Analysis
-
max time kernel
148s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22/05/2024, 01:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
735ef5571e05ed88bb7d91421afe14ca426bce739e53e4c0368d98fe291e2f6d.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
735ef5571e05ed88bb7d91421afe14ca426bce739e53e4c0368d98fe291e2f6d.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
735ef5571e05ed88bb7d91421afe14ca426bce739e53e4c0368d98fe291e2f6d.exe
-
Size
1020KB
-
MD5
546f0a90fbdbe284d4a604b8cab5c0ce
-
SHA1
439eb5242a8f0a256b8f55cce436de7fdfacaf71
-
SHA256
735ef5571e05ed88bb7d91421afe14ca426bce739e53e4c0368d98fe291e2f6d
-
SHA512
50a99ce76d3f452d1cb59884bfbac4f70ed00b9cf6efb07d518e47735585bb87b5eb2c3d6c562587c54abff940fece1ea925ab92c19b69995bc62d72173ee090
-
SSDEEP
24576:UnfyvzecrHPh2kkkkK4kXkkkkkkkkhLX3a20R0i:UnfyvKcrXbazR0i
Score
10/10
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pakdbp32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Process not Found Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lfbgmj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Process not Found Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fniihmpf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ephbhd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Process not Found Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Aonoao32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Process not Found Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Process not Found Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Process not Found Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Process not Found Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ahdged32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Emmdom32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nnfgcd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dmohno32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jiglnf32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Process not Found Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Process not Found Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jlkafdco.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Process not Found Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Process not Found Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Process not Found Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Process not Found Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Process not Found Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Process not Found Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Obkahddl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dpglmjoj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Process not Found Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nlcalieg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ijmapm32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Process not Found Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cljobphg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Klbgfc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Iedbcebd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Process not Found Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Process not Found Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Obqanjdb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Process not Found Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fjgfgbek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Process not Found Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Olfghg32.exe -
Executes dropped EXE 64 IoCs
pid Process 408 Jcgnbaeo.exe 1524 Jgeghp32.exe 388 Kkconn32.exe 4928 Kjepjkhf.exe 4100 Kmdlffhj.exe 3276 Kcndbp32.exe 3732 Kkeldnpi.exe 1544 Lnjnqh32.exe 2536 Lqkgbcff.exe 4844 Lgepom32.exe 3152 Ljfhqh32.exe 1980 Lmdemd32.exe 4976 Lqbncb32.exe 4620 Mcqjon32.exe 3040 Mnfnlf32.exe 728 Mjokgg32.exe 2228 Mmnhcb32.exe 2368 Mgehfkop.exe 4084 Mjdebfnd.exe 3268 Manmoq32.exe 3316 Nclikl32.exe 1392 Nlcalieg.exe 4036 Njfagf32.exe 980 Nmenca32.exe 4660 Napjdpcn.exe 4380 Ncofplba.exe 5100 Ngjbaj32.exe 8 Njinmf32.exe 4152 Nmgjia32.exe 1920 Nabfjpak.exe 2004 Ncabfkqo.exe 1268 Nlhkgi32.exe 3256 Nnfgcd32.exe 3436 Naecop32.exe 3208 Neqopnhb.exe 4700 Nhokljge.exe 2516 Njmhhefi.exe 4328 Neclenfo.exe 3996 Ndflak32.exe 2644 Nlmdbh32.exe 4064 Njpdnedf.exe 3944 Nmnqjp32.exe 3112 Najmjokc.exe 1792 Odhifjkg.exe 4296 Ohcegi32.exe 3408 Ojbacd32.exe 2920 Omqmop32.exe 4880 Oalipoiq.exe 4336 Odjeljhd.exe 5128 Olanmgig.exe 5168 Ojdnid32.exe 5204 Omcjep32.exe 5240 Oejbfmpg.exe 5272 Odmbaj32.exe 5308 Ohhnbhok.exe 5348 Ojgjndno.exe 5380 Oobfob32.exe 5416 Oaqbkn32.exe 5452 Oelolmnd.exe 5488 Ohkkhhmh.exe 5524 Olfghg32.exe 5560 Oodcdb32.exe 5596 Omgcpokp.exe 5632 Oeokal32.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Jbmfig32.exe Process not Found File created C:\Windows\SysWOW64\Fddqpn32.exe Process not Found File opened for modification C:\Windows\SysWOW64\Pkbjjbda.exe Phdnngdn.exe File created C:\Windows\SysWOW64\Begndj32.dll Fgiaemic.exe File created C:\Windows\SysWOW64\Okahhpqj.dll Lbebilli.exe File created C:\Windows\SysWOW64\Qdmdjkpo.dll Gjnlha32.exe File created C:\Windows\SysWOW64\Oihkgo32.exe Process not Found File created C:\Windows\SysWOW64\Cmdmki32.exe Process not Found File created C:\Windows\SysWOW64\Bgagai32.dll Process not Found File created C:\Windows\SysWOW64\Jlbejloe.exe Jidinqpb.exe File opened for modification C:\Windows\SysWOW64\Ocihgnam.exe Ofegni32.exe File created C:\Windows\SysWOW64\Hdedgjno.dll Dcffnbee.exe File created C:\Windows\SysWOW64\Kceoppmo.exe Kjmjgk32.exe File created C:\Windows\SysWOW64\Cacmkn32.exe Process not Found File created C:\Windows\SysWOW64\Hjokhh32.dll Process not Found File opened for modification C:\Windows\SysWOW64\Ndagao32.exe Process not Found File created C:\Windows\SysWOW64\Hdicnflc.dll Process not Found File created C:\Windows\SysWOW64\Gflonn32.dll Ofjqihnn.exe File created C:\Windows\SysWOW64\Dfcqod32.exe Dpihbjmg.exe File created C:\Windows\SysWOW64\Lnnkldlf.dll Process not Found File opened for modification C:\Windows\SysWOW64\Ppepkmhi.exe Process not Found File opened for modification C:\Windows\SysWOW64\Jgiiclkl.exe Process not Found File created C:\Windows\SysWOW64\Cogllb32.dll Process not Found File opened for modification C:\Windows\SysWOW64\Pafcjijo.exe Process not Found File created C:\Windows\SysWOW64\Dgeofeib.dll Oalipoiq.exe File created C:\Windows\SysWOW64\Aamknj32.exe Aonoao32.exe File created C:\Windows\SysWOW64\Hpahkbdh.dll Enkmfolf.exe File created C:\Windows\SysWOW64\Mglcla32.dll Beaohcmf.exe File created C:\Windows\SysWOW64\Hjoabfcc.dll Process not Found File opened for modification C:\Windows\SysWOW64\Fbajlo32.exe Process not Found File created C:\Windows\SysWOW64\Eagchmne.dll Jfmekm32.exe File opened for modification C:\Windows\SysWOW64\Lpghfi32.exe Process not Found File created C:\Windows\SysWOW64\Kqiibcbk.dll Process not Found File created C:\Windows\SysWOW64\Mlcaiklc.dll Process not Found File opened for modification C:\Windows\SysWOW64\Pgoigcip.exe Pfmlok32.exe File created C:\Windows\SysWOW64\Dmmbbodp.dll Process not Found File created C:\Windows\SysWOW64\Mdlkho32.dll Process not Found File created C:\Windows\SysWOW64\Lkaepbjk.dll Process not Found File created C:\Windows\SysWOW64\Ahgcjddh.exe Aehgnied.exe File opened for modification C:\Windows\SysWOW64\Eqiibjlj.exe Enkmfolf.exe File opened for modification C:\Windows\SysWOW64\Nfpled32.exe Process not Found File opened for modification C:\Windows\SysWOW64\Iaqapggb.exe Process not Found File opened for modification C:\Windows\SysWOW64\Ajphagha.exe Process not Found File created C:\Windows\SysWOW64\Kflnpild.exe Process not Found File created C:\Windows\SysWOW64\Ilpfgg32.exe Process not Found File created C:\Windows\SysWOW64\Kgpajb32.dll Process not Found File opened for modification C:\Windows\SysWOW64\Cbcieqpd.exe Process not Found File created C:\Windows\SysWOW64\Kdikkhpk.dll Process not Found File created C:\Windows\SysWOW64\Bdapehop.exe Babcil32.exe File created C:\Windows\SysWOW64\Dblnid32.exe Dlbfmjqi.exe File created C:\Windows\SysWOW64\Ihgnfnjl.exe Process not Found File opened for modification C:\Windows\SysWOW64\Eqmjen32.exe Process not Found File created C:\Windows\SysWOW64\Hbppaopp.exe Process not Found File created C:\Windows\SysWOW64\Bqhioabk.dll Process not Found File opened for modification C:\Windows\SysWOW64\Olfghg32.exe Ohkkhhmh.exe File created C:\Windows\SysWOW64\Aaimiagp.dll Process not Found File created C:\Windows\SysWOW64\Hbdjbn32.dll Process not Found File created C:\Windows\SysWOW64\Blcmakcp.dll Process not Found File created C:\Windows\SysWOW64\Jcgnbaeo.exe 735ef5571e05ed88bb7d91421afe14ca426bce739e53e4c0368d98fe291e2f6d.exe File opened for modification C:\Windows\SysWOW64\Ffobbmpp.exe Process not Found File created C:\Windows\SysWOW64\Phmhgmpc.exe Process not Found File created C:\Windows\SysWOW64\Pmeimo32.dll Process not Found File created C:\Windows\SysWOW64\Bmmljbhc.dll Process not Found File created C:\Windows\SysWOW64\Felbhdgd.exe Process not Found -
Program crash 1 IoCs
pid pid_target Process procid_target 9696 9388 Process not Found 3414 -
resource yara_rule behavioral2/memory/388-30-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral2/memory/4928-40-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral2/memory/3276-53-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral2/memory/4612-72-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral2/memory/408-97-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral2/memory/4976-113-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral2/memory/1524-112-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral2/memory/4100-128-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral2/memory/728-133-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral2/memory/3040-129-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral2/memory/2368-155-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral2/memory/8-520-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral2/memory/1268-524-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral2/memory/2004-523-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral2/memory/1920-522-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral2/memory/4152-521-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral2/memory/5100-519-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral2/memory/4380-518-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral2/memory/4660-517-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral2/memory/980-516-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral2/memory/4036-515-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral2/memory/1392-514-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral2/memory/3316-513-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral2/memory/3268-512-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral2/memory/4084-511-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral2/memory/2536-510-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral2/memory/1544-154-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral2/memory/2228-147-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral2/memory/3732-146-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral2/memory/2920-539-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral2/memory/5816-561-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral2/memory/6064-568-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral2/memory/4844-576-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral2/memory/5156-575-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral2/memory/896-574-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral2/memory/1608-573-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral2/memory/2836-572-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral2/memory/5000-571-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral2/memory/6136-570-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral2/memory/6100-569-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral2/memory/6028-567-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral2/memory/5992-566-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral2/memory/5956-565-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral2/memory/5920-564-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral2/memory/5884-563-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral2/memory/5852-562-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral2/memory/5776-560-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral2/memory/5740-559-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral2/memory/5704-558-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral2/memory/5668-557-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral2/memory/5632-556-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral2/memory/5596-555-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral2/memory/5560-554-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral2/memory/5524-553-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral2/memory/5488-552-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral2/memory/5452-551-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral2/memory/5416-550-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral2/memory/5380-549-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral2/memory/5348-548-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral2/memory/5308-547-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral2/memory/5272-546-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral2/memory/5240-545-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral2/memory/5204-544-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html behavioral2/memory/5168-543-0x0000000000400000-0x000000000043C000-memory.dmp dropper_html -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Heefek32.dll" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hokeebcd.dll" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ncqjbaco.dll" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Heepfn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmbniiil.dll" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fodobp32.dll" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mhfmbl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjfhbkgc.dll" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pcqdkcfn.dll" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Flhoinbl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cnggkf32.dll" Egcaod32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gifffn32.dll" Hejqldci.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gdqeooaa.dll" Jnedgq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ihidjh32.dll" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qjjblpmk.dll" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ejljgqdp.dll" Jcgnbaeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Odedipge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gapppp32.dll" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hdpockcf.dll" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mlljnf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lgepom32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Enkmfolf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Djaalf32.dll" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jkjhoebc.dll" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jcgnbaeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ljcoopif.dll" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Npfcfghe.dll" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Klbgfc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkkfal32.dll" Meljappg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gkedmpik.dll" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gjmgafni.dll" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Njinmf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Omofbc32.dll" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Agolng32.dll" Ocihgnam.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcoiaikp.dll" Jlbejloe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cppelkeb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jhbkgiif.dll" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iaojmhlo.dll" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pbbmgj32.dll" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohfffg32.dll" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hhjhdagb.dll" Hblkjo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oiijig32.dll" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4612 wrote to memory of 408 4612 735ef5571e05ed88bb7d91421afe14ca426bce739e53e4c0368d98fe291e2f6d.exe 90 PID 4612 wrote to memory of 408 4612 735ef5571e05ed88bb7d91421afe14ca426bce739e53e4c0368d98fe291e2f6d.exe 90 PID 4612 wrote to memory of 408 4612 735ef5571e05ed88bb7d91421afe14ca426bce739e53e4c0368d98fe291e2f6d.exe 90 PID 408 wrote to memory of 1524 408 Jcgnbaeo.exe 91 PID 408 wrote to memory of 1524 408 Jcgnbaeo.exe 91 PID 408 wrote to memory of 1524 408 Jcgnbaeo.exe 91 PID 1524 wrote to memory of 388 1524 Jgeghp32.exe 92 PID 1524 wrote to memory of 388 1524 Jgeghp32.exe 92 PID 1524 wrote to memory of 388 1524 Jgeghp32.exe 92 PID 388 wrote to memory of 4928 388 Kkconn32.exe 94 PID 388 wrote to memory of 4928 388 Kkconn32.exe 94 PID 388 wrote to memory of 4928 388 Kkconn32.exe 94 PID 4928 wrote to memory of 4100 4928 Kjepjkhf.exe 95 PID 4928 wrote to memory of 4100 4928 Kjepjkhf.exe 95 PID 4928 wrote to memory of 4100 4928 Kjepjkhf.exe 95 PID 4100 wrote to memory of 3276 4100 Kmdlffhj.exe 96 PID 4100 wrote to memory of 3276 4100 Kmdlffhj.exe 96 PID 4100 wrote to memory of 3276 4100 Kmdlffhj.exe 96 PID 3276 wrote to memory of 3732 3276 Kcndbp32.exe 99 PID 3276 wrote to memory of 3732 3276 Kcndbp32.exe 99 PID 3276 wrote to memory of 3732 3276 Kcndbp32.exe 99 PID 3732 wrote to memory of 1544 3732 Kkeldnpi.exe 100 PID 3732 wrote to memory of 1544 3732 Kkeldnpi.exe 100 PID 3732 wrote to memory of 1544 3732 Kkeldnpi.exe 100 PID 1544 wrote to memory of 2536 1544 Lnjnqh32.exe 101 PID 1544 wrote to memory of 2536 1544 Lnjnqh32.exe 101 PID 1544 wrote to memory of 2536 1544 Lnjnqh32.exe 101 PID 2536 wrote to memory of 4844 2536 Lqkgbcff.exe 102 PID 2536 wrote to memory of 4844 2536 Lqkgbcff.exe 102 PID 2536 wrote to memory of 4844 2536 Lqkgbcff.exe 102 PID 4844 wrote to memory of 3152 4844 Lgepom32.exe 103 PID 4844 wrote to memory of 3152 4844 Lgepom32.exe 103 PID 4844 wrote to memory of 3152 4844 Lgepom32.exe 103 PID 3152 wrote to memory of 1980 3152 Ljfhqh32.exe 104 PID 3152 wrote to memory of 1980 3152 Ljfhqh32.exe 104 PID 3152 wrote to memory of 1980 3152 Ljfhqh32.exe 104 PID 1980 wrote to memory of 4976 1980 Lmdemd32.exe 105 PID 1980 wrote to memory of 4976 1980 Lmdemd32.exe 105 PID 1980 wrote to memory of 4976 1980 Lmdemd32.exe 105 PID 4976 wrote to memory of 4620 4976 Lqbncb32.exe 106 PID 4976 wrote to memory of 4620 4976 Lqbncb32.exe 106 PID 4976 wrote to memory of 4620 4976 Lqbncb32.exe 106 PID 4620 wrote to memory of 3040 4620 Mcqjon32.exe 107 PID 4620 wrote to memory of 3040 4620 Mcqjon32.exe 107 PID 4620 wrote to memory of 3040 4620 Mcqjon32.exe 107 PID 3040 wrote to memory of 728 3040 Mnfnlf32.exe 108 PID 3040 wrote to memory of 728 3040 Mnfnlf32.exe 108 PID 3040 wrote to memory of 728 3040 Mnfnlf32.exe 108 PID 728 wrote to memory of 2228 728 Mjokgg32.exe 109 PID 728 wrote to memory of 2228 728 Mjokgg32.exe 109 PID 728 wrote to memory of 2228 728 Mjokgg32.exe 109 PID 2228 wrote to memory of 2368 2228 Mmnhcb32.exe 110 PID 2228 wrote to memory of 2368 2228 Mmnhcb32.exe 110 PID 2228 wrote to memory of 2368 2228 Mmnhcb32.exe 110 PID 2368 wrote to memory of 4084 2368 Mgehfkop.exe 111 PID 2368 wrote to memory of 4084 2368 Mgehfkop.exe 111 PID 2368 wrote to memory of 4084 2368 Mgehfkop.exe 111 PID 4084 wrote to memory of 3268 4084 Mjdebfnd.exe 112 PID 4084 wrote to memory of 3268 4084 Mjdebfnd.exe 112 PID 4084 wrote to memory of 3268 4084 Mjdebfnd.exe 112 PID 3268 wrote to memory of 3316 3268 Manmoq32.exe 113 PID 3268 wrote to memory of 3316 3268 Manmoq32.exe 113 PID 3268 wrote to memory of 3316 3268 Manmoq32.exe 113 PID 3316 wrote to memory of 1392 3316 Nclikl32.exe 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\735ef5571e05ed88bb7d91421afe14ca426bce739e53e4c0368d98fe291e2f6d.exe"C:\Users\Admin\AppData\Local\Temp\735ef5571e05ed88bb7d91421afe14ca426bce739e53e4c0368d98fe291e2f6d.exe"1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Windows\SysWOW64\Jcgnbaeo.exeC:\Windows\system32\Jcgnbaeo.exe2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Windows\SysWOW64\Jgeghp32.exeC:\Windows\system32\Jgeghp32.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Windows\SysWOW64\Kkconn32.exeC:\Windows\system32\Kkconn32.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:388 -
C:\Windows\SysWOW64\Kjepjkhf.exeC:\Windows\system32\Kjepjkhf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Windows\SysWOW64\Kmdlffhj.exeC:\Windows\system32\Kmdlffhj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Windows\SysWOW64\Kcndbp32.exeC:\Windows\system32\Kcndbp32.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Windows\SysWOW64\Kkeldnpi.exeC:\Windows\system32\Kkeldnpi.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Windows\SysWOW64\Lnjnqh32.exeC:\Windows\system32\Lnjnqh32.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Windows\SysWOW64\Lqkgbcff.exeC:\Windows\system32\Lqkgbcff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Windows\SysWOW64\Lgepom32.exeC:\Windows\system32\Lgepom32.exe11⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Windows\SysWOW64\Ljfhqh32.exeC:\Windows\system32\Ljfhqh32.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Windows\SysWOW64\Lmdemd32.exeC:\Windows\system32\Lmdemd32.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\SysWOW64\Lqbncb32.exeC:\Windows\system32\Lqbncb32.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Windows\SysWOW64\Mcqjon32.exeC:\Windows\system32\Mcqjon32.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Windows\SysWOW64\Mnfnlf32.exeC:\Windows\system32\Mnfnlf32.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Windows\SysWOW64\Mjokgg32.exeC:\Windows\system32\Mjokgg32.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:728 -
C:\Windows\SysWOW64\Mmnhcb32.exeC:\Windows\system32\Mmnhcb32.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Windows\SysWOW64\Mgehfkop.exeC:\Windows\system32\Mgehfkop.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Windows\SysWOW64\Mjdebfnd.exeC:\Windows\system32\Mjdebfnd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Windows\SysWOW64\Manmoq32.exeC:\Windows\system32\Manmoq32.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Windows\SysWOW64\Nclikl32.exeC:\Windows\system32\Nclikl32.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Windows\SysWOW64\Nlcalieg.exeC:\Windows\system32\Nlcalieg.exe23⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1392 -
C:\Windows\SysWOW64\Njfagf32.exeC:\Windows\system32\Njfagf32.exe24⤵
- Executes dropped EXE
PID:4036 -
C:\Windows\SysWOW64\Nmenca32.exeC:\Windows\system32\Nmenca32.exe25⤵
- Executes dropped EXE
PID:980 -
C:\Windows\SysWOW64\Napjdpcn.exeC:\Windows\system32\Napjdpcn.exe26⤵
- Executes dropped EXE
PID:4660 -
C:\Windows\SysWOW64\Ncofplba.exeC:\Windows\system32\Ncofplba.exe27⤵
- Executes dropped EXE
PID:4380 -
C:\Windows\SysWOW64\Ngjbaj32.exeC:\Windows\system32\Ngjbaj32.exe28⤵
- Executes dropped EXE
PID:5100 -
C:\Windows\SysWOW64\Njinmf32.exeC:\Windows\system32\Njinmf32.exe29⤵
- Executes dropped EXE
- Modifies registry class
PID:8 -
C:\Windows\SysWOW64\Nmgjia32.exeC:\Windows\system32\Nmgjia32.exe30⤵
- Executes dropped EXE
PID:4152 -
C:\Windows\SysWOW64\Nabfjpak.exeC:\Windows\system32\Nabfjpak.exe31⤵
- Executes dropped EXE
PID:1920 -
C:\Windows\SysWOW64\Ncabfkqo.exeC:\Windows\system32\Ncabfkqo.exe32⤵
- Executes dropped EXE
PID:2004 -
C:\Windows\SysWOW64\Nlhkgi32.exeC:\Windows\system32\Nlhkgi32.exe33⤵
- Executes dropped EXE
PID:1268 -
C:\Windows\SysWOW64\Nnfgcd32.exeC:\Windows\system32\Nnfgcd32.exe34⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:3256 -
C:\Windows\SysWOW64\Naecop32.exeC:\Windows\system32\Naecop32.exe35⤵
- Executes dropped EXE
PID:3436 -
C:\Windows\SysWOW64\Neqopnhb.exeC:\Windows\system32\Neqopnhb.exe36⤵
- Executes dropped EXE
PID:3208 -
C:\Windows\SysWOW64\Nhokljge.exeC:\Windows\system32\Nhokljge.exe37⤵
- Executes dropped EXE
PID:4700 -
C:\Windows\SysWOW64\Njmhhefi.exeC:\Windows\system32\Njmhhefi.exe38⤵
- Executes dropped EXE
PID:2516 -
C:\Windows\SysWOW64\Neclenfo.exeC:\Windows\system32\Neclenfo.exe39⤵
- Executes dropped EXE
PID:4328 -
C:\Windows\SysWOW64\Ndflak32.exeC:\Windows\system32\Ndflak32.exe40⤵
- Executes dropped EXE
PID:3996 -
C:\Windows\SysWOW64\Nlmdbh32.exeC:\Windows\system32\Nlmdbh32.exe41⤵
- Executes dropped EXE
PID:2644 -
C:\Windows\SysWOW64\Njpdnedf.exeC:\Windows\system32\Njpdnedf.exe42⤵
- Executes dropped EXE
PID:4064 -
C:\Windows\SysWOW64\Nmnqjp32.exeC:\Windows\system32\Nmnqjp32.exe43⤵
- Executes dropped EXE
PID:3944 -
C:\Windows\SysWOW64\Najmjokc.exeC:\Windows\system32\Najmjokc.exe44⤵
- Executes dropped EXE
PID:3112 -
C:\Windows\SysWOW64\Odhifjkg.exeC:\Windows\system32\Odhifjkg.exe45⤵
- Executes dropped EXE
PID:1792 -
C:\Windows\SysWOW64\Ohcegi32.exeC:\Windows\system32\Ohcegi32.exe46⤵
- Executes dropped EXE
PID:4296 -
C:\Windows\SysWOW64\Ojbacd32.exeC:\Windows\system32\Ojbacd32.exe47⤵
- Executes dropped EXE
PID:3408 -
C:\Windows\SysWOW64\Omqmop32.exeC:\Windows\system32\Omqmop32.exe48⤵
- Executes dropped EXE
PID:2920 -
C:\Windows\SysWOW64\Oalipoiq.exeC:\Windows\system32\Oalipoiq.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4880 -
C:\Windows\SysWOW64\Odjeljhd.exeC:\Windows\system32\Odjeljhd.exe50⤵
- Executes dropped EXE
PID:4336 -
C:\Windows\SysWOW64\Olanmgig.exeC:\Windows\system32\Olanmgig.exe51⤵
- Executes dropped EXE
PID:5128 -
C:\Windows\SysWOW64\Ojdnid32.exeC:\Windows\system32\Ojdnid32.exe52⤵
- Executes dropped EXE
PID:5168 -
C:\Windows\SysWOW64\Omcjep32.exeC:\Windows\system32\Omcjep32.exe53⤵
- Executes dropped EXE
PID:5204 -
C:\Windows\SysWOW64\Oejbfmpg.exeC:\Windows\system32\Oejbfmpg.exe54⤵
- Executes dropped EXE
PID:5240 -
C:\Windows\SysWOW64\Odmbaj32.exeC:\Windows\system32\Odmbaj32.exe55⤵
- Executes dropped EXE
PID:5272 -
C:\Windows\SysWOW64\Ohhnbhok.exeC:\Windows\system32\Ohhnbhok.exe56⤵
- Executes dropped EXE
PID:5308 -
C:\Windows\SysWOW64\Ojgjndno.exeC:\Windows\system32\Ojgjndno.exe57⤵
- Executes dropped EXE
PID:5348 -
C:\Windows\SysWOW64\Oobfob32.exeC:\Windows\system32\Oobfob32.exe58⤵
- Executes dropped EXE
PID:5380 -
C:\Windows\SysWOW64\Oaqbkn32.exeC:\Windows\system32\Oaqbkn32.exe59⤵
- Executes dropped EXE
PID:5416 -
C:\Windows\SysWOW64\Oelolmnd.exeC:\Windows\system32\Oelolmnd.exe60⤵
- Executes dropped EXE
PID:5452 -
C:\Windows\SysWOW64\Ohkkhhmh.exeC:\Windows\system32\Ohkkhhmh.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5488 -
C:\Windows\SysWOW64\Olfghg32.exeC:\Windows\system32\Olfghg32.exe62⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:5524 -
C:\Windows\SysWOW64\Oodcdb32.exeC:\Windows\system32\Oodcdb32.exe63⤵
- Executes dropped EXE
PID:5560 -
C:\Windows\SysWOW64\Omgcpokp.exeC:\Windows\system32\Omgcpokp.exe64⤵
- Executes dropped EXE
PID:5596 -
C:\Windows\SysWOW64\Oeokal32.exeC:\Windows\system32\Oeokal32.exe65⤵
- Executes dropped EXE
PID:5632 -
C:\Windows\SysWOW64\Odalmibl.exeC:\Windows\system32\Odalmibl.exe66⤵PID:5668
-
C:\Windows\SysWOW64\Olicnfco.exeC:\Windows\system32\Olicnfco.exe67⤵PID:5704
-
C:\Windows\SysWOW64\Okkdic32.exeC:\Windows\system32\Okkdic32.exe68⤵PID:5740
-
C:\Windows\SysWOW64\Omjpeo32.exeC:\Windows\system32\Omjpeo32.exe69⤵PID:5776
-
C:\Windows\SysWOW64\Paelfmaf.exeC:\Windows\system32\Paelfmaf.exe70⤵PID:5816
-
C:\Windows\SysWOW64\Pddhbipj.exeC:\Windows\system32\Pddhbipj.exe71⤵PID:5852
-
C:\Windows\SysWOW64\Phodcg32.exeC:\Windows\system32\Phodcg32.exe72⤵PID:5884
-
C:\Windows\SysWOW64\Pknqoc32.exeC:\Windows\system32\Pknqoc32.exe73⤵PID:5920
-
C:\Windows\SysWOW64\Poimpapp.exeC:\Windows\system32\Poimpapp.exe74⤵PID:5956
-
C:\Windows\SysWOW64\Pahilmoc.exeC:\Windows\system32\Pahilmoc.exe75⤵PID:5992
-
C:\Windows\SysWOW64\Pecellgl.exeC:\Windows\system32\Pecellgl.exe76⤵PID:6028
-
C:\Windows\SysWOW64\Phaahggp.exeC:\Windows\system32\Phaahggp.exe77⤵PID:6064
-
C:\Windows\SysWOW64\Plmmif32.exeC:\Windows\system32\Plmmif32.exe78⤵PID:6100
-
C:\Windows\SysWOW64\Poliea32.exeC:\Windows\system32\Poliea32.exe79⤵PID:6136
-
C:\Windows\SysWOW64\Pmoiqneg.exeC:\Windows\system32\Pmoiqneg.exe80⤵PID:5000
-
C:\Windows\SysWOW64\Pefabkej.exeC:\Windows\system32\Pefabkej.exe81⤵PID:2836
-
C:\Windows\SysWOW64\Pdhbmh32.exeC:\Windows\system32\Pdhbmh32.exe82⤵PID:1608
-
C:\Windows\SysWOW64\Phdnngdn.exeC:\Windows\system32\Phdnngdn.exe83⤵
- Drops file in System32 directory
PID:896 -
C:\Windows\SysWOW64\Pkbjjbda.exeC:\Windows\system32\Pkbjjbda.exe84⤵PID:5156
-
C:\Windows\SysWOW64\Pmaffnce.exeC:\Windows\system32\Pmaffnce.exe85⤵PID:5228
-
C:\Windows\SysWOW64\Pejkmk32.exeC:\Windows\system32\Pejkmk32.exe86⤵PID:5736
-
C:\Windows\SysWOW64\Phigif32.exeC:\Windows\system32\Phigif32.exe87⤵PID:5800
-
C:\Windows\SysWOW64\Pkgcea32.exeC:\Windows\system32\Pkgcea32.exe88⤵PID:5860
-
C:\Windows\SysWOW64\Qmepam32.exeC:\Windows\system32\Qmepam32.exe89⤵PID:5912
-
C:\Windows\SysWOW64\Qaalblgi.exeC:\Windows\system32\Qaalblgi.exe90⤵PID:5980
-
C:\Windows\SysWOW64\Qdphngfl.exeC:\Windows\system32\Qdphngfl.exe91⤵PID:1752
-
C:\Windows\SysWOW64\Qhkdof32.exeC:\Windows\system32\Qhkdof32.exe92⤵PID:6092
-
C:\Windows\SysWOW64\Qkipkani.exeC:\Windows\system32\Qkipkani.exe93⤵PID:2060
-
C:\Windows\SysWOW64\Qoelkp32.exeC:\Windows\system32\Qoelkp32.exe94⤵PID:1516
-
C:\Windows\SysWOW64\Qachgk32.exeC:\Windows\system32\Qachgk32.exe95⤵PID:5044
-
C:\Windows\SysWOW64\Qeodhjmo.exeC:\Windows\system32\Qeodhjmo.exe96⤵PID:5140
-
C:\Windows\SysWOW64\Qhmqdemc.exeC:\Windows\system32\Qhmqdemc.exe97⤵PID:2076
-
C:\Windows\SysWOW64\Qklmpalf.exeC:\Windows\system32\Qklmpalf.exe98⤵PID:5328
-
C:\Windows\SysWOW64\Aogiap32.exeC:\Windows\system32\Aogiap32.exe99⤵PID:5772
-
C:\Windows\SysWOW64\Aafemk32.exeC:\Windows\system32\Aafemk32.exe100⤵PID:5896
-
C:\Windows\SysWOW64\Aeaanjkl.exeC:\Windows\system32\Aeaanjkl.exe101⤵PID:5968
-
C:\Windows\SysWOW64\Ahpmjejp.exeC:\Windows\system32\Ahpmjejp.exe102⤵PID:6176
-
C:\Windows\SysWOW64\Alkijdci.exeC:\Windows\system32\Alkijdci.exe103⤵PID:6212
-
C:\Windows\SysWOW64\Aojefobm.exeC:\Windows\system32\Aojefobm.exe104⤵PID:6248
-
C:\Windows\SysWOW64\Anmfbl32.exeC:\Windows\system32\Anmfbl32.exe105⤵PID:6284
-
C:\Windows\SysWOW64\Aednci32.exeC:\Windows\system32\Aednci32.exe106⤵PID:6320
-
C:\Windows\SysWOW64\Adfnofpd.exeC:\Windows\system32\Adfnofpd.exe107⤵PID:6356
-
C:\Windows\SysWOW64\Alnfpcag.exeC:\Windows\system32\Alnfpcag.exe108⤵PID:6396
-
C:\Windows\SysWOW64\Aolblopj.exeC:\Windows\system32\Aolblopj.exe109⤵PID:6428
-
C:\Windows\SysWOW64\Aajohjon.exeC:\Windows\system32\Aajohjon.exe110⤵PID:6464
-
C:\Windows\SysWOW64\Adikdfna.exeC:\Windows\system32\Adikdfna.exe111⤵PID:6500
-
C:\Windows\SysWOW64\Ahdged32.exeC:\Windows\system32\Ahdged32.exe112⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6536 -
C:\Windows\SysWOW64\Akccap32.exeC:\Windows\system32\Akccap32.exe113⤵PID:6572
-
C:\Windows\SysWOW64\Aonoao32.exeC:\Windows\system32\Aonoao32.exe114⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:6608 -
C:\Windows\SysWOW64\Aamknj32.exeC:\Windows\system32\Aamknj32.exe115⤵PID:6644
-
C:\Windows\SysWOW64\Aehgnied.exeC:\Windows\system32\Aehgnied.exe116⤵
- Drops file in System32 directory
PID:6684 -
C:\Windows\SysWOW64\Ahgcjddh.exeC:\Windows\system32\Ahgcjddh.exe117⤵PID:6716
-
C:\Windows\SysWOW64\Albpkc32.exeC:\Windows\system32\Albpkc32.exe118⤵PID:6756
-
C:\Windows\SysWOW64\Aoalgn32.exeC:\Windows\system32\Aoalgn32.exe119⤵PID:6788
-
C:\Windows\SysWOW64\Anclbkbp.exeC:\Windows\system32\Anclbkbp.exe120⤵PID:6824
-
C:\Windows\SysWOW64\Aekddhcb.exeC:\Windows\system32\Aekddhcb.exe121⤵PID:6860
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-