19a053ebba4615e4f6e6ee299c41c7c09bbf23c6a6eccdac1ed4fb1709ccb130

Analysis

max time kernel
92s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23-07-2024 01:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

44a475c44859f4e6c46fa564af44cea0N.exe
Size

74KB
MD5

44a475c44859f4e6c46fa564af44cea0
SHA1

5c88ebf4ce7542b1c557d5f4a8e62463bff9282d
SHA256

19a053ebba4615e4f6e6ee299c41c7c09bbf23c6a6eccdac1ed4fb1709ccb130
SHA512

03435b9c3f561c49747288446ebf3c1fab13af52cb9b41b2af4f86cd0133482fca941f296e686e37fceed4f954a783a42669bff354410f2d3136d16a37c0c953
SSDEEP

1536:+jZZ5XASeKdYhKi9ZMYSsEVRagqEAxxDMB9H:MnAS/KhEtVRagqEge9H

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 42 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daqbip32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddonekbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Chagok32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnkplejl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chcddk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cmqmma32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmcibama.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dejacond.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daekdooc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Daekdooc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dmcibama.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Djgjlelk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkifae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ddakjkqi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	44a475c44859f4e6c46fa564af44cea0N.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmlcbbcj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cajlhqjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dgbdlf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkkcge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dkkcge32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	44a475c44859f4e6c46fa564af44cea0N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cnkplejl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cajlhqjp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmqmma32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfiafg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Daqbip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cegdnopg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dfiafg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Djgjlelk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dmgbnq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddakjkqi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfbkeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cmlcbbcj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmgbnq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dgbdlf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cfbkeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Chcddk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dejacond.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dkifae32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chagok32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cegdnopg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ddonekbl.exe

Executes dropped EXE 21 IoCs

pid	Process
4408	Cfbkeh32.exe
4248	Cmlcbbcj.exe
4424	Chagok32.exe
1572	Cnkplejl.exe
3512	Cajlhqjp.exe
3632	Chcddk32.exe
1976	Cmqmma32.exe
4428	Cegdnopg.exe
2988	Dfiafg32.exe
1652	Dmcibama.exe
1912	Dejacond.exe
1968	Djgjlelk.exe
3444	Daqbip32.exe
3480	Ddonekbl.exe
3544	Dkifae32.exe
540	Dmgbnq32.exe
1888	Ddakjkqi.exe
2548	Dkkcge32.exe
4344	Daekdooc.exe
2240	Dgbdlf32.exe
2952	Dmllipeg.exe

Drops file in System32 directory 63 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Okgoadbf.dll	Chcddk32.exe
File created	C:\Windows\SysWOW64\Dfiafg32.exe	Cegdnopg.exe
File created	C:\Windows\SysWOW64\Kmfjodai.dll	Dfiafg32.exe
File created	C:\Windows\SysWOW64\Ohmoom32.dll	Dkkcge32.exe
File opened for modification	C:\Windows\SysWOW64\Dgbdlf32.exe	Daekdooc.exe
File created	C:\Windows\SysWOW64\Bilonkon.dll	Cajlhqjp.exe
File created	C:\Windows\SysWOW64\Cmqmma32.exe	Chcddk32.exe
File created	C:\Windows\SysWOW64\Dmllipeg.exe	Dgbdlf32.exe
File created	C:\Windows\SysWOW64\Ddakjkqi.exe	Dmgbnq32.exe
File created	C:\Windows\SysWOW64\Dkkcge32.exe	Ddakjkqi.exe
File created	C:\Windows\SysWOW64\Dmgbnq32.exe	Dkifae32.exe
File created	C:\Windows\SysWOW64\Cfbkeh32.exe	44a475c44859f4e6c46fa564af44cea0N.exe
File created	C:\Windows\SysWOW64\Qlgene32.dll	Cmlcbbcj.exe
File created	C:\Windows\SysWOW64\Jcbdhp32.dll	Ddakjkqi.exe
File created	C:\Windows\SysWOW64\Kkmjgool.dll	Cegdnopg.exe
File opened for modification	C:\Windows\SysWOW64\Dmcibama.exe	Dfiafg32.exe
File created	C:\Windows\SysWOW64\Daqbip32.exe	Djgjlelk.exe
File created	C:\Windows\SysWOW64\Chagok32.exe	Cmlcbbcj.exe
File created	C:\Windows\SysWOW64\Pjngmo32.dll	Chagok32.exe
File opened for modification	C:\Windows\SysWOW64\Chcddk32.exe	Cajlhqjp.exe
File created	C:\Windows\SysWOW64\Mjelcfha.dll	Daqbip32.exe
File created	C:\Windows\SysWOW64\Ghekjiam.dll	44a475c44859f4e6c46fa564af44cea0N.exe
File created	C:\Windows\SysWOW64\Cmlcbbcj.exe	Cfbkeh32.exe
File opened for modification	C:\Windows\SysWOW64\Ddakjkqi.exe	Dmgbnq32.exe
File opened for modification	C:\Windows\SysWOW64\Dmllipeg.exe	Dgbdlf32.exe
File created	C:\Windows\SysWOW64\Hpnkaj32.dll	Dmcibama.exe
File opened for modification	C:\Windows\SysWOW64\Ddonekbl.exe	Daqbip32.exe
File opened for modification	C:\Windows\SysWOW64\Dkkcge32.exe	Ddakjkqi.exe
File created	C:\Windows\SysWOW64\Kngpec32.dll	Dgbdlf32.exe
File opened for modification	C:\Windows\SysWOW64\Cfbkeh32.exe	44a475c44859f4e6c46fa564af44cea0N.exe
File opened for modification	C:\Windows\SysWOW64\Chagok32.exe	Cmlcbbcj.exe
File created	C:\Windows\SysWOW64\Ihidnp32.dll	Dkifae32.exe
File created	C:\Windows\SysWOW64\Dmcibama.exe	Dfiafg32.exe
File created	C:\Windows\SysWOW64\Djgjlelk.exe	Dejacond.exe
File created	C:\Windows\SysWOW64\Pdheac32.dll	Ddonekbl.exe
File opened for modification	C:\Windows\SysWOW64\Daekdooc.exe	Dkkcge32.exe
File created	C:\Windows\SysWOW64\Dejacond.exe	Dmcibama.exe
File opened for modification	C:\Windows\SysWOW64\Dejacond.exe	Dmcibama.exe
File opened for modification	C:\Windows\SysWOW64\Cegdnopg.exe	Cmqmma32.exe
File created	C:\Windows\SysWOW64\Jdipdgch.dll	Djgjlelk.exe
File created	C:\Windows\SysWOW64\Dkifae32.exe	Ddonekbl.exe
File created	C:\Windows\SysWOW64\Gifhkeje.dll	Dmgbnq32.exe
File created	C:\Windows\SysWOW64\Dgbdlf32.exe	Daekdooc.exe
File opened for modification	C:\Windows\SysWOW64\Cajlhqjp.exe	Cnkplejl.exe
File opened for modification	C:\Windows\SysWOW64\Djgjlelk.exe	Dejacond.exe
File created	C:\Windows\SysWOW64\Ddonekbl.exe	Daqbip32.exe
File opened for modification	C:\Windows\SysWOW64\Cmlcbbcj.exe	Cfbkeh32.exe
File created	C:\Windows\SysWOW64\Cajlhqjp.exe	Cnkplejl.exe
File created	C:\Windows\SysWOW64\Cegdnopg.exe	Cmqmma32.exe
File created	C:\Windows\SysWOW64\Beeppfin.dll	Dejacond.exe
File opened for modification	C:\Windows\SysWOW64\Cmqmma32.exe	Chcddk32.exe
File created	C:\Windows\SysWOW64\Mgcail32.dll	Cmqmma32.exe
File opened for modification	C:\Windows\SysWOW64\Daqbip32.exe	Djgjlelk.exe
File opened for modification	C:\Windows\SysWOW64\Dkifae32.exe	Ddonekbl.exe
File created	C:\Windows\SysWOW64\Gfghpl32.dll	Daekdooc.exe
File created	C:\Windows\SysWOW64\Fmjkjk32.dll	Cfbkeh32.exe
File created	C:\Windows\SysWOW64\Clghpklj.dll	Cnkplejl.exe
File created	C:\Windows\SysWOW64\Chcddk32.exe	Cajlhqjp.exe
File opened for modification	C:\Windows\SysWOW64\Dfiafg32.exe	Cegdnopg.exe
File opened for modification	C:\Windows\SysWOW64\Dmgbnq32.exe	Dkifae32.exe
File created	C:\Windows\SysWOW64\Daekdooc.exe	Dkkcge32.exe
File created	C:\Windows\SysWOW64\Cnkplejl.exe	Chagok32.exe
File opened for modification	C:\Windows\SysWOW64\Cnkplejl.exe	Chagok32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3188	2952	WerFault.exe	105

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cmlcbbcj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Daqbip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ddonekbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcbdhp32.dll"	Ddakjkqi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dkkcge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Daekdooc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cmlcbbcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cnkplejl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hpnkaj32.dll"	Dmcibama.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kkmjgool.dll"	Cegdnopg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dejacond.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Beeppfin.dll"	Dejacond.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjelcfha.dll"	Daqbip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ihidnp32.dll"	Dkifae32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cnkplejl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cajlhqjp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Daekdooc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kngpec32.dll"	Dgbdlf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmjkjk32.dll"	Cfbkeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jdipdgch.dll"	Djgjlelk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ddonekbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ddakjkqi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohmoom32.dll"	Dkkcge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dfiafg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dkifae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bilonkon.dll"	Cajlhqjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgcail32.dll"	Cmqmma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Daqbip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdheac32.dll"	Ddonekbl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	44a475c44859f4e6c46fa564af44cea0N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cfbkeh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dmcibama.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Djgjlelk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	44a475c44859f4e6c46fa564af44cea0N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmfjodai.dll"	Dfiafg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dejacond.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dfiafg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gifhkeje.dll"	Dmgbnq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dmgbnq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghekjiam.dll"	44a475c44859f4e6c46fa564af44cea0N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjngmo32.dll"	Chagok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dgbdlf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}	44a475c44859f4e6c46fa564af44cea0N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cajlhqjp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cegdnopg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dmcibama.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	44a475c44859f4e6c46fa564af44cea0N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Chagok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Chagok32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Chcddk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cmqmma32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dgbdlf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Djgjlelk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dkifae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	44a475c44859f4e6c46fa564af44cea0N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qlgene32.dll"	Cmlcbbcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Okgoadbf.dll"	Chcddk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Chcddk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cmqmma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cegdnopg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dkkcge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfghpl32.dll"	Daekdooc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cfbkeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Clghpklj.dll"	Cnkplejl.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 4408	2664	44a475c44859f4e6c46fa564af44cea0N.exe	84
PID 2664 wrote to memory of 4408	2664	44a475c44859f4e6c46fa564af44cea0N.exe	84
PID 2664 wrote to memory of 4408	2664	44a475c44859f4e6c46fa564af44cea0N.exe	84
PID 4408 wrote to memory of 4248	4408	Cfbkeh32.exe	85
PID 4408 wrote to memory of 4248	4408	Cfbkeh32.exe	85
PID 4408 wrote to memory of 4248	4408	Cfbkeh32.exe	85
PID 4248 wrote to memory of 4424	4248	Cmlcbbcj.exe	86
PID 4248 wrote to memory of 4424	4248	Cmlcbbcj.exe	86
PID 4248 wrote to memory of 4424	4248	Cmlcbbcj.exe	86
PID 4424 wrote to memory of 1572	4424	Chagok32.exe	87
PID 4424 wrote to memory of 1572	4424	Chagok32.exe	87
PID 4424 wrote to memory of 1572	4424	Chagok32.exe	87
PID 1572 wrote to memory of 3512	1572	Cnkplejl.exe	88
PID 1572 wrote to memory of 3512	1572	Cnkplejl.exe	88
PID 1572 wrote to memory of 3512	1572	Cnkplejl.exe	88
PID 3512 wrote to memory of 3632	3512	Cajlhqjp.exe	89
PID 3512 wrote to memory of 3632	3512	Cajlhqjp.exe	89
PID 3512 wrote to memory of 3632	3512	Cajlhqjp.exe	89
PID 3632 wrote to memory of 1976	3632	Chcddk32.exe	90
PID 3632 wrote to memory of 1976	3632	Chcddk32.exe	90
PID 3632 wrote to memory of 1976	3632	Chcddk32.exe	90
PID 1976 wrote to memory of 4428	1976	Cmqmma32.exe	91
PID 1976 wrote to memory of 4428	1976	Cmqmma32.exe	91
PID 1976 wrote to memory of 4428	1976	Cmqmma32.exe	91
PID 4428 wrote to memory of 2988	4428	Cegdnopg.exe	92
PID 4428 wrote to memory of 2988	4428	Cegdnopg.exe	92
PID 4428 wrote to memory of 2988	4428	Cegdnopg.exe	92
PID 2988 wrote to memory of 1652	2988	Dfiafg32.exe	93
PID 2988 wrote to memory of 1652	2988	Dfiafg32.exe	93
PID 2988 wrote to memory of 1652	2988	Dfiafg32.exe	93
PID 1652 wrote to memory of 1912	1652	Dmcibama.exe	94
PID 1652 wrote to memory of 1912	1652	Dmcibama.exe	94
PID 1652 wrote to memory of 1912	1652	Dmcibama.exe	94
PID 1912 wrote to memory of 1968	1912	Dejacond.exe	95
PID 1912 wrote to memory of 1968	1912	Dejacond.exe	95
PID 1912 wrote to memory of 1968	1912	Dejacond.exe	95
PID 1968 wrote to memory of 3444	1968	Djgjlelk.exe	96
PID 1968 wrote to memory of 3444	1968	Djgjlelk.exe	96
PID 1968 wrote to memory of 3444	1968	Djgjlelk.exe	96
PID 3444 wrote to memory of 3480	3444	Daqbip32.exe	97
PID 3444 wrote to memory of 3480	3444	Daqbip32.exe	97
PID 3444 wrote to memory of 3480	3444	Daqbip32.exe	97
PID 3480 wrote to memory of 3544	3480	Ddonekbl.exe	98
PID 3480 wrote to memory of 3544	3480	Ddonekbl.exe	98
PID 3480 wrote to memory of 3544	3480	Ddonekbl.exe	98
PID 3544 wrote to memory of 540	3544	Dkifae32.exe	100
PID 3544 wrote to memory of 540	3544	Dkifae32.exe	100
PID 3544 wrote to memory of 540	3544	Dkifae32.exe	100
PID 540 wrote to memory of 1888	540	Dmgbnq32.exe	101
PID 540 wrote to memory of 1888	540	Dmgbnq32.exe	101
PID 540 wrote to memory of 1888	540	Dmgbnq32.exe	101
PID 1888 wrote to memory of 2548	1888	Ddakjkqi.exe	102
PID 1888 wrote to memory of 2548	1888	Ddakjkqi.exe	102
PID 1888 wrote to memory of 2548	1888	Ddakjkqi.exe	102
PID 2548 wrote to memory of 4344	2548	Dkkcge32.exe	103
PID 2548 wrote to memory of 4344	2548	Dkkcge32.exe	103
PID 2548 wrote to memory of 4344	2548	Dkkcge32.exe	103
PID 4344 wrote to memory of 2240	4344	Daekdooc.exe	104
PID 4344 wrote to memory of 2240	4344	Daekdooc.exe	104
PID 4344 wrote to memory of 2240	4344	Daekdooc.exe	104
PID 2240 wrote to memory of 2952	2240	Dgbdlf32.exe	105
PID 2240 wrote to memory of 2952	2240	Dgbdlf32.exe	105
PID 2240 wrote to memory of 2952	2240	Dgbdlf32.exe	105

C:\Users\Admin\AppData\Local\Temp\44a475c44859f4e6c46fa564af44cea0N.exe
"C:\Users\Admin\AppData\Local\Temp\44a475c44859f4e6c46fa564af44cea0N.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Windows\SysWOW64\Cfbkeh32.exe
  C:\Windows\system32\Cfbkeh32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4408
- - C:\Windows\SysWOW64\Cmlcbbcj.exe
    C:\Windows\system32\Cmlcbbcj.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4248
  - - C:\Windows\SysWOW64\Chagok32.exe
      C:\Windows\system32\Chagok32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4424
    - - C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1572
      - C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3512
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3632
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1976
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4428
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2988
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1652
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1912
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1968
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3444
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3480
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3544
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:540
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1888
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2548
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4344
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2240
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        22⤵
        Executes dropped EXE
        
        PID:2952
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2952 -s 408
        23⤵
        Program crash
        
        PID:3188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2952 -ip 2952
1⤵
PID:3252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Cajlhqjp.exe

Filesize
74KB

MD5
9d286907f356ab3135048a085ece44e3

SHA1
7bf3eea78fcaee26fa4c9e1f4e2da04f915c8616

SHA256
9ed8dec42d58d3cee484704ad43e77f7717769c1bcc99a77a080bfc069f669fa

SHA512
155d9d199b27769e026d629b74ea8dd6644dbcef27e4d5c8a6a340b07decf25f70f187efd88f027b263aae1d0afe09ac4434ef4950b9f74606673f113a476058

Download Submit
C:\Windows\SysWOW64\Cegdnopg.exe

Filesize
74KB

MD5
32a864dfae634b2c762baf8c64a333a8

SHA1
ce4649a7e753259084a1d253ac0864e229a85570

SHA256
ba942b11612879549a90e6b82e113f3ab7321f55a14a8fbe0e999ba1a57ea429

SHA512
3a61ee9687220d421ee829a851d25f727d131ebc6e5c42ea786525274bc06bbe8c142ec50e0cab2f37fa3f4ebf2963b9d0aa1dd22961cfc3c494498902cdadc0

Download Submit
C:\Windows\SysWOW64\Cfbkeh32.exe

Filesize
74KB

MD5
7b6996b1c265bb35c3af2289cfb7c681

SHA1
e5a28bb4c494e415ecfd04b41ddd7b5cc0f399fc

SHA256
0cff682447aeafbcf1d682a4518152b1514aa7abb795368288d423da370f4ccc

SHA512
9c275dbc13b24e75b270af68f24b8d0af34dcca1665a916611d2b1199a1b92d00cb7780a9212957880f53dcb1371e99fdc70687f88d460bcada858c6a9ea218e

Download Submit
C:\Windows\SysWOW64\Chagok32.exe

Filesize
74KB

MD5
858963e8a3eaffdbc013bc53ecb3d13d

SHA1
0e31d7ae3aa66900e4107d4a365cb2c66cf6853b

SHA256
2613812171c5ebdc406813562e42e6c72d10ad8da8a87dbca3f10cba4010506a

SHA512
fae198a593b87c4dbac1213f836893a77358dcb82e03623b8da4bd73e04483e46645909765e738881eaa8309738e04f360f8a17d7096645db84056b2f5d5adb5

Download Submit
C:\Windows\SysWOW64\Chcddk32.exe

Filesize
74KB

MD5
5cf208a577a9695b68da36a42507ca92

SHA1
f83fe4178a856b69be17c97bd11146dba963241c

SHA256
e70cde3fe3a4a47a8753482dbfa871efaebdcb594ac6ccdd90968973c61f0359

SHA512
c39e78694d4dfc8f073bc85c4e0585aa9ae3f673924235e95d46474b960755bfbbeea33d578920d5fef8834c554e952b21cbc246bd6472f456efe066a032c1be

Download Submit
C:\Windows\SysWOW64\Clghpklj.dll

Filesize
7KB

MD5
d42645fa9fabd7f9f3c583f1d0fc8060

SHA1
3749d22831fab2e081d0814c1cf8bc31f6bd4bcb

SHA256
da6c37120c8309c74e39a8bcf1e975f7d1aecd98006cab62742f25df80d07c98

SHA512
51b7da28534302c847d28aecb04a9957bf5286fa161189b48ff0499d29ae5dcfe66b54a54b63ff07314f735a426597531aa61ff5cc991c8c6dfb71a9199b6fc7

Download Submit
C:\Windows\SysWOW64\Cmlcbbcj.exe

Filesize
74KB

MD5
56a9373cf7b63251c3687ac5b42582a4

SHA1
a7db5e084395b79d7cb225fbbba6c321f8b1bcda

SHA256
6c80b23d9bcc1ce935db1e817a576240c52fcf5f7109c3bfe1b623559ec7f073

SHA512
aab020a375f4df04e22a0fdac9f8028c3e89c0d272fc440f45985ddeaf407871a0bf16daa195f7ed9039f7db8ad3eace0950847f7b986aaf889e51d556cc9fbe

Download Submit
C:\Windows\SysWOW64\Cmqmma32.exe

Filesize
74KB

MD5
fa916a85c631a1e360d7b5f9019ad186

SHA1
3078d64b8c2946692cd1df59151a353bd48f387c

SHA256
cdb15aa8818b8353e853bc8041e6ff62c2f6316414928dbe750368b94dac8f9b

SHA512
ad9928b5ac2dfe1663a2293bd831fa9b6cd2f7cb74ff953b7d484a049d69b2e44e31cca6465a7470e4c78f0d4279d1855830ada09fbdb944c0701ada4c2635a0

Download Submit
C:\Windows\SysWOW64\Cnkplejl.exe

Filesize
74KB

MD5
db6ca3c4fdca6926c5d97315403ea3bd

SHA1
2886f2efbeeb8dacf908ae71c76c9acd84bd4c53

SHA256
71eecfbf83486f3de4e6723b5eb5bb1a6df62a1c3c6d6f1685b6940fc80328d1

SHA512
667ef727b2bc238fe9253c68dff13661140502b96e20178898633a7103969589175c6da0bd53c369dea24b814c8a5cc422c804b2ee55357b760e16d41df98111

Download Submit
C:\Windows\SysWOW64\Daekdooc.exe

Filesize
74KB

MD5
f9731b1fee25ba5edaa260c4629fa2a3

SHA1
a871c77bbf769901fd41baf555320a7972546257

SHA256
ede652cf2ea4e51ceed01fbc17706ffd93ff5e61d25395cf4a699404b6cfdfae

SHA512
eb4f200aa2fe03c8d73cdd0aa45e315c8cb33baa390dda1f4bf7b2267170a812334eed562c8bafa67680d3302947c5eec9ec1b7cc509b2a31d021473e46a19f0

Download Submit
C:\Windows\SysWOW64\Daqbip32.exe

Filesize
74KB

MD5
a49e808839b6c578f006e657b82e9169

SHA1
d080534caaebb6a535532caac07bc1d162880056

SHA256
d86094416143524f8021cc530c08069b61e0d5481624284efa96ff48f4ded9a2

SHA512
4c498f9e81c8a32fb00ba7358d57884bbabee8e98c6404679b60b2d4401083a6b12e0d901c967ce0f7e10ca757ef73601beff7798392e99c512f8dd890145230

Download Submit
C:\Windows\SysWOW64\Ddakjkqi.exe

Filesize
74KB

MD5
062cbfa50c7e966a68f70404768f4b63

SHA1
d2f551d76c21f778305c684109fce9e13e0a1b11

SHA256
24b669f0cb50dec863364d5aa6a81ce60c1692aa85a9a3d9bb83b04fe12f785e

SHA512
1739ea0c7ed2657b43710822c3ba074bd0fe05080be47f096a2df9769eec3fa7a8b1ea8c966879b04712e4be16c7ec2d53bc08cc3292eab86a3effa28d8adde3

Download Submit
C:\Windows\SysWOW64\Ddakjkqi.exe

Filesize
74KB

MD5
6e0cf1c3dda3490e80c94491f2d408dc

SHA1
afee90f0409def23af3681dc2ab925ae773cf200

SHA256
d1abd741974c378da6987e1f03e9d993d04aae0f777e5b8e8d0616a0750e9da2

SHA512
136dbd0585b966cf80f01bc442c414e0e28db9005cea9050b2c551b546ff3d9856927f5a9f7f21df4e6a48b9727d1a8e046c0183c56c0ee8b7dfcb1e63843523

Download Submit
C:\Windows\SysWOW64\Ddonekbl.exe

Filesize
74KB

MD5
b1a46cc25af712687b173bec7673b474

SHA1
b90772454e60bec5ddb74e185e690115b1620dc9

SHA256
417163f52e1aa551e8b1ed43c538155ddc6cfd2e349178ebc3817e7b8c2f16e7

SHA512
9babece61085be2e55be791ffa44d73cd25b6ef75635f6a2b894cf90f895b3f1a69d19aacae45e64a111fa7b4786cac3bc3b625ec6eec46f3dd6426198f7ecaa

Download Submit
C:\Windows\SysWOW64\Dejacond.exe

Filesize
74KB

MD5
1fc08b56d14de6c7b75bb270b21f16b1

SHA1
3054912045a304e18bb831301dac1e08788f47df

SHA256
2cde341e532ce8e86c17b15f463c097b6eae6712769cabd821c347ef7dd5554d

SHA512
02046fc2f0d4b18fc6020707b2b90d3ca45d5af465d75dd40b0e6da859a1c0ed05a3bd3f8173b1cb6c3ebdb37d6d1d12b7fef4ebc1a54e0e3be5dea5e4c4bf86

Download Submit
C:\Windows\SysWOW64\Dfiafg32.exe

Filesize
74KB

MD5
11c5bc9a2c8aa612521a19a808932c14

SHA1
4f2c25d11562d6df643f7bd99252d0c37fdf1521

SHA256
fc332f781e57f0aab8ca81be65e3b4e895de6dc6006f03ecdc54aedfca20e11f

SHA512
d59390c32ee0aaba67eeb2c2de957ae680e399ca21f4fb476458789d0b37cd94acc6c3190b8fa2acca0cf51cb5836ba6ac08fad58daf7cf1e4d7ce4d15fa80ca

Download Submit
C:\Windows\SysWOW64\Dgbdlf32.exe

Filesize
74KB

MD5
6dbda4a0f37c7a1368f2f489ef8a8bf8

SHA1
cf5cf9f7087cc5a4a7339fcc361f123647cf1ecc

SHA256
e5418bf2715ee806507d5eac4edd01108201e79bd71db12dd76db64fcba72330

SHA512
88253a04eba7635fe292112a44c9ee793c1b5e9e2d2583d53e1e2916252616cefca7e73780737d283310deec23eacceaca13544e884745511df07d4f93c262c4

Download Submit
C:\Windows\SysWOW64\Djgjlelk.exe

Filesize
74KB

MD5
6d2c43e4524478e9ad22dea1f68f818b

SHA1
f8c8a2da7b17f7481616c14fd97638421e9c7d6b

SHA256
619bb95873637d963a2f803c22dd85d48789f59265269087b0fa3b81c862ee3c

SHA512
c2865357ad399a8c78df0e9c7c5ee0de51a2a593d765ae22dcf32e4958025841d6ad7e94fbbaad8a205089d7527c6b65f18167858d36472355e32704ab4488dc

Download Submit
C:\Windows\SysWOW64\Dkifae32.exe

Filesize
74KB

MD5
5b8ae8797fd89f307f2d25089288c8ca

SHA1
e67a9dc4de125aeee243b0f6c7a73840d347c26e

SHA256
ecce3fd3ee1816b13610b35b9c03fcfa6b9702cf3a3ac0de78db5f394ffdcedf

SHA512
eb7107afbe8ea67775ebb540fcdd5d660c9dd07a810fdc7026f66ad51ce9b2a39e5094c6ecee01c3867afebed2f321b44456fb635daf153601f857cbf4404e24

Download Submit
C:\Windows\SysWOW64\Dkkcge32.exe

Filesize
74KB

MD5
654894c067b27a5caf836368a542c278

SHA1
1fbbb3fc1f17a7f40732217b50882afe3197c7d4

SHA256
ebf7dcea03ac1b682a3027db63ac77df9184e217e879a0d62ed108c1185d96c3

SHA512
33a59a372cc0ceaec4157e1bf5f60500c86e301ddc2d0fa992454b5c3f59877422e0998d6d827cced51fe2450db671f868353731ec554a1f2c2652f856f81ac0

Download Submit
C:\Windows\SysWOW64\Dmcibama.exe

Filesize
74KB

MD5
5349b6a12c52253ae400718201546eff

SHA1
58fdae798e2f8870bb9218e29e696470476f47c2

SHA256
c966aa7237292f867a2523bcca517f21a99edc7386ba8fec77354eb954d409b7

SHA512
2dceb032fa66ac66585df688b438187a0a26d6bab3d05e283574e0cb3d3798bebbec201d9f7e23a5cb934527f5993a3b98bd7170db20eb8b2274c5e9b3ca1a42

Download Submit
C:\Windows\SysWOW64\Dmgbnq32.exe

Filesize
74KB

MD5
cc9516ecff97b42ddb76ef3fb191b364

SHA1
6d35c0bdc89715d09d0a68270ce5a99c974ac282

SHA256
7117b5a2a34b05c52ada4410f2fb438d28be9940574593d3ed20c25991749afa

SHA512
53aef2c4017720484baede4497b40f614e568c640b77105529fa08ab2a7fc35235e52d44063e1292e4ad7d6e427f32bd98f441dcc53018714c84fb5b9595d2b1

Download Submit
C:\Windows\SysWOW64\Dmllipeg.exe

Filesize
74KB

MD5
518985b447b252fed06d3c72c0870ffb

SHA1
d8937e6ddf5c7c815ecbc85bd5c528c589ea0faf

SHA256
66c0136dda0c505074e4da902dc83af1b0e5e2c1bd29b57016b04c57b8b98694

SHA512
d51fcc8e9e905bdcae329a009a7366216be00089cdaeb425dc8ecc6e8d619e2140f5bc90a1eb662cd6fad61adb51772d17726d6c2cc1f4795243f01c7cd1a6f8

Download Submit
memory/540-180-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/540-128-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1572-201-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1572-32-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1652-189-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1652-83-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1888-179-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1888-135-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1912-187-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1912-87-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1968-96-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1968-185-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1976-56-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1976-196-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2240-172-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2240-159-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2548-143-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2548-176-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2664-209-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2664-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2952-171-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2952-168-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2988-71-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2988-191-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3444-108-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3480-116-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3512-199-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3512-40-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3544-181-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3544-120-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3632-47-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3632-197-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4248-16-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4248-205-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4344-175-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4344-152-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4408-207-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4408-8-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4424-203-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4424-24-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4428-193-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4428-64-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads