Analysis
-
max time kernel
131s -
max time network
176s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
15/03/2024, 00:48
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
f29e097c29504700c8e5c0a089eb0a5cd10c617179b533bf2ec6d5759f816093.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
f29e097c29504700c8e5c0a089eb0a5cd10c617179b533bf2ec6d5759f816093.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
f29e097c29504700c8e5c0a089eb0a5cd10c617179b533bf2ec6d5759f816093.exe
-
Size
136KB
-
MD5
f2e589b725100342358b4e4f9024c222
-
SHA1
fb2ad28618a396b1f976a63b90fcad2dd946df34
-
SHA256
f29e097c29504700c8e5c0a089eb0a5cd10c617179b533bf2ec6d5759f816093
-
SHA512
0e1bf33d25446be89f754a100e8c324d4010a62237647de848e939dba3f1c2148f32d1bf9b636431b66cec4c5911662f8c367e46c6ea19c3783f3e044001b763
-
SSDEEP
1536:gs/BhhjjKoJ1etg7HZ8r/VW7BL0p5ijqYkYO1Uyjz0cZ44mjD9r823FQ75/DtXh:gUtKoJ1e258s0+jqYI1Uji/mjRrz3OT
Score
10/10
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Phhpic32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Pkhokkel.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kppphe32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ennqpkcm.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fbihdhhf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Npjelo32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kjhccf32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dbicjlji.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Deokhc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Efccfojn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Cddemi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Pohnhdog.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bdkgckal.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ddbfkh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eogoaifl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jnfcbg32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dooaip32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Agcikk32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Naejcl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Chiipg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Lnjgpgkf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Hkpqdifa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Egiohh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Emllbe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bjjjhifm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Codhgg32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Felbhdgd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Koodka32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hkkhjj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Poggnnkk.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eblpqono.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Amhlpb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Fmbdnhme.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Eehime32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Imfill32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kgphje32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Dhnnoe32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nnbeie32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Naejcl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Aakelfhg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ocbhjjqn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bonhqnpi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Oianmm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jgmapcqe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ckaolcol.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ebdcejpk.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eokjke32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Fkflbb32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Idfhibdn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kiejfo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Eimegk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Qaegcb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Egbdekcg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Cmhial32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Dfcjoa32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oianmm32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ggqingie.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hoogpcco.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gpkiklop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Habeni32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ibkpmm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kkbohc32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Epjfehbd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Odooqo32.exe -
UPX dump on OEP (original entry point) 44 IoCs
resource yara_rule behavioral2/files/0x000900000002328a-7.dat UPX behavioral2/files/0x000700000002328e-16.dat UPX behavioral2/files/0x0007000000023290-24.dat UPX behavioral2/files/0x0008000000023292-32.dat UPX behavioral2/files/0x0007000000023295-40.dat UPX behavioral2/files/0x000800000002329e-52.dat UPX behavioral2/files/0x000a00000002314e-59.dat UPX behavioral2/files/0x0009000000023299-69.dat UPX behavioral2/files/0x00090000000232a0-77.dat UPX behavioral2/files/0x00070000000232a2-85.dat UPX behavioral2/files/0x00070000000232a4-93.dat UPX behavioral2/files/0x00070000000232a6-101.dat UPX behavioral2/files/0x00070000000232a9-109.dat UPX behavioral2/files/0x00070000000232ad-117.dat UPX behavioral2/files/0x00070000000232b4-125.dat UPX behavioral2/files/0x00070000000232ba-128.dat UPX behavioral2/files/0x00080000000232b7-141.dat UPX behavioral2/files/0x00070000000232bd-149.dat UPX behavioral2/files/0x00070000000232bf-157.dat UPX behavioral2/files/0x00070000000232c1-165.dat UPX behavioral2/files/0x00070000000232c3-173.dat UPX behavioral2/files/0x00070000000232c6-181.dat UPX behavioral2/files/0x00070000000232c8-189.dat UPX behavioral2/files/0x00070000000232cb-197.dat UPX behavioral2/files/0x00070000000232ce-205.dat UPX behavioral2/files/0x00070000000232d0-212.dat UPX behavioral2/files/0x00070000000232d2-221.dat UPX behavioral2/files/0x00090000000232b1-229.dat UPX behavioral2/files/0x00070000000232d4-237.dat UPX behavioral2/files/0x00070000000232d6-246.dat UPX behavioral2/files/0x00090000000232b3-253.dat UPX behavioral2/files/0x00070000000232d8-262.dat UPX behavioral2/files/0x00070000000232e8-321.dat UPX behavioral2/files/0x00070000000232ee-340.dat UPX behavioral2/files/0x00070000000232f4-360.dat UPX behavioral2/files/0x00070000000232fc-385.dat UPX behavioral2/files/0x0007000000023350-676.dat UPX behavioral2/files/0x0007000000023366-750.dat UPX behavioral2/files/0x0007000000023370-782.dat UPX behavioral2/files/0x000700000002340a-1358.dat UPX behavioral2/files/0x0007000000023416-1401.dat UPX behavioral2/files/0x00070000000234b6-2034.dat UPX behavioral2/files/0x00070000000234b8-2041.dat UPX behavioral2/files/0x00070000000234c4-2083.dat UPX -
Executes dropped EXE 64 IoCs
pid Process 2784 Bdlncn32.exe 4980 Eblgon32.exe 2456 Fiaogfai.exe 3064 Foenplji.exe 388 Gklnem32.exe 4964 Eenflbll.exe 5084 Fnmqegle.exe 3432 Gaglma32.exe 4428 Hmecba32.exe 1732 Hahedoci.exe 2684 Idpdfija.exe 4108 Jkcpia32.exe 4180 Knfepldb.exe 808 Klnkoc32.exe 324 Lofjam32.exe 3872 Moajmk32.exe 3640 Nifnao32.exe 4936 Omhpcm32.exe 2228 Oianmm32.exe 1000 Pppoeg32.exe 1232 Peaahmcd.exe 3136 Apqhldjp.exe 3956 Agmmnnpj.exe 3036 Amibqhed.exe 3164 Bcmqin32.exe 3140 Bodano32.exe 2256 Cgpcklpd.exe 3444 Cokgonmp.exe 1160 Cpjdiadb.exe 3964 Cjbhbf32.exe 4628 Cfiiggpg.exe 1692 Djgbmffn.exe 984 Egiohh32.exe 1572 Gpnoigpe.exe 4152 Habeni32.exe 2424 Jhdlbp32.exe 3040 Kpfggang.exe 2608 Kafcadej.exe 2656 Kkqepi32.exe 2184 Mhpeelnd.exe 4604 Mdibplaf.exe 1944 Mbmbiqqp.exe 4948 Nocphd32.exe 1968 Nnmfdpni.exe 4696 Oelhljaq.exe 4824 Obphenpj.exe 2872 Oaeegjeb.exe 4396 Oecnmi32.exe 4952 Oajoaj32.exe 5136 Pbiklmhp.exe 5176 Phhpic32.exe 5228 Pbndgl32.exe 5268 Phmjdbpo.exe 5308 Peajngoi.exe 5352 Aemjjeek.exe 5408 Abqjci32.exe 5484 Cpgqik32.exe 5524 Djnaco32.exe 5568 Eokjke32.exe 5612 Epjfehbd.exe 5696 Fbnhjn32.exe 5768 Hclaeocp.exe 5820 Ibhdgjap.exe 5876 Kbapdfkb.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Dkahba32.exe Dbicjlji.exe File created C:\Windows\SysWOW64\Iibclmkn.exe Ichkpb32.exe File created C:\Windows\SysWOW64\Mfhhqdjl.dll Ichkpb32.exe File created C:\Windows\SysWOW64\Bmeagjbo.exe Bdmmnd32.exe File opened for modification C:\Windows\SysWOW64\Heapmp32.exe Helfbqeb.exe File opened for modification C:\Windows\SysWOW64\Kppphe32.exe Kekljlkp.exe File created C:\Windows\SysWOW64\Ckeigc32.exe Cfipol32.exe File opened for modification C:\Windows\SysWOW64\Amhlpb32.exe Alfpijll.exe File created C:\Windows\SysWOW64\Pafmke32.dll Peajngoi.exe File opened for modification C:\Windows\SysWOW64\Hbkgfode.exe Hgcfcg32.exe File created C:\Windows\SysWOW64\Alnmdojp.exe Aebhaede.exe File created C:\Windows\SysWOW64\Liddligi.exe Lpjcnd32.exe File created C:\Windows\SysWOW64\Loeoei32.exe Locbpi32.exe File opened for modification C:\Windows\SysWOW64\Ccbanfko.exe Cmhial32.exe File opened for modification C:\Windows\SysWOW64\Pacojc32.exe Odooqo32.exe File created C:\Windows\SysWOW64\Ahggbded.dll Coohbbeb.exe File created C:\Windows\SysWOW64\Deenhilj.dll Bdlncn32.exe File opened for modification C:\Windows\SysWOW64\Pbiklmhp.exe Oajoaj32.exe File created C:\Windows\SysWOW64\Jbifbcdo.dll Kekljlkp.exe File created C:\Windows\SysWOW64\Mnfnfl32.exe Mndapl32.exe File created C:\Windows\SysWOW64\Oelnpk32.dll Qjmllgjd.exe File created C:\Windows\SysWOW64\Hbiakf32.exe Gmlhbo32.exe File opened for modification C:\Windows\SysWOW64\Bfedhihl.exe Bpkllo32.exe File created C:\Windows\SysWOW64\Bhnako32.dll Kkqepi32.exe File created C:\Windows\SysWOW64\Cfhani32.exe Bfedhihl.exe File created C:\Windows\SysWOW64\Mhmmchpd.exe Lnmbjd32.exe File created C:\Windows\SysWOW64\Ldjbbc32.dll Nejpckgc.exe File created C:\Windows\SysWOW64\Fbomfokl.exe Fmbdnhme.exe File created C:\Windows\SysWOW64\Ghbccc32.dll Alpboida.exe File created C:\Windows\SysWOW64\Igkbkg32.dll Bhkmoifp.exe File created C:\Windows\SysWOW64\Hhigoqni.dll Pjnipc32.exe File created C:\Windows\SysWOW64\Ckfkioeh.dll Eainnn32.exe File created C:\Windows\SysWOW64\Jqgldb32.exe Jkjclk32.exe File created C:\Windows\SysWOW64\Cakghn32.exe Ckaolcol.exe File created C:\Windows\SysWOW64\Amibklml.exe Qjfmda32.exe File created C:\Windows\SysWOW64\Jdimjo32.dll Jcmdkbok.exe File created C:\Windows\SysWOW64\Macjbdpf.dll Pbiklmhp.exe File created C:\Windows\SysWOW64\Adbaffid.dll Fkflbb32.exe File created C:\Windows\SysWOW64\Kdeejq32.dll Gpmgph32.exe File opened for modification C:\Windows\SysWOW64\Mnfnfl32.exe Mndapl32.exe File created C:\Windows\SysWOW64\Iblacf32.dll Dkmogbeo.exe File opened for modification C:\Windows\SysWOW64\Efkfkilj.exe Doanno32.exe File created C:\Windows\SysWOW64\Imieblgl.exe Igomeb32.exe File created C:\Windows\SysWOW64\Nkleem32.dll Bbifobho.exe File created C:\Windows\SysWOW64\Fohobmke.exe Foebmn32.exe File created C:\Windows\SysWOW64\Bbhkgb32.dll Dldlbgbb.exe File created C:\Windows\SysWOW64\Cjcjlgma.dll Dhnnoe32.exe File created C:\Windows\SysWOW64\Eehnnb32.exe Ekbiaigk.exe File opened for modification C:\Windows\SysWOW64\Bnfiapfj.exe Bdkgckal.exe File opened for modification C:\Windows\SysWOW64\Cgndikgd.exe Cmipkb32.exe File opened for modification C:\Windows\SysWOW64\Lnmbjd32.exe Knfliefc.exe File created C:\Windows\SysWOW64\Bllbkg32.exe Bafnmnjn.exe File opened for modification C:\Windows\SysWOW64\Fkmbbajb.exe Fmgecn32.exe File created C:\Windows\SysWOW64\Mhdbdgjl.exe Magnbnea.exe File created C:\Windows\SysWOW64\Gfkbnk32.exe Gmbmefob.exe File created C:\Windows\SysWOW64\Nnmfdpni.exe Nocphd32.exe File created C:\Windows\SysWOW64\Eojplbhc.dll Fbnhjn32.exe File created C:\Windows\SysWOW64\Hhihnihm.exe Hoogpcco.exe File opened for modification C:\Windows\SysWOW64\Ngedbp32.exe Lngmhm32.exe File created C:\Windows\SysWOW64\Mlaahojd.dll Meadgc32.exe File opened for modification C:\Windows\SysWOW64\Jhgneqha.exe Jqpfccgo.exe File created C:\Windows\SysWOW64\Kglmbd32.exe Kqbdej32.exe File created C:\Windows\SysWOW64\Gpdjlm32.dll Ocbhjjqn.exe File created C:\Windows\SysWOW64\Cicipa32.dll Cddemi32.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Aklddmep.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Nhjbjp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 f29e097c29504700c8e5c0a089eb0a5cd10c617179b533bf2ec6d5759f816093.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ecgidn32.dll" Bodano32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ggilng32.dll" Hhihnihm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kkjqkhld.dll" Jgmapcqe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iabpjldm.dll" Locbpi32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Bcdlgnkk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Beaekmic.dll" Pehnaqid.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Cnodmijd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Jjoibadl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjgknf32.dll" Bnfiapfj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eojplbhc.dll" Fbnhjn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Dampal32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Iciflfcd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Klgqmfpj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Oqdgan32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Jhndepbi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Deenhilj.dll" Bdlncn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dooglp32.dll" Ddmhcg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Madjbg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ckeigc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Pppoeg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Mdibplaf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Jhgneqha.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Jljiimeb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Phhpic32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Iemdep32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Eehime32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ackkcmja.dll" Bcmqin32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cnelhffc.dll" Phmjdbpo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Emhlefoa.dll" Npedfjfo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Qhinmb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Flinddpj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Cofnba32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ilnbch32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Koodka32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cglahcbj.dll" Gaglma32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Obdkfg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Iiaein32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fcdamkaj.dll" Ofgmdf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Nbljaf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Magnbnea.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Knpeii32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Lnjgpgkf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Bodano32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Agcikk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Cdoegcfl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Fkflbb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Aafefq32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Doanno32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Hkpqdifa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Jljiimeb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mfhhqdjl.dll" Ichkpb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Midfiq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gdecijld.dll" Mgclja32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ilnbch32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmdhdbhl.dll" Omhpcm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Gefencoj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ahhbfkbf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Lpjcnd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Pncggqbg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Eehnnb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ckidoc32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2388 wrote to memory of 2784 2388 f29e097c29504700c8e5c0a089eb0a5cd10c617179b533bf2ec6d5759f816093.exe 97 PID 2388 wrote to memory of 2784 2388 f29e097c29504700c8e5c0a089eb0a5cd10c617179b533bf2ec6d5759f816093.exe 97 PID 2388 wrote to memory of 2784 2388 f29e097c29504700c8e5c0a089eb0a5cd10c617179b533bf2ec6d5759f816093.exe 97 PID 2784 wrote to memory of 4980 2784 Bdlncn32.exe 99 PID 2784 wrote to memory of 4980 2784 Bdlncn32.exe 99 PID 2784 wrote to memory of 4980 2784 Bdlncn32.exe 99 PID 4980 wrote to memory of 2456 4980 Eblgon32.exe 100 PID 4980 wrote to memory of 2456 4980 Eblgon32.exe 100 PID 4980 wrote to memory of 2456 4980 Eblgon32.exe 100 PID 2456 wrote to memory of 3064 2456 Fiaogfai.exe 101 PID 2456 wrote to memory of 3064 2456 Fiaogfai.exe 101 PID 2456 wrote to memory of 3064 2456 Fiaogfai.exe 101 PID 3064 wrote to memory of 388 3064 Foenplji.exe 105 PID 3064 wrote to memory of 388 3064 Foenplji.exe 105 PID 3064 wrote to memory of 388 3064 Foenplji.exe 105 PID 388 wrote to memory of 4964 388 Gklnem32.exe 106 PID 388 wrote to memory of 4964 388 Gklnem32.exe 106 PID 388 wrote to memory of 4964 388 Gklnem32.exe 106 PID 4964 wrote to memory of 5084 4964 Eenflbll.exe 107 PID 4964 wrote to memory of 5084 4964 Eenflbll.exe 107 PID 4964 wrote to memory of 5084 4964 Eenflbll.exe 107 PID 5084 wrote to memory of 3432 5084 Fnmqegle.exe 108 PID 5084 wrote to memory of 3432 5084 Fnmqegle.exe 108 PID 5084 wrote to memory of 3432 5084 Fnmqegle.exe 108 PID 3432 wrote to memory of 4428 3432 Gaglma32.exe 110 PID 3432 wrote to memory of 4428 3432 Gaglma32.exe 110 PID 3432 wrote to memory of 4428 3432 Gaglma32.exe 110 PID 4428 wrote to memory of 1732 4428 Hmecba32.exe 111 PID 4428 wrote to memory of 1732 4428 Hmecba32.exe 111 PID 4428 wrote to memory of 1732 4428 Hmecba32.exe 111 PID 1732 wrote to memory of 2684 1732 Hahedoci.exe 112 PID 1732 wrote to memory of 2684 1732 Hahedoci.exe 112 PID 1732 wrote to memory of 2684 1732 Hahedoci.exe 112 PID 2684 wrote to memory of 4108 2684 Idpdfija.exe 113 PID 2684 wrote to memory of 4108 2684 Idpdfija.exe 113 PID 2684 wrote to memory of 4108 2684 Idpdfija.exe 113 PID 4108 wrote to memory of 4180 4108 Jkcpia32.exe 114 PID 4108 wrote to memory of 4180 4108 Jkcpia32.exe 114 PID 4108 wrote to memory of 4180 4108 Jkcpia32.exe 114 PID 4180 wrote to memory of 808 4180 Knfepldb.exe 115 PID 4180 wrote to memory of 808 4180 Knfepldb.exe 115 PID 4180 wrote to memory of 808 4180 Knfepldb.exe 115 PID 808 wrote to memory of 324 808 Klnkoc32.exe 116 PID 808 wrote to memory of 324 808 Klnkoc32.exe 116 PID 808 wrote to memory of 324 808 Klnkoc32.exe 116 PID 324 wrote to memory of 3872 324 Lofjam32.exe 117 PID 324 wrote to memory of 3872 324 Lofjam32.exe 117 PID 324 wrote to memory of 3872 324 Lofjam32.exe 117 PID 3872 wrote to memory of 3640 3872 Moajmk32.exe 118 PID 3872 wrote to memory of 3640 3872 Moajmk32.exe 118 PID 3872 wrote to memory of 3640 3872 Moajmk32.exe 118 PID 3640 wrote to memory of 4936 3640 Nifnao32.exe 119 PID 3640 wrote to memory of 4936 3640 Nifnao32.exe 119 PID 3640 wrote to memory of 4936 3640 Nifnao32.exe 119 PID 4936 wrote to memory of 2228 4936 Omhpcm32.exe 120 PID 4936 wrote to memory of 2228 4936 Omhpcm32.exe 120 PID 4936 wrote to memory of 2228 4936 Omhpcm32.exe 120 PID 2228 wrote to memory of 1000 2228 Oianmm32.exe 121 PID 2228 wrote to memory of 1000 2228 Oianmm32.exe 121 PID 2228 wrote to memory of 1000 2228 Oianmm32.exe 121 PID 1000 wrote to memory of 1232 1000 Pppoeg32.exe 122 PID 1000 wrote to memory of 1232 1000 Pppoeg32.exe 122 PID 1000 wrote to memory of 1232 1000 Pppoeg32.exe 122 PID 1232 wrote to memory of 3136 1232 Peaahmcd.exe 123
Processes
-
C:\Users\Admin\AppData\Local\Temp\f29e097c29504700c8e5c0a089eb0a5cd10c617179b533bf2ec6d5759f816093.exe"C:\Users\Admin\AppData\Local\Temp\f29e097c29504700c8e5c0a089eb0a5cd10c617179b533bf2ec6d5759f816093.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Windows\SysWOW64\Bdlncn32.exeC:\Windows\system32\Bdlncn32.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\SysWOW64\Eblgon32.exeC:\Windows\system32\Eblgon32.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Windows\SysWOW64\Fiaogfai.exeC:\Windows\system32\Fiaogfai.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Windows\SysWOW64\Foenplji.exeC:\Windows\system32\Foenplji.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Windows\SysWOW64\Gklnem32.exeC:\Windows\system32\Gklnem32.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:388 -
C:\Windows\SysWOW64\Eenflbll.exeC:\Windows\system32\Eenflbll.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Windows\SysWOW64\Fnmqegle.exeC:\Windows\system32\Fnmqegle.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Windows\SysWOW64\Gaglma32.exeC:\Windows\system32\Gaglma32.exe9⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Windows\SysWOW64\Hmecba32.exeC:\Windows\system32\Hmecba32.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Windows\SysWOW64\Hahedoci.exeC:\Windows\system32\Hahedoci.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Windows\SysWOW64\Idpdfija.exeC:\Windows\system32\Idpdfija.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Windows\SysWOW64\Jkcpia32.exeC:\Windows\system32\Jkcpia32.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Windows\SysWOW64\Knfepldb.exeC:\Windows\system32\Knfepldb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Windows\SysWOW64\Klnkoc32.exeC:\Windows\system32\Klnkoc32.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Windows\SysWOW64\Lofjam32.exeC:\Windows\system32\Lofjam32.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:324 -
C:\Windows\SysWOW64\Moajmk32.exeC:\Windows\system32\Moajmk32.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Windows\SysWOW64\Nifnao32.exeC:\Windows\system32\Nifnao32.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Windows\SysWOW64\Omhpcm32.exeC:\Windows\system32\Omhpcm32.exe19⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Windows\SysWOW64\Oianmm32.exeC:\Windows\system32\Oianmm32.exe20⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Windows\SysWOW64\Pppoeg32.exeC:\Windows\system32\Pppoeg32.exe21⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Windows\SysWOW64\Peaahmcd.exeC:\Windows\system32\Peaahmcd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Windows\SysWOW64\Apqhldjp.exeC:\Windows\system32\Apqhldjp.exe23⤵
- Executes dropped EXE
PID:3136 -
C:\Windows\SysWOW64\Agmmnnpj.exeC:\Windows\system32\Agmmnnpj.exe24⤵
- Executes dropped EXE
PID:3956 -
C:\Windows\SysWOW64\Amibqhed.exeC:\Windows\system32\Amibqhed.exe25⤵
- Executes dropped EXE
PID:3036 -
C:\Windows\SysWOW64\Bcmqin32.exeC:\Windows\system32\Bcmqin32.exe26⤵
- Executes dropped EXE
- Modifies registry class
PID:3164 -
C:\Windows\SysWOW64\Bodano32.exeC:\Windows\system32\Bodano32.exe27⤵
- Executes dropped EXE
- Modifies registry class
PID:3140 -
C:\Windows\SysWOW64\Cgpcklpd.exeC:\Windows\system32\Cgpcklpd.exe28⤵
- Executes dropped EXE
PID:2256 -
C:\Windows\SysWOW64\Cokgonmp.exeC:\Windows\system32\Cokgonmp.exe29⤵
- Executes dropped EXE
PID:3444 -
C:\Windows\SysWOW64\Cpjdiadb.exeC:\Windows\system32\Cpjdiadb.exe30⤵
- Executes dropped EXE
PID:1160 -
C:\Windows\SysWOW64\Cjbhbf32.exeC:\Windows\system32\Cjbhbf32.exe31⤵
- Executes dropped EXE
PID:3964 -
C:\Windows\SysWOW64\Cfiiggpg.exeC:\Windows\system32\Cfiiggpg.exe32⤵
- Executes dropped EXE
PID:4628 -
C:\Windows\SysWOW64\Djgbmffn.exeC:\Windows\system32\Djgbmffn.exe33⤵
- Executes dropped EXE
PID:1692 -
C:\Windows\SysWOW64\Egiohh32.exeC:\Windows\system32\Egiohh32.exe34⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:984 -
C:\Windows\SysWOW64\Gpnoigpe.exeC:\Windows\system32\Gpnoigpe.exe35⤵
- Executes dropped EXE
PID:1572 -
C:\Windows\SysWOW64\Habeni32.exeC:\Windows\system32\Habeni32.exe36⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:4152 -
C:\Windows\SysWOW64\Jhdlbp32.exeC:\Windows\system32\Jhdlbp32.exe37⤵
- Executes dropped EXE
PID:2424 -
C:\Windows\SysWOW64\Kpfggang.exeC:\Windows\system32\Kpfggang.exe38⤵
- Executes dropped EXE
PID:3040 -
C:\Windows\SysWOW64\Kafcadej.exeC:\Windows\system32\Kafcadej.exe39⤵
- Executes dropped EXE
PID:2608 -
C:\Windows\SysWOW64\Kkqepi32.exeC:\Windows\system32\Kkqepi32.exe40⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2656 -
C:\Windows\SysWOW64\Mhpeelnd.exeC:\Windows\system32\Mhpeelnd.exe41⤵
- Executes dropped EXE
PID:2184 -
C:\Windows\SysWOW64\Mdibplaf.exeC:\Windows\system32\Mdibplaf.exe42⤵
- Executes dropped EXE
- Modifies registry class
PID:4604 -
C:\Windows\SysWOW64\Mbmbiqqp.exeC:\Windows\system32\Mbmbiqqp.exe43⤵
- Executes dropped EXE
PID:1944 -
C:\Windows\SysWOW64\Nocphd32.exeC:\Windows\system32\Nocphd32.exe44⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4948 -
C:\Windows\SysWOW64\Nnmfdpni.exeC:\Windows\system32\Nnmfdpni.exe45⤵
- Executes dropped EXE
PID:1968 -
C:\Windows\SysWOW64\Oelhljaq.exeC:\Windows\system32\Oelhljaq.exe46⤵
- Executes dropped EXE
PID:4696 -
C:\Windows\SysWOW64\Obphenpj.exeC:\Windows\system32\Obphenpj.exe47⤵
- Executes dropped EXE
PID:4824 -
C:\Windows\SysWOW64\Oaeegjeb.exeC:\Windows\system32\Oaeegjeb.exe48⤵
- Executes dropped EXE
PID:2872 -
C:\Windows\SysWOW64\Oecnmi32.exeC:\Windows\system32\Oecnmi32.exe49⤵
- Executes dropped EXE
PID:4396 -
C:\Windows\SysWOW64\Oajoaj32.exeC:\Windows\system32\Oajoaj32.exe50⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4952 -
C:\Windows\SysWOW64\Pbiklmhp.exeC:\Windows\system32\Pbiklmhp.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5136 -
C:\Windows\SysWOW64\Phhpic32.exeC:\Windows\system32\Phhpic32.exe52⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:5176 -
C:\Windows\SysWOW64\Pbndgl32.exeC:\Windows\system32\Pbndgl32.exe53⤵
- Executes dropped EXE
PID:5228 -
C:\Windows\SysWOW64\Phmjdbpo.exeC:\Windows\system32\Phmjdbpo.exe54⤵
- Executes dropped EXE
- Modifies registry class
PID:5268 -
C:\Windows\SysWOW64\Peajngoi.exeC:\Windows\system32\Peajngoi.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5308 -
C:\Windows\SysWOW64\Aemjjeek.exeC:\Windows\system32\Aemjjeek.exe56⤵
- Executes dropped EXE
PID:5352 -
C:\Windows\SysWOW64\Abqjci32.exeC:\Windows\system32\Abqjci32.exe57⤵
- Executes dropped EXE
PID:5408 -
C:\Windows\SysWOW64\Cpgqik32.exeC:\Windows\system32\Cpgqik32.exe58⤵
- Executes dropped EXE
PID:5484 -
C:\Windows\SysWOW64\Djnaco32.exeC:\Windows\system32\Djnaco32.exe59⤵
- Executes dropped EXE
PID:5524 -
C:\Windows\SysWOW64\Eokjke32.exeC:\Windows\system32\Eokjke32.exe60⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:5568 -
C:\Windows\SysWOW64\Epjfehbd.exeC:\Windows\system32\Epjfehbd.exe61⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:5612 -
C:\Windows\SysWOW64\Fbnhjn32.exeC:\Windows\system32\Fbnhjn32.exe62⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:5696 -
C:\Windows\SysWOW64\Hclaeocp.exeC:\Windows\system32\Hclaeocp.exe63⤵
- Executes dropped EXE
PID:5768 -
C:\Windows\SysWOW64\Ibhdgjap.exeC:\Windows\system32\Ibhdgjap.exe64⤵
- Executes dropped EXE
PID:5820 -
C:\Windows\SysWOW64\Kbapdfkb.exeC:\Windows\system32\Kbapdfkb.exe65⤵
- Executes dropped EXE
PID:5876 -
C:\Windows\SysWOW64\Kgphje32.exeC:\Windows\system32\Kgphje32.exe66⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5944 -
C:\Windows\SysWOW64\Lkgdfb32.exeC:\Windows\system32\Lkgdfb32.exe67⤵PID:5996
-
C:\Windows\SysWOW64\Lngmhm32.exeC:\Windows\system32\Lngmhm32.exe68⤵
- Drops file in System32 directory
PID:6052 -
C:\Windows\SysWOW64\Ngedbp32.exeC:\Windows\system32\Ngedbp32.exe69⤵PID:6096
-
C:\Windows\SysWOW64\Nnolojhk.exeC:\Windows\system32\Nnolojhk.exe70⤵PID:5124
-
C:\Windows\SysWOW64\Ocnampdp.exeC:\Windows\system32\Ocnampdp.exe71⤵PID:5168
-
C:\Windows\SysWOW64\Onceji32.exeC:\Windows\system32\Onceji32.exe72⤵PID:5264
-
C:\Windows\SysWOW64\Ocqncp32.exeC:\Windows\system32\Ocqncp32.exe73⤵PID:4836
-
C:\Windows\SysWOW64\Ojjfpjjj.exeC:\Windows\system32\Ojjfpjjj.exe74⤵PID:5336
-
C:\Windows\SysWOW64\Ognginic.exeC:\Windows\system32\Ognginic.exe75⤵PID:5360
-
C:\Windows\SysWOW64\Obdkfg32.exeC:\Windows\system32\Obdkfg32.exe76⤵
- Modifies registry class
PID:4632 -
C:\Windows\SysWOW64\Panabc32.exeC:\Windows\system32\Panabc32.exe77⤵PID:5468
-
C:\Windows\SysWOW64\Pjffkhpl.exeC:\Windows\system32\Pjffkhpl.exe78⤵PID:5516
-
C:\Windows\SysWOW64\Peljha32.exeC:\Windows\system32\Peljha32.exe79⤵PID:5604
-
C:\Windows\SysWOW64\Pkebekgo.exeC:\Windows\system32\Pkebekgo.exe80⤵PID:4520
-
C:\Windows\SysWOW64\Pabknbef.exeC:\Windows\system32\Pabknbef.exe81⤵PID:5660
-
C:\Windows\SysWOW64\Pkhokkel.exeC:\Windows\system32\Pkhokkel.exe82⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4980 -
C:\Windows\SysWOW64\Qaegcb32.exeC:\Windows\system32\Qaegcb32.exe83⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5704 -
C:\Windows\SysWOW64\Qjmllgjd.exeC:\Windows\system32\Qjmllgjd.exe84⤵
- Drops file in System32 directory
PID:5808 -
C:\Windows\SysWOW64\Agcikk32.exeC:\Windows\system32\Agcikk32.exe85⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:5840 -
C:\Windows\SysWOW64\Abimhd32.exeC:\Windows\system32\Abimhd32.exe86⤵PID:5888
-
C:\Windows\SysWOW64\Ahffqk32.exeC:\Windows\system32\Ahffqk32.exe87⤵PID:5936
-
C:\Windows\SysWOW64\Aanjiqki.exeC:\Windows\system32\Aanjiqki.exe88⤵PID:6020
-
C:\Windows\SysWOW64\Ahhbfkbf.exeC:\Windows\system32\Ahhbfkbf.exe89⤵
- Modifies registry class
PID:6104 -
C:\Windows\SysWOW64\Abngccbl.exeC:\Windows\system32\Abngccbl.exe90⤵PID:5164
-
C:\Windows\SysWOW64\Ahjoljqc.exeC:\Windows\system32\Ahjoljqc.exe91⤵PID:5236
-
C:\Windows\SysWOW64\Aaccdp32.exeC:\Windows\system32\Aaccdp32.exe92⤵PID:5348
-
C:\Windows\SysWOW64\Blhhaigj.exeC:\Windows\system32\Blhhaigj.exe93⤵PID:3744
-
C:\Windows\SysWOW64\Bbifobho.exeC:\Windows\system32\Bbifobho.exe94⤵
- Drops file in System32 directory
PID:5436 -
C:\Windows\SysWOW64\Blakhgoo.exeC:\Windows\system32\Blakhgoo.exe95⤵PID:5600
-
C:\Windows\SysWOW64\Ckidoc32.exeC:\Windows\system32\Ckidoc32.exe96⤵
- Modifies registry class
PID:3244 -
C:\Windows\SysWOW64\Ceoillaj.exeC:\Windows\system32\Ceoillaj.exe97⤵PID:5812
-
C:\Windows\SysWOW64\Ckladcoa.exeC:\Windows\system32\Ckladcoa.exe98⤵PID:5884
-
C:\Windows\SysWOW64\Cddemi32.exeC:\Windows\system32\Cddemi32.exe99⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:6060 -
C:\Windows\SysWOW64\Cbefkp32.exeC:\Windows\system32\Cbefkp32.exe100⤵PID:828
-
C:\Windows\SysWOW64\Dampal32.exeC:\Windows\system32\Dampal32.exe101⤵
- Modifies registry class
PID:4332 -
C:\Windows\SysWOW64\Ddmhcg32.exeC:\Windows\system32\Ddmhcg32.exe102⤵
- Modifies registry class
PID:5392 -
C:\Windows\SysWOW64\Docmqp32.exeC:\Windows\system32\Docmqp32.exe103⤵PID:5480
-
C:\Windows\SysWOW64\Dlgmjdlg.exeC:\Windows\system32\Dlgmjdlg.exe104⤵PID:2128
-
C:\Windows\SysWOW64\Dhnnoe32.exeC:\Windows\system32\Dhnnoe32.exe105⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:5924 -
C:\Windows\SysWOW64\Eddodfhp.exeC:\Windows\system32\Eddodfhp.exe106⤵PID:5988
-
C:\Windows\SysWOW64\Ekngqqol.exeC:\Windows\system32\Ekngqqol.exe107⤵PID:5320
-
C:\Windows\SysWOW64\Eehdii32.exeC:\Windows\system32\Eehdii32.exe108⤵PID:5680
-
C:\Windows\SysWOW64\Eaabci32.exeC:\Windows\system32\Eaabci32.exe109⤵PID:5976
-
C:\Windows\SysWOW64\Foebmn32.exeC:\Windows\system32\Foebmn32.exe110⤵
- Drops file in System32 directory
PID:6040 -
C:\Windows\SysWOW64\Fohobmke.exeC:\Windows\system32\Fohobmke.exe111⤵PID:1104
-
C:\Windows\SysWOW64\Fhpckb32.exeC:\Windows\system32\Fhpckb32.exe112⤵PID:5940
-
C:\Windows\SysWOW64\Fbihdhhf.exeC:\Windows\system32\Fbihdhhf.exe113⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3064 -
C:\Windows\SysWOW64\Fkcibnmd.exeC:\Windows\system32\Fkcibnmd.exe114⤵PID:6196
-
C:\Windows\SysWOW64\Gohhik32.exeC:\Windows\system32\Gohhik32.exe115⤵PID:6244
-
C:\Windows\SysWOW64\Gmlhbo32.exeC:\Windows\system32\Gmlhbo32.exe116⤵
- Drops file in System32 directory
PID:6300 -
C:\Windows\SysWOW64\Hbiakf32.exeC:\Windows\system32\Hbiakf32.exe117⤵PID:6348
-
C:\Windows\SysWOW64\Homadjin.exeC:\Windows\system32\Homadjin.exe118⤵PID:6396
-
C:\Windows\SysWOW64\Hejjmage.exeC:\Windows\system32\Hejjmage.exe119⤵PID:6456
-
C:\Windows\SysWOW64\Helfbqeb.exeC:\Windows\system32\Helfbqeb.exe120⤵
- Drops file in System32 directory
PID:6492 -
C:\Windows\SysWOW64\Heapmp32.exeC:\Windows\system32\Heapmp32.exe121⤵PID:6552
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-