a5e2fd09d3741e62ed3bb8921569b18e6c4bda0d4ecd18da62d7d138c0bcbe73

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03/03/2024, 10:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
virussign.com_a795a05bf3161ca8504aee5891e1d659.exe
Size 128KB
Sample240303-mf51cshb21
SHA256 a5e2fd09d3741e62ed3bb8921569b18e6c4bda0d4ecd18da62d7d138c0bcbe73
MD5 a795a05bf3161ca8504aee5891e1d659
SHA1 b08dbb2c6e808788f64a82b9ae2567cf07239888
SHA512 6bf803394fec022c90974e4bf3bec1a147c4fd348fe3a41eb78a1a0473c3d5af46687517d8685a309229a6731978131d959ef6033249e2e07d7ba2fcd64c0f72
SSDEEP 3072:ZyDjOOALgDZLnWZhnFEPk8QYxQdLrCimBaH8UH30ZIvM6qMH5X3O/:cDSOOgDZjchnFEPFtCApaH8m3QIvMWHV
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mkpgck32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njogjfoj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndidbn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mamleegg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ngcgcjnc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lkdggmlj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdhbec32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmqgnhmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lmqgnhmp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpfijcfl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lgbnmm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ndidbn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnlfigcc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpdelajl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nceonl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ngedij32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kkbkamnl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kckbqpnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lgpagm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdfofakp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mdfofakp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdiklqhm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nkjjij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nqfbaq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	virussign.com_a795a05bf3161ca8504aee5891e1d659.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kgphpo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kbfiep32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mkepnjng.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nbhkac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lijdhiaa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcbiao32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nkjjij32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njljefql.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqfbaq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmccchkn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnfipekh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njogjfoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kckbqpnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kipabjil.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkepnjng.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kajfig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lpfijcfl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgpagm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mdmegp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	virussign.com_a795a05bf3161ca8504aee5891e1d659.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdaldd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kgdbkohf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njljefql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lcbiao32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mdiklqhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mkgmcjld.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcbahlip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdaldd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcpllo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgkhlnbn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mcbahlip.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nddkgonp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdhbec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lgkhlnbn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mnfipekh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kagichjo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lijdhiaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mnlfigcc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnolfdcn.exe

Executes dropped EXE 50 IoCs

pid	Process
3656	Kdaldd32.exe
4568	Kgphpo32.exe
64	Kphmie32.exe
2984	Kbfiep32.exe
1668	Kipabjil.exe
5012	Kagichjo.exe
2236	Kgdbkohf.exe
2768	Kajfig32.exe
3804	Kdhbec32.exe
876	Kckbqpnj.exe
1612	Kkbkamnl.exe
2464	Lmqgnhmp.exe
5056	Lkdggmlj.exe
3704	Lmccchkn.exe
732	Lcpllo32.exe
2732	Lgkhlnbn.exe
1636	Lijdhiaa.exe
1600	Laalifad.exe
432	Ldohebqh.exe
2796	Lcbiao32.exe
4852	Lkiqbl32.exe
1628	Lnhmng32.exe
1924	Lpfijcfl.exe
2624	Lgpagm32.exe
4416	Lgbnmm32.exe
3424	Mnlfigcc.exe
4560	Mdfofakp.exe
316	Mkpgck32.exe
408	Mdiklqhm.exe
2704	Mamleegg.exe
4500	Mcnhmm32.exe
4280	Mkepnjng.exe
3312	Mdmegp32.exe
1952	Mkgmcjld.exe
2468	Mnfipekh.exe
3316	Mpdelajl.exe
556	Mcbahlip.exe
2880	Nkjjij32.exe
4664	Njljefql.exe
2324	Nqfbaq32.exe
4696	Nceonl32.exe
1512	Njogjfoj.exe
4708	Nddkgonp.exe
1148	Ngcgcjnc.exe
2744	Njacpf32.exe
3060	Nbhkac32.exe
1444	Ngedij32.exe
3212	Nnolfdcn.exe
2836	Ndidbn32.exe
4588	Nkcmohbg.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Kajfig32.exe	Kgdbkohf.exe
File created	C:\Windows\SysWOW64\Qgejif32.dll	Lmqgnhmp.exe
File created	C:\Windows\SysWOW64\Ndidbn32.exe	Nnolfdcn.exe
File opened for modification	C:\Windows\SysWOW64\Kdaldd32.exe	virussign.com_a795a05bf3161ca8504aee5891e1d659.exe
File created	C:\Windows\SysWOW64\Ppaaagol.dll	Kphmie32.exe
File created	C:\Windows\SysWOW64\Lijdhiaa.exe	Lgkhlnbn.exe
File opened for modification	C:\Windows\SysWOW64\Lijdhiaa.exe	Lgkhlnbn.exe
File created	C:\Windows\SysWOW64\Dnapla32.dll	Lkiqbl32.exe
File created	C:\Windows\SysWOW64\Njljefql.exe	Nkjjij32.exe
File created	C:\Windows\SysWOW64\Ldohebqh.exe	Laalifad.exe
File opened for modification	C:\Windows\SysWOW64\Mdiklqhm.exe	Mkpgck32.exe
File opened for modification	C:\Windows\SysWOW64\Njogjfoj.exe	Nceonl32.exe
File opened for modification	C:\Windows\SysWOW64\Mnfipekh.exe	Mkgmcjld.exe
File created	C:\Windows\SysWOW64\Lcpllo32.exe	Lmccchkn.exe
File created	C:\Windows\SysWOW64\Mdiklqhm.exe	Mkpgck32.exe
File created	C:\Windows\SysWOW64\Mcnhmm32.exe	Mamleegg.exe
File created	C:\Windows\SysWOW64\Egqcbapl.dll	Mcbahlip.exe
File opened for modification	C:\Windows\SysWOW64\Njacpf32.exe	Ngcgcjnc.exe
File created	C:\Windows\SysWOW64\Lmqgnhmp.exe	Kkbkamnl.exe
File created	C:\Windows\SysWOW64\Cmafhe32.dll	Lkdggmlj.exe
File created	C:\Windows\SysWOW64\Nkcmohbg.exe	Ndidbn32.exe
File opened for modification	C:\Windows\SysWOW64\Kbfiep32.exe	Kphmie32.exe
File opened for modification	C:\Windows\SysWOW64\Lkiqbl32.exe	Lcbiao32.exe
File created	C:\Windows\SysWOW64\Bidjkmlh.dll	Lgbnmm32.exe
File created	C:\Windows\SysWOW64\Njacpf32.exe	Ngcgcjnc.exe
File opened for modification	C:\Windows\SysWOW64\Mdfofakp.exe	Mnlfigcc.exe
File created	C:\Windows\SysWOW64\Flfmin32.dll	Mnlfigcc.exe
File created	C:\Windows\SysWOW64\Mcbahlip.exe	Mpdelajl.exe
File created	C:\Windows\SysWOW64\Lelgbkio.dll	Mpdelajl.exe
File created	C:\Windows\SysWOW64\Kbfiep32.exe	Kphmie32.exe
File created	C:\Windows\SysWOW64\Lmccchkn.exe	Lkdggmlj.exe
File created	C:\Windows\SysWOW64\Lcbiao32.exe	Ldohebqh.exe
File created	C:\Windows\SysWOW64\Dgcifj32.dll	Mamleegg.exe
File opened for modification	C:\Windows\SysWOW64\Ndidbn32.exe	Nnolfdcn.exe
File created	C:\Windows\SysWOW64\Mkeebhjc.dll	Kgphpo32.exe
File opened for modification	C:\Windows\SysWOW64\Lmccchkn.exe	Lkdggmlj.exe
File opened for modification	C:\Windows\SysWOW64\Lpfijcfl.exe	Lnhmng32.exe
File created	C:\Windows\SysWOW64\Mecaoggc.dll	Lgpagm32.exe
File created	C:\Windows\SysWOW64\Nceonl32.exe	Nqfbaq32.exe
File opened for modification	C:\Windows\SysWOW64\Lkdggmlj.exe	Lmqgnhmp.exe
File created	C:\Windows\SysWOW64\Lidmdfdo.dll	Ldohebqh.exe
File opened for modification	C:\Windows\SysWOW64\Lnhmng32.exe	Lkiqbl32.exe
File created	C:\Windows\SysWOW64\Ipkobd32.dll	Njacpf32.exe
File created	C:\Windows\SysWOW64\Kdaldd32.exe	virussign.com_a795a05bf3161ca8504aee5891e1d659.exe
File created	C:\Windows\SysWOW64\Kgdbkohf.exe	Kagichjo.exe
File created	C:\Windows\SysWOW64\Ogdimilg.dll	Kajfig32.exe
File created	C:\Windows\SysWOW64\Mnlfigcc.exe	Lgbnmm32.exe
File created	C:\Windows\SysWOW64\Gjoceo32.dll	Lmccchkn.exe
File created	C:\Windows\SysWOW64\Lmbnpm32.dll	Ngcgcjnc.exe
File opened for modification	C:\Windows\SysWOW64\Kgdbkohf.exe	Kagichjo.exe
File opened for modification	C:\Windows\SysWOW64\Ldohebqh.exe	Laalifad.exe
File created	C:\Windows\SysWOW64\Bgcomh32.dll	Laalifad.exe
File opened for modification	C:\Windows\SysWOW64\Nkjjij32.exe	Mcbahlip.exe
File created	C:\Windows\SysWOW64\Nbhkac32.exe	Njacpf32.exe
File created	C:\Windows\SysWOW64\Fogjfmfe.dll	Kagichjo.exe
File created	C:\Windows\SysWOW64\Lbhnnj32.dll	Kgdbkohf.exe
File created	C:\Windows\SysWOW64\Kdhbec32.exe	Kajfig32.exe
File opened for modification	C:\Windows\SysWOW64\Kckbqpnj.exe	Kdhbec32.exe
File created	C:\Windows\SysWOW64\Ofdhdf32.dll	Kkbkamnl.exe
File opened for modification	C:\Windows\SysWOW64\Lgpagm32.exe	Lpfijcfl.exe
File opened for modification	C:\Windows\SysWOW64\Lgbnmm32.exe	Lgpagm32.exe
File created	C:\Windows\SysWOW64\Mkpgck32.exe	Mdfofakp.exe
File opened for modification	C:\Windows\SysWOW64\Mkpgck32.exe	Mdfofakp.exe
File opened for modification	C:\Windows\SysWOW64\Njljefql.exe	Nkjjij32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1184	4588	WerFault.exe	139

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kkbkamnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bgcomh32.dll"	Laalifad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mecaoggc.dll"	Lgpagm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Flfmin32.dll"	Mnlfigcc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dgcifj32.dll"	Mamleegg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kdhbec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kkbkamnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogijli32.dll"	Lgkhlnbn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cknpkhch.dll"	Ngedij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	virussign.com_a795a05bf3161ca8504aee5891e1d659.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kajfig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gjoceo32.dll"	Lmccchkn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ndclfb32.dll"	Lcpllo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	virussign.com_a795a05bf3161ca8504aee5891e1d659.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nqjfoc32.dll"	Kdaldd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ppaaagol.dll"	Kphmie32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dnapla32.dll"	Lkiqbl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nqfbaq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nqfbaq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ngedij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkeebhjc.dll"	Kgphpo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lijdhiaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mpdelajl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Opbnic32.dll"	Nnolfdcn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Njljefql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lijdhiaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lnhmng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lnhmng32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lpfijcfl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lpfijcfl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lgbnmm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mdfofakp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogdimilg.dll"	Kajfig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ldohebqh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mnlfigcc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mnlfigcc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mkepnjng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kipabjil.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lcpllo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Njacpf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lkiqbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nnolfdcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lmccchkn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mdemcacc.dll"	Lijdhiaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lidmdfdo.dll"	Ldohebqh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lgbnmm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kgdbkohf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbhnnj32.dll"	Kgdbkohf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kgdbkohf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qgejif32.dll"	Lmqgnhmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cmafhe32.dll"	Lkdggmlj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Laalifad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lkiqbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Codhke32.dll"	Mkgmcjld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Npckna32.dll"	Njljefql.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nnolfdcn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kckbqpnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mbaohn32.dll"	Lnhmng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Njacpf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	virussign.com_a795a05bf3161ca8504aee5891e1d659.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gcdihi32.dll"	Kckbqpnj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lgpagm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mdmegp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mkgmcjld.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1772 wrote to memory of 3656	1772	virussign.com_a795a05bf3161ca8504aee5891e1d659.exe	87
PID 1772 wrote to memory of 3656	1772	virussign.com_a795a05bf3161ca8504aee5891e1d659.exe	87
PID 1772 wrote to memory of 3656	1772	virussign.com_a795a05bf3161ca8504aee5891e1d659.exe	87
PID 3656 wrote to memory of 4568	3656	Kdaldd32.exe	88
PID 3656 wrote to memory of 4568	3656	Kdaldd32.exe	88
PID 3656 wrote to memory of 4568	3656	Kdaldd32.exe	88
PID 4568 wrote to memory of 64	4568	Kgphpo32.exe	89
PID 4568 wrote to memory of 64	4568	Kgphpo32.exe	89
PID 4568 wrote to memory of 64	4568	Kgphpo32.exe	89
PID 64 wrote to memory of 2984	64	Kphmie32.exe	90
PID 64 wrote to memory of 2984	64	Kphmie32.exe	90
PID 64 wrote to memory of 2984	64	Kphmie32.exe	90
PID 2984 wrote to memory of 1668	2984	Kbfiep32.exe	91
PID 2984 wrote to memory of 1668	2984	Kbfiep32.exe	91
PID 2984 wrote to memory of 1668	2984	Kbfiep32.exe	91
PID 1668 wrote to memory of 5012	1668	Kipabjil.exe	92
PID 1668 wrote to memory of 5012	1668	Kipabjil.exe	92
PID 1668 wrote to memory of 5012	1668	Kipabjil.exe	92
PID 5012 wrote to memory of 2236	5012	Kagichjo.exe	93
PID 5012 wrote to memory of 2236	5012	Kagichjo.exe	93
PID 5012 wrote to memory of 2236	5012	Kagichjo.exe	93
PID 2236 wrote to memory of 2768	2236	Kgdbkohf.exe	94
PID 2236 wrote to memory of 2768	2236	Kgdbkohf.exe	94
PID 2236 wrote to memory of 2768	2236	Kgdbkohf.exe	94
PID 2768 wrote to memory of 3804	2768	Kajfig32.exe	95
PID 2768 wrote to memory of 3804	2768	Kajfig32.exe	95
PID 2768 wrote to memory of 3804	2768	Kajfig32.exe	95
PID 3804 wrote to memory of 876	3804	Kdhbec32.exe	96
PID 3804 wrote to memory of 876	3804	Kdhbec32.exe	96
PID 3804 wrote to memory of 876	3804	Kdhbec32.exe	96
PID 876 wrote to memory of 1612	876	Kckbqpnj.exe	97
PID 876 wrote to memory of 1612	876	Kckbqpnj.exe	97
PID 876 wrote to memory of 1612	876	Kckbqpnj.exe	97
PID 1612 wrote to memory of 2464	1612	Kkbkamnl.exe	98
PID 1612 wrote to memory of 2464	1612	Kkbkamnl.exe	98
PID 1612 wrote to memory of 2464	1612	Kkbkamnl.exe	98
PID 2464 wrote to memory of 5056	2464	Lmqgnhmp.exe	100
PID 2464 wrote to memory of 5056	2464	Lmqgnhmp.exe	100
PID 2464 wrote to memory of 5056	2464	Lmqgnhmp.exe	100
PID 5056 wrote to memory of 3704	5056	Lkdggmlj.exe	101
PID 5056 wrote to memory of 3704	5056	Lkdggmlj.exe	101
PID 5056 wrote to memory of 3704	5056	Lkdggmlj.exe	101
PID 3704 wrote to memory of 732	3704	Lmccchkn.exe	102
PID 3704 wrote to memory of 732	3704	Lmccchkn.exe	102
PID 3704 wrote to memory of 732	3704	Lmccchkn.exe	102
PID 732 wrote to memory of 2732	732	Lcpllo32.exe	103
PID 732 wrote to memory of 2732	732	Lcpllo32.exe	103
PID 732 wrote to memory of 2732	732	Lcpllo32.exe	103
PID 2732 wrote to memory of 1636	2732	Lgkhlnbn.exe	104
PID 2732 wrote to memory of 1636	2732	Lgkhlnbn.exe	104
PID 2732 wrote to memory of 1636	2732	Lgkhlnbn.exe	104
PID 1636 wrote to memory of 1600	1636	Lijdhiaa.exe	105
PID 1636 wrote to memory of 1600	1636	Lijdhiaa.exe	105
PID 1636 wrote to memory of 1600	1636	Lijdhiaa.exe	105
PID 1600 wrote to memory of 432	1600	Laalifad.exe	106
PID 1600 wrote to memory of 432	1600	Laalifad.exe	106
PID 1600 wrote to memory of 432	1600	Laalifad.exe	106
PID 432 wrote to memory of 2796	432	Ldohebqh.exe	107
PID 432 wrote to memory of 2796	432	Ldohebqh.exe	107
PID 432 wrote to memory of 2796	432	Ldohebqh.exe	107
PID 2796 wrote to memory of 4852	2796	Lcbiao32.exe	108
PID 2796 wrote to memory of 4852	2796	Lcbiao32.exe	108
PID 2796 wrote to memory of 4852	2796	Lcbiao32.exe	108
PID 4852 wrote to memory of 1628	4852	Lkiqbl32.exe	109

C:\Users\Admin\AppData\Local\Temp\virussign.com_a795a05bf3161ca8504aee5891e1d659.exe
"C:\Users\Admin\AppData\Local\Temp\virussign.com_a795a05bf3161ca8504aee5891e1d659.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Windows\SysWOW64\Kdaldd32.exe
  C:\Windows\system32\Kdaldd32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3656
- - C:\Windows\SysWOW64\Kgphpo32.exe
    C:\Windows\system32\Kgphpo32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4568
  - - C:\Windows\SysWOW64\Kphmie32.exe
      C:\Windows\system32\Kphmie32.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:64
    - - C:\Windows\SysWOW64\Kbfiep32.exe
        
        C:\Windows\system32\Kbfiep32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2984
      - C:\Windows\SysWOW64\Kipabjil.exe
        
        C:\Windows\system32\Kipabjil.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1668
        
        C:\Windows\SysWOW64\Kagichjo.exe
        
        C:\Windows\system32\Kagichjo.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5012
        
        C:\Windows\SysWOW64\Kgdbkohf.exe
        
        C:\Windows\system32\Kgdbkohf.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2236
        
        C:\Windows\SysWOW64\Kajfig32.exe
        
        C:\Windows\system32\Kajfig32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2768
        
        C:\Windows\SysWOW64\Kdhbec32.exe
        
        C:\Windows\system32\Kdhbec32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3804
        
        C:\Windows\SysWOW64\Kckbqpnj.exe
        
        C:\Windows\system32\Kckbqpnj.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:876
        
        C:\Windows\SysWOW64\Kkbkamnl.exe
        
        C:\Windows\system32\Kkbkamnl.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1612
        
        C:\Windows\SysWOW64\Lmqgnhmp.exe
        
        C:\Windows\system32\Lmqgnhmp.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2464
        
        C:\Windows\SysWOW64\Lkdggmlj.exe
        
        C:\Windows\system32\Lkdggmlj.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5056
        
        C:\Windows\SysWOW64\Lmccchkn.exe
        
        C:\Windows\system32\Lmccchkn.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3704
        
        C:\Windows\SysWOW64\Lcpllo32.exe
        
        C:\Windows\system32\Lcpllo32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:732
        
        C:\Windows\SysWOW64\Lgkhlnbn.exe
        
        C:\Windows\system32\Lgkhlnbn.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2732
        
        C:\Windows\SysWOW64\Lijdhiaa.exe
        
        C:\Windows\system32\Lijdhiaa.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1636
        
        C:\Windows\SysWOW64\Laalifad.exe
        
        C:\Windows\system32\Laalifad.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1600
        
        C:\Windows\SysWOW64\Ldohebqh.exe
        
        C:\Windows\system32\Ldohebqh.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:432
        
        C:\Windows\SysWOW64\Lcbiao32.exe
        
        C:\Windows\system32\Lcbiao32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2796
        
        C:\Windows\SysWOW64\Lkiqbl32.exe
        
        C:\Windows\system32\Lkiqbl32.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4852
        
        C:\Windows\SysWOW64\Lnhmng32.exe
        
        C:\Windows\system32\Lnhmng32.exe
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1628
        
        C:\Windows\SysWOW64\Lpfijcfl.exe
        
        C:\Windows\system32\Lpfijcfl.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1924
        
        C:\Windows\SysWOW64\Lgpagm32.exe
        
        C:\Windows\system32\Lgpagm32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2624
        
        C:\Windows\SysWOW64\Lgbnmm32.exe
        
        C:\Windows\system32\Lgbnmm32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4416
        
        C:\Windows\SysWOW64\Mnlfigcc.exe
        
        C:\Windows\system32\Mnlfigcc.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3424
        
        C:\Windows\SysWOW64\Mdfofakp.exe
        
        C:\Windows\system32\Mdfofakp.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4560
        
        C:\Windows\SysWOW64\Mkpgck32.exe
        
        C:\Windows\system32\Mkpgck32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:316
        
        C:\Windows\SysWOW64\Mdiklqhm.exe
        
        C:\Windows\system32\Mdiklqhm.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:408
        
        C:\Windows\SysWOW64\Mamleegg.exe
        
        C:\Windows\system32\Mamleegg.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2704
        
        C:\Windows\SysWOW64\Mcnhmm32.exe
        
        C:\Windows\system32\Mcnhmm32.exe
        32⤵
        Executes dropped EXE
        
        PID:4500
        
        C:\Windows\SysWOW64\Mkepnjng.exe
        
        C:\Windows\system32\Mkepnjng.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4280
        
        C:\Windows\SysWOW64\Mdmegp32.exe
        
        C:\Windows\system32\Mdmegp32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3312
        
        C:\Windows\SysWOW64\Mkgmcjld.exe
        
        C:\Windows\system32\Mkgmcjld.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1952
        
        C:\Windows\SysWOW64\Mnfipekh.exe
        
        C:\Windows\system32\Mnfipekh.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2468
        
        C:\Windows\SysWOW64\Mpdelajl.exe
        
        C:\Windows\system32\Mpdelajl.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3316
        
        C:\Windows\SysWOW64\Mcbahlip.exe
        
        C:\Windows\system32\Mcbahlip.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:556
        
        C:\Windows\SysWOW64\Nkjjij32.exe
        
        C:\Windows\system32\Nkjjij32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2880
        
        C:\Windows\SysWOW64\Njljefql.exe
        
        C:\Windows\system32\Njljefql.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4664
        
        C:\Windows\SysWOW64\Nqfbaq32.exe
        
        C:\Windows\system32\Nqfbaq32.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2324
        
        C:\Windows\SysWOW64\Nceonl32.exe
        
        C:\Windows\system32\Nceonl32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4696
        
        C:\Windows\SysWOW64\Njogjfoj.exe
        
        C:\Windows\system32\Njogjfoj.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1512
        
        C:\Windows\SysWOW64\Nddkgonp.exe
        
        C:\Windows\system32\Nddkgonp.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4708
        
        C:\Windows\SysWOW64\Ngcgcjnc.exe
        
        C:\Windows\system32\Ngcgcjnc.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1148
        
        C:\Windows\SysWOW64\Njacpf32.exe
        
        C:\Windows\system32\Njacpf32.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2744
        
        C:\Windows\SysWOW64\Nbhkac32.exe
        
        C:\Windows\system32\Nbhkac32.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3060
        
        C:\Windows\SysWOW64\Ngedij32.exe
        
        C:\Windows\system32\Ngedij32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1444
        
        C:\Windows\SysWOW64\Nnolfdcn.exe
        
        C:\Windows\system32\Nnolfdcn.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3212
        
        C:\Windows\SysWOW64\Ndidbn32.exe
        
        C:\Windows\system32\Ndidbn32.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2836
        
        C:\Windows\SysWOW64\Nkcmohbg.exe
        
        C:\Windows\system32\Nkcmohbg.exe
        51⤵
        Executes dropped EXE
        
        PID:4588
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 400
        52⤵
        Program crash
        
        PID:1184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4588 -ip 4588
1⤵
PID:3960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Kagichjo.exe

Path C:\Windows\SysWOW64\Kagichjo.exe
Size 128KB
SHA256 7b0361e2d267a5cb457a9a3d4ad7e890fd9d2aabc15f59aa0898ca99dcda105a
MD5 1aa981294b565c21c3858199ee4f125a
SHA1 3cae083750c244a8d2ff85960082628424106243
SHA512 781754df2aae7b5e900d183d9673e657f4cc51f3bed87260570bd0d927ce8a7d5c6baeb9976775fdb28490d3c60f6c140978fd59b427c06a78d28e048bc28f4b
SSDEEP 3072:qIX4gDs/eV/iUYiz+5I9EO7k8QYxQdLrCimBaH8UH30ZIvM6qMH5X3O/:qIIgDs/ARK5ME4FtCApaH8m3QIvMWH5H
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kajfig32.exe

Path C:\Windows\SysWOW64\Kajfig32.exe
Size 128KB
SHA256 3b537db5a67da094126bf67065db84b0302932ac54d90cae12bc252a07506da2
MD5 05f90787c2914db46f07902e773c3e4b
SHA1 e4cd83877c543d41871b83cefa33c972f67e7cb2
SHA512 ab5e16b18ed19f580cb412a5a34f31112b4756be5cd727bf1ab55438f6293303e582b5eebe61c7a31d507a14bd1f0d3fedcf1eef43325234dc4b4601d0fff4ea
SSDEEP 3072:P3hAENO1cEZKgEpk8QYxQdLrCimBaH8UH30ZIvM6qMH5X3O/:fhAEickNEpFtCApaH8m3QIvMWH5H
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kbfiep32.exe

Path C:\Windows\SysWOW64\Kbfiep32.exe
Size 128KB
SHA256 d00678dc05a3db4e599afa1cf6ded6ff06c50d22554910623a0cdf09414afce3
MD5 30999c0a42f877781ecdcbbfd05ee09a
SHA1 ed329e6ac851fe6745f571dff0d080ea52b38496
SHA512 75ae420489db3d59b9a0008c98656c8c8136fa78344b616dbb210e1a450eec9df0c35803d78e49d870da2b9bf899efbb8ea9cca593daefa1dd4b0626efecdd2a
SSDEEP 3072:OEVxTxNXPxXYaPQmEak8QYxQdLrCimBaH8UH30ZIvM6qMH5X3O/:Owh6aImEaFtCApaH8m3QIvMWH5H
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kckbqpnj.exe

Path C:\Windows\SysWOW64\Kckbqpnj.exe
Size 128KB
SHA256 39e38e2df003704dadb483acc044ff2ad9924bb856db9bb2b684d472aa0db45b
MD5 b57615fd0b59e8156a26f1efd1b2eb8b
SHA1 62cbc1af7125ac7506396132f0480e5cd5e4b97f
SHA512 8f048828afba45c43f19efed547db21b290c78efc2f8618a9e37ffecb631b610d12348f99a69ff8e1d03759dd4d3bcd3b8e1becd30c98182e063eacb0a8459ba
SSDEEP 3072:cT1cKw34AyDyuEwk8QYxQdLrCimBaH8UH30ZIvM6qMH5X3O/:kcZ34zrEwFtCApaH8m3QIvMWH5H
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kdaldd32.exe

Path C:\Windows\SysWOW64\Kdaldd32.exe
Size 128KB
SHA256 1411943f059a352c92e656509738a05975797ace03125432205c0658dabbc2d6
MD5 afb4757824eb9a9346de02b61f67be92
SHA1 9afceee557fe5c21d441ab92b275784154a32a8b
SHA512 ebdce1a9c887365252b96df3180f61ea62fb8b192d1e349892f440955ef629bd097352cb533416a338a3c2c6ffccd743bad7c97d485cb12416701009077e8e0f
SSDEEP 3072:8QW0GIaPpR1jEvk8QYxQdLrCimBaH8UH30ZIvM6qMH5X3O/:snIaPpnEvFtCApaH8m3QIvMWH5H
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kdhbec32.exe

Path C:\Windows\SysWOW64\Kdhbec32.exe
Size 128KB
SHA256 339b54b94478c18739a42965cfc306e1f1b5552da16e62e9923c6f7b4867fbc4
MD5 7b8b643b857a6cfd1ae8159f9eab6c96
SHA1 0e3e2e6331dd37927826934f08f9610104f6a6b4
SHA512 c3874627037756ec517f5940136e37a9b00bf9a72e2d0b78538a372f35b6ba7182aeea64a54e12184a079a79865b06c429e0de2f758c9a527db71276c042fa05
SSDEEP 3072:NO9foIQ23Cl0ZAB5FNbKcEGk8QYxQdLrCimBaH8UH30ZIvM6qMH5X3O/:C/x3ClgG5PtEGFtCApaH8m3QIvMWH5H
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kgdbkohf.exe

Path C:\Windows\SysWOW64\Kgdbkohf.exe
Size 128KB
SHA256 08077eaa300a846b4582978e7de0d3519fdf38577196c49c76fd6ce2358a79fd
MD5 e80462e74b14599f1fed55bfdec4727a
SHA1 4da18fc8d456f03f98c108a26c3ea1fd0d2227ac
SHA512 66a5cc018fcc7e6d772d3e00feff808c5ab41651b1dee1dbaa7734b71db44a2eeb206c4d3ab73508101e7651bb9085fa2ee6572b190f3b84601d44ea424b15a4
SSDEEP 3072:TjrabWDQyrF7BNQEWk8QYxQdLrCimBaH8UH30ZIvM6qMH5X3O/:T+WDQyrF7TQEWFtCApaH8m3QIvMWH5H
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kgphpo32.exe

Path C:\Windows\SysWOW64\Kgphpo32.exe
Size 128KB
SHA256 9a1876458759da47e2667ef7c565a094e572468ef5416aa36b4c6e5b3ce6f365
MD5 8a5ee0ff4196415e66a10510d961ff3d
SHA1 20f190d273bb8f05061bbae7166baa4c25b4eb37
SHA512 08765a67b76aa444ce1425b57b101fd87d2285a5dda80698ff54d5a82a29d67ddec58f096dd89ec8e3e377d768b4c705b0bb123f02aafe7a1b152ebded48b38a
SSDEEP 3072:isd9j324LxckXTuXxdEck8QYxQdLrCimBaH8UH30ZIvM6qMH5X3O/:iGl24Vj6hdEcFtCApaH8m3QIvMWH5H
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kipabjil.exe

Path C:\Windows\SysWOW64\Kipabjil.exe
Size 128KB
SHA256 64a46b72036f98acb2ce3517bde9a7a65212b8ee3b086f833534d4c53aa7b0df
MD5 08eb1563b921067d9f8e817d1bfc38d6
SHA1 2ecbde4f38fbcd4bdb6dac51a75b8dc4940bea01
SHA512 e7d9d4eca061255e51260b951374f1b2319b8b6cf23a96b392395e5a831fa3492aac332f24281b20b2b5e11512335eb70aa5f4244c10b46fd32b725bf16c1c80
SSDEEP 3072:OPdPyOE3k8QYxQdLrCimBaH8UH30ZIvM6qMH5X3O/:OPdLE3FtCApaH8m3QIvMWH5H
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kkbkamnl.exe

Path C:\Windows\SysWOW64\Kkbkamnl.exe
Size 128KB
SHA256 998c7095321f318064614d422ea356da874ec7a8c1575d738318c45c68a8c944
MD5 eb2c9ff9e05b1915a8d299076feba80c
SHA1 8383acf9495e023447656763c48fce9d5d2f2f6b
SHA512 b165e7c7ce2e93d34fefece4e4e8d2b239131f582340593d1ce10029e3a38d975decc0a8aaf1ec934c6a795b28a2a5aa2e2282893e9b1ce0fa99dd8bb6df12f5
SSDEEP 3072:6ivwFf2bDZQLESk8QYxQdLrCimBaH8UH30ZIvM6qMH5X3O/:5vwFZESFtCApaH8m3QIvMWH5H
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kphmie32.exe

Path C:\Windows\SysWOW64\Kphmie32.exe
Size 128KB
SHA256 c91fb253ebb1ec152f971f65bd9bdafed75b6b11b182385510d157eb9944140d
MD5 32b42a40f68a790e885b44ab28f8dc57
SHA1 25d9069d0436740f3f6ef7fe2079fa3e1aa300f2
SHA512 854bf7533445948ce2faf0a98ca33518ac4b0a0c1871953919f1920bca678080873650440f00dbfafe24973a5d0a754c4e75d6ae4aca85d41aefa3bfcaa83886
SSDEEP 3072:W4JthEug6UNiXEHk8QYxQdLrCimBaH8UH30ZIvM6qMH5X3O/:jfEHFtCApaH8m3QIvMWH5H
MD5 SHA1 SHA512 SSDEEP

Submit Download

Laalifad.exe

Path C:\Windows\SysWOW64\Laalifad.exe
Size 128KB
SHA256 a90b8151ef5d23fd6809c7d04e8860211103ae93f4c72889024ed568e33f0076
MD5 1c42a4de0e61e0fcaed6e3fa93aabd31
SHA1 316a36bf2fb071cdecfb8679f9cae076ec276090
SHA512 0c681532f85ada5c9e2a051dfeec6dd2dd873ba7d78ba9d07aa9819be23f59ddc8dc53db91ed589dd7548e2ad3d8aa46b9e547edf776f43a6a160995c92163cf
SSDEEP 3072:zn4h2kwzVr5VngP9u4U4E4k8QYxQdLrCimBaH8UH30ZIvM6qMH5X3O/:zdBVVq9uGE4FtCApaH8m3QIvMWH5H
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lcbiao32.exe

Path C:\Windows\SysWOW64\Lcbiao32.exe
Size 128KB
SHA256 470720e7897288067ecff553ff88f378d215f891ffdc225103aef038670e0483
MD5 eac1e4bd185a58c08e3afe2ef9b91725
SHA1 d3078d9d121145e27a7e92dad75863a31745ccb9
SHA512 3f4f8bbdd6fef73f44c695938655e8e660419250378672a93e39a8e3635d9348992c2fd3c5c369b389e9e60242165e9c1d52fbcee3056bc981c4dbb0101a1cd7
SSDEEP 3072:3q8/ij/xis3J20ssvjjjTqVP0ysEkk8QYxQdLrCimBaH8UH30ZIvM6qMH5X3O/:r/iTxdMXsvjjjTqVP0HEkFtCApaH8m3j
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lcpllo32.exe

Path C:\Windows\SysWOW64\Lcpllo32.exe
Size 128KB
SHA256 455e7faf0799ee63db8ff3c21e9e0bd4ce17017a175cd76a5f129f9afa606dfb
MD5 b983513a5d53a3431f4445e82678d944
SHA1 8fbba7a3c147a68d8ee7df02cfc841ad50b5fcec
SHA512 c8bd90ed1bbae9f1ba90ae53d25d9dc3d61c19dd283c0bb328061da2ea149a1329acd0afb47940af78c4c104aa02ab97152870d975a5d2681b23ab2e940cc139
SSDEEP 3072:eqOq5rC7FxyEOk8QYxQdLrCimBaH8UH30ZIvM6qMH5X3O/:ejqg7iEOFtCApaH8m3QIvMWH5H
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ldohebqh.exe

Path C:\Windows\SysWOW64\Ldohebqh.exe
Size 128KB
SHA256 22b9b3349e6fb7b60347af8d315c3c90afaabe0abca772914ef88ae933d3ca64
MD5 a4324dddd85562847effdf3faaebfc2c
SHA1 395826908d59ffbbddd0fd217422bf5bf1060310
SHA512 d7439def9db1b114f35647e580d61bc2c2885e30a28a6a933b0895b15ef062f14b5481ec5d9623dbc93dc79bbf0674d2f029abf7e3304d7b2e4fb4d45a00d06b
SSDEEP 3072:tcJRofL8ubgypkE2k8QYxQdLrCimBaH8UH30ZIvM6qMH5X3O/:tMkL8ubgypkE2FtCApaH8m3QIvMWH5H
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lgbnmm32.exe

Path C:\Windows\SysWOW64\Lgbnmm32.exe
Size 128KB
SHA256 3f3a583e02cfb964cd2643e523ee5a79bb29e0a1186f45e4c8bad8a68ab5f4e8
MD5 c14e28665d4670fce38f0b645b010b6b
SHA1 b02b071c94aed2ef4990cbf59eced0b6a5023141
SHA512 dbc06493f4d9c454b41a18f40348c671554c0128f8f0320fd9c8d135cf909599dcd76d0ccda5b4b45d5d34d3b13a491c4b73ab6cc3550dd06ae41f38c750d5f7
SSDEEP 3072:G7yPGqFMkrkDDExk8QYxQdLrCimBaH8UH30ZIvM6qMH5X3O/:G7y7xryExFtCApaH8m3QIvMWH5H
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lgkhlnbn.exe

Path C:\Windows\SysWOW64\Lgkhlnbn.exe
Size 128KB
SHA256 1f7b8f3716d174ace59a0b20b664f4d9db3df390f7d2c9e73ab4f7841086c989
MD5 bf4898eb4f9dec2c57675a233aa51516
SHA1 a03661593d6dac3f947a11393377c5fbe484130b
SHA512 7cf2657ed6859292bbedf00244a8523470f4d2fd34a26f1078a96d26788fbcaf637abed3b496686817aa3146a2483259d872d7ccfab987046ed68d66223208ea
SSDEEP 3072:2DP1v029UYVqE6k8QYxQdLrCimBaH8UH30ZIvM6qMH5X3O/:2DP1t9UYQE6FtCApaH8m3QIvMWH5H
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lgpagm32.exe

Path C:\Windows\SysWOW64\Lgpagm32.exe
Size 128KB
SHA256 134a292b94f84ddcc78c74c2d32c61276b541fc057dc30f88ba8ac6b05b8ed66
MD5 73bdbaf14da8dee5237631f52c469b54
SHA1 be61689255948f0b9455cd8ab20c5d8e26dc6f72
SHA512 c04fd90fd73d35ee3e795d6634ff3b736aa3207f9304b941a746f51297d5d7d940c3757b55bafcaa1e0e566fe15e373266b4915b97ef66e0fe34ff0c3ffad526
SSDEEP 3072:HaMrp7qRPa7oKnodHE1k8QYxQdLrCimBaH8UH30ZIvM6qMH5X3O/:6Mr8A75eHE1FtCApaH8m3QIvMWH5H
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lijdhiaa.exe

Path C:\Windows\SysWOW64\Lijdhiaa.exe
Size 128KB
SHA256 85bca5ab328ac6be846036c55e1e46aba8a6390e125088a9fe65d87e93ed8a91
MD5 5a075b439cd78578442429a41520ae4a
SHA1 693e7b85bd6493878af3d59e0817b87e442a6288
SHA512 4c5452dadaebf4bb268eb47681acf8c0ce0ad1abf0429783e290d96de4c6997c04d127c2f6e8b22bbbb79344b5b9fb358f395fa536bfbad879c221ea99ffdaff
SSDEEP 3072:PdPHdbESGAXrf/ESk8QYxQdLrCimBaH8UH30ZIvM6qMH5X3O/:FPmU7ESFtCApaH8m3QIvMWH5H
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lkdggmlj.exe

Path C:\Windows\SysWOW64\Lkdggmlj.exe
Size 128KB
SHA256 31f6de2f0ee6e089fa3c83ae0c5f860118015fd46bab3c2a7f9a5ef46eb29dde
MD5 354d5f360ecaa5e72e5adb17c29af1c6
SHA1 164e91b8fd2cb6dc011ae74da58e60a6b35e0be2
SHA512 d144930900a4ebe14c3fb9904f15ed9cb1ea23a9b88dca7b21d5f4c5d23c2a4d37b87952feb1fc020195322f37962a2a3accace4c88e99befcc7c5cf92e29ff2
SSDEEP 3072:iBUfw5crN2SEHk8QYxQdLrCimBaH8UH30ZIvM6qMH5X3O/:iBUfws2SEHFtCApaH8m3QIvMWH5H
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lkiqbl32.exe

Path C:\Windows\SysWOW64\Lkiqbl32.exe
Size 128KB
SHA256 8e545b0a1f98a678fa1d86cbfc0e895339657db1127cf5206c14a2e0129c2521
MD5 a042a61f9807147d618632eba8b9b09f
SHA1 f10a2e168d47f51882621eb596072b8e9a05c306
SHA512 cfb5d7cc1ca9bf3f0915b90f15cfd91241bf32ee3494249140e0d3211106243fcf6989e57b9c4ff8ec8904040a93e2c58bdfa5845c16148a68658f93efdc898b
SSDEEP 3072:IXey+qCjThxQj8MT2E1k8QYxQdLrCimBaH8UH30ZIvM6qMH5X3O/:IXey+LtO2E1FtCApaH8m3QIvMWH5H
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lmccchkn.exe

Path C:\Windows\SysWOW64\Lmccchkn.exe
Size 128KB
SHA256 e91dd7162044e73164cde22fbde4dcdc6f60e2b4acedfc4c6d8b9e9b0c3dc770
MD5 25d9c427d96c1f8a681e7316833871a9
SHA1 bd0429ff2a21ff10479cbf0c83141cf9403df0b5
SHA512 127990b10fb8e6c1820bae4118cdce54f76844ca99a0360d3cd9adaa8566ded5ef69e3bc7efde5775c2740164d31226a082eb1ce667c8243d6fa4b40e53522d3
SSDEEP 3072:aPYXESDvxD0odsExk8QYxQdLrCimBaH8UH30ZIvM6qMH5X3O/:aAbDvxD0oCExFtCApaH8m3QIvMWH5H
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lmqgnhmp.exe

Path C:\Windows\SysWOW64\Lmqgnhmp.exe
Size 128KB
SHA256 79453330a7105918912f1b0728bad6ffcb502330a8bd17121abd6108b12a7140
MD5 4e83b53b039201615387b8532e039a9d
SHA1 21c692337f565133de9fabb5282f6018513a45d5
SHA512 1fde120a588925bedbdacc2662b76a5922394c35f8dc0aaeef429edb3299e6f67198ea3a7fb5fb2be3e26a4ee9a1a7d66c831efc8c3539347293908a869bf6ee
SSDEEP 3072:NxDJZjL76Poq94ETk8QYxQdLrCimBaH8UH30ZIvM6qMH5X3O/:Nxz+gbETFtCApaH8m3QIvMWH5H
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lnhmng32.exe

Path C:\Windows\SysWOW64\Lnhmng32.exe
Size 128KB
SHA256 abbb32a09c916460f99429910c2cc91d0ade58fa8217bb6b4e78411dfe5413a0
MD5 8b39d4a6815913f9787d4b9051770d9e
SHA1 66df89430ff879d80c86691b24c4249db66d151a
SHA512 c139c8af603482a8a9228d2b4d57b08c76ae2b65fefa1b7a3520c7f0ed072464b8fa47f7e6952ff1ec7a27ee192ac6266a52e807ef34dfe00c5cadeaaf21197d
SSDEEP 3072:/PoBMsypjDmjExk8QYxQdLrCimBaH8UH30ZIvM6qMH5X3O/:4SnYExFtCApaH8m3QIvMWH5H
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lpfijcfl.exe

Path C:\Windows\SysWOW64\Lpfijcfl.exe
Size 128KB
SHA256 e10f7f5cae78e07d2cd2809f6ffff8a0c7e23325132550e5a6c928d907caebe2
MD5 ed7d8b4e62b1a0bb990121ea2186c412
SHA1 3373b953639d2ac1049215e6046b80c4df23222f
SHA512 47117a8d8249372dde3b9786a9f5599c5e738f9be6b2f5c2b767414449fd68cf41c46bb99eced8c33d58bcb977e5d59fd934e27d4d5447996aa060eed700ded7
SSDEEP 3072:aif73PzZm0ivvwElk8QYxQdLrCimBaH8UH30ZIvM6qMH5X3O/:aU3LZmXvwElFtCApaH8m3QIvMWH5H
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mamleegg.exe

Path C:\Windows\SysWOW64\Mamleegg.exe
Size 128KB
SHA256 e83869bc2d6f5670b717c9930a26bf55f9084274f6f2b8632e2daeeba292978f
MD5 612e221a1599b5f83ad16b818da8df23
SHA1 1dff3f8b4e8fd3dc39a8300b88e6905504070652
SHA512 fecacd288d2e4939af675c7f766350103b4a3fcd01fe706aab50fb1c7e2f6d97753b7c60714abe60422487c360ae5cb01c7440c34771a8d97c877900cd0ea570
SSDEEP 3072:AP3VZ2ePBr7b2jNETk8QYxQdLrCimBaH8UH30ZIvM6qMH5X3O/:AveepnbIETFtCApaH8m3QIvMWH5H
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mcnhmm32.exe

Path C:\Windows\SysWOW64\Mcnhmm32.exe
Size 128KB
SHA256 1b1c0d48a214c9afd0e978a7409b7e48ea2ded02f141a444841cf9973c3de400
MD5 c2c86aa530aa013d4c3f584b67cc800d
SHA1 9be58ce287a239daf050bd9f75016fe394dfeb74
SHA512 a10a87a09f0a1669ef0f4194134fcdb8058778e4f362c401a5ad6bbfd52b732aa0142070f2d9a6f9e7be9d9dfdccf212835241a64fa6433b75cf323fd82a5892
SSDEEP 3072:GRKp5lIakeJPuoxIECk8QYxQdLrCimBaH8UH30ZIvM6qMH5X3O/:GR6POexriECFtCApaH8m3QIvMWH5H
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mdfofakp.exe

Path C:\Windows\SysWOW64\Mdfofakp.exe
Size 128KB
SHA256 92529222e508b44274846cb1923e5d93d42c42784b272524f69abb17ca56ba1d
MD5 cb24ca80a780fec282f9548c85244a88
SHA1 4d3d695d1934b01a91e309429422c1fbb1dbd60b
SHA512 1f37d4f02b75767471318d8905608eb9f720be9744101349dbe4bb939d035f8cfef24f32521f3abca961005888b1aa2e831f78eed3fb3f58ba17e1e4a7b25dd3
SSDEEP 3072:hEiL+Z8Eek8QYxQdLrCimBaH8UH30ZIvM6qMH5X3O/:hEiL+iEeFtCApaH8m3QIvMWH5H
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mdiklqhm.exe

Path C:\Windows\SysWOW64\Mdiklqhm.exe
Size 128KB
SHA256 129cebc3d5157bf4708c1adfb163bfc457ed1af3aa3d040beab9d3100bc11329
MD5 baa8e933dfd8e1ebed2af44ef77fa788
SHA1 7b6a7f50f7e4cf3a5105c16d2b340ee3bcec605e
SHA512 d60ed9d9d3f95c330c2e6af92a0e567c3e2d475e8152f04a193026ad0adef94919f5ba3df0e298106a281c4562bc4e0cb21d73b7cfd4dd01630d64e78a09c5d0
SSDEEP 3072:V+AKJABuyUEfk8QYxQdLrCimBaH8UH30ZIvM6qMH5X3O/:AhqBuyUEfFtCApaH8m3QIvMWH5H
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mkepnjng.exe

Path C:\Windows\SysWOW64\Mkepnjng.exe
Size 128KB
SHA256 f3a570376d6b9cf8fc0b420981171caeed281041a00244300092b7b5def08ae1
MD5 772949990838dc887e5f1ca95ee57105
SHA1 5dccc448a1a9d0c5f953db80daec7a025de148b3
SHA512 2f1471063747ff3ed5fa51433fdb126eb7eb9c007d5bdd3fb12a0e4b37ef4297ca047243e46649e52c3977d60ccd4c8906fc6a2206415664d86d24141460d95d
SSDEEP 3072:vlX97bY6zZEzWQvrfMCnIEEk8QYxQdLrCimBaH8UH30ZIvM6qMH5X3O/:vltQyE5rfMCnIEEFtCApaH8m3QIvMWHV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mkpgck32.exe

Path C:\Windows\SysWOW64\Mkpgck32.exe
Size 128KB
SHA256 debe16d4a2dfed70314dc096a284111c62ece91c21325e5f65b4bc59a28f547a
MD5 fb04900948981e5d70a0e3684feeb7fb
SHA1 9036284181c3005f53b194527929725728ed7f95
SHA512 da30ef29d67ce00778ccd000f8d3bd901bd68ce6307872e1318fa68ca45daad641151e89afa34bd788d89769c67efdc769c2d48eee97f6a35e8903ebea14e077
SSDEEP 3072:tgDYzub6JbNBEIk8QYxQdLrCimBaH8UH30ZIvM6qMH5X3O/:+BboEIFtCApaH8m3QIvMWH5H
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mnlfigcc.exe

Path C:\Windows\SysWOW64\Mnlfigcc.exe
Size 128KB
SHA256 06b364f00d90909a217234f033a0bfd96072c909182ffe518c64cadb14f630d8
MD5 b37cfd66c74c335f20551b23bf22142f
SHA1 67c669f864fbbf41fba89b35e253f380b67f6af4
SHA512 9ea5a579a286868ce2ec54cb941dc2a95ef3225885847e1a1959427746c2a6d570d3b9e45ede561037671f8255cb2736ea0e228a6f5c37cfdf4ba12f7a4e637f
SSDEEP 3072:Ko8qnkhF6bDQ7c+WuKerE4k8QYxQdLrCimBaH8UH30ZIvM6qMH5X3O/:Ko8qnk2bD1Nu1E4FtCApaH8m3QIvMWHV
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/64-25-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/316-225-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/408-233-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/432-178-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/556-287-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/732-121-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/876-81-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1148-329-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1148-372-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1444-347-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1444-369-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1512-317-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1512-374-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1600-172-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1612-93-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1628-187-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1636-189-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1668-41-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1772-0-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1772-5-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1924-199-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1952-269-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2236-57-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2324-376-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2324-305-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2464-102-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2468-275-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2624-205-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2704-240-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2732-136-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2744-335-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2744-371-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2768-65-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2796-181-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2836-359-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2836-367-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2880-293-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2984-33-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3060-370-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3060-341-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3212-353-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3212-368-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3312-263-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3316-281-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3424-223-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3656-9-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3704-113-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3804-73-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4280-261-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4416-215-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4500-249-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4560-221-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4568-20-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4588-366-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4588-365-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4664-299-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4664-377-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4696-311-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4696-375-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4708-373-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4708-323-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4852-195-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5012-49-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5056-109-0x0000000000400000-0x000000000043E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads