b155001a878cfcbd7ecf511fb258bdddd60aa32742ab404c3e93ed9a54f94522

Analysis

max time kernel
103s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20/08/2024, 14:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cdf42e0adf58e3fbeb09464a5c32bae0N.exe
Size

790KB
MD5

cdf42e0adf58e3fbeb09464a5c32bae0
SHA1

0c719ecd45df12281784dc3b5e3e85525df9b11b
SHA256

b155001a878cfcbd7ecf511fb258bdddd60aa32742ab404c3e93ed9a54f94522
SHA512

aa49fa411615530c98874fc8771b2e6c96e0645c06bbaa055a7ad87313593f19c2bf6418090d6633d49fc7c3e63edc021de70f896afd17db84c0c9aa136736fe
SSDEEP

12288:uG/vt3cFB24lwR4P87g7/VycgE81lgxaa79y:uI18PqoIlg17o

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 62 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Amgapeea.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdhhdlid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dfiafg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acnlgp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cagobalc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfiafg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmefhako.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Deokon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cjinkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cagobalc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dkifae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bfdodjhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Belebq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cjkjpgfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cfbkeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Calhnpgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Qffbbldm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chjaol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Deokon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bchomn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bmbplc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmnpgb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qffbbldm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcjlcn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmbplc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ddjejl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	cdf42e0adf58e3fbeb09464a5c32bae0N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aqppkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ajhddjfn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfdodjhm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aqncedbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bcjlcn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjfaeh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Belebq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cmnpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cdhhdlid.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daekdooc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Anadoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Chjaol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Afhohlbj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajhddjfn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dknpmdfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aqncedbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Anadoi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aqppkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Acnlgp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bjfaeh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjinkg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	cdf42e0adf58e3fbeb09464a5c32bae0N.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bchomn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfbkeh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afhohlbj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmngqdpj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkifae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dknpmdfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Amgapeea.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjkjpgfi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Calhnpgn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddjejl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dmefhako.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Daekdooc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bmngqdpj.exe

Executes dropped EXE 31 IoCs

pid	Process
3140	Qffbbldm.exe
4364	Afhohlbj.exe
3956	Aqncedbp.exe
2324	Anadoi32.exe
540	Aqppkd32.exe
3356	Acnlgp32.exe
2316	Ajhddjfn.exe
3084	Amgapeea.exe
4980	Bfdodjhm.exe
2424	Bmngqdpj.exe
1992	Bchomn32.exe
1768	Bcjlcn32.exe
2936	Bmbplc32.exe
3936	Bjfaeh32.exe
1900	Belebq32.exe
1948	Chjaol32.exe
1548	Cjinkg32.exe
4280	Cjkjpgfi.exe
1588	Cfbkeh32.exe
4368	Cagobalc.exe
1484	Cmnpgb32.exe
2124	Cdhhdlid.exe
3992	Calhnpgn.exe
4924	Ddjejl32.exe
4836	Dfiafg32.exe
1004	Dmefhako.exe
2796	Dkifae32.exe
468	Deokon32.exe
4804	Daekdooc.exe
4776	Dknpmdfc.exe
1028	Dmllipeg.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Ffpmlcim.dll	Cagobalc.exe
File created	C:\Windows\SysWOW64\Lpggmhkg.dll	Cmnpgb32.exe
File created	C:\Windows\SysWOW64\Jpcnha32.dll	Bcjlcn32.exe
File created	C:\Windows\SysWOW64\Ghekjiam.dll	Cjkjpgfi.exe
File created	C:\Windows\SysWOW64\Dmllipeg.exe	Dknpmdfc.exe
File opened for modification	C:\Windows\SysWOW64\Aqncedbp.exe	Afhohlbj.exe
File opened for modification	C:\Windows\SysWOW64\Aqppkd32.exe	Anadoi32.exe
File created	C:\Windows\SysWOW64\Bchomn32.exe	Bmngqdpj.exe
File created	C:\Windows\SysWOW64\Kbejge32.dll	Bmngqdpj.exe
File opened for modification	C:\Windows\SysWOW64\Cjinkg32.exe	Chjaol32.exe
File created	C:\Windows\SysWOW64\Naeheh32.dll	Cdhhdlid.exe
File created	C:\Windows\SysWOW64\Daekdooc.exe	Deokon32.exe
File created	C:\Windows\SysWOW64\Ajhddjfn.exe	Acnlgp32.exe
File opened for modification	C:\Windows\SysWOW64\Amgapeea.exe	Ajhddjfn.exe
File created	C:\Windows\SysWOW64\Gmdlbjng.dll	Ajhddjfn.exe
File created	C:\Windows\SysWOW64\Glbandkm.dll	Amgapeea.exe
File created	C:\Windows\SysWOW64\Bcjlcn32.exe	Bchomn32.exe
File opened for modification	C:\Windows\SysWOW64\Belebq32.exe	Bjfaeh32.exe
File created	C:\Windows\SysWOW64\Cjinkg32.exe	Chjaol32.exe
File opened for modification	C:\Windows\SysWOW64\Cmnpgb32.exe	Cagobalc.exe
File created	C:\Windows\SysWOW64\Anadoi32.exe	Aqncedbp.exe
File opened for modification	C:\Windows\SysWOW64\Acnlgp32.exe	Aqppkd32.exe
File opened for modification	C:\Windows\SysWOW64\Daekdooc.exe	Deokon32.exe
File created	C:\Windows\SysWOW64\Nokpao32.dll	Daekdooc.exe
File created	C:\Windows\SysWOW64\Dknpmdfc.exe	Daekdooc.exe
File created	C:\Windows\SysWOW64\Hfanhp32.dll	Calhnpgn.exe
File created	C:\Windows\SysWOW64\Dfiafg32.exe	Ddjejl32.exe
File created	C:\Windows\SysWOW64\Maghgl32.dll	Aqppkd32.exe
File created	C:\Windows\SysWOW64\Ndhkdnkh.dll	Bmbplc32.exe
File created	C:\Windows\SysWOW64\Echdno32.dll	Cfbkeh32.exe
File created	C:\Windows\SysWOW64\Dkifae32.exe	Dmefhako.exe
File opened for modification	C:\Windows\SysWOW64\Qffbbldm.exe	cdf42e0adf58e3fbeb09464a5c32bae0N.exe
File created	C:\Windows\SysWOW64\Pkejdahi.dll	Afhohlbj.exe
File created	C:\Windows\SysWOW64\Ddjejl32.exe	Calhnpgn.exe
File opened for modification	C:\Windows\SysWOW64\Dmllipeg.exe	Dknpmdfc.exe
File created	C:\Windows\SysWOW64\Kngpec32.dll	Dknpmdfc.exe
File created	C:\Windows\SysWOW64\Bfdodjhm.exe	Amgapeea.exe
File created	C:\Windows\SysWOW64\Bmbplc32.exe	Bcjlcn32.exe
File opened for modification	C:\Windows\SysWOW64\Ajhddjfn.exe	Acnlgp32.exe
File created	C:\Windows\SysWOW64\Ogfilp32.dll	Chjaol32.exe
File created	C:\Windows\SysWOW64\Aqppkd32.exe	Anadoi32.exe
File created	C:\Windows\SysWOW64\Jlklhm32.dll	Anadoi32.exe
File opened for modification	C:\Windows\SysWOW64\Bfdodjhm.exe	Amgapeea.exe
File opened for modification	C:\Windows\SysWOW64\Bjfaeh32.exe	Bmbplc32.exe
File created	C:\Windows\SysWOW64\Dmefhako.exe	Dfiafg32.exe
File created	C:\Windows\SysWOW64\Afhohlbj.exe	Qffbbldm.exe
File opened for modification	C:\Windows\SysWOW64\Anadoi32.exe	Aqncedbp.exe
File created	C:\Windows\SysWOW64\Leqcid32.dll	Bfdodjhm.exe
File created	C:\Windows\SysWOW64\Hjjdjk32.dll	Bchomn32.exe
File opened for modification	C:\Windows\SysWOW64\Bmbplc32.exe	Bcjlcn32.exe
File created	C:\Windows\SysWOW64\Cmnpgb32.exe	Cagobalc.exe
File created	C:\Windows\SysWOW64\Cdhhdlid.exe	Cmnpgb32.exe
File opened for modification	C:\Windows\SysWOW64\Calhnpgn.exe	Cdhhdlid.exe
File created	C:\Windows\SysWOW64\Aoqimi32.dll	cdf42e0adf58e3fbeb09464a5c32bae0N.exe
File created	C:\Windows\SysWOW64\Bmngqdpj.exe	Bfdodjhm.exe
File created	C:\Windows\SysWOW64\Kkmjgool.dll	Ddjejl32.exe
File created	C:\Windows\SysWOW64\Jfihel32.dll	Belebq32.exe
File opened for modification	C:\Windows\SysWOW64\Cfbkeh32.exe	Cjkjpgfi.exe
File opened for modification	C:\Windows\SysWOW64\Cdhhdlid.exe	Cmnpgb32.exe
File created	C:\Windows\SysWOW64\Calhnpgn.exe	Cdhhdlid.exe
File opened for modification	C:\Windows\SysWOW64\Dfiafg32.exe	Ddjejl32.exe
File created	C:\Windows\SysWOW64\Ohmoom32.dll	Deokon32.exe
File created	C:\Windows\SysWOW64\Belebq32.exe	Bjfaeh32.exe
File created	C:\Windows\SysWOW64\Gallfmbn.dll	Bjfaeh32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1116	1028	WerFault.exe	119

System Location Discovery: System Language Discovery 1 TTPs 32 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Belebq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjkjpgfi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cagobalc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daekdooc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dknpmdfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmllipeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Anadoi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chjaol32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Calhnpgn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfiafg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qffbbldm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmbplc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjinkg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmnpgb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmefhako.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cdf42e0adf58e3fbeb09464a5c32bae0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfbkeh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afhohlbj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aqncedbp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aqppkd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjfaeh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajhddjfn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amgapeea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmngqdpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Deokon32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Acnlgp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bchomn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdhhdlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkifae32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfdodjhm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcjlcn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddjejl32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Calhnpgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hfanhp32.dll"	Calhnpgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dmefhako.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	cdf42e0adf58e3fbeb09464a5c32bae0N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Glbandkm.dll"	Amgapeea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Echdno32.dll"	Cfbkeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cmnpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cjinkg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cmnpgb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Daekdooc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkejdahi.dll"	Afhohlbj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Aqppkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Amgapeea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogfilp32.dll"	Chjaol32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	cdf42e0adf58e3fbeb09464a5c32bae0N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	cdf42e0adf58e3fbeb09464a5c32bae0N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kngpec32.dll"	Dknpmdfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cjkjpgfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Naeheh32.dll"	Cdhhdlid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Daekdooc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bchomn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kkmjgool.dll"	Ddjejl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nokpao32.dll"	Daekdooc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Anadoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Acnlgp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ajhddjfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bmngqdpj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bmngqdpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kbejge32.dll"	Bmngqdpj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bjfaeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bjfaeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Qffbbldm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Aqncedbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ajhddjfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bfdodjhm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Belebq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cagobalc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ddjejl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dknpmdfc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Acnlgp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bchomn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gallfmbn.dll"	Bjfaeh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dkifae32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}	cdf42e0adf58e3fbeb09464a5c32bae0N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmdlbjng.dll"	Ajhddjfn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bmbplc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Calhnpgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Amfoeb32.dll"	Dkifae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Deokon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kboeke32.dll"	Qffbbldm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Chjaol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ffpmlcim.dll"	Cagobalc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cdhhdlid.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dfiafg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gidbim32.dll"	Dfiafg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dmefhako.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Anadoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bcjlcn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfihel32.dll"	Belebq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Chjaol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Omocan32.dll"	Cjinkg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cagobalc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dkifae32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Afhohlbj.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 3140	4800	cdf42e0adf58e3fbeb09464a5c32bae0N.exe	86
PID 4800 wrote to memory of 3140	4800	cdf42e0adf58e3fbeb09464a5c32bae0N.exe	86
PID 4800 wrote to memory of 3140	4800	cdf42e0adf58e3fbeb09464a5c32bae0N.exe	86
PID 3140 wrote to memory of 4364	3140	Qffbbldm.exe	87
PID 3140 wrote to memory of 4364	3140	Qffbbldm.exe	87
PID 3140 wrote to memory of 4364	3140	Qffbbldm.exe	87
PID 4364 wrote to memory of 3956	4364	Afhohlbj.exe	88
PID 4364 wrote to memory of 3956	4364	Afhohlbj.exe	88
PID 4364 wrote to memory of 3956	4364	Afhohlbj.exe	88
PID 3956 wrote to memory of 2324	3956	Aqncedbp.exe	89
PID 3956 wrote to memory of 2324	3956	Aqncedbp.exe	89
PID 3956 wrote to memory of 2324	3956	Aqncedbp.exe	89
PID 2324 wrote to memory of 540	2324	Anadoi32.exe	90
PID 2324 wrote to memory of 540	2324	Anadoi32.exe	90
PID 2324 wrote to memory of 540	2324	Anadoi32.exe	90
PID 540 wrote to memory of 3356	540	Aqppkd32.exe	91
PID 540 wrote to memory of 3356	540	Aqppkd32.exe	91
PID 540 wrote to memory of 3356	540	Aqppkd32.exe	91
PID 3356 wrote to memory of 2316	3356	Acnlgp32.exe	92
PID 3356 wrote to memory of 2316	3356	Acnlgp32.exe	92
PID 3356 wrote to memory of 2316	3356	Acnlgp32.exe	92
PID 2316 wrote to memory of 3084	2316	Ajhddjfn.exe	93
PID 2316 wrote to memory of 3084	2316	Ajhddjfn.exe	93
PID 2316 wrote to memory of 3084	2316	Ajhddjfn.exe	93
PID 3084 wrote to memory of 4980	3084	Amgapeea.exe	94
PID 3084 wrote to memory of 4980	3084	Amgapeea.exe	94
PID 3084 wrote to memory of 4980	3084	Amgapeea.exe	94
PID 4980 wrote to memory of 2424	4980	Bfdodjhm.exe	95
PID 4980 wrote to memory of 2424	4980	Bfdodjhm.exe	95
PID 4980 wrote to memory of 2424	4980	Bfdodjhm.exe	95
PID 2424 wrote to memory of 1992	2424	Bmngqdpj.exe	96
PID 2424 wrote to memory of 1992	2424	Bmngqdpj.exe	96
PID 2424 wrote to memory of 1992	2424	Bmngqdpj.exe	96
PID 1992 wrote to memory of 1768	1992	Bchomn32.exe	98
PID 1992 wrote to memory of 1768	1992	Bchomn32.exe	98
PID 1992 wrote to memory of 1768	1992	Bchomn32.exe	98
PID 1768 wrote to memory of 2936	1768	Bcjlcn32.exe	99
PID 1768 wrote to memory of 2936	1768	Bcjlcn32.exe	99
PID 1768 wrote to memory of 2936	1768	Bcjlcn32.exe	99
PID 2936 wrote to memory of 3936	2936	Bmbplc32.exe	101
PID 2936 wrote to memory of 3936	2936	Bmbplc32.exe	101
PID 2936 wrote to memory of 3936	2936	Bmbplc32.exe	101
PID 3936 wrote to memory of 1900	3936	Bjfaeh32.exe	103
PID 3936 wrote to memory of 1900	3936	Bjfaeh32.exe	103
PID 3936 wrote to memory of 1900	3936	Bjfaeh32.exe	103
PID 1900 wrote to memory of 1948	1900	Belebq32.exe	104
PID 1900 wrote to memory of 1948	1900	Belebq32.exe	104
PID 1900 wrote to memory of 1948	1900	Belebq32.exe	104
PID 1948 wrote to memory of 1548	1948	Chjaol32.exe	105
PID 1948 wrote to memory of 1548	1948	Chjaol32.exe	105
PID 1948 wrote to memory of 1548	1948	Chjaol32.exe	105
PID 1548 wrote to memory of 4280	1548	Cjinkg32.exe	106
PID 1548 wrote to memory of 4280	1548	Cjinkg32.exe	106
PID 1548 wrote to memory of 4280	1548	Cjinkg32.exe	106
PID 4280 wrote to memory of 1588	4280	Cjkjpgfi.exe	107
PID 4280 wrote to memory of 1588	4280	Cjkjpgfi.exe	107
PID 4280 wrote to memory of 1588	4280	Cjkjpgfi.exe	107
PID 1588 wrote to memory of 4368	1588	Cfbkeh32.exe	108
PID 1588 wrote to memory of 4368	1588	Cfbkeh32.exe	108
PID 1588 wrote to memory of 4368	1588	Cfbkeh32.exe	108
PID 4368 wrote to memory of 1484	4368	Cagobalc.exe	109
PID 4368 wrote to memory of 1484	4368	Cagobalc.exe	109
PID 4368 wrote to memory of 1484	4368	Cagobalc.exe	109
PID 1484 wrote to memory of 2124	1484	Cmnpgb32.exe	110

C:\Users\Admin\AppData\Local\Temp\cdf42e0adf58e3fbeb09464a5c32bae0N.exe
"C:\Users\Admin\AppData\Local\Temp\cdf42e0adf58e3fbeb09464a5c32bae0N.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Windows\SysWOW64\Qffbbldm.exe
  C:\Windows\system32\Qffbbldm.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3140
- - C:\Windows\SysWOW64\Afhohlbj.exe
    C:\Windows\system32\Afhohlbj.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4364
  - - C:\Windows\SysWOW64\Aqncedbp.exe
      C:\Windows\system32\Aqncedbp.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3956
    - - C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2324
      - C:\Windows\SysWOW64\Aqppkd32.exe
        
        C:\Windows\system32\Aqppkd32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:540
        
        C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3356
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2316
        
        C:\Windows\SysWOW64\Amgapeea.exe
        
        C:\Windows\system32\Amgapeea.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3084
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4980
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2424
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1992
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1768
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2936
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3936
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1900
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1948
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1548
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4280
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1588
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4368
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1484
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2124
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3992
        
        C:\Windows\SysWOW64\Ddjejl32.exe
        
        C:\Windows\system32\Ddjejl32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4924
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4836
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1004
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2796
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:468
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4804
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4776
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        32⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1028
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1028 -s 412
        33⤵
        Program crash
        
        PID:1116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1028 -ip 1028
1⤵
PID:2200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Acnlgp32.exe

Filesize
790KB

MD5
ca4f3052de74415e55afde69be1f69f6

SHA1
1548f878771e5945ba2750fd331e0154c2d50d3b

SHA256
2adf6695d7de8f7e35d5e737467149182ae48eb29cd170598558b733ebfb5a35

SHA512
b2f61b59598324484284d6f85d33a6790bea8dd3b9cc731038f684d12e95f6f9c8595cf17a507c4680336586f381366fdba9a1fec1a1c709ca92d2a1f357ec55

Download Submit
C:\Windows\SysWOW64\Afhohlbj.exe

Filesize
790KB

MD5
2874f46779d5ba5d43c84446f9d01a14

SHA1
6af276fbfac9eefb1f559da364aa08a155f4bd27

SHA256
d8a9cd527095d564d9a9e343d9d2586a882a40fa3decf01dd04efba7e6e91ca9

SHA512
e9e39ed8d99f143339be4e7639ab4ebe73f3bcb90f8ae3a4133d32deb5cb02269997d1d04a2038292e3485be3adef780ed415fb327f927e7b97a291544279be7

Download Submit
C:\Windows\SysWOW64\Afhohlbj.exe

Filesize
64KB

MD5
71e0793b8573beec3b3abe506361ef8f

SHA1
5b9f26c350e94f48f7e54c836a5d062234607d14

SHA256
3455c47c3feb10121d3ef8f7c725b3ce73cfc3ca377f19def19860076e742e5b

SHA512
9f88ecb674fb626dc6a7be1995aa98f08a098a7433b1490a2a23752ae1531f2344160e197d8f2b46ff8ecf085597f3c02ba8b955524a9089a8ccfcb6e176599b

Download Submit
C:\Windows\SysWOW64\Ajhddjfn.exe

Filesize
790KB

MD5
408cb007b6e812ea8c8ea6b56ce2652c

SHA1
3102897cd1623a7f9050cc217b65ca78d3f5a81b

SHA256
e50c764efe27b3d3e9cf5061ebccc1dfb1c641e4ed8c9cdf241637304f9fb6f2

SHA512
f65ef8b7c350c1768c84ffbfc0a242713eea0f46f006cfc3f0875c9cac46c16233062c29d17a05a3f93ced57e5319f28fdc3fa9e0452aec2e6cf596b586838de

Download Submit
C:\Windows\SysWOW64\Amgapeea.exe

Filesize
790KB

MD5
c51600047c35267ce0ffeb921f946bb1

SHA1
e68915aa2a5d44186c9c31a6e5e6ef01957c5149

SHA256
7a7f3b63a69bd12660f5435416ffcf24dacfc8ede8b34e6d8ff6a9cc49db3a21

SHA512
fdec15c800252983bf49b1e09a035814850f420d26180bf989c3aba5a438a324911673103f3d1dc649d93c2b7a28e6724c4ee9b6b7437fdc10ce5645a61e76f4

Download Submit
C:\Windows\SysWOW64\Anadoi32.exe

Filesize
790KB

MD5
c0d9d36f177557fc96bc05003da21134

SHA1
a317d84bff9e7f45b3e95116502eb87fdc8c281b

SHA256
828d3e1ffc960cd7e7069318f7ee607a05762ecb2a1bb400b0cbe7265181e3fb

SHA512
e72ffd02059b9dc41ec95a13574cf70a103f43ac39191afdc54185d2c714ae3201d9556a9980608b8c2ad431de93bc9b18fde600b043a3e9e39d903ad4db94eb

Download Submit
C:\Windows\SysWOW64\Aqncedbp.exe

Filesize
790KB

MD5
defb834b7c7d4c121220473616bc1c63

SHA1
0fe3d1e9caba11828bfbeb9f3b5cb09910106364

SHA256
49f4e43b7a9e4916a3ba669850b929a2286f5376aa37c1aaac29a609b33c0009

SHA512
92fae87bf33d75f9e1c0162aa1b742987a0b1ac4e4e8c8c681e2121d7d9a1b0cc04715882dfe00c1e16e78b1b8806e34ed40e44c6f5fa7a03a0878f04f758ac8

Download Submit
C:\Windows\SysWOW64\Aqppkd32.exe

Filesize
790KB

MD5
42c609e0145643154b3c87e509582726

SHA1
403670fa0740c37af670f738b6b4c37f37cc8953

SHA256
6ff2e54fc3b4fbbbf88cc90fabc5d60e74cc4ec68379a4c04a08560a0ab7fd38

SHA512
60254196d323b2ed3f6e367534936cf28df37aab870fa935ee7fc0cfcd166360e23ce16105a2b83c2957a0e65a72e85780976c308d47b61e538781c0fd76b241

Download Submit
C:\Windows\SysWOW64\Bchomn32.exe

Filesize
790KB

MD5
7889a18cbf8e03b832b597b3ed6e613d

SHA1
164a7915d11113cea8e15455ec1d700ffdc50f96

SHA256
6b527a0fe4e0951a47ea4080562f06ea1adb2212cae3653d94bc2fbf4184d3d8

SHA512
329c52922dc9254780cabe0ed916c7e4df0a124d7dd2c7c0f26200cd3484a589b55eb3803fce6aa0829fc95d95e9f7a0d4c3cb90fadf24bf0517895192e4b84c

Download Submit
C:\Windows\SysWOW64\Bcjlcn32.exe

Filesize
790KB

MD5
48b49b433c93dd7d063feb55423b534d

SHA1
17736ab9ebd142f8ba30c2099fd4ca4ffdf21836

SHA256
9161f039260484193ccb0dd7109fdd2b5345e4f0689802ef5f6211c99d9a0943

SHA512
7f9f1c1722bda5e222f0e3c37d3c37a518231cd07d4ef2b8d4df3b3ebdc24b8f3b292fec24b1d3f099c9ce1678f71fea545cc456317663bdc3219639743cb6b0

Download Submit
C:\Windows\SysWOW64\Belebq32.exe

Filesize
790KB

MD5
5cc5f160792cfd59ff8b28eeaf362fb8

SHA1
9bd1d9df7e9d1339e4fb1df1eaae8bf18048b94f

SHA256
0fe60971194c5ab274b945636a0a0e18ddac827ee3fc8948e779e2b852af575a

SHA512
e73859afade42df9669547891d7c069b654dbfda60a25e741dc7a2c3b6f3c42a750144d1fe49102e49720faeb84eafcd07f2be2397bb8ae944082df10da833f5

Download Submit
C:\Windows\SysWOW64\Bfdodjhm.exe

Filesize
790KB

MD5
28bc20729d32444dbaa062844e034293

SHA1
c03c57b17ff06353b15eeab673f2ff3df9f7fb7f

SHA256
6c8db94b45d0d019223db528d65716d87785f75324fff6b3d6582dbe59e046d9

SHA512
942160d0a7b875a84b6bfa4abb4e106741e047b23e02dc771f1e745a26148dbc2cf2f93968996f66e797b9563fa44991f223fe5a5e75b13c47d8f44f66012749

Download Submit
C:\Windows\SysWOW64\Bjfaeh32.exe

Filesize
790KB

MD5
40d5d5a1c65f5d6a4fc10c7c6fcb678d

SHA1
d96790610c5ec47bdd8f5c38c68137e367740c79

SHA256
27eadcc680ba4d52f507ebd0175af084715b04fe400e97825a282debf78ac489

SHA512
89b6faf37ac5f79f2afd727b218c41770f89060193de1567f8de4c0ec2d0e249681f5fb8d92e7c7b11d2d47ccc9d696eabf29ccec03ec115ea1ebdcc1a02f23d

Download Submit
C:\Windows\SysWOW64\Bmbplc32.exe

Filesize
790KB

MD5
9abed83bcb137edc631824ad487c0676

SHA1
f2e04ba6ac530a4f39a694bd729760d448c714c8

SHA256
6d8308a8b8ce7e6e4c1a2ef9af061fb803f8761827562293b9155bca742fb36b

SHA512
cda28a8295d79196d1761ba7500496b326b39d23b07226dee1e95dfd8e65a7a07f426b8ef85e3587c02a663909b74f7f5e35420feec836d6270ea43e48086f7b

Download Submit
C:\Windows\SysWOW64\Bmngqdpj.exe

Filesize
790KB

MD5
03aca5d1c70df2018e9763fb13ad0ca6

SHA1
e4dc804f10075e787ab7c5772369b7b7a107644c

SHA256
5be517631481872ad47b713c72d55eaa98c774222759b2e9f39d6dc8e91ce868

SHA512
d69c2a0b4c5c814b000e8e1ed7f3e983c8ec23a1b33c30b7dce9096c6f546e2fcbb7bda359072b87696308c07f709fcbdad590217a99fab5f6110028cfbb1fea

Download Submit
C:\Windows\SysWOW64\Cagobalc.exe

Filesize
790KB

MD5
ca8906fd8320f6e34b57242d5d622854

SHA1
259fae96be0b03cd92d186e827e12b626dee0c7f

SHA256
ed43177c69bfe4ebf1740b9911deafb14a06034695a8ceb77bf1cd92066d55ba

SHA512
34eac7d37af001f7a59d557c064f6d98301b421a8c04e47446543f34301052aa845f06f97b6d4dea26a43106b2a1f0878709433f3ab21f0811fd176b0a169a5c

Download Submit
C:\Windows\SysWOW64\Calhnpgn.exe

Filesize
790KB

MD5
5041231db77611dd2642f53706b70176

SHA1
b4fd26639d2abcba1c733006d8cc2df459333990

SHA256
c262fb95713995ecbd26d4140a039a54cabfa0d54807a3c4498220f85ef5535f

SHA512
900f789ca723b82ec06bf324a3c58f564e413c561dcbcd2c7b502a3405a5f46cfa2e38a58676e6e8aace70565a1c34c5e0663016024f3452a3e54973b771c92b

Download Submit
C:\Windows\SysWOW64\Cdhhdlid.exe

Filesize
790KB

MD5
a1821111f3e70cb842eb6599588a7122

SHA1
84544e9682a0182dfb24093343d7188bb4ed98f6

SHA256
80aa813e56f83ad4157b3223ed961d3cf66a06e5cf5307e4b0ae50e666fe086e

SHA512
e426ce2291c23b3194dbb1b6e6f4e457834fa6c6a457ba804d28ae99e572dd3e8b758c4c9f6b6201d4c3fdcbc13cdb2382b82d1c32c33cd55f66e57f8f0bb6a5

Download Submit
C:\Windows\SysWOW64\Cfbkeh32.exe

Filesize
790KB

MD5
6db27ffff91f021f798e5693bcb7394c

SHA1
641c15382a7887b197e4f482d44cc79c7ba3b6de

SHA256
df12b6d4074926faea30cea59da2f384992090c6d6417fbdd281235fc7db4807

SHA512
46c0f29261ab5cb30a99517f6e47d5dfca0e5b6b34beaa1dcb0c86b38a04e313ab72f79607d2831021ed84e58470bc19274c2963cd0aec6195e4b1767aef6f5b

Download Submit
C:\Windows\SysWOW64\Chjaol32.exe

Filesize
790KB

MD5
f67f129a2a1ca90b47d35c277bd7f22c

SHA1
0140201b6f536899287751ec576613dce2f7fccf

SHA256
7bb54e0becf6adca53b12a6c83a0dc1f9fbb5c3539517d68682ce810966ff71d

SHA512
a86eef0e5d3e895972efed8515fe300ac000b408ccd642a65dc03bd5275543a469cb56e85209102ee273cbe35223d726391516f97bd88057fdb38d46f450d76d

Download Submit
C:\Windows\SysWOW64\Cjinkg32.exe

Filesize
790KB

MD5
905edf919711bb9e6bf2f870b69f3cae

SHA1
ef4717b49211da66c6182794adf61d50d4ff8648

SHA256
753b0cd810d3bb4164fc7534f6580215d97d4bb259aa4520462edb0cc3c4ab4b

SHA512
7005dc994893cd5deb94b109eb9fd28127e20533fc3d9d6bf1ec062cd3638f8dcc64f66f2b712da415f97d27e85a5a7faa8efb3a1ea6ac2c74474865f5675a37

Download Submit
C:\Windows\SysWOW64\Cjkjpgfi.exe

Filesize
790KB

MD5
17ad61c710a161b2fb95aaba7fe10f03

SHA1
a1ec9853881c91b760a9b48926629072c32821b9

SHA256
ef142fdfe767ebc1f691b5785b54c498ae6b66ebb808babb0bdcf84c846fb485

SHA512
5fde64a8759ccf058d9daaab9a786613375e1ee51bb2e338db134af31fd5b141c740e23e9bf976be14384421ad83a68a55b93905dd708cfc7d35069b01ff0acc

Download Submit
C:\Windows\SysWOW64\Cmnpgb32.exe

Filesize
790KB

MD5
891c990560a34983268942757dfc0bf7

SHA1
42435b78fd7542f0a6ed294d331a0c45dd343efc

SHA256
0448bc842bf4aca316c32bef19699033e62c83b74a7b436e5a6e949a4c8564bd

SHA512
cbdcd3029187ac9995d15790405e41bd5583b5816db14c090776acaf5184a55cc7e49c9913a81cf0efed0708e4f22954b2abf8410a0beaa245d11f171dc17b94

Download Submit
C:\Windows\SysWOW64\Daekdooc.exe

Filesize
790KB

MD5
85fbe0ab31625afa226c668cb7f0efda

SHA1
f849fc327b9e4f5387ed2c4baf0c7d7a70dd9fda

SHA256
6cda7c67461d6e94604a547f0e6507ca46d9d18ae1adad102fdb22f6add6a4a3

SHA512
ba6c742afc51506f2d952931ab2410a1a47b4d50100235c314e64f20b5c8ef3803de5e1239e4e5772bd2b9c90fc34faa80e076391995ee14ebb9bdea065d5d6a

Download Submit
C:\Windows\SysWOW64\Ddjejl32.exe

Filesize
790KB

MD5
60f8bed1eebeeac0cc6d1d5d6b32ed91

SHA1
72f86e8bacea0f971e5595ca6a78683291a355c0

SHA256
4e18322ab9568a9b7c783f8798645940d7882681b6201074b78b1cc17e12ce6d

SHA512
3084d502a51e412732bf3695f441d63201c77e261ccc2e7a29d3bf39cb15f1a2fc1c55fe08e0549e57628afb353efa1e161fa10de90b1aabd081efaa09f1190d

Download Submit
C:\Windows\SysWOW64\Deokon32.exe

Filesize
790KB

MD5
3a1ef87edf738ac9fb442af0b805b09e

SHA1
e0c7514b07ed7ef3953a4df0120258cd48edd7e2

SHA256
3b7cf367157ada6d1f7822f783cf67fc163e30986005ed257b2f4b8f7cc04786

SHA512
c4f836f232225b50c480e08c83a152bea1df20588b60ca9be884d19e31190fb40c902cf26e2b5989c2dbb0a77b30e6fa7696df3b27202681c6cc683214ad8702

Download Submit
C:\Windows\SysWOW64\Dfiafg32.exe

Filesize
790KB

MD5
9f82c0e76731ded8c23d1a53e5dd11e9

SHA1
154c27a1f866b4ea93d415c482ad6c589df28b44

SHA256
18f8311e842c2e0c7d263b8bb369b7bfbd2830e92f1504c425223b6e174d5cb2

SHA512
fdd0ee07a37c4d8b5912a203ac4c81832fb3db17e88c4e76420164b250adfe44c47a5ff9c8a79e910f0653a1e18d7bc1692f3c7826bbb54acdd661093967384b

Download Submit
C:\Windows\SysWOW64\Dfiafg32.exe

Filesize
790KB

MD5
cff9a88872c3e512684d1033c43b19c9

SHA1
dfeb1d46bb7520c9b0e12f5fbdfe65c499206451

SHA256
5cdb962bc01a4e6d1b7e251663a793b076652c41b60a454051fff608a569adb3

SHA512
1416601efffa7ac1d71a657b656a7f252fdd963ba86314d4c4b303b1ca76f5065df9bd5539cb0e958d2e9a194f8c92815630d5b9dd9dfa93d2a295f343979a93

Download Submit
C:\Windows\SysWOW64\Dkifae32.exe

Filesize
790KB

MD5
bf58ab4d9ceefc939d8bee322993d042

SHA1
57cc46fd02c8ab15f742b988c70b608411ceb704

SHA256
28d78de289bd84c19e2596855cc50b3e51659aea4042c9694f3a9da1cea851a3

SHA512
cd5254f4fe817e93e6b38e1f2145b0017a605cd992c3ad2af1fa8f9e41f0bafecf7512d19ff191a3f076f6225d3552e79a314597695d52910440cab9669df27c

Download Submit
C:\Windows\SysWOW64\Dknpmdfc.exe

Filesize
790KB

MD5
b31fa2d253143aa26d10fc19edcee25e

SHA1
3e4e825c1e476a9be6bd189d7bebe64721667981

SHA256
e5dcfb429bec04c84aed81a55febf66e093216c91a82886a1bf096dcef9ed5a3

SHA512
5a3d28d608e07359878cb39c168e7de3c2e42e0b8b44f9da5b10607a7bf53248dd94c816cb54ade2a712537752a9df70cb9aa039c74330e0f0bacdcd71c519aa

Download Submit
C:\Windows\SysWOW64\Dmefhako.exe

Filesize
790KB

MD5
0376988181191470aa849dbe55d439fb

SHA1
bdcded0abaf460076fdb589b0ef82a70de1ffc9c

SHA256
68b750f52270dffb6e68228e465e32617c284372c973e811e3a7e3f192664fe0

SHA512
f1d4afd4b98388afd5adac2ac1b9d52c376380c6ab6b18a31dfb2b56bfa1c3941e7d49e20ab415b80d2f8fd9b233bf9a4683a315652ff30429a1ae53a7d58ed2

Download Submit
C:\Windows\SysWOW64\Dmllipeg.exe

Filesize
790KB

MD5
723f703adf8b0ab4b9b4a82f4620d5e1

SHA1
9583269b40e8fcd4a5fcdf56494cce4cdae4dcab

SHA256
a614a137fdc64e16d5bb96c3b5b094a5fa6c3448388c2abe186803cebbf7f70f

SHA512
ac8b9b825b40eaa3b34a02b153b3eb9e64913562f931bcc85e60ba4107e25e84a15ff1110b6ea788ff62f29e94ebbc83cb3ff2ba9064eb8f8e139aed24abd9ea

Download Submit
C:\Windows\SysWOW64\Jlklhm32.dll

Filesize
7KB

MD5
b50ca70676af0a30c53aaea410827822

SHA1
931f02f41f500b787974d42440767e829541d1ff

SHA256
acebb5d6bc10e79a5657c80ef07607e261827c99ad2f8a7f3162298d3b4259b9

SHA512
199defa0ad1efcea95f95dda968842e0317c5d06ff0653bcf116eadd18148a2e4edce9b7280fdaa4830e10d18009889740c44a8166712f2b4b2402c02d4f701c

Download Submit
C:\Windows\SysWOW64\Qffbbldm.exe

Filesize
790KB

MD5
5611111fbf608fc21b20c8d4c193a77f

SHA1
81f00789a427d4da40690d7d16e17d5a5f6f2a96

SHA256
90173637848c8159788a600a0405ec77e05038fe1bdb7f784383c30c91f4709a

SHA512
c29359a63708724c528e977b63104504d1f5beaebe88bb667dd7cf9a4c9f0a0004e008fc4a1c280ef67094d5f0a12011b9336f0992e08f7ae7f1350412aa7d6f

Download Submit
memory/468-256-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/468-223-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/540-44-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1004-207-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1004-260-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1028-247-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1028-251-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1484-268-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1484-168-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1548-135-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1548-276-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1588-151-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1588-272-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1768-95-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1768-286-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1900-119-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1900-280-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1948-128-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1948-278-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1992-88-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1992-288-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2124-175-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2124-266-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2316-296-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2316-56-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2324-32-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2324-301-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2424-290-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2424-79-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2796-258-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2796-215-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2936-104-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2936-284-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3084-64-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3084-294-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3140-7-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3140-307-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3356-48-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3356-298-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3936-282-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3936-111-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3956-23-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3956-303-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3992-188-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4280-143-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4280-274-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4364-305-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4364-15-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4368-270-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4368-159-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4776-252-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4776-240-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4800-309-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4800-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4804-254-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4804-231-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4836-199-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4836-262-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4924-193-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4924-263-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4980-292-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4980-71-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads