a5d7a65f9f0d80fcdfa40db51921bf63e368772107f1edf9d99708cc73bf11af

Analysis

max time kernel
134s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 01:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a5d7a65f9f0d80fcdfa40db51921bf63e368772107f1edf9d99708cc73bf11af.exe
Size 93KB
Sample240530-bnb7gaaa89
SHA256 a5d7a65f9f0d80fcdfa40db51921bf63e368772107f1edf9d99708cc73bf11af
MD5 fdc2d78c8c1c6b61de40abbd19dc4eb3
SHA1 fd97d10e278e978aeceda50502abd86f787377e5
SHA512 81df5ac17605c0daaed683589a92b1ac6766eba90cbc68fc2eb33c57a37cd7f7f75369b97c1b87b44c1bb5a8b95cf866614ed0a9b546106935cb068aad758097
SSDEEP 1536:nMDBnr7P0FJ1P1kb9/O3SEhvQ8B3HOo8TT9jiwg58:Snfe15ZJXZKRY58
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 62 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcbiao32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lphfpbdi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mjcgohig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mpaifalo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nnhfee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	a5d7a65f9f0d80fcdfa40db51921bf63e368772107f1edf9d99708cc73bf11af.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lgbnmm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mamleegg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcbahlip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ngpjnkpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nbhkac32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgkhlnbn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mahbje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mdfofakp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mkbchk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjhqjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mpmokb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mcbahlip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lgpagm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mahbje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mcnhmm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mjhqjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Maaepd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nddkgonp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nddkgonp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lijdhiaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lcbiao32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lphfpbdi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdfofakp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcpebmkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ndbnboqb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngpjnkpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lgkhlnbn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgbnmm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mamleegg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	a5d7a65f9f0d80fcdfa40db51921bf63e368772107f1edf9d99708cc73bf11af.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lkiqbl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkbchk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mjjmog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Laciofpa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nbhkac32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ljnnch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mgekbljc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjcgohig.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnhfee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lijdhiaa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgekbljc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcklgm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mcklgm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcnhmm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpaifalo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mcpebmkb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpappc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lkiqbl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgpagm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lpappc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ljnnch32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpmokb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjjmog32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Laciofpa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndbnboqb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Maaepd32.exe

Executes dropped EXE 31 IoCs

pid	Process
3764	Lpappc32.exe
2552	Lgkhlnbn.exe
2872	Lijdhiaa.exe
2656	Lcbiao32.exe
4844	Lkiqbl32.exe
2032	Laciofpa.exe
2148	Lgpagm32.exe
1052	Ljnnch32.exe
1008	Lphfpbdi.exe
5084	Lgbnmm32.exe
4308	Mahbje32.exe
4796	Mdfofakp.exe
3776	Mgekbljc.exe
736	Mjcgohig.exe
4864	Mpmokb32.exe
3016	Mcklgm32.exe
212	Mkbchk32.exe
2292	Mamleegg.exe
2276	Mcnhmm32.exe
3936	Mjhqjg32.exe
2700	Mpaifalo.exe
2140	Mcpebmkb.exe
5104	Mjjmog32.exe
2472	Maaepd32.exe
4508	Mcbahlip.exe
4720	Nnhfee32.exe
3040	Ndbnboqb.exe
1036	Ngpjnkpf.exe
4200	Nddkgonp.exe
2968	Nbhkac32.exe
2516	Nkcmohbg.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Mpmokb32.exe	Mjcgohig.exe
File created	C:\Windows\SysWOW64\Epmjjbbj.dll	Mpmokb32.exe
File opened for modification	C:\Windows\SysWOW64\Maaepd32.exe	Mjjmog32.exe
File created	C:\Windows\SysWOW64\Nbhkac32.exe	Nddkgonp.exe
File created	C:\Windows\SysWOW64\Bbgkjl32.dll	Laciofpa.exe
File created	C:\Windows\SysWOW64\Mdfofakp.exe	Mahbje32.exe
File opened for modification	C:\Windows\SysWOW64\Mjcgohig.exe	Mgekbljc.exe
File created	C:\Windows\SysWOW64\Mamleegg.exe	Mkbchk32.exe
File opened for modification	C:\Windows\SysWOW64\Mjhqjg32.exe	Mcnhmm32.exe
File created	C:\Windows\SysWOW64\Geegicjl.dll	Mcpebmkb.exe
File created	C:\Windows\SysWOW64\Jlnpomfk.dll	Ngpjnkpf.exe
File created	C:\Windows\SysWOW64\Nkcmohbg.exe	Nbhkac32.exe
File created	C:\Windows\SysWOW64\Mecaoggc.dll	Lphfpbdi.exe
File created	C:\Windows\SysWOW64\Ocbakl32.dll	Mgekbljc.exe
File created	C:\Windows\SysWOW64\Mkbchk32.exe	Mcklgm32.exe
File created	C:\Windows\SysWOW64\Hnibdpde.dll	Nbhkac32.exe
File created	C:\Windows\SysWOW64\Dihcoe32.dll	Nnhfee32.exe
File opened for modification	C:\Windows\SysWOW64\Lcbiao32.exe	Lijdhiaa.exe
File opened for modification	C:\Windows\SysWOW64\Mcklgm32.exe	Mpmokb32.exe
File created	C:\Windows\SysWOW64\Gqffnmfa.dll	Mcklgm32.exe
File opened for modification	C:\Windows\SysWOW64\Mpmokb32.exe	Mjcgohig.exe
File opened for modification	C:\Windows\SysWOW64\Mcpebmkb.exe	Mpaifalo.exe
File created	C:\Windows\SysWOW64\Ndclfb32.dll	Lpappc32.exe
File created	C:\Windows\SysWOW64\Lphfpbdi.exe	Ljnnch32.exe
File opened for modification	C:\Windows\SysWOW64\Lgbnmm32.exe	Lphfpbdi.exe
File created	C:\Windows\SysWOW64\Kpdobeck.dll	Mdfofakp.exe
File created	C:\Windows\SysWOW64\Mpaifalo.exe	Mjhqjg32.exe
File opened for modification	C:\Windows\SysWOW64\Mpaifalo.exe	Mjhqjg32.exe
File created	C:\Windows\SysWOW64\Lijdhiaa.exe	Lgkhlnbn.exe
File created	C:\Windows\SysWOW64\Ljnnch32.exe	Lgpagm32.exe
File opened for modification	C:\Windows\SysWOW64\Lphfpbdi.exe	Ljnnch32.exe
File created	C:\Windows\SysWOW64\Dgcifj32.dll	Mamleegg.exe
File opened for modification	C:\Windows\SysWOW64\Mjjmog32.exe	Mcpebmkb.exe
File created	C:\Windows\SysWOW64\Nnhfee32.exe	Mcbahlip.exe
File created	C:\Windows\SysWOW64\Lpappc32.exe	a5d7a65f9f0d80fcdfa40db51921bf63e368772107f1edf9d99708cc73bf11af.exe
File opened for modification	C:\Windows\SysWOW64\Lijdhiaa.exe	Lgkhlnbn.exe
File opened for modification	C:\Windows\SysWOW64\Mkbchk32.exe	Mcklgm32.exe
File created	C:\Windows\SysWOW64\Mjhqjg32.exe	Mcnhmm32.exe
File created	C:\Windows\SysWOW64\Gpnkgo32.dll	Mcnhmm32.exe
File created	C:\Windows\SysWOW64\Hhapkbgi.dll	Mpaifalo.exe
File created	C:\Windows\SysWOW64\Maaepd32.exe	Mjjmog32.exe
File opened for modification	C:\Windows\SysWOW64\Mcbahlip.exe	Maaepd32.exe
File opened for modification	C:\Windows\SysWOW64\Mdfofakp.exe	Mahbje32.exe
File created	C:\Windows\SysWOW64\Flfmin32.dll	Mahbje32.exe
File opened for modification	C:\Windows\SysWOW64\Mcnhmm32.exe	Mamleegg.exe
File opened for modification	C:\Windows\SysWOW64\Nnhfee32.exe	Mcbahlip.exe
File opened for modification	C:\Windows\SysWOW64\Lkiqbl32.exe	Lcbiao32.exe
File opened for modification	C:\Windows\SysWOW64\Laciofpa.exe	Lkiqbl32.exe
File opened for modification	C:\Windows\SysWOW64\Mgekbljc.exe	Mdfofakp.exe
File opened for modification	C:\Windows\SysWOW64\Nkcmohbg.exe	Nbhkac32.exe
File created	C:\Windows\SysWOW64\Nddkgonp.exe	Ngpjnkpf.exe
File opened for modification	C:\Windows\SysWOW64\Nddkgonp.exe	Ngpjnkpf.exe
File opened for modification	C:\Windows\SysWOW64\Nbhkac32.exe	Nddkgonp.exe
File created	C:\Windows\SysWOW64\Mahbje32.exe	Lgbnmm32.exe
File created	C:\Windows\SysWOW64\Mlhblb32.dll	Ndbnboqb.exe
File created	C:\Windows\SysWOW64\Ndbnboqb.exe	Nnhfee32.exe
File opened for modification	C:\Windows\SysWOW64\Ngpjnkpf.exe	Ndbnboqb.exe
File opened for modification	C:\Windows\SysWOW64\Lgkhlnbn.exe	Lpappc32.exe
File created	C:\Windows\SysWOW64\Lidmdfdo.dll	Lijdhiaa.exe
File opened for modification	C:\Windows\SysWOW64\Lgpagm32.exe	Laciofpa.exe
File created	C:\Windows\SysWOW64\Bkankc32.dll	Mjcgohig.exe
File created	C:\Windows\SysWOW64\Jgengpmj.dll	Mkbchk32.exe
File opened for modification	C:\Windows\SysWOW64\Ljnnch32.exe	Lgpagm32.exe
File created	C:\Windows\SysWOW64\Mglppmnd.dll	Ljnnch32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3852	2516	WerFault.exe	115

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Epmjjbbj.dll"	Mpmokb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ndbnboqb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nbhkac32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	a5d7a65f9f0d80fcdfa40db51921bf63e368772107f1edf9d99708cc73bf11af.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lpappc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ljnnch32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mahbje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mpmokb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mcnhmm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Geegicjl.dll"	Mcpebmkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mcbahlip.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mkbchk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mpaifalo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mcbahlip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mlhblb32.dll"	Ndbnboqb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ngpjnkpf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	a5d7a65f9f0d80fcdfa40db51921bf63e368772107f1edf9d99708cc73bf11af.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lgpagm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lphfpbdi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mpmokb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hhapkbgi.dll"	Mpaifalo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mcpebmkb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mjjmog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Maaepd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nnhfee32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lcbiao32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lcbiao32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Khehmdgi.dll"	Lkiqbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lgpagm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mamleegg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lijdhiaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lkiqbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bbgkjl32.dll"	Laciofpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fnelfilp.dll"	Mjhqjg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ngpjnkpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogndib32.dll"	a5d7a65f9f0d80fcdfa40db51921bf63e368772107f1edf9d99708cc73bf11af.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekiidlll.dll"	Lcbiao32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mdfofakp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mcklgm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mjhqjg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lgkhlnbn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mdfofakp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mcpebmkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	a5d7a65f9f0d80fcdfa40db51921bf63e368772107f1edf9d99708cc73bf11af.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogijli32.dll"	Lgkhlnbn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Laciofpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bkankc32.dll"	Mjcgohig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ipkobd32.dll"	Nddkgonp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnibdpde.dll"	Nbhkac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nbhkac32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lphfpbdi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mecaoggc.dll"	Lphfpbdi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibhblqpo.dll"	Lgbnmm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ocbakl32.dll"	Mgekbljc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mjcgohig.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mamleegg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dgcifj32.dll"	Mamleegg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mjhqjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mpaifalo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlnpomfk.dll"	Ngpjnkpf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}	a5d7a65f9f0d80fcdfa40db51921bf63e368772107f1edf9d99708cc73bf11af.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lijdhiaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Laciofpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gpnkgo32.dll"	Mcnhmm32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1532 wrote to memory of 3764	1532	a5d7a65f9f0d80fcdfa40db51921bf63e368772107f1edf9d99708cc73bf11af.exe	82
PID 1532 wrote to memory of 3764	1532	a5d7a65f9f0d80fcdfa40db51921bf63e368772107f1edf9d99708cc73bf11af.exe	82
PID 1532 wrote to memory of 3764	1532	a5d7a65f9f0d80fcdfa40db51921bf63e368772107f1edf9d99708cc73bf11af.exe	82
PID 3764 wrote to memory of 2552	3764	Lpappc32.exe	83
PID 3764 wrote to memory of 2552	3764	Lpappc32.exe	83
PID 3764 wrote to memory of 2552	3764	Lpappc32.exe	83
PID 2552 wrote to memory of 2872	2552	Lgkhlnbn.exe	84
PID 2552 wrote to memory of 2872	2552	Lgkhlnbn.exe	84
PID 2552 wrote to memory of 2872	2552	Lgkhlnbn.exe	84
PID 2872 wrote to memory of 2656	2872	Lijdhiaa.exe	85
PID 2872 wrote to memory of 2656	2872	Lijdhiaa.exe	85
PID 2872 wrote to memory of 2656	2872	Lijdhiaa.exe	85
PID 2656 wrote to memory of 4844	2656	Lcbiao32.exe	86
PID 2656 wrote to memory of 4844	2656	Lcbiao32.exe	86
PID 2656 wrote to memory of 4844	2656	Lcbiao32.exe	86
PID 4844 wrote to memory of 2032	4844	Lkiqbl32.exe	87
PID 4844 wrote to memory of 2032	4844	Lkiqbl32.exe	87
PID 4844 wrote to memory of 2032	4844	Lkiqbl32.exe	87
PID 2032 wrote to memory of 2148	2032	Laciofpa.exe	88
PID 2032 wrote to memory of 2148	2032	Laciofpa.exe	88
PID 2032 wrote to memory of 2148	2032	Laciofpa.exe	88
PID 2148 wrote to memory of 1052	2148	Lgpagm32.exe	89
PID 2148 wrote to memory of 1052	2148	Lgpagm32.exe	89
PID 2148 wrote to memory of 1052	2148	Lgpagm32.exe	89
PID 1052 wrote to memory of 1008	1052	Ljnnch32.exe	90
PID 1052 wrote to memory of 1008	1052	Ljnnch32.exe	90
PID 1052 wrote to memory of 1008	1052	Ljnnch32.exe	90
PID 1008 wrote to memory of 5084	1008	Lphfpbdi.exe	91
PID 1008 wrote to memory of 5084	1008	Lphfpbdi.exe	91
PID 1008 wrote to memory of 5084	1008	Lphfpbdi.exe	91
PID 5084 wrote to memory of 4308	5084	Lgbnmm32.exe	92
PID 5084 wrote to memory of 4308	5084	Lgbnmm32.exe	92
PID 5084 wrote to memory of 4308	5084	Lgbnmm32.exe	92
PID 4308 wrote to memory of 4796	4308	Mahbje32.exe	93
PID 4308 wrote to memory of 4796	4308	Mahbje32.exe	93
PID 4308 wrote to memory of 4796	4308	Mahbje32.exe	93
PID 4796 wrote to memory of 3776	4796	Mdfofakp.exe	95
PID 4796 wrote to memory of 3776	4796	Mdfofakp.exe	95
PID 4796 wrote to memory of 3776	4796	Mdfofakp.exe	95
PID 3776 wrote to memory of 736	3776	Mgekbljc.exe	96
PID 3776 wrote to memory of 736	3776	Mgekbljc.exe	96
PID 3776 wrote to memory of 736	3776	Mgekbljc.exe	96
PID 736 wrote to memory of 4864	736	Mjcgohig.exe	97
PID 736 wrote to memory of 4864	736	Mjcgohig.exe	97
PID 736 wrote to memory of 4864	736	Mjcgohig.exe	97
PID 4864 wrote to memory of 3016	4864	Mpmokb32.exe	98
PID 4864 wrote to memory of 3016	4864	Mpmokb32.exe	98
PID 4864 wrote to memory of 3016	4864	Mpmokb32.exe	98
PID 3016 wrote to memory of 212	3016	Mcklgm32.exe	99
PID 3016 wrote to memory of 212	3016	Mcklgm32.exe	99
PID 3016 wrote to memory of 212	3016	Mcklgm32.exe	99
PID 212 wrote to memory of 2292	212	Mkbchk32.exe	100
PID 212 wrote to memory of 2292	212	Mkbchk32.exe	100
PID 212 wrote to memory of 2292	212	Mkbchk32.exe	100
PID 2292 wrote to memory of 2276	2292	Mamleegg.exe	101
PID 2292 wrote to memory of 2276	2292	Mamleegg.exe	101
PID 2292 wrote to memory of 2276	2292	Mamleegg.exe	101
PID 2276 wrote to memory of 3936	2276	Mcnhmm32.exe	103
PID 2276 wrote to memory of 3936	2276	Mcnhmm32.exe	103
PID 2276 wrote to memory of 3936	2276	Mcnhmm32.exe	103
PID 3936 wrote to memory of 2700	3936	Mjhqjg32.exe	104
PID 3936 wrote to memory of 2700	3936	Mjhqjg32.exe	104
PID 3936 wrote to memory of 2700	3936	Mjhqjg32.exe	104
PID 2700 wrote to memory of 2140	2700	Mpaifalo.exe	105

C:\Users\Admin\AppData\Local\Temp\a5d7a65f9f0d80fcdfa40db51921bf63e368772107f1edf9d99708cc73bf11af.exe
"C:\Users\Admin\AppData\Local\Temp\a5d7a65f9f0d80fcdfa40db51921bf63e368772107f1edf9d99708cc73bf11af.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1532
- C:\Windows\SysWOW64\Lpappc32.exe
  C:\Windows\system32\Lpappc32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3764
- - C:\Windows\SysWOW64\Lgkhlnbn.exe
    C:\Windows\system32\Lgkhlnbn.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2552
  - - C:\Windows\SysWOW64\Lijdhiaa.exe
      C:\Windows\system32\Lijdhiaa.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2872
    - - C:\Windows\SysWOW64\Lcbiao32.exe
        
        C:\Windows\system32\Lcbiao32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2656
      - C:\Windows\SysWOW64\Lkiqbl32.exe
        
        C:\Windows\system32\Lkiqbl32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4844
        
        C:\Windows\SysWOW64\Laciofpa.exe
        
        C:\Windows\system32\Laciofpa.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2032
        
        C:\Windows\SysWOW64\Lgpagm32.exe
        
        C:\Windows\system32\Lgpagm32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2148
        
        C:\Windows\SysWOW64\Ljnnch32.exe
        
        C:\Windows\system32\Ljnnch32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1052
        
        C:\Windows\SysWOW64\Lphfpbdi.exe
        
        C:\Windows\system32\Lphfpbdi.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1008
        
        C:\Windows\SysWOW64\Lgbnmm32.exe
        
        C:\Windows\system32\Lgbnmm32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5084
        
        C:\Windows\SysWOW64\Mahbje32.exe
        
        C:\Windows\system32\Mahbje32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4308
        
        C:\Windows\SysWOW64\Mdfofakp.exe
        
        C:\Windows\system32\Mdfofakp.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4796
        
        C:\Windows\SysWOW64\Mgekbljc.exe
        
        C:\Windows\system32\Mgekbljc.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3776
        
        C:\Windows\SysWOW64\Mjcgohig.exe
        
        C:\Windows\system32\Mjcgohig.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:736
        
        C:\Windows\SysWOW64\Mpmokb32.exe
        
        C:\Windows\system32\Mpmokb32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4864
        
        C:\Windows\SysWOW64\Mcklgm32.exe
        
        C:\Windows\system32\Mcklgm32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3016
        
        C:\Windows\SysWOW64\Mkbchk32.exe
        
        C:\Windows\system32\Mkbchk32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:212
        
        C:\Windows\SysWOW64\Mamleegg.exe
        
        C:\Windows\system32\Mamleegg.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2292
        
        C:\Windows\SysWOW64\Mcnhmm32.exe
        
        C:\Windows\system32\Mcnhmm32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2276
        
        C:\Windows\SysWOW64\Mjhqjg32.exe
        
        C:\Windows\system32\Mjhqjg32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3936
        
        C:\Windows\SysWOW64\Mpaifalo.exe
        
        C:\Windows\system32\Mpaifalo.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2700
        
        C:\Windows\SysWOW64\Mcpebmkb.exe
        
        C:\Windows\system32\Mcpebmkb.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2140
        
        C:\Windows\SysWOW64\Mjjmog32.exe
        
        C:\Windows\system32\Mjjmog32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:5104
        
        C:\Windows\SysWOW64\Maaepd32.exe
        
        C:\Windows\system32\Maaepd32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2472
        
        C:\Windows\SysWOW64\Mcbahlip.exe
        
        C:\Windows\system32\Mcbahlip.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4508
        
        C:\Windows\SysWOW64\Nnhfee32.exe
        
        C:\Windows\system32\Nnhfee32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4720
        
        C:\Windows\SysWOW64\Ndbnboqb.exe
        
        C:\Windows\system32\Ndbnboqb.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3040
        
        C:\Windows\SysWOW64\Ngpjnkpf.exe
        
        C:\Windows\system32\Ngpjnkpf.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1036
        
        C:\Windows\SysWOW64\Nddkgonp.exe
        
        C:\Windows\system32\Nddkgonp.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4200
        
        C:\Windows\SysWOW64\Nbhkac32.exe
        
        C:\Windows\system32\Nbhkac32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2968
        
        C:\Windows\SysWOW64\Nkcmohbg.exe
        
        C:\Windows\system32\Nkcmohbg.exe
        32⤵
        Executes dropped EXE
        
        PID:2516
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2516 -s 412
        33⤵
        Program crash
        
        PID:3852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2516 -ip 2516
1⤵
PID:3664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Ekiidlll.dll

Path C:\Windows\SysWOW64\Ekiidlll.dll
Size 7KB
SHA256 54144987af48f22b6728188d9f47f551a4c1e4ec5653fe0e2297dfc54b11e8fd
MD5 55ad13407a9914cc6c770fa960e2b363
SHA1 0fe4238a3f08a9e293052ba8add5efdf4cdb49fd
SHA512 e302873b23608072287441308fb91f3fe09cba37c38bdd8d3d6c97ec9484325640622cff1895640977a00de1853250b7c424a7d8b6830bb53cdbf38ec3a42606
SSDEEP 48:66ay5YVO3EVkApc2wp8hH1NZn5EquglQ067YbPWYbABbgL3q9J5S2hmc:b3EVkApcX4Hiv0hbPOq3qX5S2hV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Laciofpa.exe

Path C:\Windows\SysWOW64\Laciofpa.exe
Size 93KB
SHA256 0dcfa0503988a25091aa96e04af4fd88fb30eb3e1c52c97e04136726655a9c34
MD5 be5a6a17fe8b2414e373d830ed2eb42a
SHA1 9a3a1b8d672bafb0f43a63c12c757b506e0a9f31
SHA512 c7fff8b65ba907f76b5e4c3944241666bf856a9d5c7f66c5194f90099a4cc33d164eab1e4da5b0f411f885eb0206003c9f30f8c8ab3f6b3f86855243a48b575f
SSDEEP 1536:LXXn1Zf2sXTz4ukkcOlB/JSCTilKK8/LyTNhjiwg58:b1BFX49khca/uHY58
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lcbiao32.exe

Path C:\Windows\SysWOW64\Lcbiao32.exe
Size 93KB
SHA256 97cc26bfbed533a884fed5f3bf1d5fa55a374fd82970506e077f781cbdb31ff2
MD5 0dee105df42afffe662430ed091493d6
SHA1 8b4327bf441c61b4feba053ea820e3fe2c6520ab
SHA512 cecba02e9e7370954b3ff6ebec3e53ad6f28c25f1372a293b6b3a8434ddcfee28365137a8e50c11d5d4f363db40bfb5b31e06fb611a7c0d61204ae1dd22041de
SSDEEP 1536:5DceenJIHnqkYDQhx/LSwA2RVR0E7SXWRtONSOGITQMjiwg58:5DceenmKAhx/+N2RVRzmNSOGI9Y58
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lgbnmm32.exe

Path C:\Windows\SysWOW64\Lgbnmm32.exe
Size 93KB
SHA256 60c8e4a78ee7e502717493d1db0add3efcaea424e3cf5d518118e3aaed5926d0
MD5 054928a4d817fdbced2f0fb034fcdb33
SHA1 3b39c8145b9b01729322608694414166fbdcf5ee
SHA512 aa332ef5c3312f5f526ceca9ad45281b10fa220c6b645cc30a4bbea2c012d977c863a31b7f0372ec36b5a3bf0f6bc043ac565827db943d85cc00154904b7ee06
SSDEEP 1536:lG2yooTRvPfQvKNChZBsqDaXOB1LsBw1KfJtTgSjiwg58:lpoTRftvquXALsWQJtzY58
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lgkhlnbn.exe

Path C:\Windows\SysWOW64\Lgkhlnbn.exe
Size 93KB
SHA256 e26b70086994aab98b46fb99529abc5f4b21985358fffe9bbaa1fb7e2fa86d63
MD5 833e6d08fb6a30d7275a1412393e3e1f
SHA1 600a30b90173a3dcd6719544b5f3c58bccddde98
SHA512 85b48c3f03e4f6299da991869933e66ff4a41428c6b4fcbbe9cc48d655be7d9209286f8c67f45e40ec3b301403bbcfd154a8dcef274493f69dbe616d49e57a16
SSDEEP 1536:fEAVoyagGn6xjsxsJcPNwFLI4sLpF9X0aa13Tzjiwg58:fEAGR7ajQsO9lp/XUxLY58
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lgpagm32.exe

Path C:\Windows\SysWOW64\Lgpagm32.exe
Size 93KB
SHA256 2c93fbdd8c9aeeb4885fe79c49c12a6bcad2dd3ee2efa298d823c230dabbb516
MD5 0b504f6a964a1c2469eab832a9d30deb
SHA1 a305fed0ee2557f6ce16c67691dd7978fbb1bd02
SHA512 e6ff8d4252d05a203bb567087e95d8c678c669383c79e1330d720df011861dac6f5e3ec571c3a324f955777fcc8d5406af0146de569d249050ba43bbc5605076
SSDEEP 1536:9j8otJoCaiWzROXihsT5z1uFWGuNGM4P1k0TrNT+jiwg58:9j8oHo1ijihslQWGuNGM4Pz+Y58
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lijdhiaa.exe

Path C:\Windows\SysWOW64\Lijdhiaa.exe
Size 93KB
SHA256 728e463ec0b6dbc9d6336f8197a685c1a6df010ebfa8ace516ba89444c6abe55
MD5 e9b2cc70483906b9edb01add25763b57
SHA1 e5716abf5c05ae29d63fabbeaf823d1fdab669ab
SHA512 5e5abcb03dd5c835fc78808b5e058b3a83de82421ca9b192c723b4aadafea56f3f5e69bcfd4fedf34acdc027a3bd7d910f4ec6341703ce5387e135d7f1ad8c5e
SSDEEP 1536:IYejhGANcDVBloOXEwaevd3baHf+XGDpJh7LPTbjiwg58:INiDBoOXIq+PDpJZrY58
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ljnnch32.exe

Path C:\Windows\SysWOW64\Ljnnch32.exe
Size 93KB
SHA256 a3c3aff3c97a4a8ffe31727deb13a55015e127bed407946cf012070b08884a72
MD5 9ee603db05ed7fa3944ba63585293794
SHA1 4fe41de83073270abc1433d2a37e6b9c56f5d306
SHA512 9d25ec2310590acb5a49bda71f331318c2caeb528361cf8530e024b2011b476fad6248b35e1aa70896881d6d681c3d85f87f81e6c6dc04fe1fae3e0b38423b8a
SSDEEP 1536:WUUnxxslOULVxVI0VGJWnjwEM8fUface7Yq+/leS2Ttjiwg58:WDxilOULVxbhnkEM8fUfaPieXhY58
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lkiqbl32.exe

Path C:\Windows\SysWOW64\Lkiqbl32.exe
Size 93KB
SHA256 15212a3037d6e7f97d63bcfa49dde7d1b41a852fec0ff50ab74711382e150bd3
MD5 d7d0142bf9fd4d973699b3c719c9e0a0
SHA1 2993c7028fe083ea3e8b47c1cd177f3455809b92
SHA512 ffe8766d6f9c20169c91c57e58c5da1ab04309951f1d652baa8861279a857b32d285a157e34d7acb23c4b4a76a434cd47ca765c57be38e59b8dbf6d041f27c1f
SSDEEP 1536:8MCYYg7nN0CkEbK3jCltzClF0UHZ39r8q1vTVGjiwg58:b7nVIjCylFHz44vAY58
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lpappc32.exe

Path C:\Windows\SysWOW64\Lpappc32.exe
Size 93KB
SHA256 86dfd744df8471c0bfb8ae9624da6e2127a6da02c682d7f8037bb6bbe45baa03
MD5 77f9ff552f1f05e38f770503e1a39d8d
SHA1 007f3518cfa4b68e296241349c6af41dac26eb3a
SHA512 2330fedc0c4734cbb71f637ad38f3d9350fd462f6ec0b9f7d35928064b6e891fa9d6cc9bb8fe69b7e555282a6d6290a330b75bccfcbb859e0905870b1d1d0157
SSDEEP 1536:ZT2mLwZqNUVhWxNi1MwAadZUxNvy80nG/jT5jiwg58:ZbLDNAWxMFPdeSIjFY58
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lphfpbdi.exe

Path C:\Windows\SysWOW64\Lphfpbdi.exe
Size 93KB
SHA256 dc86dab48d39c933d996793d20466feb8c261e79348a87611d887421e7c1cc50
MD5 9497b8ff2bef7afcac2d22ecd8dbba9e
SHA1 28cd69ad24405f79cce925acf462eabe350d7cf5
SHA512 49bf518059afc5e06cc24fd2b13475a9c3ddd7c514a367bcc988fcc3239b4e10e0f9ea4cad769836af6a0de86c41369e5f0cd8ad59d7e7ece76c51c59438ae57
SSDEEP 1536:byveQS2iF3Yb5yPCMgOn/LDgaOLsRkHk69e79S3dl5C/7j862Tsvjiwg58:8faF3Yb8PCM/LDxRkHk69e79Sn56oFAZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Maaepd32.exe

Path C:\Windows\SysWOW64\Maaepd32.exe
Size 93KB
SHA256 1abb6d8bb5423692509e2c88b737c8d07af5a4e4da375792cba02d44ac370952
MD5 2d9f92a3ac7ce2b68afe05f23e5711c1
SHA1 242fc4f6c802c3e03ee28dc9bb97e532f06b6aea
SHA512 c633f717fc0769172af92dd9b8344f85d0256384e0e27d053f3d43a3d2930c1d784e155faa15838fbd6032cc81cac8cee7fc54e21ddf14044daa68b7b2f5a069
SSDEEP 1536:q26GYqmpki256jCxfzfdtPJ7/BzSU4r1Us7Trjiwg58:qPdCi5CxrLp9SU4qyTY58
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mahbje32.exe

Path C:\Windows\SysWOW64\Mahbje32.exe
Size 93KB
SHA256 3ac4d9cf0adc40befd5d9b2bc24e68bc2dcabbeaf37ae8363e3c262ea8d3b1d9
MD5 dce206ff63eafefe87edca973c12a16e
SHA1 34657cedbaef79209e7f4c6ac382fbeece90dd23
SHA512 ea156e8baba90eb67dca0f7cb116b1e8c14ba504efdb20ad9f1adc990c6af1808762e45da16e41eb2ac1ddb7a6dd9bd47e43b85d319136f468da8aa57cef6202
SSDEEP 1536:z/eS+aKqlyuyvlOSlK37tdLGAdHgDhTiTPcjiwg58:DeS+alyuyvyQFmT0Y58
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mamleegg.exe

Path C:\Windows\SysWOW64\Mamleegg.exe
Size 93KB
SHA256 f6e258dba984075ee4463dc5a6ab831b7dac9a590b8755d16fc81e050de1316e
MD5 f67687a2c6c59e4402f997d6e6d1050f
SHA1 0ca1f31de42f9c22d6c5676c8d508681fd034aa3
SHA512 8563b4612b8e3511c35e966dc3867769904fda127757ceac88122afe7048805c4315bfdebf0bed213bf316606a51cbc5fe59d9b8a3f157f5ef246c94ca2bed6c
SSDEEP 1536:xaOYfIXh7itcwGNdoiOpwukDiNgarrd4daTcjiwg58:xvYfIX/tOpkDgBJQY58
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mcbahlip.exe

Path C:\Windows\SysWOW64\Mcbahlip.exe
Size 93KB
SHA256 07f7dc147fb8877c52bfc45f60287d58cbd7e740f508d69f4876488c1d5d1c1b
MD5 1a9682d23417a1c0b5a5351d66dfce3b
SHA1 1d0795df7858e481d44513b83d2e5a5884960230
SHA512 40e797fefece3b86f2d2168e7761d22a213b563ad9fbf31d4e2d3d746f9cfccec0c53d5ed47510a8f3dcd7392970a0fb22625e2d472e5d6674ab3bcd1de507d1
SSDEEP 1536:LnJ2Z4rYZvSQjrWErzqjN0vvkRJ5YMa8FeTAKjiwg58:LJOZbrWZjNgMJ5YM8hY58
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mcklgm32.exe

Path C:\Windows\SysWOW64\Mcklgm32.exe
Size 93KB
SHA256 3669ee003fb76d4d090ae8304ede7ecba0d98b54bdfaeb347b9db21ca0cf7e42
MD5 48842f4084d9894e19532e90556fc26e
SHA1 f3885e6a44ba2b208169de8bfaf91ae12f8beeeb
SHA512 7c80d6f0787bf0db23436f4c484bd38e888908e5df86555131fef1266c2cbe224ede9049b89bcafaa8816a036f975d9b1769463d4f9a111339946828f76a2cc1
SSDEEP 1536:mEn46cyNO7bNiRza6emZlOG55j8VB02GEMoN4XslU4TEJBATYTcjiwg58:mEn4jyIXNiRfZlOGMVB0No2ahAAEAY58
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mcnhmm32.exe

Path C:\Windows\SysWOW64\Mcnhmm32.exe
Size 93KB
SHA256 86e893ef06abe60a10f99970e83f743d2b63308caa9eb08c1bc01dfb5ad63794
MD5 e2227ea90f78c8ac1e1f357c65694945
SHA1 03e4948d4d1fa34ff595cbc1ccc855cbc5409826
SHA512 03f31249f760a7dc946cec52851ea387167f9d6bf9fdec9680b2d1494db4ca6769686546f4426b609446c5cad250b662018408a69182b098fac8d2fa03b21881
SSDEEP 1536:BhT6ZWROu/UF7yOweJ4aycm5pntjITrjiwg58:BhfRORkwyltErY58
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mcpebmkb.exe

Path C:\Windows\SysWOW64\Mcpebmkb.exe
Size 93KB
SHA256 ec2df07d7f48510f5149fe3fed0e25fcc439e458554e3af7258b06c51cb6e8cd
MD5 ed54ffd7d4512d1b6f49354b2394e0f5
SHA1 ac5154e55c0848422c0704a710595bba8b0a82a5
SHA512 9ea2a7c4ad2afaea9855a8b734befb9d0a32d69c943880f8b502c18837080a0e90874ac916338234bb020f9645c9f4861f9a63a0eac752c50ff6c8a6339813cd
SSDEEP 1536:weLV3cfFFJVHPfnSH3O5TzcEmQPNRFF0FFFFFFFFFFFFFFfFFFFFFF7FFFFFRHVq:we5QnzpzcEmS+1LC1Y58
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mdfofakp.exe

Path C:\Windows\SysWOW64\Mdfofakp.exe
Size 93KB
SHA256 43a72450db97e916bd16fd1f933dd5d6de2d9cdfda864dc9d405b184a341dcd6
MD5 5fe94aa3d006f278fb3f2916896346fc
SHA1 4b6998d7021f3d73150e6fc632e886aa218b825d
SHA512 fa79c6fb0fc8e610bc33f6a069b9a35855492fec47c166bb96c23168d107913141d8d4adc847d4e394d49afc8f1c8d2bfde36c696c1923cb93854a6e266d7d45
SSDEEP 1536:CZW7v4YvNHMZ81nPMSIAPO2P61xU/IPv7TjT5Tjjiwg58:8W7vjvNsZ81n1I6jO80P5LY58
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mgekbljc.exe

Path C:\Windows\SysWOW64\Mgekbljc.exe
Size 93KB
SHA256 de0fe585ccbddd0725076f8f3d8b828abc23e83826103671585946ebb8e547b6
MD5 443f712ffb7af6544036b21ebfb05bce
SHA1 974de639fc000f40d0274ab092657d50416edeaa
SHA512 a12ad029797c85c2cacbf833fe618a91dce95b8df675ac40d1855b8e57c2a956687cd96a724565c89ba9036cb52b75507994e6a1e9ce7c1f3ea7ae9f5366aa3a
SSDEEP 1536:svauNTAfiUDTK2chYdOjrc7kOumS0Bi1sL2GYtVT+jiwg58:oNTgiUDRBOjA7kO7y1wYtVeY58
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mjcgohig.exe

Path C:\Windows\SysWOW64\Mjcgohig.exe
Size 93KB
SHA256 f7171ff94b107fa8d9b55ba813a2e7928e85d8bbce8caa39b8b5345079063f44
MD5 7c23bae61f48b800bffee85b12b91b15
SHA1 a762cfc71d4db37eef84314e538b29c65da6a59c
SHA512 f413841ede8e33e8c831e30a50400772d4950130dcf227e8451878476b9115476f9bc13f6bd2abda2779c6a4b749e5ff2409a655ef305394fe21c03fb7adbfd2
SSDEEP 1536:ASNTPKgNHwmd+yUleW2wI5GHV+tiEyzR8yjYhulA1n8V/001bDdjVuTYjiwg58:VFx/1U6ie18V/bDSsY58
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mjhqjg32.exe

Path C:\Windows\SysWOW64\Mjhqjg32.exe
Size 93KB
SHA256 3750c80c43181ed74223f75bb8f1e8c37ba25451af8b11983c3efa744bca60e5
MD5 d9e45c03c39c0cc7fbd23fb640c0eec3
SHA1 c21a40ecc34985cf21ccb0a005faab75c71cd0fe
SHA512 ed8f7b992348613f2ef8162385beb516cf0d891083cac084192a7b4082b641ddcec9ce367e4e80a397dab18c48750dff743bd09e766a6b705362f57c3b8e9255
SSDEEP 1536:8pmFXQZMBV6XpgDqcMGQk8cGpFVXN9KoK371z4ir0nT60jiwg58:gmFAZuV6K9O/VXN9Koi71cUi/Y58
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mjjmog32.exe

Path C:\Windows\SysWOW64\Mjjmog32.exe
Size 93KB
SHA256 c40ac8297fe82fb537a784b3ba5549fb5206d88c2ff51f23d01669440e3ad964
MD5 c21a15e93137ea52b91c314c80b167d2
SHA1 3850f472b3e08309a4d256c3e7a57cf7db292a7e
SHA512 17bf6d6a79830d4ca8b148212a2a7229ed9d90613b6d4d0b6eb24e08019155851542c38673793351151e1f47cbb4d01818f0ffcd4ae7850aa51e6eced6b8498a
SSDEEP 1536:oAQZAmNRW/ODJOrKewmW9GPTcmSTABmTRfUcnW92LLTcjiwg58:oLZbRKOD0rFGABunWeLAY58
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mkbchk32.exe

Path C:\Windows\SysWOW64\Mkbchk32.exe
Size 93KB
SHA256 5c9f1176ddef7fe14c5f084ec180175a4a8a8c3084bc8e47f1dcb927adbdf56e
MD5 c087925d825b6c568306755b7fc3b33f
SHA1 bfb551b19ed11fd370b7f8ea50786b48147be979
SHA512 c0389cc85045a0d799e5386892245c1c5c2f67a73362c0f860b55879523a36fb39144fb1f878f54ef474ee424a9172aaa1a042674623101157b627dee80c49f1
SSDEEP 1536:UqStrOTEDsHV1oeTRT1977J18jZfWcF8RB9I9jTJjiwg58:ULrLA11oeTRBF8jZfWcFABWd1Y58
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mpaifalo.exe

Path C:\Windows\SysWOW64\Mpaifalo.exe
Size 93KB
SHA256 e87d593b35b0e3fd7c18fc0c7f67a0123c289d4674228fb3a3a2b7f51898f513
MD5 b4bccfbef38a77f2725b27b3d1822def
SHA1 a70d7230d224840e585e9be1d7eff31608053e1b
SHA512 1aa0221080c37b8b6f7412d99c8fd3de5f7771e6c5c65999f9b28d019be8fbc6f488bf6afc9813fd6e4bd3d7e8112f13c1f6c7c4c0c3954025c01fb5a242df35
SSDEEP 1536:ksbz5hngbx33K8s7jUX35+r5nsGCUTRjiwg58:ksBhngZK8sY3fGCUFY58
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mpmokb32.exe

Path C:\Windows\SysWOW64\Mpmokb32.exe
Size 93KB
SHA256 9958c49bbefb1be58941ea76445d6191e434a2d566992e3590826ed5a9f26891
MD5 02fcb63bb37e7a4f7a34573c8f90106a
SHA1 909f07c5292444d093868ef3c44887183932ecd1
SHA512 5f035e2e594fd0b0e14c375427311b7116fb61da9ee6d9372a121e1756fd66f1a86534d2bf91d8fe59cb7f3372ef4d66323518a710a6463c23dc6c6ea375a1d4
SSDEEP 1536:wA2S6XW3wtodK1cIw/HsALNQgyu4CV5lCojMBRda7fGWCLENTZjiwg58:2S6XW3wokcIwxRQ8dcTKAKlY58
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nbhkac32.exe

Path C:\Windows\SysWOW64\Nbhkac32.exe
Size 93KB
SHA256 153fe14fe63d884e4a3a2eade7bdd776fdb8a4917861003464c84606de230b38
MD5 ac3dd5c43bf49b30526e368e540f24ae
SHA1 0252fe2f8dea9e0dc81edcd80c2adaeaaef692fe
SHA512 a66426d63f2be345caba3f57ca0c1def60c73d056efb3a745c4170f3ded6987e80030a9e9aaa8e5ccbaa26dfb703e66cd9555861308c3f74d71023911c2184ac
SSDEEP 1536:kBvoRWteiwjgNM4C3hFxaUlKQst7s2JlYBXnVVSITQjiwg58:kxoR/4CRFxaUglXJlYBXV5sY58
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ndbnboqb.exe

Path C:\Windows\SysWOW64\Ndbnboqb.exe
Size 93KB
SHA256 2d1e325be834985fbc3108dc43278677902432bcaa3b2e8425cd7c03ad2a5acb
MD5 ceeee5479b40cd41d3a3de4ee668234b
SHA1 7d68e89b0d6d42e469bd45a9b15537c7b151090c
SHA512 fd48a985a6f5ebf494ef8f55c9ef0afdec982a291717580b2b7298dfc8f5a28c30bc97db606c5e759e3c676860b6b771959e5aced20113c1a738be3f177c798f
SSDEEP 1536:VKevxgV+2cfaaca//ZGSQK9Pw4xt4zuZknNvo7FPjvAZVA7TO/jiwg58:1vxgVTaZ/hQ23xtlZknNEFbAZy7ibY58
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nddkgonp.exe

Path C:\Windows\SysWOW64\Nddkgonp.exe
Size 93KB
SHA256 35bd98aaebc8896e6d222d9caea5f9072018fc3c6790136eae2e16695071bc16
MD5 a12002c7b8da43008ea236a775dcbd25
SHA1 0adba3c7c895b89fa13a6804144f9c20432bda2b
SHA512 875f0ecb46db68599a3de12db2a9e8bdf933c9a3d55e6c0a67c24cdeb246bfdcb6c14bebd4a12dddeff02ea7651d550e48d5eaa01e6ae68131d6d719e21ca9bc
SSDEEP 1536:jUp6L6E2BXc0tFch/0HBsnvqq0gPCcP5r98CTrgThljiwg58:jUw+Eam/0HKS9gPCZC47Y58
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ngpjnkpf.exe

Path C:\Windows\SysWOW64\Ngpjnkpf.exe
Size 93KB
SHA256 c6ecbb743133a2a54fca6d9f769dd686e272cd9d34c087c7ffc0dacc2633bb2d
MD5 e05a81ea2ed4c29bbe57348fd5bdac2a
SHA1 ad1c7371df1eebfac6d7606cbcacc51ace431001
SHA512 8a7d9c41d18af7d333ed2fabffe8750bbacef2f85a337388237d39d39ce2d4e055b4c584cadf6c49cfadc85e3161dfbc863c07f898c52d00dc32970d312c7c35
SSDEEP 1536:EQO+OoTkgq2oDhqZi3nYBg48vPlRUorgcY/TMjiwg58:EQBLggq2oDjn4gFlRUo0cywY58
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nkcmohbg.exe

Path C:\Windows\SysWOW64\Nkcmohbg.exe
Size 93KB
SHA256 024f1237e32bcc723384a39f9dfcd7bd3836c291beb7415161512a75127d8b78
MD5 ab111c18cde784194b37baee36bb65bb
SHA1 75b34dd93beedf23cd0f93b28607a6604d141afd
SHA512 7b13d7e33fd63ca6cc4ded7ec5f361afab85ff8c6870d5fc19cdc13c166565b9ac5f01fe958edcd89af8f9d7ccff7bdfc0ab4096821c45f3124125489e8b2f4c
SSDEEP 1536:/9egcbtvr50zHQKe+5cT8/yq6Xro+x8LmR+rWfzrcYjlOHAhqm0NgyKtTGjiwg58:/9eLt8k+5cJI+/rlv0iRGY58
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nnhfee32.exe

Path C:\Windows\SysWOW64\Nnhfee32.exe
Size 93KB
SHA256 bc0e7c952d56041a6590006802ed87c9f630272ec89f188262fbfccbb38b7491
MD5 da904d1d23b9d77805f4d54928f51fc1
SHA1 0ad3df128380ce39c621f67b76d1568430b532de
SHA512 a01ed0ed5f05f1a06ae94291dd841a680063aa16ba77edc4d6a3c2e8cd87d5a22997481da7669a377ea033e7b0c7e325b98ecb442df575bb670dc92c56f9731b
SSDEEP 1536:UNOpJeppIIOg8X2LncN+VGmju5z2/OCmi2eOtReZVcZYrWhsWTrKjiwg58:QOOpMBX2LcMkmju5z2/OHeOtReZI8iHM
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/212-260-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/212-136-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/736-112-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/736-263-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/1008-72-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/1008-266-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/1036-251-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/1036-223-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/1052-64-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/1052-267-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/1532-274-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/1532-0-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2032-269-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2032-47-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2140-176-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2140-256-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2148-268-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2148-56-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2276-258-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2276-152-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2292-259-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2292-144-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2472-253-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2472-192-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2516-249-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2516-248-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2552-272-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2552-19-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2656-36-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2700-275-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2700-168-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2872-24-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2872-271-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2968-245-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3016-261-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3016-128-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3040-221-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3764-8-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3764-273-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3776-110-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3936-257-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3936-159-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4200-250-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4200-231-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4308-88-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4308-264-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4508-199-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4508-252-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4720-254-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4720-208-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4796-100-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4844-270-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4844-44-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4864-123-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4864-262-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/5084-265-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/5084-79-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/5104-184-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/5104-255-0x0000000000400000-0x000000000043F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads