Analysis
-
max time kernel
161s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
10/04/2024, 05:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
218bc6d0d52d86454a45447d98ebba2c.exe
Resource
win7-20240221-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
218bc6d0d52d86454a45447d98ebba2c.exe
Resource
win10v2004-20240226-en
6 signatures
150 seconds
General
-
Target
218bc6d0d52d86454a45447d98ebba2c.exe
-
Size
208KB
-
MD5
218bc6d0d52d86454a45447d98ebba2c
-
SHA1
8bb2c134299b96da7f88c89eed0b2c2f71a3a644
-
SHA256
4ab047b933a3b1e78bbe5d5fd9eebfeecd1d0a1eab1110fcc1f54398b082ce33
-
SHA512
6f78cb100fa68d07273048d8cee65068202f0cf735ffe367075bd9d852f002caa1cafc57f9f631e704706401891db79f6ff05b8efbcc86ddaf663b4be9c2f153
-
SSDEEP
6144:jN0drKPXuapoaCPXbo92ynnZlVrtv35CPX:jm4uqFHo
Score
10/10
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ababkdij.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hhbnqi32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dcdpakii.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kgpodk32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lechfeoi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lhijcohe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cknlln32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ioppho32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dnondf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Aancojgn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ajdjcc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bllbkg32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dfglpjqo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Enkmpe32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ebiffc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Heochp32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bfqkmj32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pafcjijo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fbmoabde.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jcgbmd32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jfnbnk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ejklfd32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gjebiq32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pgfljqia.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ffobbmpp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cbknhqbl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ngemjg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lkjhfh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mbmbiqqp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cakjfcfe.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gcdkdpih.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Efamkepl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ompfnoci.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hdbmfhbi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gmkibl32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Giacmggo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Doojni32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bibpkiie.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ceqngekl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kgacaopj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kcpjgo32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Edbhgokc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fkfcjh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kiaqnagj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ecjhmm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mdjapphl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Olqofjhn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Igedenca.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Oagpne32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Llhnpe32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iffmmihf.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bckddn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nnjljd32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ngmpmd32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bfpdcc32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ffmelmbc.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Chfaenfb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mginniij.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dcglfjgf.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ndphpk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kngcdkjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jkgpleaf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cdpjeh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bbefln32.exe -
Executes dropped EXE 64 IoCs
pid Process 3140 Lbebilli.exe 4812 Mklfjm32.exe 2432 Ncjdki32.exe 3576 Nlgbon32.exe 4668 Omcbkl32.exe 3836 Pbbgicnd.exe 1976 Apddce32.exe 3620 Aiabhj32.exe 4168 Bmddihfj.exe 968 Bbefln32.exe 1064 Cleqfb32.exe 1512 Dedkogqm.exe 4872 Dibdeegc.exe 2320 Edakimoo.exe 2384 Fdogjk32.exe 4568 Fcddkggf.exe 4748 Gddqejni.exe 1404 Gloejmld.exe 2756 Gfgjbb32.exe 4412 Gjebiq32.exe 3320 Hdbmfhbi.exe 3812 Ifmldo32.exe 640 Jfoaam32.exe 1572 Knbinhfl.exe 1180 Lmgfod32.exe 2804 Mginniij.exe 3260 Moeoje32.exe 3668 Ngemjg32.exe 2072 Nehjmnei.exe 1632 Okeklcen.exe 2192 Pkjegb32.exe 60 Pklamb32.exe 2940 Abpmpkoh.exe 1748 Afnefieo.exe 4436 Afpbkicl.exe 1016 Aohfdnil.exe 1688 Bnppkj32.exe 3992 Becknc32.exe 2424 Chfaenfb.exe 3196 Cejaobel.exe 3988 Clffalkf.exe 2088 Dlicflic.exe 4592 Dhpdkm32.exe 2104 Dlnlak32.exe 5040 Donecfao.exe 1900 Eldbbjof.exe 4784 Eemgkpef.exe 1076 Ebagdddp.exe 3652 Ehbihj32.exe 2660 Fgcjea32.exe 2932 Fekclnif.exe 3504 Fofdkcmd.exe 4876 Ggafgo32.exe 1504 Ghgljg32.exe 1128 Gjghdj32.exe 1888 Hhleefhe.exe 3976 Hjlaoioh.exe 1164 Ioppho32.exe 2168 Ijngkf32.exe 1760 Kiaqnagj.exe 4212 Ladhkmno.exe 1368 Lipmoo32.exe 4960 Mpchbhjl.exe 2724 Mfomda32.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Jbkeki32.dll Lbebilli.exe File opened for modification C:\Windows\SysWOW64\Ophbja32.exe Obdbqm32.exe File created C:\Windows\SysWOW64\Mmjdpi32.dll Aaoadg32.exe File opened for modification C:\Windows\SysWOW64\Jncobabm.exe Jdhndlno.exe File created C:\Windows\SysWOW64\Peajngoi.exe Picchg32.exe File created C:\Windows\SysWOW64\Bidefbcg.exe Alioloje.exe File opened for modification C:\Windows\SysWOW64\Bblcda32.exe Blakhgoo.exe File created C:\Windows\SysWOW64\Loeoei32.exe Lhkghofb.exe File created C:\Windows\SysWOW64\Oemofpel.exe Nppfnige.exe File opened for modification C:\Windows\SysWOW64\Picchg32.exe Ophbja32.exe File created C:\Windows\SysWOW64\Mncmck32.exe Mcnhfb32.exe File created C:\Windows\SysWOW64\Imjddmpl.exe Iecmcpoj.exe File opened for modification C:\Windows\SysWOW64\Ddifaqcn.exe Dnondf32.exe File opened for modification C:\Windows\SysWOW64\Okbhlm32.exe Omjnhiiq.exe File created C:\Windows\SysWOW64\Dbghhd32.dll Cfiiggpg.exe File created C:\Windows\SysWOW64\Lffhpnhe.exe Lplpcc32.exe File created C:\Windows\SysWOW64\Eikcmf32.dll Pgfljqia.exe File created C:\Windows\SysWOW64\Nggnjjoo.exe Nqmfnp32.exe File opened for modification C:\Windows\SysWOW64\Fbbhla32.exe Fgldoi32.exe File opened for modification C:\Windows\SysWOW64\Kiaqnagj.exe Ijngkf32.exe File created C:\Windows\SysWOW64\Njmejp32.exe Mphamg32.exe File opened for modification C:\Windows\SysWOW64\Agnkck32.exe Ababkdij.exe File created C:\Windows\SysWOW64\Peiqme32.dll Nabfcegi.exe File opened for modification C:\Windows\SysWOW64\Lfbpcgbl.exe Lofjam32.exe File created C:\Windows\SysWOW64\Nppfnige.exe Nejbaqgo.exe File created C:\Windows\SysWOW64\Fihqfh32.exe Fbnhjn32.exe File opened for modification C:\Windows\SysWOW64\Epndddnk.exe Ebjckppa.exe File created C:\Windows\SysWOW64\Mnhdae32.exe Mogccnfg.exe File opened for modification C:\Windows\SysWOW64\Peajngoi.exe Picchg32.exe File created C:\Windows\SysWOW64\Lehaad32.exe Lnnidjcg.exe File opened for modification C:\Windows\SysWOW64\Dhpdkm32.exe Dlicflic.exe File created C:\Windows\SysWOW64\Jhodeflk.dll Fofdkcmd.exe File created C:\Windows\SysWOW64\Aqhhdgfp.dll Claenb32.exe File created C:\Windows\SysWOW64\Kpfggang.exe Kgkfil32.exe File opened for modification C:\Windows\SysWOW64\Cojqdhid.exe Cikkga32.exe File opened for modification C:\Windows\SysWOW64\Cpljdjnd.exe Cakjfcfe.exe File created C:\Windows\SysWOW64\Ampkil32.exe Afeblb32.exe File opened for modification C:\Windows\SysWOW64\Gfomfo32.exe Gdppllld.exe File created C:\Windows\SysWOW64\Flgaodbm.exe Epndddnk.exe File opened for modification C:\Windows\SysWOW64\Ifgbhbbh.exe Ilbnkiba.exe File opened for modification C:\Windows\SysWOW64\Plbmhadm.exe Pehekgmp.exe File created C:\Windows\SysWOW64\Dnondf32.exe Dgeegled.exe File created C:\Windows\SysWOW64\Hiffij32.dll Knbinhfl.exe File created C:\Windows\SysWOW64\Jmqekg32.exe Jaekkfcm.exe File opened for modification C:\Windows\SysWOW64\Mgbnfb32.exe Maefnk32.exe File opened for modification C:\Windows\SysWOW64\Fjmkhkff.exe Fllkjd32.exe File opened for modification C:\Windows\SysWOW64\Bhgcdjje.exe Akccje32.exe File opened for modification C:\Windows\SysWOW64\Bkibqnah.exe Bdojdd32.exe File created C:\Windows\SysWOW64\Ompfnoci.exe Offnae32.exe File created C:\Windows\SysWOW64\Kcgleaad.dll Foocegea.exe File created C:\Windows\SysWOW64\Mnfooh32.dll 218bc6d0d52d86454a45447d98ebba2c.exe File created C:\Windows\SysWOW64\Igehifaa.dll Npjnbg32.exe File created C:\Windows\SysWOW64\Ababkdij.exe Adnbapjp.exe File created C:\Windows\SysWOW64\Agnkck32.exe Ababkdij.exe File created C:\Windows\SysWOW64\Cpljdjnd.exe Cakjfcfe.exe File created C:\Windows\SysWOW64\Aomfme32.dll Lffhpnhe.exe File opened for modification C:\Windows\SysWOW64\Hfnpacjb.exe Heochp32.exe File created C:\Windows\SysWOW64\Kncpqlhj.dll Nehjmnei.exe File created C:\Windows\SysWOW64\Npjnbg32.exe Njmejp32.exe File created C:\Windows\SysWOW64\Ldnjndpo.exe Kkjejqcl.exe File created C:\Windows\SysWOW64\Anlqcl32.dll Lfbpcgbl.exe File opened for modification C:\Windows\SysWOW64\Hfemkdbm.exe Gkoinlbg.exe File created C:\Windows\SysWOW64\Cijdnf32.dll Hbnjfefo.exe File created C:\Windows\SysWOW64\Jececi32.dll Ocpghj32.exe -
Program crash 2 IoCs
pid pid_target Process procid_target 5580 8024 WerFault.exe 668 4196 8024 WerFault.exe 668 -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Epndddnk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Qgehml32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ncdckahg.dll" Nejbaqgo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hnpognhd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bfpdcc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Abpmpkoh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ababkdij.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ckjegk32.dll" Ipaeedpp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cdiohhbm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bqpbboeg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mcklac32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lgkhec32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Oaajoj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ajbmmcii.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ofdgji32.dll" Igkkdigp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bllbkg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Adnbapjp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ngpcmj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iddkqo32.dll" Efhcld32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cifdhj32.dll" Ggfombmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Deqqek32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hfgjad32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Edqdij32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Egomanpl.dll" Cldgmgml.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Opdomjnf.dll" Cpajdc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nqgiel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jcgbmd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Moeoje32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkeipiep.dll" Cpljdjnd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lnjnjn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cdpjeh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Meiabh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ichcim32.dll" Afhoaahg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kaghho32.dll" Ocamcc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ccoolcnf.dll" Igdnkhoe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Abdoqd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jkkbnl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehqapd32.dll" Bidefbcg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bblcda32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Klhglj32.dll" Bhgcdjje.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ocamcc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cndeoqhk.dll" Ejklfd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Chfaenfb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghjdclhp.dll" Hnblmnfa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lefkfk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfcgkj32.dll" Baickimp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fnlnac32.dll" Iffmmihf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bchjnhhk.dll" Njghkb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Blggmjbd.dll" Kgpodk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fafjdb32.dll" Fjmkhkff.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ajdjcc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Egnhcgeb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cikkga32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kgpajb32.dll" Eajehd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gdfend32.dll" Lhijcohe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Knkkoggp.dll" Gfgjbb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mginniij.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkdjpbad.dll" Cdiohhbm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jlhlcnge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jijhom32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Akpojpic.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Eobffk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nqifkl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bidefbcg.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4120 wrote to memory of 3140 4120 218bc6d0d52d86454a45447d98ebba2c.exe 96 PID 4120 wrote to memory of 3140 4120 218bc6d0d52d86454a45447d98ebba2c.exe 96 PID 4120 wrote to memory of 3140 4120 218bc6d0d52d86454a45447d98ebba2c.exe 96 PID 3140 wrote to memory of 4812 3140 Lbebilli.exe 97 PID 3140 wrote to memory of 4812 3140 Lbebilli.exe 97 PID 3140 wrote to memory of 4812 3140 Lbebilli.exe 97 PID 4812 wrote to memory of 2432 4812 Mklfjm32.exe 98 PID 4812 wrote to memory of 2432 4812 Mklfjm32.exe 98 PID 4812 wrote to memory of 2432 4812 Mklfjm32.exe 98 PID 2432 wrote to memory of 3576 2432 Ncjdki32.exe 99 PID 2432 wrote to memory of 3576 2432 Ncjdki32.exe 99 PID 2432 wrote to memory of 3576 2432 Ncjdki32.exe 99 PID 3576 wrote to memory of 4668 3576 Nlgbon32.exe 100 PID 3576 wrote to memory of 4668 3576 Nlgbon32.exe 100 PID 3576 wrote to memory of 4668 3576 Nlgbon32.exe 100 PID 4668 wrote to memory of 3836 4668 Omcbkl32.exe 101 PID 4668 wrote to memory of 3836 4668 Omcbkl32.exe 101 PID 4668 wrote to memory of 3836 4668 Omcbkl32.exe 101 PID 3836 wrote to memory of 1976 3836 Pbbgicnd.exe 102 PID 3836 wrote to memory of 1976 3836 Pbbgicnd.exe 102 PID 3836 wrote to memory of 1976 3836 Pbbgicnd.exe 102 PID 1976 wrote to memory of 3620 1976 Apddce32.exe 103 PID 1976 wrote to memory of 3620 1976 Apddce32.exe 103 PID 1976 wrote to memory of 3620 1976 Apddce32.exe 103 PID 3620 wrote to memory of 4168 3620 Aiabhj32.exe 104 PID 3620 wrote to memory of 4168 3620 Aiabhj32.exe 104 PID 3620 wrote to memory of 4168 3620 Aiabhj32.exe 104 PID 4168 wrote to memory of 968 4168 Bmddihfj.exe 105 PID 4168 wrote to memory of 968 4168 Bmddihfj.exe 105 PID 4168 wrote to memory of 968 4168 Bmddihfj.exe 105 PID 968 wrote to memory of 1064 968 Bbefln32.exe 106 PID 968 wrote to memory of 1064 968 Bbefln32.exe 106 PID 968 wrote to memory of 1064 968 Bbefln32.exe 106 PID 1064 wrote to memory of 1512 1064 Cleqfb32.exe 107 PID 1064 wrote to memory of 1512 1064 Cleqfb32.exe 107 PID 1064 wrote to memory of 1512 1064 Cleqfb32.exe 107 PID 1512 wrote to memory of 4872 1512 Dedkogqm.exe 108 PID 1512 wrote to memory of 4872 1512 Dedkogqm.exe 108 PID 1512 wrote to memory of 4872 1512 Dedkogqm.exe 108 PID 4872 wrote to memory of 2320 4872 Dibdeegc.exe 109 PID 4872 wrote to memory of 2320 4872 Dibdeegc.exe 109 PID 4872 wrote to memory of 2320 4872 Dibdeegc.exe 109 PID 2320 wrote to memory of 2384 2320 Edakimoo.exe 110 PID 2320 wrote to memory of 2384 2320 Edakimoo.exe 110 PID 2320 wrote to memory of 2384 2320 Edakimoo.exe 110 PID 2384 wrote to memory of 4568 2384 Fdogjk32.exe 111 PID 2384 wrote to memory of 4568 2384 Fdogjk32.exe 111 PID 2384 wrote to memory of 4568 2384 Fdogjk32.exe 111 PID 4568 wrote to memory of 4748 4568 Fcddkggf.exe 112 PID 4568 wrote to memory of 4748 4568 Fcddkggf.exe 112 PID 4568 wrote to memory of 4748 4568 Fcddkggf.exe 112 PID 4748 wrote to memory of 1404 4748 Gddqejni.exe 113 PID 4748 wrote to memory of 1404 4748 Gddqejni.exe 113 PID 4748 wrote to memory of 1404 4748 Gddqejni.exe 113 PID 1404 wrote to memory of 2756 1404 Gloejmld.exe 114 PID 1404 wrote to memory of 2756 1404 Gloejmld.exe 114 PID 1404 wrote to memory of 2756 1404 Gloejmld.exe 114 PID 2756 wrote to memory of 4412 2756 Gfgjbb32.exe 115 PID 2756 wrote to memory of 4412 2756 Gfgjbb32.exe 115 PID 2756 wrote to memory of 4412 2756 Gfgjbb32.exe 115 PID 4412 wrote to memory of 3320 4412 Gjebiq32.exe 116 PID 4412 wrote to memory of 3320 4412 Gjebiq32.exe 116 PID 4412 wrote to memory of 3320 4412 Gjebiq32.exe 116 PID 3320 wrote to memory of 3812 3320 Hdbmfhbi.exe 117
Processes
-
C:\Users\Admin\AppData\Local\Temp\218bc6d0d52d86454a45447d98ebba2c.exe"C:\Users\Admin\AppData\Local\Temp\218bc6d0d52d86454a45447d98ebba2c.exe"1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Windows\SysWOW64\Lbebilli.exeC:\Windows\system32\Lbebilli.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Windows\SysWOW64\Mklfjm32.exeC:\Windows\system32\Mklfjm32.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Windows\SysWOW64\Ncjdki32.exeC:\Windows\system32\Ncjdki32.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Windows\SysWOW64\Nlgbon32.exeC:\Windows\system32\Nlgbon32.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Windows\SysWOW64\Omcbkl32.exeC:\Windows\system32\Omcbkl32.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Windows\SysWOW64\Pbbgicnd.exeC:\Windows\system32\Pbbgicnd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Windows\SysWOW64\Apddce32.exeC:\Windows\system32\Apddce32.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\SysWOW64\Aiabhj32.exeC:\Windows\system32\Aiabhj32.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Windows\SysWOW64\Bmddihfj.exeC:\Windows\system32\Bmddihfj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Windows\SysWOW64\Bbefln32.exeC:\Windows\system32\Bbefln32.exe11⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Windows\SysWOW64\Cleqfb32.exeC:\Windows\system32\Cleqfb32.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Windows\SysWOW64\Dedkogqm.exeC:\Windows\system32\Dedkogqm.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Windows\SysWOW64\Dibdeegc.exeC:\Windows\system32\Dibdeegc.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Windows\SysWOW64\Edakimoo.exeC:\Windows\system32\Edakimoo.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Windows\SysWOW64\Fdogjk32.exeC:\Windows\system32\Fdogjk32.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Windows\SysWOW64\Fcddkggf.exeC:\Windows\system32\Fcddkggf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Windows\SysWOW64\Gddqejni.exeC:\Windows\system32\Gddqejni.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Windows\SysWOW64\Gloejmld.exeC:\Windows\system32\Gloejmld.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Windows\SysWOW64\Gfgjbb32.exeC:\Windows\system32\Gfgjbb32.exe20⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Windows\SysWOW64\Gjebiq32.exeC:\Windows\system32\Gjebiq32.exe21⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Windows\SysWOW64\Hdbmfhbi.exeC:\Windows\system32\Hdbmfhbi.exe22⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Windows\SysWOW64\Ifmldo32.exeC:\Windows\system32\Ifmldo32.exe23⤵
- Executes dropped EXE
PID:3812 -
C:\Windows\SysWOW64\Jfoaam32.exeC:\Windows\system32\Jfoaam32.exe24⤵
- Executes dropped EXE
PID:640 -
C:\Windows\SysWOW64\Knbinhfl.exeC:\Windows\system32\Knbinhfl.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1572 -
C:\Windows\SysWOW64\Lmgfod32.exeC:\Windows\system32\Lmgfod32.exe26⤵
- Executes dropped EXE
PID:1180 -
C:\Windows\SysWOW64\Mginniij.exeC:\Windows\system32\Mginniij.exe27⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:2804 -
C:\Windows\SysWOW64\Moeoje32.exeC:\Windows\system32\Moeoje32.exe28⤵
- Executes dropped EXE
- Modifies registry class
PID:3260 -
C:\Windows\SysWOW64\Ngemjg32.exeC:\Windows\system32\Ngemjg32.exe29⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:3668 -
C:\Windows\SysWOW64\Nehjmnei.exeC:\Windows\system32\Nehjmnei.exe30⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2072 -
C:\Windows\SysWOW64\Okeklcen.exeC:\Windows\system32\Okeklcen.exe31⤵
- Executes dropped EXE
PID:1632 -
C:\Windows\SysWOW64\Pkjegb32.exeC:\Windows\system32\Pkjegb32.exe32⤵
- Executes dropped EXE
PID:2192 -
C:\Windows\SysWOW64\Pklamb32.exeC:\Windows\system32\Pklamb32.exe33⤵
- Executes dropped EXE
PID:60 -
C:\Windows\SysWOW64\Abpmpkoh.exeC:\Windows\system32\Abpmpkoh.exe34⤵
- Executes dropped EXE
- Modifies registry class
PID:2940 -
C:\Windows\SysWOW64\Afnefieo.exeC:\Windows\system32\Afnefieo.exe35⤵
- Executes dropped EXE
PID:1748 -
C:\Windows\SysWOW64\Afpbkicl.exeC:\Windows\system32\Afpbkicl.exe36⤵
- Executes dropped EXE
PID:4436 -
C:\Windows\SysWOW64\Aohfdnil.exeC:\Windows\system32\Aohfdnil.exe37⤵
- Executes dropped EXE
PID:1016 -
C:\Windows\SysWOW64\Bnppkj32.exeC:\Windows\system32\Bnppkj32.exe38⤵
- Executes dropped EXE
PID:1688 -
C:\Windows\SysWOW64\Becknc32.exeC:\Windows\system32\Becknc32.exe39⤵
- Executes dropped EXE
PID:3992 -
C:\Windows\SysWOW64\Chfaenfb.exeC:\Windows\system32\Chfaenfb.exe40⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:2424 -
C:\Windows\SysWOW64\Cejaobel.exeC:\Windows\system32\Cejaobel.exe41⤵
- Executes dropped EXE
PID:3196 -
C:\Windows\SysWOW64\Clffalkf.exeC:\Windows\system32\Clffalkf.exe42⤵
- Executes dropped EXE
PID:3988 -
C:\Windows\SysWOW64\Dlicflic.exeC:\Windows\system32\Dlicflic.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2088 -
C:\Windows\SysWOW64\Dhpdkm32.exeC:\Windows\system32\Dhpdkm32.exe44⤵
- Executes dropped EXE
PID:4592 -
C:\Windows\SysWOW64\Dlnlak32.exeC:\Windows\system32\Dlnlak32.exe45⤵
- Executes dropped EXE
PID:2104 -
C:\Windows\SysWOW64\Donecfao.exeC:\Windows\system32\Donecfao.exe46⤵
- Executes dropped EXE
PID:5040 -
C:\Windows\SysWOW64\Eldbbjof.exeC:\Windows\system32\Eldbbjof.exe47⤵
- Executes dropped EXE
PID:1900 -
C:\Windows\SysWOW64\Eemgkpef.exeC:\Windows\system32\Eemgkpef.exe48⤵
- Executes dropped EXE
PID:4784 -
C:\Windows\SysWOW64\Ebagdddp.exeC:\Windows\system32\Ebagdddp.exe49⤵
- Executes dropped EXE
PID:1076 -
C:\Windows\SysWOW64\Ehbihj32.exeC:\Windows\system32\Ehbihj32.exe50⤵
- Executes dropped EXE
PID:3652 -
C:\Windows\SysWOW64\Fgcjea32.exeC:\Windows\system32\Fgcjea32.exe51⤵
- Executes dropped EXE
PID:2660 -
C:\Windows\SysWOW64\Fekclnif.exeC:\Windows\system32\Fekclnif.exe52⤵
- Executes dropped EXE
PID:2932 -
C:\Windows\SysWOW64\Fofdkcmd.exeC:\Windows\system32\Fofdkcmd.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3504 -
C:\Windows\SysWOW64\Ggafgo32.exeC:\Windows\system32\Ggafgo32.exe54⤵
- Executes dropped EXE
PID:4876 -
C:\Windows\SysWOW64\Ghgljg32.exeC:\Windows\system32\Ghgljg32.exe55⤵
- Executes dropped EXE
PID:1504 -
C:\Windows\SysWOW64\Gjghdj32.exeC:\Windows\system32\Gjghdj32.exe56⤵
- Executes dropped EXE
PID:1128 -
C:\Windows\SysWOW64\Hhleefhe.exeC:\Windows\system32\Hhleefhe.exe57⤵
- Executes dropped EXE
PID:1888 -
C:\Windows\SysWOW64\Hjlaoioh.exeC:\Windows\system32\Hjlaoioh.exe58⤵
- Executes dropped EXE
PID:3976 -
C:\Windows\SysWOW64\Ioppho32.exeC:\Windows\system32\Ioppho32.exe59⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1164 -
C:\Windows\SysWOW64\Ijngkf32.exeC:\Windows\system32\Ijngkf32.exe60⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2168 -
C:\Windows\SysWOW64\Kiaqnagj.exeC:\Windows\system32\Kiaqnagj.exe61⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1760 -
C:\Windows\SysWOW64\Ladhkmno.exeC:\Windows\system32\Ladhkmno.exe62⤵
- Executes dropped EXE
PID:4212 -
C:\Windows\SysWOW64\Lipmoo32.exeC:\Windows\system32\Lipmoo32.exe63⤵
- Executes dropped EXE
PID:1368 -
C:\Windows\SysWOW64\Mpchbhjl.exeC:\Windows\system32\Mpchbhjl.exe64⤵
- Executes dropped EXE
PID:4960 -
C:\Windows\SysWOW64\Mfomda32.exeC:\Windows\system32\Mfomda32.exe65⤵
- Executes dropped EXE
PID:2724 -
C:\Windows\SysWOW64\Mphamg32.exeC:\Windows\system32\Mphamg32.exe66⤵
- Drops file in System32 directory
PID:1944 -
C:\Windows\SysWOW64\Njmejp32.exeC:\Windows\system32\Njmejp32.exe67⤵
- Drops file in System32 directory
PID:4484 -
C:\Windows\SysWOW64\Npjnbg32.exeC:\Windows\system32\Npjnbg32.exe68⤵
- Drops file in System32 directory
PID:1708 -
C:\Windows\SysWOW64\Nmnnlk32.exeC:\Windows\system32\Nmnnlk32.exe69⤵PID:2280
-
C:\Windows\SysWOW64\Ngipjp32.exeC:\Windows\system32\Ngipjp32.exe70⤵PID:4880
-
C:\Windows\SysWOW64\Omjnhiiq.exeC:\Windows\system32\Omjnhiiq.exe71⤵
- Drops file in System32 directory
PID:4408 -
C:\Windows\SysWOW64\Okbhlm32.exeC:\Windows\system32\Okbhlm32.exe72⤵PID:5132
-
C:\Windows\SysWOW64\Pnenchoc.exeC:\Windows\system32\Pnenchoc.exe73⤵PID:5172
-
C:\Windows\SysWOW64\Pknghk32.exeC:\Windows\system32\Pknghk32.exe74⤵PID:5212
-
C:\Windows\SysWOW64\Qpkppbho.exeC:\Windows\system32\Qpkppbho.exe75⤵PID:5252
-
C:\Windows\SysWOW64\Qgehml32.exeC:\Windows\system32\Qgehml32.exe76⤵
- Modifies registry class
PID:5300 -
C:\Windows\SysWOW64\Adnbapjp.exeC:\Windows\system32\Adnbapjp.exe77⤵
- Drops file in System32 directory
- Modifies registry class
PID:5340 -
C:\Windows\SysWOW64\Ababkdij.exeC:\Windows\system32\Ababkdij.exe78⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:5376 -
C:\Windows\SysWOW64\Agnkck32.exeC:\Windows\system32\Agnkck32.exe79⤵PID:5424
-
C:\Windows\SysWOW64\Abdoqd32.exeC:\Windows\system32\Abdoqd32.exe80⤵
- Modifies registry class
PID:5464 -
C:\Windows\SysWOW64\Aklciimh.exeC:\Windows\system32\Aklciimh.exe81⤵PID:5512
-
C:\Windows\SysWOW64\Ahpdcn32.exeC:\Windows\system32\Ahpdcn32.exe82⤵PID:5552
-
C:\Windows\SysWOW64\Bggnijof.exeC:\Windows\system32\Bggnijof.exe83⤵PID:5592
-
C:\Windows\SysWOW64\Bqpbboeg.exeC:\Windows\system32\Bqpbboeg.exe84⤵
- Modifies registry class
PID:5640 -
C:\Windows\SysWOW64\Cqghcn32.exeC:\Windows\system32\Cqghcn32.exe85⤵PID:5700
-
C:\Windows\SysWOW64\Cgejkh32.exeC:\Windows\system32\Cgejkh32.exe86⤵PID:5736
-
C:\Windows\SysWOW64\Cbknhqbl.exeC:\Windows\system32\Cbknhqbl.exe87⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5788 -
C:\Windows\SysWOW64\Djklgb32.exeC:\Windows\system32\Djklgb32.exe88⤵PID:5828
-
C:\Windows\SysWOW64\Deqqek32.exeC:\Windows\system32\Deqqek32.exe89⤵
- Modifies registry class
PID:5936 -
C:\Windows\SysWOW64\Hhbnqi32.exeC:\Windows\system32\Hhbnqi32.exe90⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6012 -
C:\Windows\SysWOW64\Idpdfija.exeC:\Windows\system32\Idpdfija.exe91⤵PID:6064
-
C:\Windows\SysWOW64\Kkjejqcl.exeC:\Windows\system32\Kkjejqcl.exe92⤵
- Drops file in System32 directory
PID:6108 -
C:\Windows\SysWOW64\Ldnjndpo.exeC:\Windows\system32\Ldnjndpo.exe93⤵PID:5152
-
C:\Windows\SysWOW64\Lfnfhg32.exeC:\Windows\system32\Lfnfhg32.exe94⤵PID:5260
-
C:\Windows\SysWOW64\Lofjam32.exeC:\Windows\system32\Lofjam32.exe95⤵
- Drops file in System32 directory
PID:5348 -
C:\Windows\SysWOW64\Lfbpcgbl.exeC:\Windows\system32\Lfbpcgbl.exe96⤵
- Drops file in System32 directory
PID:5404 -
C:\Windows\SysWOW64\Mkohln32.exeC:\Windows\system32\Mkohln32.exe97⤵PID:5484
-
C:\Windows\SysWOW64\Mfdlif32.exeC:\Windows\system32\Mfdlif32.exe98⤵PID:5540
-
C:\Windows\SysWOW64\Mejijcea.exeC:\Windows\system32\Mejijcea.exe99⤵PID:5636
-
C:\Windows\SysWOW64\Niohap32.exeC:\Windows\system32\Niohap32.exe100⤵PID:5392
-
C:\Windows\SysWOW64\Npmjij32.exeC:\Windows\system32\Npmjij32.exe101⤵PID:5732
-
C:\Windows\SysWOW64\Nejbaqgo.exeC:\Windows\system32\Nejbaqgo.exe102⤵
- Drops file in System32 directory
- Modifies registry class
PID:5808 -
C:\Windows\SysWOW64\Nppfnige.exeC:\Windows\system32\Nppfnige.exe103⤵
- Drops file in System32 directory
PID:5876 -
C:\Windows\SysWOW64\Oemofpel.exeC:\Windows\system32\Oemofpel.exe104⤵PID:760
-
C:\Windows\SysWOW64\Olidijjf.exeC:\Windows\system32\Olidijjf.exe105⤵PID:2516
-
C:\Windows\SysWOW64\Olkqnjhd.exeC:\Windows\system32\Olkqnjhd.exe106⤵PID:5864
-
C:\Windows\SysWOW64\Ofadlbhj.exeC:\Windows\system32\Ofadlbhj.exe107⤵PID:216
-
C:\Windows\SysWOW64\Aploae32.exeC:\Windows\system32\Aploae32.exe108⤵PID:6008
-
C:\Windows\SysWOW64\Alelkf32.exeC:\Windows\system32\Alelkf32.exe109⤵PID:6084
-
C:\Windows\SysWOW64\Aochga32.exeC:\Windows\system32\Aochga32.exe110⤵PID:4668
-
C:\Windows\SysWOW64\Apcead32.exeC:\Windows\system32\Apcead32.exe111⤵PID:1976
-
C:\Windows\SysWOW64\Bibpkiie.exeC:\Windows\system32\Bibpkiie.exe112⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5296 -
C:\Windows\SysWOW64\Bckddn32.exeC:\Windows\system32\Bckddn32.exe113⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5028 -
C:\Windows\SysWOW64\Bidlqhgc.exeC:\Windows\system32\Bidlqhgc.exe114⤵PID:5124
-
C:\Windows\SysWOW64\Claenb32.exeC:\Windows\system32\Claenb32.exe115⤵
- Drops file in System32 directory
PID:3492 -
C:\Windows\SysWOW64\Cfiiggpg.exeC:\Windows\system32\Cfiiggpg.exe116⤵
- Drops file in System32 directory
PID:4812 -
C:\Windows\SysWOW64\Dnhgidka.exeC:\Windows\system32\Dnhgidka.exe117⤵PID:1020
-
C:\Windows\SysWOW64\Dcdpakii.exeC:\Windows\system32\Dcdpakii.exe118⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2756 -
C:\Windows\SysWOW64\Djnhne32.exeC:\Windows\system32\Djnhne32.exe119⤵PID:1064
-
C:\Windows\SysWOW64\Dcglfjgf.exeC:\Windows\system32\Dcglfjgf.exe120⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5204 -
C:\Windows\SysWOW64\Enlqdc32.exeC:\Windows\system32\Enlqdc32.exe121⤵PID:5272
-
C:\Windows\SysWOW64\Egeemiml.exeC:\Windows\system32\Egeemiml.exe122⤵PID:1684
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-