4511b6ef7139f7e7e763e1723429a2891360941754f38435f7265b1e245e7c54

Analysis

max time kernel
97s
max time network
236s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
07/01/2024, 20:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b90b6b551262d4a4d0818132ee60fa5c.exe
Size 128KB
Sample240107-y6jetsdghk
SHA256 4511b6ef7139f7e7e763e1723429a2891360941754f38435f7265b1e245e7c54
MD5 b90b6b551262d4a4d0818132ee60fa5c
SHA1 c3efab5bd75c21207daed83fccfd4a5e14e8fda8
SHA512 a149a342d040a3e039840f2fbd8f77c217f6bba046a7203fa972c519c0eca3b50ff262e43a16507c036090ba72e6d743c00d4cd7ba721fa21096ae1201275d7e
SSDEEP 3072:I7a7rkUojbCfAeISJdEN0s4WE+3S9pui6yYPaI7DX:I7a7rk5OjxENm+3Mpui6yYPaI/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jknocljn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jhapmphg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jhapmphg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jkplilgk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jmqekg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jpoagb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	b90b6b551262d4a4d0818132ee60fa5c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jkkbnl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jknocljn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jpmdabfb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jggmnmmo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jggmnmmo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jmqekg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jpoagb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	b90b6b551262d4a4d0818132ee60fa5c.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jkkbnl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jahgpf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jkplilgk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cbhifj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kpfggang.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jahgpf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jpmdabfb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cbhifj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kpfggang.exe

Executes dropped EXE 11 IoCs

pid	Process
4956	Jkkbnl32.exe
3544	Jknocljn.exe
3312	Jahgpf32.exe
2132	Jhapmphg.exe
3128	Jkplilgk.exe
4072	Jpmdabfb.exe
3548	Jggmnmmo.exe
2084	Jmqekg32.exe
440	Jpoagb32.exe
2056	Cbhifj32.exe
4184	Kpfggang.exe

Drops file in System32 directory 36 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Ligiodee.dll	b90b6b551262d4a4d0818132ee60fa5c.exe
File opened for modification	C:\Windows\SysWOW64\Jknocljn.exe	Jkkbnl32.exe
File created	C:\Windows\SysWOW64\Lbkdla32.dll	Jkkbnl32.exe
File created	C:\Windows\SysWOW64\Gfghkgkc.dll	Jhapmphg.exe
File created	C:\Windows\SysWOW64\Jknocljn.exe	Jkkbnl32.exe
File created	C:\Windows\SysWOW64\Jpmdabfb.exe	Jkplilgk.exe
File created	C:\Windows\SysWOW64\Mappie32.dll	Jkplilgk.exe
File opened for modification	C:\Windows\SysWOW64\Jggmnmmo.exe	Jpmdabfb.exe
File created	C:\Windows\SysWOW64\Iefkmhfm.dll	Jmqekg32.exe
File created	C:\Windows\SysWOW64\Oaqafbfj.dll	Jpoagb32.exe
File opened for modification	C:\Windows\SysWOW64\Kpfggang.exe	Cbhifj32.exe
File created	C:\Windows\SysWOW64\Kjinplje.dll	Jknocljn.exe
File opened for modification	C:\Windows\SysWOW64\Jkplilgk.exe	Jhapmphg.exe
File created	C:\Windows\SysWOW64\Kpfggang.exe	Cbhifj32.exe
File created	C:\Windows\SysWOW64\Jhapmphg.exe	Jahgpf32.exe
File created	C:\Windows\SysWOW64\Jggmnmmo.exe	Jpmdabfb.exe
File created	C:\Windows\SysWOW64\Odejmglm.dll	Jahgpf32.exe
File opened for modification	C:\Windows\SysWOW64\Jpmdabfb.exe	Jkplilgk.exe
File created	C:\Windows\SysWOW64\Jkkbnl32.exe	b90b6b551262d4a4d0818132ee60fa5c.exe
File opened for modification	C:\Windows\SysWOW64\Jahgpf32.exe	Jknocljn.exe
File opened for modification	C:\Windows\SysWOW64\Jhapmphg.exe	Jahgpf32.exe
File created	C:\Windows\SysWOW64\Jkplilgk.exe	Jhapmphg.exe
File created	C:\Windows\SysWOW64\Jmqekg32.exe	Jggmnmmo.exe
File created	C:\Windows\SysWOW64\Dbhida32.dll	Jggmnmmo.exe
File created	C:\Windows\SysWOW64\Jpoagb32.exe	Jmqekg32.exe
File opened for modification	C:\Windows\SysWOW64\Jpoagb32.exe	Jmqekg32.exe
File created	C:\Windows\SysWOW64\Jgiiclkl.exe	Jpoagb32.exe
File opened for modification	C:\Windows\SysWOW64\Jgiiclkl.exe	Jpoagb32.exe
File created	C:\Windows\SysWOW64\Plkdkcqg.dll	Cbhifj32.exe
File created	C:\Windows\SysWOW64\Kgpodk32.exe	Kpfggang.exe
File opened for modification	C:\Windows\SysWOW64\Jkkbnl32.exe	b90b6b551262d4a4d0818132ee60fa5c.exe
File opened for modification	C:\Windows\SysWOW64\Jmqekg32.exe	Jggmnmmo.exe
File created	C:\Windows\SysWOW64\Jahgpf32.exe	Jknocljn.exe
File created	C:\Windows\SysWOW64\Ccjfjk32.dll	Jpmdabfb.exe
File opened for modification	C:\Windows\SysWOW64\Kgpodk32.exe	Kpfggang.exe
File created	C:\Windows\SysWOW64\Adfdfinl.dll	Kpfggang.exe

Modifies registry class 39 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	b90b6b551262d4a4d0818132ee60fa5c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	b90b6b551262d4a4d0818132ee60fa5c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iefkmhfm.dll"	Jmqekg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jmqekg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kpfggang.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}	b90b6b551262d4a4d0818132ee60fa5c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jknocljn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jkplilgk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jpmdabfb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jggmnmmo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kpfggang.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jahgpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mappie32.dll"	Jkplilgk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jpoagb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cbhifj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	b90b6b551262d4a4d0818132ee60fa5c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jknocljn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jhapmphg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jpmdabfb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ligiodee.dll"	b90b6b551262d4a4d0818132ee60fa5c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odejmglm.dll"	Jahgpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbhida32.dll"	Jggmnmmo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cbhifj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Adfdfinl.dll"	Kpfggang.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfghkgkc.dll"	Jhapmphg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ccjfjk32.dll"	Jpmdabfb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jmqekg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jpoagb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Plkdkcqg.dll"	Cbhifj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jkkbnl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kjinplje.dll"	Jknocljn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jkplilgk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jggmnmmo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oaqafbfj.dll"	Jpoagb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	b90b6b551262d4a4d0818132ee60fa5c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbkdla32.dll"	Jkkbnl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jkkbnl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jahgpf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jhapmphg.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 64 wrote to memory of 4956	64	b90b6b551262d4a4d0818132ee60fa5c.exe	92
PID 64 wrote to memory of 4956	64	b90b6b551262d4a4d0818132ee60fa5c.exe	92
PID 64 wrote to memory of 4956	64	b90b6b551262d4a4d0818132ee60fa5c.exe	92
PID 4956 wrote to memory of 3544	4956	Jkkbnl32.exe	94
PID 4956 wrote to memory of 3544	4956	Jkkbnl32.exe	94
PID 4956 wrote to memory of 3544	4956	Jkkbnl32.exe	94
PID 3544 wrote to memory of 3312	3544	Jknocljn.exe	117
PID 3544 wrote to memory of 3312	3544	Jknocljn.exe	117
PID 3544 wrote to memory of 3312	3544	Jknocljn.exe	117
PID 3312 wrote to memory of 2132	3312	Jahgpf32.exe	116
PID 3312 wrote to memory of 2132	3312	Jahgpf32.exe	116
PID 3312 wrote to memory of 2132	3312	Jahgpf32.exe	116
PID 2132 wrote to memory of 3128	2132	Jhapmphg.exe	115
PID 2132 wrote to memory of 3128	2132	Jhapmphg.exe	115
PID 2132 wrote to memory of 3128	2132	Jhapmphg.exe	115
PID 3128 wrote to memory of 4072	3128	Jkplilgk.exe	114
PID 3128 wrote to memory of 4072	3128	Jkplilgk.exe	114
PID 3128 wrote to memory of 4072	3128	Jkplilgk.exe	114
PID 4072 wrote to memory of 3548	4072	Jpmdabfb.exe	95
PID 4072 wrote to memory of 3548	4072	Jpmdabfb.exe	95
PID 4072 wrote to memory of 3548	4072	Jpmdabfb.exe	95
PID 3548 wrote to memory of 2084	3548	Jggmnmmo.exe	97
PID 3548 wrote to memory of 2084	3548	Jggmnmmo.exe	97
PID 3548 wrote to memory of 2084	3548	Jggmnmmo.exe	97
PID 2084 wrote to memory of 440	2084	Jmqekg32.exe	96
PID 2084 wrote to memory of 440	2084	Jmqekg32.exe	96
PID 2084 wrote to memory of 440	2084	Jmqekg32.exe	96
PID 440 wrote to memory of 2056	440	Jpoagb32.exe	151
PID 440 wrote to memory of 2056	440	Jpoagb32.exe	151
PID 440 wrote to memory of 2056	440	Jpoagb32.exe	151
PID 2056 wrote to memory of 4184	2056	Cbhifj32.exe	112
PID 2056 wrote to memory of 4184	2056	Cbhifj32.exe	112
PID 2056 wrote to memory of 4184	2056	Cbhifj32.exe	112

C:\Users\Admin\AppData\Local\Temp\b90b6b551262d4a4d0818132ee60fa5c.exe
"C:\Users\Admin\AppData\Local\Temp\b90b6b551262d4a4d0818132ee60fa5c.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:64
- C:\Windows\SysWOW64\Jkkbnl32.exe
  C:\Windows\system32\Jkkbnl32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4956
- - C:\Windows\SysWOW64\Jknocljn.exe
    C:\Windows\system32\Jknocljn.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3544
  - - C:\Windows\SysWOW64\Jahgpf32.exe
      C:\Windows\system32\Jahgpf32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3312

C:\Windows\SysWOW64\Jggmnmmo.exe
C:\Windows\system32\Jggmnmmo.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3548
- C:\Windows\SysWOW64\Jmqekg32.exe
  C:\Windows\system32\Jmqekg32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2084

C:\Windows\SysWOW64\Jpoagb32.exe
C:\Windows\system32\Jpoagb32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:440
- C:\Windows\SysWOW64\Jgiiclkl.exe
  C:\Windows\system32\Jgiiclkl.exe
  2⤵
  PID:2056

C:\Windows\SysWOW64\Kafcadej.exe
C:\Windows\system32\Kafcadej.exe
1⤵
PID:4720
- C:\Windows\SysWOW64\Kddpnpdn.exe
  C:\Windows\system32\Kddpnpdn.exe
  2⤵
  PID:384

C:\Windows\SysWOW64\Lajmmc32.exe
C:\Windows\system32\Lajmmc32.exe
1⤵
PID:4324
- C:\Windows\SysWOW64\Lhdeinhb.exe
  C:\Windows\system32\Lhdeinhb.exe
  2⤵
  PID:3004
- - C:\Windows\SysWOW64\Lhgbomfo.exe
    C:\Windows\system32\Lhgbomfo.exe
    3⤵
    PID:1052

C:\Windows\SysWOW64\Lqbgcp32.exe
C:\Windows\system32\Lqbgcp32.exe
1⤵
PID:3924
- C:\Windows\SysWOW64\Locgagli.exe
  C:\Windows\system32\Locgagli.exe
  2⤵
  PID:1876

C:\Windows\SysWOW64\Lncjgddf.exe
C:\Windows\system32\Lncjgddf.exe
1⤵
PID:3508

C:\Windows\SysWOW64\Kolaqh32.exe
C:\Windows\system32\Kolaqh32.exe
1⤵
PID:1856

C:\Windows\SysWOW64\Khbhdn32.exe
C:\Windows\system32\Khbhdn32.exe
1⤵
PID:2308

C:\Windows\SysWOW64\Kpkqbq32.exe
C:\Windows\system32\Kpkqbq32.exe
1⤵
PID:320

C:\Windows\SysWOW64\Kknhjj32.exe
C:\Windows\system32\Kknhjj32.exe
1⤵
PID:4424

C:\Windows\SysWOW64\Koggehff.exe
C:\Windows\system32\Koggehff.exe
1⤵
PID:3920

C:\Windows\SysWOW64\Kgpodk32.exe
C:\Windows\system32\Kgpodk32.exe
1⤵
PID:3236

C:\Windows\SysWOW64\Kpfggang.exe
C:\Windows\system32\Kpfggang.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:4184

C:\Windows\SysWOW64\Jpmdabfb.exe
C:\Windows\system32\Jpmdabfb.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4072

C:\Windows\SysWOW64\Jkplilgk.exe
C:\Windows\system32\Jkplilgk.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3128

C:\Windows\SysWOW64\Jhapmphg.exe
C:\Windows\system32\Jhapmphg.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2132

C:\Windows\SysWOW64\Ncenga32.exe
C:\Windows\system32\Ncenga32.exe
1⤵
PID:3428
- C:\Windows\SysWOW64\Nnjbdj32.exe
  C:\Windows\system32\Nnjbdj32.exe
  2⤵
  PID:3752

C:\Windows\SysWOW64\Nnmojj32.exe
C:\Windows\system32\Nnmojj32.exe
1⤵
PID:4844
- C:\Windows\SysWOW64\Ngedbp32.exe
  C:\Windows\system32\Ngedbp32.exe
  2⤵
  PID:3176
- - C:\Windows\SysWOW64\Njcpok32.exe
    C:\Windows\system32\Njcpok32.exe
    3⤵
    PID:4892

C:\Windows\SysWOW64\Ngbgmpcq.exe
C:\Windows\system32\Ngbgmpcq.exe
1⤵
PID:4360

C:\Windows\SysWOW64\Nqioqf32.exe
C:\Windows\system32\Nqioqf32.exe
1⤵
PID:1216

C:\Windows\SysWOW64\Oqgkadod.exe
C:\Windows\system32\Oqgkadod.exe
1⤵
PID:4304
- C:\Windows\SysWOW64\Ocegnoog.exe
  C:\Windows\system32\Ocegnoog.exe
  2⤵
  PID:3172
- - C:\Windows\SysWOW64\Onklkhnn.exe
    C:\Windows\system32\Onklkhnn.exe
    3⤵
    PID:4028
  - - C:\Windows\SysWOW64\Pkoldl32.exe
      C:\Windows\system32\Pkoldl32.exe
      4⤵
      PID:4732
    - - C:\Windows\SysWOW64\Pcojdnfm.exe
        
        C:\Windows\system32\Pcojdnfm.exe
        5⤵
        
        PID:2272

C:\Windows\SysWOW64\Ojmcej32.exe
C:\Windows\system32\Ojmcej32.exe
1⤵
PID:1660

C:\Windows\SysWOW64\Pndoagfc.exe
C:\Windows\system32\Pndoagfc.exe
1⤵
PID:1528
- C:\Windows\SysWOW64\Pabknbef.exe
  C:\Windows\system32\Pabknbef.exe
  2⤵
  PID:3780
- - C:\Windows\SysWOW64\Pcagjndj.exe
    C:\Windows\system32\Pcagjndj.exe
    3⤵
    PID:4576

C:\Windows\SysWOW64\Pkhokkel.exe
C:\Windows\system32\Pkhokkel.exe
1⤵
PID:2436
- C:\Windows\SysWOW64\Qnfkgfdp.exe
  C:\Windows\system32\Qnfkgfdp.exe
  2⤵
  PID:1420
- - C:\Windows\SysWOW64\Keakqeal.exe
    C:\Windows\system32\Keakqeal.exe
    3⤵
    PID:2608

C:\Windows\SysWOW64\Pkebekgo.exe
C:\Windows\system32\Pkebekgo.exe
1⤵
PID:4884
- C:\Windows\SysWOW64\Ghmbbh32.exe
  C:\Windows\system32\Ghmbbh32.exe
  2⤵
  PID:4232
- - C:\Windows\SysWOW64\Gogjobmc.exe
    C:\Windows\system32\Gogjobmc.exe
    3⤵
    PID:2028
  - - C:\Windows\SysWOW64\Gaffkmlg.exe
      C:\Windows\system32\Gaffkmlg.exe
      4⤵
      PID:4276
    - - C:\Windows\SysWOW64\Gimomkmi.exe
        
        C:\Windows\system32\Gimomkmi.exe
        5⤵
        
        PID:4356
      - C:\Windows\SysWOW64\Gojgea32.exe
        
        C:\Windows\system32\Gojgea32.exe
        6⤵
        
        PID:3160
        
        C:\Windows\SysWOW64\Gahcam32.exe
        
        C:\Windows\system32\Gahcam32.exe
        7⤵
        
        PID:4544
        
        C:\Windows\SysWOW64\Giokbj32.exe
        
        C:\Windows\system32\Giokbj32.exe
        8⤵
        
        PID:64
        
        C:\Windows\SysWOW64\Hkgnja32.exe
        
        C:\Windows\system32\Hkgnja32.exe
        9⤵
        
        PID:4160
        
        C:\Windows\SysWOW64\Iaoknc32.exe
        
        C:\Windows\system32\Iaoknc32.exe
        10⤵
        
        PID:2628

C:\Windows\SysWOW64\Nqfbkf32.exe
C:\Windows\system32\Nqfbkf32.exe
1⤵
PID:4332

C:\Windows\SysWOW64\Njljnl32.exe
C:\Windows\system32\Njljnl32.exe
1⤵
PID:4928

C:\Windows\SysWOW64\Ngnnbq32.exe
C:\Windows\system32\Ngnnbq32.exe
1⤵
PID:4068

C:\Windows\SysWOW64\Ndpafe32.exe
C:\Windows\system32\Ndpafe32.exe
1⤵
PID:3832

C:\Windows\SysWOW64\Knipik32.exe
C:\Windows\system32\Knipik32.exe
1⤵
PID:2448
- C:\Windows\SysWOW64\Pogpcghp.exe
  C:\Windows\system32\Pogpcghp.exe
  2⤵
  PID:392
- - C:\Windows\SysWOW64\Ahdgnj32.exe
    C:\Windows\system32\Ahdgnj32.exe
    3⤵
    PID:2232
  - - C:\Windows\SysWOW64\Hlkmfkli.exe
      C:\Windows\system32\Hlkmfkli.exe
      4⤵
      PID:4216
    - - C:\Windows\SysWOW64\Gbnhhp32.exe
        
        C:\Windows\system32\Gbnhhp32.exe
        5⤵
        
        PID:2248
      - C:\Windows\SysWOW64\Lpeplmha.exe
        
        C:\Windows\system32\Lpeplmha.exe
        6⤵
        
        PID:3416
        
        C:\Windows\SysWOW64\Ckmeag32.exe
        
        C:\Windows\system32\Ckmeag32.exe
        7⤵
        
        PID:3652
        
        C:\Windows\SysWOW64\Cbhifj32.exe
        
        C:\Windows\system32\Cbhifj32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2056
        
        C:\Windows\SysWOW64\Kopcld32.exe
        
        C:\Windows\system32\Kopcld32.exe
        9⤵
        
        PID:2444
        
        C:\Windows\SysWOW64\Lmicnj32.exe
        
        C:\Windows\system32\Lmicnj32.exe
        10⤵
        
        PID:2160
        
        C:\Windows\SysWOW64\Gegcaa32.exe
        
        C:\Windows\system32\Gegcaa32.exe
        11⤵
        
        PID:4000
        
        C:\Windows\SysWOW64\Mdgnkm32.exe
        
        C:\Windows\system32\Mdgnkm32.exe
        12⤵
        
        PID:3832
        
        C:\Windows\SysWOW64\Fbejobal.exe
        
        C:\Windows\system32\Fbejobal.exe
        13⤵
        
        PID:3808
        
        C:\Windows\SysWOW64\Gkiaic32.exe
        
        C:\Windows\system32\Gkiaic32.exe
        14⤵
        
        PID:4892
        
        C:\Windows\SysWOW64\Gbqija32.exe
        
        C:\Windows\system32\Gbqija32.exe
        15⤵
        
        PID:2996
        
        C:\Windows\SysWOW64\Geoffl32.exe
        
        C:\Windows\system32\Geoffl32.exe
        16⤵
        
        PID:4884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Cnlhfk32.exe

Path C:\Windows\SysWOW64\Cnlhfk32.exe
Size 63KB
SHA256 cdb7ee019183d93313093f99f2d32e24f22317ff816d0a97ca0ed940d00e904d
MD5 6c2d6d6a6739f82720eee1f9935ceac3
SHA1 b033f52bc314336e27605add7876055875badbf5
SHA512 548731eaca7305540c018a01f141c1fc479a25e1d38e6fa02edbda209a52c69368a682777043944fd142233f5d3842db048c8bc134af6736519400d01f638047
SSDEEP 1536:k/76u26DFsA8KxaPe7n8Ki5ygtMUsR3csRQP:khDFhxaG7n8Ki0gtvsRLeP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gaffkmlg.exe

Path C:\Windows\SysWOW64\Gaffkmlg.exe
Size 22KB
SHA256 084aa2edb0e54003d1464fb1f313ddc7f4d0abd95d29dda822c45d742efed46a
MD5 12080ee94c6cf5cf61e1b1db85cacec4
SHA1 748614f28a25884952941846e9f132197548ee42
SHA512 ea664d9478d4e4f2046053efdfad3a937d844223bd7c9c8b9beeebfd7ca125bded1cf662be387b9404cd034916036947cc05706a4d1e860b9b583495f9d4abcb
SSDEEP 384:aokeu0P9+Ie0Ri9P/kxph1KSjL4mHdTJX0iCHeizeVcS1ipzm+nijGzxWeJWqWii:aoxVP8h/WpvVkhyVcFFijGzQkZWX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gahcam32.exe

Path C:\Windows\SysWOW64\Gahcam32.exe
Size 26KB
SHA256 a1932ac1e01dddfdde03f65e21b15c66bcfbad862397f3e5afcd7272f6dd2149
MD5 014f99a81e8fab5359bf5fad42b4c9e6
SHA1 a16544692ccc48f70e538600677825a5c1835742
SHA512 66a3922d82cc6236b3435c8f88f11a6d242f3d3efa79587e39efc653c5be38b313212b252015cad69afb1347d20ed9fc88fc60aa1e4cba9ef7055bc2d493ccfe
SSDEEP 384:a3Uwy+tL4lB0RKkT+sLIHODsT+I3FYLUZ1E52ndAidLhwc4aLoMEZWdJdcBSm0I/:a3UV+B4kokaAsTySddrhoWq9O+k9M0S
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gegcaa32.exe

Path C:\Windows\SysWOW64\Gegcaa32.exe
Size 20KB
SHA256 fec044bcf5534a2d4b3b661af1243a58fd8acdd184e46eb5e9bea672b316762e
MD5 4e2fc5c93a8a93585261bd2014f0bb80
SHA1 9799290e2111eca74f3a9ef6f9a9ff1d1dc44b34
SHA512 09ef0867ddd40df897ec01ccf887b92b33d78fb4189d66a043abc014768095843b65cd37ad31bab865cd8e7b8872ed89edcd947b7fa1e2b00a19292320665e5d
SSDEEP 384:ahm4KfrsbEKlntvgg8coX/U0s7CxsUX3hL5vD4y4AukwbpujOO4F:aofrsbEKltvxAXs0YCR3v0yAkk24F
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gfghkgkc.dll

Path C:\Windows\SysWOW64\Gfghkgkc.dll
Size 7KB
SHA256 80d244129b60f69ff37091dd83beabd1d4c06625117bd0cde8a1d487a43e56df
MD5 7b22a04c16c6b0d8e4384e3cb246b980
SHA1 2c2c1715bb4b1e813011443940f6335973981770
SHA512 d6ac68ae20c2c33024767988d7465f2867bf3aa2ea89eff58e6739766236702cb1e0c9f3a0d98ac4fa0bd83277fee368300d11dae2e147ad719c5211371a9930
SSDEEP 96:wb4VHccYJUC/aFbz/j0OvaPqrd3cX5aXW:wUaJf/aFbP0OL2JaX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hkgnja32.exe

Path C:\Windows\SysWOW64\Hkgnja32.exe
Size 8KB
SHA256 5dfeffb0d3d51301bbb3ae68f280dd47b57ef4fffab14eda178329ea93ff6d05
MD5 570d0edce48d2604065864eb5e2561a2
SHA1 e3446dbd3fcb3ad0deffef11645cb19d43acccdb
SHA512 df1d02fda2023a77b8640b9bffc965525d03503ad004f14b86f4c4002cba9517e49773ce6419a51a7a519e09934f0d1e3d066e8a9686c00bb6bea030318d44b9
SSDEEP 192:aS9hI+RWshZsBqzNozQY1c6FsFxY1utpV/mC2BTn5sjXUIG9IkH:aS/I+RWshZsBqzNmQY1cIM/2BYUIG9IA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jahgpf32.exe

Path C:\Windows\SysWOW64\Jahgpf32.exe
Size 128KB
SHA256 f2827f88548d6e58888a733cf3647ec708bf86091d9d486f9674183fcb7e7733
MD5 0df072717613ad73fda38650415c2871
SHA1 f78a5410ecf739dd65f756f2c1d19263ec04f3fd
SHA512 1ad7591cc3b25d645620ce6443f53374b66425822ab7087b2d8e6d511ce5aa8d33280dcc8a3bd13c9e6b715970a1242d93d046c7324109d313d6101cafa44ab3
SSDEEP 3072:dgeKUMS75NjAJVyXz2femSJdEN0s4WE+3S9pui6yYPaI7DX:dgecSjYITENm+3Mpui6yYPaI/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jgiiclkl.exe

Path C:\Windows\SysWOW64\Jgiiclkl.exe
Size 128KB
SHA256 85fde27a31ea82f5385f8666a031875a0e30673521420721c4d2442e78287130
MD5 a0e8e6a57bc5730232fabe6bcedbdb6e
SHA1 136a32dc2470a0c833a2ab8effb5c7155a0cdad6
SHA512 1a725a381887392e73f6a6f91496a0382faf7a4ca78caa28965d3dbc9b85f5bebb5d51e19fce7234ba82b84612b69e5f2aa984206fbf66095473cd7003be49c6
SSDEEP 3072:tqH3ZSsTsXwHERXbc6txMmbQeKSJdEN0s4WE+3S9pui6yYPaI7DX:tqXZSsxERXbtxMmPvENm+3Mpui6yYPa6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jhapmphg.exe

Path C:\Windows\SysWOW64\Jhapmphg.exe
Size 128KB
SHA256 2898c15f56b84972d550ae3cd7e3a9dc43fbf2722dc3e73e7526751eece81778
MD5 f514e413bce83b9583e4972af7fdf407
SHA1 d41af94e9f22be2c419d60909659136fb84e8852
SHA512 e76fab8e2091119ee169855d97752addd14c11c44bf379ef01f279dc10d6e159725101a98df15762028e54665fa02c4df670e5a25e6283b1e4c03bc56025889e
SSDEEP 3072:fbP8xtZ/8geqSJdEN0s4WE+3S9pui6yYPaI7DX:j4ZE7PENm+3Mpui6yYPaI/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jkkbnl32.exe

Path C:\Windows\SysWOW64\Jkkbnl32.exe
Size 128KB
SHA256 39f5521f99af95f0cfc2aaf4b923349194c2eb39f2f2110050fc30b9cc0ea9e7
MD5 a4fb589a93357c1dc24c54ca3358ca1c
SHA1 9cfefba6eb5642abfe158154f2e5497cfb94ba2d
SHA512 82ddcb2ec6c08f28d082255760471ac754bae0f5e788cdd951e89c0321ea271740eb5bcbc4c6c33666b67724cf5f541013dbb418e2a340022bfa9316d349c886
SSDEEP 3072:3GyepM9knSc7OaW6BAeKSJdEN0s4WE+3S9pui6yYPaI7DX:3Gy4yMSlUbvENm+3Mpui6yYPaI/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jknocljn.exe

Path C:\Windows\SysWOW64\Jknocljn.exe
Size 128KB
SHA256 20f561cb87b2fd6ac99bba2fd6f45f4437eb77ad4edf270a32e83b084a24e64b
MD5 3574986647adae64f5e5d8a44cad3fc0
SHA1 867812c3521fde3f6a3a641ce1ad147cc940d4b5
SHA512 46997b6bcb6ba05558479c7e852576dc562ed1d9c9184e7c7d3c56f3ec3276d11e7851efa06064559a3544e36d0fa85b4cf5f164ee6d4f5bc1aec8cc51cbf2a0
SSDEEP 3072:q9g6N8PeROwVNBMvNIeASJdEN0s4WE+3S9pui6yYPaI7DX:q97bJNkND5ENm+3Mpui6yYPaI/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jkplilgk.exe

Path C:\Windows\SysWOW64\Jkplilgk.exe
Size 128KB
SHA256 48caa031b16253c8bd0b998b90c6092020e621ec7c230597532a9d28bfc37a87
MD5 8e47b9ff239f93828908e2f90c8a9d93
SHA1 d0c9af38baa6a213eea89ed6168d04183214cedc
SHA512 9a967e0210bb347467be8395502e622ed3460af96af0d880707658cfc096e1204b4cb768fb1d60b238cee906e14925ca318989c78ea4fc6e55cea8d590af1838
SSDEEP 3072:pjzEo0HYLnJYO1867e8SJdEN0s4WE+3S9pui6yYPaI7DX:hoU1hC9ENm+3Mpui6yYPaI/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jpmdabfb.exe

Path C:\Windows\SysWOW64\Jpmdabfb.exe
Size 128KB
SHA256 6c606b011d4a7d25c76912ed11489987fc2ce6b425e47a1b461f244104f5900b
MD5 971b7591a967e8aee807a537ff864dd4
SHA1 0045f871350d28ef268bb76e75f524610528b5ef
SHA512 835ee07e3cf19f20a3179aab0f2e303388663956d0baaae24810d743b114fbb59ae3ec1697b3a101d5c7cb1cc5315531642ef62a67843030ef451855775c80cf
SSDEEP 3072:tGI6F2HmhiBM8FdMrT56eBSJdEN0s4WE+3S9pui6yYPaI7DX:MGGQrdsFRAENm+3Mpui6yYPaI/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kpfggang.exe

Path C:\Windows\SysWOW64\Kpfggang.exe
Size 128KB
SHA256 b369d9df3691d64f4370dcb97981058ce756723b82c700795d6c2ab2d69f0495
MD5 ad7562fc27fb2c133c75677de31e051a
SHA1 7b2f4435e56477e7781bc6387b16c912f5d39f94
SHA512 e90be6ac08d7f28600ed48d2b4cfd74d2b9f4e36758dd99916e7f1e23b8427da2fec6158f2554d689d38c205d6509a88df1974a0e491520d68b5cbf48cf21fa2
SSDEEP 3072:iomivjplV/HuWfCi0JusXMg5eCSJdEN0s4WE+3S9pui6yYPaI7DX:ioFvFHfuWq62CXENm+3Mpui6yYPaI/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kpfggang.exe

Path C:\Windows\SysWOW64\Kpfggang.exe
Size 39KB
SHA256 ff2994a642643881373da88c588ec77f14a1d93e6834b14c77c2e09e9d639078
MD5 df58836698313c9de2091aab3d568075
SHA1 eeb36651ea90dcf98c89dbfc27c623802e4f435d
SHA512 f44d0a7d09ff64fe34d312b437276daea22337e6bb745654aeadf41e73abff0d0cb9e21bc47cc168c95f89bfc6486724e567ad36d9f195f7a32880578e64aada
SSDEEP 768:aldP29WGqohj7rCl2ucnmipmm5D/iYJr6te2CfplVZJ5NwIVIltqdRw6AWjLV4qP:uto9vCMucnmiJ5D/i2BplV/Hu85BfV4W
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lmicnj32.exe

Path C:\Windows\SysWOW64\Lmicnj32.exe
Size 36KB
SHA256 11ed2ae0d5595caaa43dc41015f32ae320f4093c520b41ec98da44476ebe3a97
MD5 01cc0b82e8dff3b0abc8f9c280856de4
SHA1 4a02fd6063686a10c7fe2d2068229266a7b22c1b
SHA512 505653f3329d860df5309ece3af8f79b21f170e702d20a2526c76d66709485bc5a833cc429dc569afef313532e62b225a37f5de10ecf5086362d4aa8b2360570
SSDEEP 768:aofrsbEKltvxAXs0YCR3v0yAkk24PF3jqlgYoqoMi6d7BF:/fH8t5AXFYCpFk24PF3jqlN7/d7BF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locgagli.exe

Path C:\Windows\SysWOW64\Locgagli.exe
Size 128KB
SHA256 c9eb38c545ac87bd8b088587cbe48d0364334f912aa23550db3451c9154eaf50
MD5 8b70fef68ca87ec58bcf092921e45fd8
SHA1 c1f92d437913d2c49606738fd8e7fbc0bba28410
SHA512 c4713d91f1b365c8f4de70fff50615ce1e28e2f91dc23268385838acb39482f34b322912cf1792d0a8b07080b90eb7b0af951617aac011682fc265194ff2b848
SSDEEP 3072:x4RWrA+BCUecySJdEN0s4WE+3S9pui6yYPaI7DX:x4RdcnENm+3Mpui6yYPaI/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ndpafe32.exe

Path C:\Windows\SysWOW64\Ndpafe32.exe
Size 128KB
SHA256 a7b9fdfd474445b5de1eda0331d992e852b122936f0388ed903dd227394494c9
MD5 3800cc6bd737c9d5e913804884581637
SHA1 3fea440e3b5e9b45d8091500496ac58342c66717
SHA512 2e8f0a73c8378c357ed59dfd6c3d345f6d9170877a299c37d791050fed2c595db6b8f1b81f884f7a6202d82f6df3cdd64563993ac7d95483cbb3bf0f476cd178
SSDEEP 3072:EwSCgNcMgDw3JBDXIUOuBJAtCe/ySJdEN0s4WE+3S9pui6yYPaI7DX:fgNcM4wBXJc/nENm+3Mpui6yYPaI/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ngnnbq32.exe

Path C:\Windows\SysWOW64\Ngnnbq32.exe
Size 128KB
SHA256 9e32d66b11a04896b961fb3154903ad97c9264d910cc0528fd9e252cbf16bbf0
MD5 1d48c9c40f3a0e9eb848bb8a1d3125de
SHA1 9a0c7681c89787c83e2391d5568d541bbe1cdcad
SHA512 f3fc7a828595a6455f113841cb92f955fb4fda1d4f43d7729da5f5a6be5950daa90639d466e3aa94bb02c730a75165489835208130a837ec5e02ef7029468b0f
SSDEEP 3072:PDwv/GA3XSjQ/0/j6ue6SJdEN0s4WE+3S9pui6yYPaI7DX:rwv/GASjOSG/ENm+3Mpui6yYPaI/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Njljnl32.exe

Path C:\Windows\SysWOW64\Njljnl32.exe
Size 11KB
SHA256 343a5e9dc8d893b1442969cc7c9f6b1d4cce2a0fbbf8aded01de9eade52a87e3
MD5 2e526995abd5cd5ae2e523e4c8bc5de3
SHA1 07262f9dc76451174e0dbd613b1a7872abbfbeb7
SHA512 23298c0e441749119758821ef630b254f7e3aac9e70eed899774490c2b168bb6cbf2e036014c135a30d88b83ad3bc64776a08e5b32337662611af59f69ac5cbd
SSDEEP 192:aAkVbJe0nBwKOg5WX92ZkVqPb3/19Xw92TX81jwjsNrwhwEG6aWJ:aJJaKOg5bZkVqPb37Y2TMxwjsN8uIaWJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/64-0-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/64-32-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/320-141-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/320-209-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/384-123-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/384-207-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/440-158-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/440-73-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1052-242-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1052-185-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1216-336-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1216-273-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1660-308-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1856-164-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1876-219-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2056-172-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2056-81-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2084-150-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2084-64-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2132-37-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2272-337-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2308-154-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3004-229-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3004-176-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3128-45-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3172-316-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3176-291-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3236-182-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3236-98-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3312-28-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3312-106-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3428-257-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3428-322-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3508-193-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3508-250-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3544-21-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3548-140-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3548-57-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3752-265-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3752-329-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3832-225-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3920-112-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3924-256-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3924-201-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4028-323-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4068-303-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4068-230-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4072-52-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4072-131-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4184-94-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4304-314-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4324-174-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4332-252-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4360-279-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4424-132-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4424-208-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4720-115-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4720-200-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4732-330-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4844-285-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4892-297-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4928-243-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4956-89-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4956-8-0x0000000000400000-0x0000000000440000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads