
PID:900
- C:\Windows\SysWOW64\Nmnqjp32.exe
  C:\Windows\system32\Nmnqjp32.exe
  2⤵
  PID:3480
- - C:\Windows\SysWOW64\Odhifjkg.exe
    C:\Windows\system32\Odhifjkg.exe
    3⤵
    PID:216
  - - C:\Windows\SysWOW64\Bdbnjdfg.exe
      C:\Windows\system32\Bdbnjdfg.exe
      4⤵
      PID:220

C:\Windows\SysWOW64\Nccokk32.exe
C:\Windows\system32\Nccokk32.exe
1⤵
PID:3760

C:\Windows\SysWOW64\Naecop32.exe
C:\Windows\system32\Naecop32.exe
1⤵
PID:2316

C:\Windows\SysWOW64\Ngjbaj32.exe
C:\Windows\system32\Ngjbaj32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1944

C:\Windows\SysWOW64\Nelfeo32.exe
C:\Windows\system32\Nelfeo32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3504

C:\Windows\SysWOW64\Bhpfqcln.exe
C:\Windows\system32\Bhpfqcln.exe
1⤵
PID:1660
- C:\Windows\SysWOW64\Bkobmnka.exe
  C:\Windows\system32\Bkobmnka.exe
  2⤵
  PID:716

C:\Windows\SysWOW64\Bahkih32.exe
C:\Windows\system32\Bahkih32.exe
1⤵
PID:1564
- C:\Windows\SysWOW64\Bhbcfbjk.exe
  C:\Windows\system32\Bhbcfbjk.exe
  2⤵
  PID:4892

C:\Windows\SysWOW64\Cfipef32.exe
C:\Windows\system32\Cfipef32.exe
1⤵
PID:428
- C:\Windows\SysWOW64\Clchbqoo.exe
  C:\Windows\system32\Clchbqoo.exe
  2⤵
  PID:3176

C:\Windows\SysWOW64\Cbdjeg32.exe
C:\Windows\system32\Cbdjeg32.exe
1⤵
PID:1112
- C:\Windows\SysWOW64\Ckmonl32.exe
  C:\Windows\system32\Ckmonl32.exe
  2⤵
  PID:2708
- - C:\Windows\SysWOW64\Jgmjmjnb.exe
    C:\Windows\system32\Jgmjmjnb.exe
    3⤵
    PID:4164

C:\Windows\SysWOW64\Cofnik32.exe
C:\Windows\system32\Cofnik32.exe
1⤵
PID:2788

C:\Windows\SysWOW64\Chlflabp.exe
C:\Windows\system32\Chlflabp.exe
1⤵
PID:2036

C:\Windows\SysWOW64\Cnfaohbj.exe
C:\Windows\system32\Cnfaohbj.exe
1⤵
PID:556

C:\Windows\SysWOW64\Chiigadc.exe
C:\Windows\system32\Chiigadc.exe
1⤵
PID:4168

C:\Windows\SysWOW64\Cfkmkf32.exe
C:\Windows\system32\Cfkmkf32.exe
1⤵
PID:2168

C:\Windows\SysWOW64\Coadnlnb.exe
C:\Windows\system32\Coadnlnb.exe
1⤵
PID:1596

C:\Windows\SysWOW64\Coohhlpe.exe
C:\Windows\system32\Coohhlpe.exe
1⤵
PID:3048

C:\Windows\SysWOW64\Bheplb32.exe
C:\Windows\system32\Bheplb32.exe
1⤵
PID:5060

C:\Windows\SysWOW64\Bakgoh32.exe
C:\Windows\system32\Bakgoh32.exe
1⤵
PID:2312

C:\Windows\SysWOW64\Bomkcm32.exe
C:\Windows\system32\Bomkcm32.exe
1⤵
PID:3984

C:\Windows\SysWOW64\Bebjdgmj.exe
C:\Windows\system32\Bebjdgmj.exe
1⤵
PID:384

C:\Windows\SysWOW64\Bohbhmfm.exe
C:\Windows\system32\Bohbhmfm.exe
1⤵
PID:852

C:\Windows\SysWOW64\Jngbjd32.exe
C:\Windows\system32\Jngbjd32.exe
1⤵
PID:2164
- C:\Windows\SysWOW64\Jpenfp32.exe
  C:\Windows\system32\Jpenfp32.exe
  2⤵
  PID:3540
- - C:\Windows\SysWOW64\Jcdjbk32.exe
    C:\Windows\system32\Jcdjbk32.exe
    3⤵
    PID:3164
  - - C:\Windows\SysWOW64\Jinboekc.exe
      C:\Windows\system32\Jinboekc.exe
      4⤵
      PID:3788

C:\Windows\SysWOW64\Jedccfqg.exe
C:\Windows\system32\Jedccfqg.exe
1⤵
PID:5160
- C:\Windows\SysWOW64\Jnlkedai.exe
  C:\Windows\system32\Jnlkedai.exe
  2⤵
  PID:5200
- - C:\Windows\SysWOW64\Kgdpni32.exe
    C:\Windows\system32\Kgdpni32.exe
    3⤵
    PID:5240

C:\Windows\SysWOW64\Knnhjcog.exe
C:\Windows\system32\Knnhjcog.exe
1⤵
PID:5280
- C:\Windows\SysWOW64\Kpmdfonj.exe
  C:\Windows\system32\Kpmdfonj.exe
  2⤵
  PID:5320

C:\Windows\SysWOW64\Kgflcifg.exe
C:\Windows\system32\Kgflcifg.exe
1⤵
PID:5360
- C:\Windows\SysWOW64\Klcekpdo.exe
  C:\Windows\system32\Klcekpdo.exe
  2⤵
  PID:5404
- - C:\Windows\SysWOW64\Kcmmhj32.exe
    C:\Windows\system32\Kcmmhj32.exe
    3⤵
    PID:5444
  - - C:\Windows\SysWOW64\Kjgeedch.exe
      C:\Windows\system32\Kjgeedch.exe
      4⤵
      PID:5484
    - - C:\Windows\SysWOW64\Klfaapbl.exe
        
        C:\Windows\system32\Klfaapbl.exe
        5⤵
        
        PID:5524

C:\Windows\SysWOW64\Kgnbdh32.exe
C:\Windows\system32\Kgnbdh32.exe
1⤵
PID:5728
- C:\Windows\SysWOW64\Kjlopc32.exe
  C:\Windows\system32\Kjlopc32.exe
  2⤵
  PID:5768
- - C:\Windows\SysWOW64\Lljklo32.exe
    C:\Windows\system32\Lljklo32.exe
    3⤵
    PID:5816
  - - C:\Windows\SysWOW64\Llodgnja.exe
      C:\Windows\system32\Llodgnja.exe
      4⤵
      PID:5856
    - - C:\Windows\SysWOW64\Lcimdh32.exe
        
        C:\Windows\system32\Lcimdh32.exe
        5⤵
        
        PID:5912

C:\Windows\SysWOW64\Kofkbk32.exe
C:\Windows\system32\Kofkbk32.exe
1⤵
PID:5688

C:\Windows\SysWOW64\Lfgipd32.exe
C:\Windows\system32\Lfgipd32.exe
1⤵
PID:5948
- C:\Windows\SysWOW64\Lnoaaaad.exe
  C:\Windows\system32\Lnoaaaad.exe
  2⤵
  PID:5992
- - C:\Windows\SysWOW64\Lopmii32.exe
    C:\Windows\system32\Lopmii32.exe
    3⤵
    PID:6056
  - - C:\Windows\SysWOW64\Lfjfecno.exe
      C:\Windows\system32\Lfjfecno.exe
      4⤵
      PID:6100
    - - C:\Windows\SysWOW64\Lnangaoa.exe
        
        C:\Windows\system32\Lnangaoa.exe
        5⤵
        
        PID:5124
      - C:\Windows\SysWOW64\Lcnfohmi.exe
        
        C:\Windows\system32\Lcnfohmi.exe
        6⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\Ljhnlb32.exe
        
        C:\Windows\system32\Ljhnlb32.exe
        7⤵
        
        PID:5328

C:\Windows\SysWOW64\Mqafhl32.exe
C:\Windows\system32\Mqafhl32.exe
1⤵
PID:5380
- C:\Windows\SysWOW64\Modgdicm.exe
  C:\Windows\system32\Modgdicm.exe
  2⤵
  PID:5480
- - C:\Windows\SysWOW64\Mgloefco.exe
    C:\Windows\system32\Mgloefco.exe
    3⤵
    PID:5572

C:\Windows\SysWOW64\Mjlhgaqp.exe
C:\Windows\system32\Mjlhgaqp.exe
1⤵
PID:5640
- C:\Windows\SysWOW64\Mnhdgpii.exe
  C:\Windows\system32\Mnhdgpii.exe
  2⤵
  PID:5716
- - C:\Windows\SysWOW64\Mcelpggq.exe
    C:\Windows\system32\Mcelpggq.exe
    3⤵
    PID:5800

C:\Windows\SysWOW64\Mjodla32.exe
C:\Windows\system32\Mjodla32.exe
1⤵
PID:5544
- C:\Windows\SysWOW64\Mmmqhl32.exe
  C:\Windows\system32\Mmmqhl32.exe
  2⤵
  PID:6000
- - C:\Windows\SysWOW64\Mokmdh32.exe
    C:\Windows\system32\Mokmdh32.exe
    3⤵
    PID:6092

C:\Windows\SysWOW64\Mcgiefen.exe
C:\Windows\system32\Mcgiefen.exe
1⤵
PID:5236
- C:\Windows\SysWOW64\Mfeeabda.exe
  C:\Windows\system32\Mfeeabda.exe
  2⤵
  PID:5336
- - C:\Windows\SysWOW64\Mnmmboed.exe
    C:\Windows\system32\Mnmmboed.exe
    3⤵
    PID:5492
  - - C:\Windows\SysWOW64\Nmbjcljl.exe
      C:\Windows\system32\Nmbjcljl.exe
      4⤵
      PID:5592
    - - C:\Windows\SysWOW64\Nclbpf32.exe
        
        C:\Windows\system32\Nclbpf32.exe
        5⤵
        
        PID:5676
      - C:\Windows\SysWOW64\Nnafno32.exe
        
        C:\Windows\system32\Nnafno32.exe
        6⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\Nqpcjj32.exe
        
        C:\Windows\system32\Nqpcjj32.exe
        7⤵
        
        PID:6088

C:\Windows\SysWOW64\Npbceggm.exe
C:\Windows\system32\Npbceggm.exe
1⤵
PID:5228
- C:\Windows\SysWOW64\Ngjkfd32.exe
  C:\Windows\system32\Ngjkfd32.exe
  2⤵
  PID:1968

C:\Windows\SysWOW64\Nflkbanj.exe
C:\Windows\system32\Nflkbanj.exe
1⤵
PID:5612
- C:\Windows\SysWOW64\Nncccnol.exe
  C:\Windows\system32\Nncccnol.exe
  2⤵
  PID:5904
- - C:\Windows\SysWOW64\Ncqlkemc.exe
    C:\Windows\system32\Ncqlkemc.exe
    3⤵
    PID:6108

C:\Windows\SysWOW64\Nmipdk32.exe
C:\Windows\system32\Nmipdk32.exe
1⤵
PID:5924
- C:\Windows\SysWOW64\Npgmpf32.exe
  C:\Windows\system32\Npgmpf32.exe
  2⤵
  PID:5808
- - C:\Windows\SysWOW64\Nmkmjjaa.exe
    C:\Windows\system32\Nmkmjjaa.exe
    3⤵
    PID:5988
  - - C:\Windows\SysWOW64\Ojomcopk.exe
      C:\Windows\system32\Ojomcopk.exe
      4⤵
      PID:5752
    - - C:\Windows\SysWOW64\Ogcnmc32.exe
        
        C:\Windows\system32\Ogcnmc32.exe
        5⤵
        
        PID:5684
      - C:\Windows\SysWOW64\Oakbehfe.exe
        
        C:\Windows\system32\Oakbehfe.exe
        6⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\Ogekbb32.exe
        
        C:\Windows\system32\Ogekbb32.exe
        7⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Ojdgnn32.exe
        
        C:\Windows\system32\Ojdgnn32.exe
        8⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Oclkgccf.exe
        
        C:\Windows\system32\Oclkgccf.exe
        9⤵
        
        PID:6236
        
        C:\Windows\SysWOW64\Ofkgcobj.exe
        
        C:\Windows\system32\Ofkgcobj.exe
        10⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\Opclldhj.exe
        
        C:\Windows\system32\Opclldhj.exe
        11⤵
        
        PID:6332
        
        C:\Windows\SysWOW64\Ofmdio32.exe
        
        C:\Windows\system32\Ofmdio32.exe
        12⤵
        
        PID:6372

C:\Windows\SysWOW64\Ondljl32.exe
C:\Windows\system32\Ondljl32.exe
1⤵
PID:6408
- C:\Windows\SysWOW64\Oabhfg32.exe
  C:\Windows\system32\Oabhfg32.exe
  2⤵
  PID:6468
- - C:\Windows\SysWOW64\Qfkqjmdg.exe
    C:\Windows\system32\Qfkqjmdg.exe
    3⤵
    PID:6512
  - - C:\Windows\SysWOW64\Qpcecb32.exe
      C:\Windows\system32\Qpcecb32.exe
      4⤵
      PID:6556
    - - C:\Windows\SysWOW64\Qodeajbg.exe
        
        C:\Windows\system32\Qodeajbg.exe
        5⤵
        
        PID:6600
      - C:\Windows\SysWOW64\Akkffkhk.exe
        
        C:\Windows\system32\Akkffkhk.exe
        6⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\Amjbbfgo.exe
        
        C:\Windows\system32\Amjbbfgo.exe
        7⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\Ahofoogd.exe
        
        C:\Windows\system32\Ahofoogd.exe
        8⤵
        
        PID:6744
        
        C:\Windows\SysWOW64\Amlogfel.exe
        
        C:\Windows\system32\Amlogfel.exe
        9⤵
        
        PID:6792
        
        C:\Windows\SysWOW64\Adfgdpmi.exe
        
        C:\Windows\system32\Adfgdpmi.exe
        10⤵
        
        PID:6860
        
        C:\Windows\SysWOW64\Agdcpkll.exe
        
        C:\Windows\system32\Agdcpkll.exe
        11⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\Aajhndkb.exe
        
        C:\Windows\system32\Aajhndkb.exe
        12⤵
        
        PID:6952
        
        C:\Windows\SysWOW64\Adhdjpjf.exe
        
        C:\Windows\system32\Adhdjpjf.exe
        13⤵
        
        PID:6996
        
        C:\Windows\SysWOW64\Aggpfkjj.exe
        
        C:\Windows\system32\Aggpfkjj.exe
        14⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\Amqhbe32.exe
        
        C:\Windows\system32\Amqhbe32.exe
        15⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\Adkqoohc.exe
        
        C:\Windows\system32\Adkqoohc.exe
        16⤵
        
        PID:7124

C:\Windows\SysWOW64\Klhnfo32.exe
C:\Windows\system32\Klhnfo32.exe
1⤵
PID:5644

C:\Windows\SysWOW64\Kjjbjd32.exe
C:\Windows\system32\Kjjbjd32.exe
1⤵
PID:5604

C:\Windows\SysWOW64\Kgkfnh32.exe
C:\Windows\system32\Kgkfnh32.exe
1⤵
PID:5564

C:\Windows\SysWOW64\Ahfmpnql.exe
C:\Windows\system32\Ahfmpnql.exe
1⤵
PID:7164
- C:\Windows\SysWOW64\Akdilipp.exe
  C:\Windows\system32\Akdilipp.exe
  2⤵
  PID:6188

C:\Windows\SysWOW64\Amcehdod.exe
C:\Windows\system32\Amcehdod.exe
1⤵
PID:6232
- C:\Windows\SysWOW64\Bdmmeo32.exe
  C:\Windows\system32\Bdmmeo32.exe
  2⤵
  PID:6304
- - C:\Windows\SysWOW64\Bgkiaj32.exe
    C:\Windows\system32\Bgkiaj32.exe
    3⤵
    PID:2512
  - - C:\Windows\SysWOW64\Baannc32.exe
      C:\Windows\system32\Baannc32.exe
      4⤵
      PID:1820
    - - C:\Windows\SysWOW64\Bdojjo32.exe
        
        C:\Windows\system32\Bdojjo32.exe
        5⤵
        
        PID:3172
      - C:\Windows\SysWOW64\Bgnffj32.exe
        
        C:\Windows\system32\Bgnffj32.exe
        6⤵
        
        PID:4836

C:\Windows\SysWOW64\Bmhocd32.exe
C:\Windows\system32\Bmhocd32.exe
1⤵
PID:6464
- C:\Windows\SysWOW64\Bpfkpp32.exe
  C:\Windows\system32\Bpfkpp32.exe
  2⤵
  PID:6496

C:\Windows\SysWOW64\Bdagpnbk.exe
C:\Windows\system32\Bdagpnbk.exe
1⤵
PID:3844
- C:\Windows\SysWOW64\Bgpcliao.exe
  C:\Windows\system32\Bgpcliao.exe
  2⤵
  PID:6624
- - C:\Windows\SysWOW64\Bogkmgba.exe
    C:\Windows\system32\Bogkmgba.exe
    3⤵
    PID:6684

C:\Windows\SysWOW64\Bphgeo32.exe
C:\Windows\system32\Bphgeo32.exe
1⤵
PID:6768
- C:\Windows\SysWOW64\Bhpofl32.exe
  C:\Windows\system32\Bhpofl32.exe
  2⤵
  PID:6840
- - C:\Windows\SysWOW64\Bknlbhhe.exe
    C:\Windows\system32\Bknlbhhe.exe
    3⤵
    PID:6932

C:\Windows\SysWOW64\Bnlhncgi.exe
C:\Windows\system32\Bnlhncgi.exe
1⤵
PID:6980
- C:\Windows\SysWOW64\Bpkdjofm.exe
  C:\Windows\system32\Bpkdjofm.exe
  2⤵
  PID:7076
- - C:\Windows\SysWOW64\Bgelgi32.exe
    C:\Windows\system32\Bgelgi32.exe
    3⤵
    PID:7140
  - - C:\Windows\SysWOW64\Bnoddcef.exe
      C:\Windows\system32\Bnoddcef.exe
      4⤵
      PID:5464
    - - C:\Windows\SysWOW64\Cpmapodj.exe
        
        C:\Windows\system32\Cpmapodj.exe
        5⤵
        
        PID:6268
      - C:\Windows\SysWOW64\Cggimh32.exe
        
        C:\Windows\system32\Cggimh32.exe
        6⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\Conanfli.exe
        
        C:\Windows\system32\Conanfli.exe
        7⤵
        
        PID:4260
        
        C:\Windows\SysWOW64\Chfegk32.exe
        
        C:\Windows\system32\Chfegk32.exe
        8⤵
        
        PID:6404

C:\Windows\SysWOW64\Ckebcg32.exe
C:\Windows\system32\Ckebcg32.exe
1⤵
PID:6492
- C:\Windows\SysWOW64\Cpbjkn32.exe
  C:\Windows\system32\Cpbjkn32.exe
  2⤵
  PID:6612
- - C:\Windows\SysWOW64\Chiblk32.exe
    C:\Windows\system32\Chiblk32.exe
    3⤵
    PID:6700

C:\Windows\SysWOW64\Cpdgqmnb.exe
C:\Windows\system32\Cpdgqmnb.exe
1⤵
PID:6984
- C:\Windows\SysWOW64\Chkobkod.exe
  C:\Windows\system32\Chkobkod.exe
  2⤵
  PID:7032
- - C:\Windows\SysWOW64\Ckjknfnh.exe
    C:\Windows\system32\Ckjknfnh.exe
    3⤵
    PID:6160
  - - C:\Windows\SysWOW64\Coegoe32.exe
      C:\Windows\system32\Coegoe32.exe
      4⤵
      PID:7148
    - - C:\Windows\SysWOW64\Chnlgjlb.exe
        
        C:\Windows\system32\Chnlgjlb.exe
        5⤵
        
        PID:4876
      - C:\Windows\SysWOW64\Cnjdpaki.exe
        
        C:\Windows\system32\Cnjdpaki.exe
        6⤵
        
        PID:6428
        
        C:\Windows\SysWOW64\Dddllkbf.exe
        
        C:\Windows\system32\Dddllkbf.exe
        7⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Dojqjdbl.exe
        
        C:\Windows\system32\Dojqjdbl.exe
        8⤵
        
        PID:6740
        
        C:\Windows\SysWOW64\Dpkmal32.exe
        
        C:\Windows\system32\Dpkmal32.exe
        9⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\Dkqaoe32.exe
        
        C:\Windows\system32\Dkqaoe32.exe
        10⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6148 -s 400
        11⤵
        Program crash
        
        PID:6396

C:\Windows\SysWOW64\Cnfkdb32.exe
C:\Windows\system32\Cnfkdb32.exe
1⤵
PID:6856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 6148 -ip 6148
1⤵
PID:4616

C:\Windows\SysWOW64\Jcfggkac.exe
C:\Windows\system32\Jcfggkac.exe
1⤵
PID:1092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Agdcpkll.exe

Path C:\Windows\SysWOW64\Agdcpkll.exe
Size 113KB
SHA256 b5aa314cb7a5d24d516392ef99e7867b95bb41aa4564b34248ddd9661d6d7d5e
MD5 97511c620232266216886f71c9a78e77
SHA1 414a6174f783840f9d6dcae6b59dbb127810e40e
SHA512 a7ae3c55b4babd2c6a731990d799d1f334fb6af4b50c7d7645785747d677b6807813d31bcae69afc45af3ff7efd726e7e2bf2ca1caafdb3dc912a86d2d67923f
SSDEEP 1536:C99yXWTXuyevAsWBvNqj0O617DWkZFfScD7SzCbHWrAW8wTWiliX:ytTXoFQ20OuGkZFfFSebHWrH8wTW0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ahfmpnql.exe

Path C:\Windows\SysWOW64\Ahfmpnql.exe
Size 113KB
SHA256 748698c5f374f4e531ef528328d72a96532089bdfe9b72b67b43bd34d02de1f2
MD5 f64f7d67ae66f145d28fbf4dffb745a3
SHA1 94e78bdae95433bed9ba6a8e6099ae0d8964bf45
SHA512 b3a993ee11b657b2de2ad840b3d908e429caf8314244d5989f73e952cedd2ecf07c33a18229506d469e37b867be64bafccfa5a2d3e248c64c366b9d9c274d67f
SSDEEP 3072:gjhsoSKqRKvCq6ZiOuGkZFfFSebHWrH8wTW0:gdALlq6Z37otSeWrP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Chnlgjlb.exe

Path C:\Windows\SysWOW64\Chnlgjlb.exe
Size 113KB
SHA256 48e1bfac76b27ecd76b099be3d669d8c31b81f9adde1dc233615c9e740e61634
MD5 8fe41bc203c868b0748d2216231e6f9b
SHA1 5a63767313e1eb9476a7c35458072d35f2fd19f6
SHA512 f39b5b8356f3eecf2a3a15eafff5b060bdc3774a44aa158c52321049af3e4604b67dc45eb4ed9160170fc127f8b1174b0ec85e81f2def29b010312ef05554f11
SSDEEP 3072:R+R8oAoDuuFDzOuGkZFfFSebHWrH8wTW0:R1o/D67otSeWrP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cnfkdb32.exe

Path C:\Windows\SysWOW64\Cnfkdb32.exe
Size 113KB
SHA256 0bf107d1679e595ab89ae55d62740c188cb3c9270f7766d76e461565456bca9f
MD5 7176b0504c03b785c4a01a9e4e9576f6
SHA1 7c871dca9abd3c81c12bb8a88a1552ab5927e970
SHA512 55c863b1a739f968301e0eba3d1a35aa64ca04ae86a27b23d21fed6a6d64f9278fd3094a050562e59c2e924e62d04aa6f2a2c7489a0a6c7dc7b863ca4439f119
SSDEEP 3072:LJGIGqAMNl38XqOuGkZFfFSebHWrH8wTW0:LgIGqAMbgf7otSeWrP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cpmapodj.exe

Path C:\Windows\SysWOW64\Cpmapodj.exe
Size 113KB
SHA256 8686450b6521f70f5d93cf92e3edce3ae10e614de1685171a00702e6b76291c8
MD5 4458fc71958471c970f26e3ae6c15067
SHA1 0537e3d085f98718820dc8322abb8d892c5b1947
SHA512 1d4a27c0e1883831f3113e378d270ee2aa4e0f7fc8a27fb436490cdefa611783dd610ef78173a3578b0db9a9fdbafabcbed24ce35004c7434c13933a8d522018
SSDEEP 3072:TGGwCC09Iz24vqM6X7OuGkZFfFSebHWrH8wTW0:CjgejSVi7otSeWrP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ebhglj32.exe

Path C:\Windows\SysWOW64\Ebhglj32.exe
Size 113KB
SHA256 a3e6c0b3d3a4b818c2c2a07e0e8a2d16fa2cf15217bb01f16127931b2608d31a
MD5 dc7e7c27c6b83ae6f066acae99d3a3d3
SHA1 443d8f8358c74984ba864b790c94cc70432cd0a4
SHA512 bb9d3688321fc43af98352bdc9a6795383ba0da4b9e123c002ffe85f9ea91eabd1ba0cec8d48d9ff6bc49e63cfc14b8a0a7b921c2a9302f62e2aebe65a098378
SSDEEP 1536:rRw4OpjlvVTn57WIIKR87FdO617DWkZFfScD7SzCbHWrAW8wTWiliX:FVYVTcHeidOuGkZFfFSebHWrH8wTW0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kgdpni32.exe

Path C:\Windows\SysWOW64\Kgdpni32.exe
Size 113KB
SHA256 77cb286b632d2926b28655469d8a4521882c36a9b05b8900646563ee13ee85a1
MD5 bc68a49444952e76e8196c11592393ae
SHA1 bd592c57cd04abf83d00aab3448fc2937ef65d2f
SHA512 671cef626d13e948e48651a51f26a2693dcd55a2181115620d831317a88774ee13b039894d776a209a833c586b031c20117ad873405c6be3d9fcc35eafa30d01
SSDEEP 3072:qpZ3CMIG2bRZA/up43OuGkZFfFSebHWrH8wTW0:I7BOet+7otSeWrP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kjepjkhf.exe

Path C:\Windows\SysWOW64\Kjepjkhf.exe
Size 113KB
SHA256 905994e1da677864993ea7b91874919a31715fe22c46327ec4c937976a5d78db
MD5 aad495a3c3aa32fc9d7eb9aa7a647653
SHA1 10d6429bad76b63db00bcf71cd7b93061951aeb3
SHA512 6201bf01792c8003babd47c7bc83120abec85836628364b9f542003e7bc1f2021db096a43c6a9a277c0a5a0b45dc63e39010d7c05409a26252a80fc9abbc1c82
SSDEEP 3072:Nmkr6NCw0zZIojcOyMUtEd+3pOuGkZFfFSebHWrH8wTW0:Zr6AwKZVjUtEd+3Y7otSeWrP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kjepjkhf.exe

Path C:\Windows\SysWOW64\Kjepjkhf.exe
Size 94KB
SHA256 8c784d8e58baf801dced50537550db75c3a80ac85d65f88f3d6df22cf4e2e8d7
MD5 9c2e7dd3f0cc7021b37b06dae10685b4
SHA1 7ad9f1fa0d4bdd902acec1a48571b7959fcb4165
SHA512 fb8726dcdc9c0c8e1943fdbb866907e59ecbe6b1f631a73129a614f6a1e8aa3c27da8e54075169f0bd015c7b51993505faf997b31bdbc985629812e1ca68f1fa
SSDEEP 1536:NmkEQ6NCGvh+zZFaojcZsyMUtEdPG3pO617DWkZFfScD7SzCbHWrAW8wTWiliX:Nmkr6NCw0zZIojcOyMUtEd+3pOuGkZFW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kpmdfonj.exe

Path C:\Windows\SysWOW64\Kpmdfonj.exe
Size 113KB
SHA256 f28a636a6412e3ec9b8a7bb7073410461baa84049fda17ee62bc94ff55453059
MD5 9ea5c40a4ae3bfa5d1e3b370f6964e74
SHA1 2e86e60e8768c700924538c3eae75ccd91ad89a4
SHA512 bb7f18eb30d4e0a1283d4550eb4a933773b3d6c2469258d130ca8169193cda2e050378f0a61f4b1c4e204329b080ca204fa902bb97d068ddd450b83a77d6cc65
SSDEEP 3072:lh4XkSJAcKbUdCOuGkZFfFSebHWrH8wTW0:lh4IodX7otSeWrP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lfjfecno.exe

Path C:\Windows\SysWOW64\Lfjfecno.exe
Size 113KB
SHA256 d2e2b201382f470f768effc972451e3e49d54d57c054d88a28ea1af5fe689848
MD5 07e4e51ddb16f4a910208de295ec16db
SHA1 bb24df118497c8c439d5a8a52ce6ebc1028f7676
SHA512 5a76f34dc02da6a09b925a1fd66a5157105060c04017ecc5b1a19c60265b12556cf91ced9e227e91ad90acd467d3642e42106e055c138eceee9dfdbe0f0665bd
SSDEEP 1536:6dJOFTyR0J5ipfJLO617DWkZFfScD7SzCbHWrAW8wTWiliX:6jdSbizLOuGkZFfFSebHWrH8wTW0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Llodgnja.exe

Path C:\Windows\SysWOW64\Llodgnja.exe
Size 113KB
SHA256 7499cd4764114e333911c3f56ebac5908c9b46b54fa4c75ac4369f0204dce39c
MD5 27735b20562ca5c3800e8d1d628a071e
SHA1 8be2abce774b117a7f1b5965654375d5e5a2d962
SHA512 718e2d4a4b0a9fbb921ab40c18bb79f163e90c1d40df34d2e97f6632819a3b3e6915b834a534abde2ef2b951a8210c3747a5a230492e3aa83d584ff8c2127dfe
SSDEEP 1536:UZhAAzf+aunfTsYfTO617DWkZFfScD7SzCbHWrAW8wTWiliX:+6nJfTOuGkZFfFSebHWrH8wTW0
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/216-119-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/220-127-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/384-144-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/428-216-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/536-72-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/556-256-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/716-164-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/852-140-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/900-104-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/964-80-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/1092-320-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/1112-274-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/1564-172-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/1596-232-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/1644-63-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/1660-156-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/1944-48-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/2036-265-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/2120-0-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/2164-296-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/2168-240-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/2268-8-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/2312-192-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/2316-88-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/2708-284-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/2788-268-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/2800-56-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/2932-31-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/3048-207-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/3164-308-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/3176-224-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/3480-111-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/3504-40-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/3540-298-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/3760-95-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/3788-311-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/3984-184-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4164-290-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4168-248-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4544-16-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4892-176-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4932-25-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/5060-200-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/5160-322-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/5200-328-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/5240-338-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/5280-340-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/5320-350-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/5360-356-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/5404-358-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/5444-364-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/5484-374-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/5524-376-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/5564-382-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/5604-388-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/5644-398-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/5688-404-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/5728-406-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/5768-412-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/5816-418-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/5856-424-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/5912-430-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/5948-440-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/5992-442-0x0000000000400000-0x000000000043D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads