ba3fb48f150de2912ff2c4b495802cafcb893863212592a18cd7d2299a89a7ae

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03/09/2024, 13:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c2ce920d9c99840a8d01d3c728cb9c20N.exe
Size

74KB
MD5

c2ce920d9c99840a8d01d3c728cb9c20
SHA1

706b4f1499eb5210b2c551d8be8c62a4575ff05a
SHA256

ba3fb48f150de2912ff2c4b495802cafcb893863212592a18cd7d2299a89a7ae
SHA512

03239ae967e622eacadfab8f4a451bceebc38839e1dd27473c101d7a72ae65c9376ddb8096207a0a9dd679c95380c352225ad88bb3028cfdccf34aec9fa83af4
SSDEEP

1536:ncdde9+09e0vnpRVNRpx5I2QnfUh5UDs8B/R5Go+XAW/c8mVa6+Mp:ncLH2pFNRq2Ysh5UDBBZ5GFX/RsaDa

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dbfabp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Enakbp32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Egllae32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	c2ce920d9c99840a8d01d3c728cb9c20N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Djmicm32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dojald32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dbhnhp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ejkima32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eojnkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Eojnkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dhnmij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dkcofe32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Egoife32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eqijej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dbhnhp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dbkknojp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Echfaf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fidoim32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Djmicm32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Enakbp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Eqijej32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Djhphncm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ccngld32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Edkcojga.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Echfaf32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ccngld32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eqpgol32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ejkima32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dlnbeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dliijipn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Egllae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Egoife32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cclkfdnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Djhphncm.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dlgldibq.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dglpbbbg.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dbfabp32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dlnbeh32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Emieil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Edpmjj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cclkfdnc.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fjaonpnn.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Endhhp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ekelld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Eqpgol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fjaonpnn.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdikkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cdikkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dcadac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dojald32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddigjkid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Emieil32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnobnmpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cnobnmpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dlgldibq.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dcadac32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ekelld32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Edpmjj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	c2ce920d9c99840a8d01d3c728cb9c20N.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dolnad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ddigjkid.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhnmij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dolnad32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dbkknojp.exe

Executes dropped EXE 35 IoCs

pid	Process
2552	Cnobnmpl.exe
2728	Cdikkg32.exe
2092	Cclkfdnc.exe
2484	Ccngld32.exe
2460	Djhphncm.exe
2996	Dlgldibq.exe
536	Dcadac32.exe
1408	Dglpbbbg.exe
2916	Dhnmij32.exe
2952	Dliijipn.exe
1628	Dbfabp32.exe
1856	Djmicm32.exe
2756	Dojald32.exe
396	Dbhnhp32.exe
2056	Dlnbeh32.exe
1716	Dolnad32.exe
2060	Dbkknojp.exe
2336	Ddigjkid.exe
2872	Dkcofe32.exe
1168	Enakbp32.exe
704	Eqpgol32.exe
980	Edkcojga.exe
1188	Ekelld32.exe
964	Endhhp32.exe
1784	Egllae32.exe
2208	Ejkima32.exe
1636	Emieil32.exe
2604	Edpmjj32.exe
2588	Egoife32.exe
2664	Eojnkg32.exe
1036	Eqijej32.exe
1916	Echfaf32.exe
2016	Fjaonpnn.exe
604	Fidoim32.exe
2736	Fkckeh32.exe

Loads dropped DLL 64 IoCs

pid	Process
2080	c2ce920d9c99840a8d01d3c728cb9c20N.exe
2080	c2ce920d9c99840a8d01d3c728cb9c20N.exe
2552	Cnobnmpl.exe
2552	Cnobnmpl.exe
2728	Cdikkg32.exe
2728	Cdikkg32.exe
2092	Cclkfdnc.exe
2092	Cclkfdnc.exe
2484	Ccngld32.exe
2484	Ccngld32.exe
2460	Djhphncm.exe
2460	Djhphncm.exe
2996	Dlgldibq.exe
2996	Dlgldibq.exe
536	Dcadac32.exe
536	Dcadac32.exe
1408	Dglpbbbg.exe
1408	Dglpbbbg.exe
2916	Dhnmij32.exe
2916	Dhnmij32.exe
2952	Dliijipn.exe
2952	Dliijipn.exe
1628	Dbfabp32.exe
1628	Dbfabp32.exe
1856	Djmicm32.exe
1856	Djmicm32.exe
2756	Dojald32.exe
2756	Dojald32.exe
396	Dbhnhp32.exe
396	Dbhnhp32.exe
2056	Dlnbeh32.exe
2056	Dlnbeh32.exe
1716	Dolnad32.exe
1716	Dolnad32.exe
2060	Dbkknojp.exe
2060	Dbkknojp.exe
2336	Ddigjkid.exe
2336	Ddigjkid.exe
2872	Dkcofe32.exe
2872	Dkcofe32.exe
1168	Enakbp32.exe
1168	Enakbp32.exe
704	Eqpgol32.exe
704	Eqpgol32.exe
980	Edkcojga.exe
980	Edkcojga.exe
1188	Ekelld32.exe
1188	Ekelld32.exe
964	Endhhp32.exe
964	Endhhp32.exe
1784	Egllae32.exe
1784	Egllae32.exe
2208	Ejkima32.exe
2208	Ejkima32.exe
1636	Emieil32.exe
1636	Emieil32.exe
2604	Edpmjj32.exe
2604	Edpmjj32.exe
2588	Egoife32.exe
2588	Egoife32.exe
2664	Eojnkg32.exe
2664	Eojnkg32.exe
1036	Eqijej32.exe
1036	Eqijej32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Clkmne32.dll	Fidoim32.exe
File created	C:\Windows\SysWOW64\Dlgldibq.exe	Djhphncm.exe
File created	C:\Windows\SysWOW64\Dglpbbbg.exe	Dcadac32.exe
File opened for modification	C:\Windows\SysWOW64\Ddigjkid.exe	Dbkknojp.exe
File opened for modification	C:\Windows\SysWOW64\Dkcofe32.exe	Ddigjkid.exe
File opened for modification	C:\Windows\SysWOW64\Eqpgol32.exe	Enakbp32.exe
File opened for modification	C:\Windows\SysWOW64\Edkcojga.exe	Eqpgol32.exe
File created	C:\Windows\SysWOW64\Gogcek32.dll	Eqpgol32.exe
File created	C:\Windows\SysWOW64\Aphdelhp.dll	Ejkima32.exe
File opened for modification	C:\Windows\SysWOW64\Dliijipn.exe	Dhnmij32.exe
File created	C:\Windows\SysWOW64\Djmicm32.exe	Dbfabp32.exe
File created	C:\Windows\SysWOW64\Hoogfn32.dll	Echfaf32.exe
File opened for modification	C:\Windows\SysWOW64\Fkckeh32.exe	Fidoim32.exe
File created	C:\Windows\SysWOW64\Lednakhd.dll	Dkcofe32.exe
File opened for modification	C:\Windows\SysWOW64\Fjaonpnn.exe	Echfaf32.exe
File created	C:\Windows\SysWOW64\Lkmkpl32.dll	Egoife32.exe
File created	C:\Windows\SysWOW64\Fjaonpnn.exe	Echfaf32.exe
File created	C:\Windows\SysWOW64\Dlnbeh32.exe	Dbhnhp32.exe
File created	C:\Windows\SysWOW64\Ejkima32.exe	Egllae32.exe
File created	C:\Windows\SysWOW64\Klmkof32.dll	Eojnkg32.exe
File created	C:\Windows\SysWOW64\Cclkfdnc.exe	Cdikkg32.exe
File created	C:\Windows\SysWOW64\Epjomppp.dll	Dhnmij32.exe
File created	C:\Windows\SysWOW64\Dbhnhp32.exe	Dojald32.exe
File created	C:\Windows\SysWOW64\Mmjale32.dll	Egllae32.exe
File created	C:\Windows\SysWOW64\Cnobnmpl.exe	c2ce920d9c99840a8d01d3c728cb9c20N.exe
File created	C:\Windows\SysWOW64\Cdikkg32.exe	Cnobnmpl.exe
File created	C:\Windows\SysWOW64\Kcbabf32.dll	Endhhp32.exe
File opened for modification	C:\Windows\SysWOW64\Endhhp32.exe	Ekelld32.exe
File created	C:\Windows\SysWOW64\Pmdgmd32.dll	Emieil32.exe
File opened for modification	C:\Windows\SysWOW64\Dbkknojp.exe	Dolnad32.exe
File created	C:\Windows\SysWOW64\Cbcodmih.dll	Ddigjkid.exe
File created	C:\Windows\SysWOW64\Echfaf32.exe	Eqijej32.exe
File created	C:\Windows\SysWOW64\Ffpncj32.dll	Edpmjj32.exe
File opened for modification	C:\Windows\SysWOW64\Eojnkg32.exe	Egoife32.exe
File opened for modification	C:\Windows\SysWOW64\Dojald32.exe	Djmicm32.exe
File created	C:\Windows\SysWOW64\Nnfbei32.dll	Dbhnhp32.exe
File created	C:\Windows\SysWOW64\Enakbp32.exe	Dkcofe32.exe
File created	C:\Windows\SysWOW64\Hhijaf32.dll	Enakbp32.exe
File opened for modification	C:\Windows\SysWOW64\Cclkfdnc.exe	Cdikkg32.exe
File created	C:\Windows\SysWOW64\Eofjhkoj.dll	Dlgldibq.exe
File created	C:\Windows\SysWOW64\Dliijipn.exe	Dhnmij32.exe
File created	C:\Windows\SysWOW64\Khknah32.dll	Fjaonpnn.exe
File created	C:\Windows\SysWOW64\Fkckeh32.exe	Fidoim32.exe
File created	C:\Windows\SysWOW64\Jaegglem.dll	Ccngld32.exe
File created	C:\Windows\SysWOW64\Eqijej32.exe	Eojnkg32.exe
File created	C:\Windows\SysWOW64\Olfeho32.dll	Edkcojga.exe
File created	C:\Windows\SysWOW64\Edpmjj32.exe	Emieil32.exe
File created	C:\Windows\SysWOW64\Odifab32.dll	Dbfabp32.exe
File opened for modification	C:\Windows\SysWOW64\Emieil32.exe	Ejkima32.exe
File opened for modification	C:\Windows\SysWOW64\Cnobnmpl.exe	c2ce920d9c99840a8d01d3c728cb9c20N.exe
File created	C:\Windows\SysWOW64\Djhphncm.exe	Ccngld32.exe
File created	C:\Windows\SysWOW64\Edekcace.dll	Dojald32.exe
File created	C:\Windows\SysWOW64\Edkcojga.exe	Eqpgol32.exe
File created	C:\Windows\SysWOW64\Ddigjkid.exe	Dbkknojp.exe
File created	C:\Windows\SysWOW64\Ekelld32.exe	Edkcojga.exe
File opened for modification	C:\Windows\SysWOW64\Egoife32.exe	Edpmjj32.exe
File created	C:\Windows\SysWOW64\Lqelfddi.dll	Djmicm32.exe
File opened for modification	C:\Windows\SysWOW64\Dbhnhp32.exe	Dojald32.exe
File created	C:\Windows\SysWOW64\Aabagnfc.dll	Ekelld32.exe
File created	C:\Windows\SysWOW64\Kijbioba.dll	Dcadac32.exe
File created	C:\Windows\SysWOW64\Eqpgol32.exe	Enakbp32.exe
File opened for modification	C:\Windows\SysWOW64\Ejkima32.exe	Egllae32.exe
File opened for modification	C:\Windows\SysWOW64\Djmicm32.exe	Dbfabp32.exe
File created	C:\Windows\SysWOW64\Jfiilbkl.dll	Dolnad32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2968	2736	WerFault.exe	62

System Location Discovery: System Language Discovery 1 TTPs 36 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Edpmjj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Egoife32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fkckeh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdikkg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dbkknojp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddigjkid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Edkcojga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ejkima32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eojnkg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fidoim32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cclkfdnc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dcadac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dliijipn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dojald32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djhphncm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkcofe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ccngld32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dolnad32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Emieil32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhnmij32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dbfabp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djmicm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ekelld32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnobnmpl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c2ce920d9c99840a8d01d3c728cb9c20N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eqpgol32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Egllae32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Echfaf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Enakbp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Endhhp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eqijej32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fjaonpnn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dlgldibq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dglpbbbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dbhnhp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dlnbeh32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	c2ce920d9c99840a8d01d3c728cb9c20N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dbhnhp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Endhhp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ejkima32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dcadac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kcbabf32.dll"	Endhhp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Clkmne32.dll"	Fidoim32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dhnmij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dhnmij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Eqpgol32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}	c2ce920d9c99840a8d01d3c728cb9c20N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Galmmc32.dll"	Dlnbeh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dbhnhp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dkcofe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Echfaf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fidoim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hadfjo32.dll"	Cdikkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eofjhkoj.dll"	Dlgldibq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lqelfddi.dll"	Djmicm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akigbbni.dll"	Cclkfdnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ccngld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nnfbei32.dll"	Dbhnhp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Edkcojga.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ffpncj32.dll"	Edpmjj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Klmkof32.dll"	Eojnkg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Eqijej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ekelld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Echfaf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ccngld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Edekcace.dll"	Dojald32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ddigjkid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Edkcojga.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fjaonpnn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fileil32.dll"	Dglpbbbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dliijipn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dojald32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ekelld32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Egoife32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Eqijej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dglpbbbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odifab32.dll"	Dbfabp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dlnbeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfiilbkl.dll"	Dolnad32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ddigjkid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gogcek32.dll"	Eqpgol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aabagnfc.dll"	Ekelld32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Eqpgol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Edpmjj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dojald32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dbkknojp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Egoife32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Najgne32.dll"	Eqijej32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dlnbeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aphdelhp.dll"	Ejkima32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pmdgmd32.dll"	Emieil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cdikkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Olfeho32.dll"	Edkcojga.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Emieil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Eojnkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cclkfdnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kijbioba.dll"	Dcadac32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Edpmjj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bebpkk32.dll"	Cnobnmpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cbcodmih.dll"	Ddigjkid.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 2552	2080	c2ce920d9c99840a8d01d3c728cb9c20N.exe	28
PID 2080 wrote to memory of 2552	2080	c2ce920d9c99840a8d01d3c728cb9c20N.exe	28
PID 2080 wrote to memory of 2552	2080	c2ce920d9c99840a8d01d3c728cb9c20N.exe	28
PID 2080 wrote to memory of 2552	2080	c2ce920d9c99840a8d01d3c728cb9c20N.exe	28
PID 2552 wrote to memory of 2728	2552	Cnobnmpl.exe	29
PID 2552 wrote to memory of 2728	2552	Cnobnmpl.exe	29
PID 2552 wrote to memory of 2728	2552	Cnobnmpl.exe	29
PID 2552 wrote to memory of 2728	2552	Cnobnmpl.exe	29
PID 2728 wrote to memory of 2092	2728	Cdikkg32.exe	30
PID 2728 wrote to memory of 2092	2728	Cdikkg32.exe	30
PID 2728 wrote to memory of 2092	2728	Cdikkg32.exe	30
PID 2728 wrote to memory of 2092	2728	Cdikkg32.exe	30
PID 2092 wrote to memory of 2484	2092	Cclkfdnc.exe	31
PID 2092 wrote to memory of 2484	2092	Cclkfdnc.exe	31
PID 2092 wrote to memory of 2484	2092	Cclkfdnc.exe	31
PID 2092 wrote to memory of 2484	2092	Cclkfdnc.exe	31
PID 2484 wrote to memory of 2460	2484	Ccngld32.exe	32
PID 2484 wrote to memory of 2460	2484	Ccngld32.exe	32
PID 2484 wrote to memory of 2460	2484	Ccngld32.exe	32
PID 2484 wrote to memory of 2460	2484	Ccngld32.exe	32
PID 2460 wrote to memory of 2996	2460	Djhphncm.exe	33
PID 2460 wrote to memory of 2996	2460	Djhphncm.exe	33
PID 2460 wrote to memory of 2996	2460	Djhphncm.exe	33
PID 2460 wrote to memory of 2996	2460	Djhphncm.exe	33
PID 2996 wrote to memory of 536	2996	Dlgldibq.exe	34
PID 2996 wrote to memory of 536	2996	Dlgldibq.exe	34
PID 2996 wrote to memory of 536	2996	Dlgldibq.exe	34
PID 2996 wrote to memory of 536	2996	Dlgldibq.exe	34
PID 536 wrote to memory of 1408	536	Dcadac32.exe	35
PID 536 wrote to memory of 1408	536	Dcadac32.exe	35
PID 536 wrote to memory of 1408	536	Dcadac32.exe	35
PID 536 wrote to memory of 1408	536	Dcadac32.exe	35
PID 1408 wrote to memory of 2916	1408	Dglpbbbg.exe	36
PID 1408 wrote to memory of 2916	1408	Dglpbbbg.exe	36
PID 1408 wrote to memory of 2916	1408	Dglpbbbg.exe	36
PID 1408 wrote to memory of 2916	1408	Dglpbbbg.exe	36
PID 2916 wrote to memory of 2952	2916	Dhnmij32.exe	37
PID 2916 wrote to memory of 2952	2916	Dhnmij32.exe	37
PID 2916 wrote to memory of 2952	2916	Dhnmij32.exe	37
PID 2916 wrote to memory of 2952	2916	Dhnmij32.exe	37
PID 2952 wrote to memory of 1628	2952	Dliijipn.exe	38
PID 2952 wrote to memory of 1628	2952	Dliijipn.exe	38
PID 2952 wrote to memory of 1628	2952	Dliijipn.exe	38
PID 2952 wrote to memory of 1628	2952	Dliijipn.exe	38
PID 1628 wrote to memory of 1856	1628	Dbfabp32.exe	39
PID 1628 wrote to memory of 1856	1628	Dbfabp32.exe	39
PID 1628 wrote to memory of 1856	1628	Dbfabp32.exe	39
PID 1628 wrote to memory of 1856	1628	Dbfabp32.exe	39
PID 1856 wrote to memory of 2756	1856	Djmicm32.exe	40
PID 1856 wrote to memory of 2756	1856	Djmicm32.exe	40
PID 1856 wrote to memory of 2756	1856	Djmicm32.exe	40
PID 1856 wrote to memory of 2756	1856	Djmicm32.exe	40
PID 2756 wrote to memory of 396	2756	Dojald32.exe	41
PID 2756 wrote to memory of 396	2756	Dojald32.exe	41
PID 2756 wrote to memory of 396	2756	Dojald32.exe	41
PID 2756 wrote to memory of 396	2756	Dojald32.exe	41
PID 396 wrote to memory of 2056	396	Dbhnhp32.exe	42
PID 396 wrote to memory of 2056	396	Dbhnhp32.exe	42
PID 396 wrote to memory of 2056	396	Dbhnhp32.exe	42
PID 396 wrote to memory of 2056	396	Dbhnhp32.exe	42
PID 2056 wrote to memory of 1716	2056	Dlnbeh32.exe	43
PID 2056 wrote to memory of 1716	2056	Dlnbeh32.exe	43
PID 2056 wrote to memory of 1716	2056	Dlnbeh32.exe	43
PID 2056 wrote to memory of 1716	2056	Dlnbeh32.exe	43

C:\Users\Admin\AppData\Local\Temp\c2ce920d9c99840a8d01d3c728cb9c20N.exe
"C:\Users\Admin\AppData\Local\Temp\c2ce920d9c99840a8d01d3c728cb9c20N.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\SysWOW64\Cnobnmpl.exe
  C:\Windows\system32\Cnobnmpl.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2552
- - C:\Windows\SysWOW64\Cdikkg32.exe
    C:\Windows\system32\Cdikkg32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2728
  - - C:\Windows\SysWOW64\Cclkfdnc.exe
      C:\Windows\system32\Cclkfdnc.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2092
    - - C:\Windows\SysWOW64\Ccngld32.exe
        
        C:\Windows\system32\Ccngld32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2484
      - C:\Windows\SysWOW64\Djhphncm.exe
        
        C:\Windows\system32\Djhphncm.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2460
        
        C:\Windows\SysWOW64\Dlgldibq.exe
        
        C:\Windows\system32\Dlgldibq.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2996
        
        C:\Windows\SysWOW64\Dcadac32.exe
        
        C:\Windows\system32\Dcadac32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:536
        
        C:\Windows\SysWOW64\Dglpbbbg.exe
        
        C:\Windows\system32\Dglpbbbg.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1408
        
        C:\Windows\SysWOW64\Dhnmij32.exe
        
        C:\Windows\system32\Dhnmij32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2916
        
        C:\Windows\SysWOW64\Dliijipn.exe
        
        C:\Windows\system32\Dliijipn.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2952
        
        C:\Windows\SysWOW64\Dbfabp32.exe
        
        C:\Windows\system32\Dbfabp32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1628
        
        C:\Windows\SysWOW64\Djmicm32.exe
        
        C:\Windows\system32\Djmicm32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1856
        
        C:\Windows\SysWOW64\Dojald32.exe
        
        C:\Windows\system32\Dojald32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2756
        
        C:\Windows\SysWOW64\Dbhnhp32.exe
        
        C:\Windows\system32\Dbhnhp32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:396
        
        C:\Windows\SysWOW64\Dlnbeh32.exe
        
        C:\Windows\system32\Dlnbeh32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2056
        
        C:\Windows\SysWOW64\Dolnad32.exe
        
        C:\Windows\system32\Dolnad32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1716
        
        C:\Windows\SysWOW64\Dbkknojp.exe
        
        C:\Windows\system32\Dbkknojp.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2060
        
        C:\Windows\SysWOW64\Ddigjkid.exe
        
        C:\Windows\system32\Ddigjkid.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2336
        
        C:\Windows\SysWOW64\Dkcofe32.exe
        
        C:\Windows\system32\Dkcofe32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2872
        
        C:\Windows\SysWOW64\Enakbp32.exe
        
        C:\Windows\system32\Enakbp32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1168
        
        C:\Windows\SysWOW64\Eqpgol32.exe
        
        C:\Windows\system32\Eqpgol32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:704
        
        C:\Windows\SysWOW64\Edkcojga.exe
        
        C:\Windows\system32\Edkcojga.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:980
        
        C:\Windows\SysWOW64\Ekelld32.exe
        
        C:\Windows\system32\Ekelld32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1188
        
        C:\Windows\SysWOW64\Endhhp32.exe
        
        C:\Windows\system32\Endhhp32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:964
        
        C:\Windows\SysWOW64\Egllae32.exe
        
        C:\Windows\system32\Egllae32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1784
        
        C:\Windows\SysWOW64\Ejkima32.exe
        
        C:\Windows\system32\Ejkima32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2208
        
        C:\Windows\SysWOW64\Emieil32.exe
        
        C:\Windows\system32\Emieil32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1636
        
        C:\Windows\SysWOW64\Edpmjj32.exe
        
        C:\Windows\system32\Edpmjj32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2604
        
        C:\Windows\SysWOW64\Egoife32.exe
        
        C:\Windows\system32\Egoife32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2588
        
        C:\Windows\SysWOW64\Eojnkg32.exe
        
        C:\Windows\system32\Eojnkg32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2664
        
        C:\Windows\SysWOW64\Eqijej32.exe
        
        C:\Windows\system32\Eqijej32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1036
        
        C:\Windows\SysWOW64\Echfaf32.exe
        
        C:\Windows\system32\Echfaf32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1916
        
        C:\Windows\SysWOW64\Fjaonpnn.exe
        
        C:\Windows\system32\Fjaonpnn.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2016
        
        C:\Windows\SysWOW64\Fidoim32.exe
        
        C:\Windows\system32\Fidoim32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:604
        
        C:\Windows\SysWOW64\Fkckeh32.exe
        
        C:\Windows\system32\Fkckeh32.exe
        36⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2736
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 140
        37⤵
        Program crash
        
        PID:2968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Cdikkg32.exe

Filesize
74KB

MD5
e56c5079101a218c91c0ff4f396dd07a

SHA1
6fc61c05032ff7afa4b3db04d1634512015ee12a

SHA256
2d5872d0e9c721dda40fddb61a081cff39c6fb63e62db7fc83b2ca05082f74dc

SHA512
af798ca3f0bfb5e8b95ae2a7f8d84cf12b4f0b297195f77aafd924aec1c898b0d96b980e2a798d0ef7b86e2279efc48b97b3242be8b1ee95aa7ecff90e544fe0

Download Submit
C:\Windows\SysWOW64\Dbkknojp.exe

Filesize
74KB

MD5
b64314ff1dada2ade70744ecedce4469

SHA1
6422cb085894cbc22eeb4afdaf61a2710404f7e0

SHA256
2f40b4518a1713183c58a0601c6c9ea626b1f323a4e0e3c42d0d4fca57593664

SHA512
159491f0a699ce0d2712ea9029ecab43de527027ec1f4a85b387225011c277755bdb3cb146a7aad34063d317f07633fa58b2ecda2f662ea834c9cbf5beff5a4e

Download Submit
C:\Windows\SysWOW64\Ddigjkid.exe

Filesize
74KB

MD5
9304ea4b44dc234f7ae2ae20f7b1a294

SHA1
ae7ee596d4d8ee8fbfb390fdbc7dae4e6ba8f0fc

SHA256
704924c99a1005691cec909910c75039155bcfbcbe92f370c49ab906d257713e

SHA512
6a90a6c98a1a4d62e15aaa1d8c9691d5d479a26453b4703d06d88a5120c943d93a086a3056c74d9862bcf777b5c706add956a4355de360c737e922e55477a5bc

Download Submit
C:\Windows\SysWOW64\Dkcofe32.exe

Filesize
74KB

MD5
a2afc1877d1e11ab0a1ad970e2afeb8b

SHA1
cc26ad593bdb7bc72262ead22ef9d2f6f8a00c77

SHA256
0608e721ca6d73e9ed36b466a5600ff31585f7d6983f26714236da70042d4c26

SHA512
99dd9c0867d1bfa40cb13c03c538fac7185039f9de709a70d9ed6f9d4a3d2c8bc6d5e24b9b492fc86ccf41b4cfa60238268664b72af075a691c6f000d8a1b403

Download Submit
C:\Windows\SysWOW64\Echfaf32.exe

Filesize
74KB

MD5
7ba5815eec5b5a9405b55cb8f90bc883

SHA1
f833c65e5260ac864553ed8775a44cb72e3a074e

SHA256
e0b2e461db0dc7c3b26a84d41daca8003e289f9ff7b8d6cb31d4dc1395f6bb90

SHA512
acf71de0ab6198b6db9030fac9943c68545062a7043042cf6834a965131634bf2d801eefedb2562871609b894c7489e7e8f7bb81ff6a792ab9c3a94b795d98c4

Download Submit
C:\Windows\SysWOW64\Edkcojga.exe

Filesize
74KB

MD5
6ac194177d2f62d9602f6e33d3b2e47c

SHA1
1751bf94e4db61d1af79589ef162886572c88933

SHA256
ff3f27366c0bed5191edf16bec979e698d63964289cba3aef2151126c7cb7b9a

SHA512
50b5caf10df80459dff6768dea81ec9ed95a8244461baef3d2ddede8db5aecfe40c7b1805f3777b75529fd977b7708b658c16c7b18e4042888c0f69a7fb9086c

Download Submit
C:\Windows\SysWOW64\Edpmjj32.exe

Filesize
74KB

MD5
682d6ebf5b797ae03da363a8dc38ab15

SHA1
ceca06969cec2aff09f8e8404f2ef71192c3b10a

SHA256
0091d3aa74f3c3c439a63067f657fe4c7d07234778940f9670d47eebf7330435

SHA512
c472a4e94ceff9edd109ac4674ede729192e9a0065392df50ebff368d5bf13b92abb535a0ca3cebb4921a2a2f94ea7f86fbafeed6c26914d105cd3ccae76cce3

Download Submit
C:\Windows\SysWOW64\Egllae32.exe

Filesize
74KB

MD5
a81ec89b8d38144aa116fec7f98d890c

SHA1
104e01d455ce77e2566843f95c7dd2eba4d75211

SHA256
0bf89cb7c1c0a675f7ebb98eeb593975ed725fff385c3ae0c8daf1718db2be22

SHA512
ea61e2c5b4dd45f4c1d0569ce34f90e7dd47debc4bc8541903ddbab6a0a27a527797b566a1b3a89c301f9640a4e6a7e4b3cbef1a3a11aad643e016925dcee543

Download Submit
C:\Windows\SysWOW64\Egoife32.exe

Filesize
74KB

MD5
aeeeb77fc59cc0f60892aaf519ef2469

SHA1
5982ef50d77481ead2771765b13e3ea5a52c3b99

SHA256
71de3745c6b2ed8e9cef6a012dbd1776bb3908623b393c4578fc7d8df0d7329d

SHA512
59a4af332540fbe299087177e91da408f732ca69d686feb39d17dce5a73dc8ea464f01dccdea0fbdc48510c0b71086afb9b0089f214bfd7f35bafd1a11319708

Download Submit
C:\Windows\SysWOW64\Ejkima32.exe

Filesize
74KB

MD5
a9c38b9523b30e4f99403536dfb254f6

SHA1
1f0cc67eb46b6880dc906d4af5673d2facbabbf6

SHA256
bd2f2e1e2dd35b1e5d195969b4b54fe4c4e44f246b71e243f3fec89555df105f

SHA512
338d35933f9cded73c97400dda68e91e3a5c54eb6f115047854a305d6ff765386683caf5df036235fb77cb94d89b6c8ea3919d16bd5110f6d2ed026796149921

Download Submit
C:\Windows\SysWOW64\Ekelld32.exe

Filesize
74KB

MD5
1c709f508e454ee6b9354cd344339cce

SHA1
0757cfb03d4223189fe505c4db0c7f8418d15360

SHA256
e7ad53b349dbe8d487bc7ebf1ca1555abbe6bfd9d6fed0384f06acf2ed986840

SHA512
5cc3997551efc4533ed0f1a6181bf9206e00e91d6fe60b89ded7dc63fa4608fefbbd467c47e4a49d392149bf5d39322970af08b12d0dec2bd65d7580e6758ee3

Download Submit
C:\Windows\SysWOW64\Emieil32.exe

Filesize
74KB

MD5
9968ebe89a19722ac8f8f5efe4ee5f2b

SHA1
5c1eb131e1cd2e709f7d345eac9ea237b16f79dd

SHA256
52ee4e7e7dd3ac8597ca33bdea55537541405bb6978041c8fe32fc2827f6084d

SHA512
23b932194408c023563109137586d58e58385c87a85b0977f4013cc23afdab3d6fb28d155b7035c6b08241dc97f9180dce699881ead132c39836ce55df06ae8d

Download Submit
C:\Windows\SysWOW64\Enakbp32.exe

Filesize
74KB

MD5
797a811f8dd1ea4e3e05006ac62ee2eb

SHA1
31a3e534d61091666ad272dbfab2fc4e05d7a82a

SHA256
412355e9a98777fc9ea03de2d628632f176ad9963a92aaeafa79fc9f67f8a50d

SHA512
b95fed2daddc5e6770d98a442c78e74dcb87a664c1c5178043b6e5718aa3bd155400a824f2b3a1699aa31e459505c91afbbc488d66d89d7aac325e996d3b1ea1

Download Submit
C:\Windows\SysWOW64\Endhhp32.exe

Filesize
74KB

MD5
32efd8797a81cada62039dc4e23a8556

SHA1
f409239fa22e3ffdc320f2c0354fbd4f94aa829f

SHA256
40581c48f4d190e996abe829b2f7c31e085fbc09d1d88fb760502c16c491884f

SHA512
d8aed0930780da15dd8caad904d260784a1e3608da7482c12f1eadea633024fa977a583d66687a2747ae86a34a0706e06135c821643abdc7e8acb98fc9244f4b

Download Submit
C:\Windows\SysWOW64\Eojnkg32.exe

Filesize
74KB

MD5
b3d2508fac97ef71e0015a6fac329d59

SHA1
e02f67c6e0ac6c25b073f9ce83ce2e72ee8c3399

SHA256
1e49bfc2103c99e912cbb20a9df7c66b6110029d969a2249908a42f7ea2dc173

SHA512
b7f0220ddbea78d60be0f549521c0fd88e23f89380acaaf2d77a26e7cec32e2097863f2f6bd788afa0c6b7efe274b6e86de68f905db45f6fc575d97afe977aab

Download Submit
C:\Windows\SysWOW64\Eqijej32.exe

Filesize
74KB

MD5
f6e870d84f0ae90c19faf6acc1d9d17e

SHA1
766e820a4142a068ca858b4ce0ea7ed84f955cc4

SHA256
54251c19c234565e93c001c8d858ffff3439a58418a0ada598bca8acb3cca75b

SHA512
4d1e08cd099fdd2374c5ab54cda3328db10119a41cf72383f4a3d07372cb386f5afa10e76673ac4670973be2ea677a801fc6832a181fbe847568b51f389e2cf5

Download Submit
C:\Windows\SysWOW64\Eqpgol32.exe

Filesize
74KB

MD5
b7452feb8a01e9d8107bf5bca495d5a0

SHA1
0c516031457e96d55b01c60d6740d2b2fe2bfc8c

SHA256
10c1c4da3284fcb014f93be4fdde9b76474997d2947ca3bbaa2d116b4807902b

SHA512
1c4990bad9c0908e1ec0c724a16442e0553e8d5eef2274ac71abde244e580bffff3a23bf78bd3a06028b1fdefac07a444f7202c617a840a2964497396281db67

Download Submit
C:\Windows\SysWOW64\Fidoim32.exe

Filesize
74KB

MD5
3e981f1ab12faf168dcd04cc0df75116

SHA1
3f9dbef35461da6f833c31fca9a70bea2cd57389

SHA256
cbc1ea59b9e5fe0ed4ef56919f1267c3e69f7dea7eb4fd65bf14dbf480a7e6dc

SHA512
69e711da4e302271d003769de8a05805a41a65948be3a3423ba378b0f47036d16997b3876157f47634374bf3d60d6a3c2e5ff7a621fd582241c0086cf63108a3

Download Submit
C:\Windows\SysWOW64\Fjaonpnn.exe

Filesize
74KB

MD5
f478a3dd70244c8253431de3a0236ccc

SHA1
e392b027675d71ff9dccee792a0450a48cd2c8b9

SHA256
a64e658a2c2c7a50d1ef8a98ff0d0f6d8b330b5849ad54454973dd65c686d751

SHA512
2f115719e80a16341b490f0b5f51f9b7f196e4d942c9701d47aaf704c33a6912a13dcf32bcf2b24d0bfb32f3264d6fb00cb09a28be46bb2822677dcdefece2fe

Download Submit
C:\Windows\SysWOW64\Fkckeh32.exe

Filesize
74KB

MD5
1f3b74172e65cbb0a7a37812167bbd95

SHA1
924dc904a1732e963ff838a671a991e13304d184

SHA256
f3f7ecda5a085993411d19187f44ac8af2ddab53d8a8d50e5835cebed9968e9c

SHA512
82d863ae4554999d92d0621e2e47b3d62d9c4dc007aa3026513b40819fe43e0a5b34572c4f2f5ec94d1e2fe6840f3bf40b238604cedcf5cfd23db0e373a0fae0

Download Submit
C:\Windows\SysWOW64\Jaegglem.dll

Filesize
7KB

MD5
ef245f767a759aec740d9dd57d0b5031

SHA1
faadf20bfbc7f7c7d5f9d4513ba0e55f6a041fcc

SHA256
e141296ff2d6c2b1ea5df5ca4ce764d17fff48b4c7fdf4ff4501fb2c72f8bc2c

SHA512
233a2dd28dec6b72b8fae378631561064622853b24e580706e82924351335675cd326c910ee3d4b751b46661797f0d1c2e5d9af39da108f9cb7cfa3c572fbc61

Download Submit
\Windows\SysWOW64\Cclkfdnc.exe

Filesize
74KB

MD5
4ccbdfccd578dedd3a0fa006b5086a36

SHA1
662483e1c25d40c4c9632c0b1142676a4391fb13

SHA256
17adb36046d1b41d3d8dd194cd0bd9061bc0187133bf4e0c5a53afcfaf92ba33

SHA512
2b991e679290aff6f2bb8f486e685c90e2fd6ed0fa198a5614a1541f60478953698d33b359d4b22d9bb8033cc316465cb9cb98d4bdb1deb0d68b0254b0e848bf

Download Submit
\Windows\SysWOW64\Ccngld32.exe

Filesize
74KB

MD5
531fc03b2bd1ba400561c611740eab35

SHA1
169369ddf88c808732086404ff477156e1d67e9e

SHA256
a38e44fe5ac9345683f539bb02a36247b6a22db53d3a3520e7e511df8262b330

SHA512
aafa8d2ed6054bf05461e1aa724bc185cd2a071bd494ca8e971d17c2b83ab9e169cc85fd035056e00cac986ff729a34c135591926b13c8aee21d32aa5df87d66

Download Submit
\Windows\SysWOW64\Cnobnmpl.exe

Filesize
74KB

MD5
8e2166ae7be6ef16aa66a5c2d47cb4e2

SHA1
94521cc1e4aedc296a087b326bcf05bc91fa2c99

SHA256
e1f88de6529998dfd15294f001804c61d2d7bed373719e0f787c7abda92f321d

SHA512
b3467611e2f0bda21ef480ff4f027114bec6a77d73c2118d192f4cf28943e54630dc7aea431cba0e7108c13eb2e6733f64abb2fde871c456030831e4dfb33b12

Download Submit
\Windows\SysWOW64\Dbfabp32.exe

Filesize
74KB

MD5
9abde4917c002d19d247078cda3dc727

SHA1
4e40ffca9255b04f4cc542bac918aba266f58191

SHA256
ee2d70917b23ed2c3e575416a388d3cac10e4d81197d06c4abf18c046a9b97cd

SHA512
91e9770e6f4d9d5d8899c41ce643301d3dcd2dafe404e767cd710cac29f9c20ccd3d5a252a166a4f42d4c377785b07020bdfdb6d8c79d9d4d306cf2eeabbaa2f

Download Submit
\Windows\SysWOW64\Dbhnhp32.exe

Filesize
74KB

MD5
b572f074160e248537b85cd51c53df53

SHA1
540a8604b2357b34bf8b2cfc2add867a364a6faa

SHA256
40808a8be8b3543e4c3cb79666c8c28453ad22dea8375c19391de910ad8ac4a5

SHA512
c80c999ab6dc8fe7e0c302ff6e721c9af4507d1be3df2594801a8f907eec64636252f9ccffb7d4d92e1b2f3dbb85ff5b35ebebe88a9f5fb61f2f696620fc3613

Download Submit
\Windows\SysWOW64\Dcadac32.exe

Filesize
74KB

MD5
1d9aec7bab67bd68d5d175eee60d307d

SHA1
15c0fb0611398f3e5c861f94aecb112abf7f048d

SHA256
23bcd888c3397efdd046264c6ee48f4428faeef1d9b38d591b2532157092528f

SHA512
d2082d294520498a5709c6b13f74d6a5f5020db9ddcf9d596ac8423e8c9d60ace4291c718eaab188d59f1f0ba91f831cc744954985772779f0b68c8786cc952f

Download Submit
\Windows\SysWOW64\Dglpbbbg.exe

Filesize
74KB

MD5
0f5048066561b1c430f7f78ed4a53af0

SHA1
a078587af8885b114bf01ae6a54498a6df3128a5

SHA256
01007ab5e850d12826a8a1d4a7d3d1a072d33df1fcd90b556a361d051b5c27ea

SHA512
9724988f6d4d74eaa7b15001d14427dcadc6d1069d20c975b8f98471e0bfda994addfccb5963a5ca93ab196f63641d24d7eaf73451836b0d9bba02493f35452b

Download Submit
\Windows\SysWOW64\Dhnmij32.exe

Filesize
74KB

MD5
5fbe2944e3858f95c48918c5add66ac8

SHA1
3dee7970265d60d6ce4978cc0c9e56179a4d4ee2

SHA256
4301bcb9dbd2e979dd9e26101c347d88dabb7b3b21670946b803445b8d3c1652

SHA512
6b2e2d617a3f3ea9f4797e7e158d0613c70005ee09fe28ef99e9a60fcb7e43f02e21500da3646d332aa7d1cea398fb1cca5f6ad3cebc474c5deb8b73861609e8

Download Submit
\Windows\SysWOW64\Djhphncm.exe

Filesize
74KB

MD5
7755a75c4fb766414096db955145a924

SHA1
9a5866b3540837d1a361659674a934ed5f7fdf79

SHA256
8f264ea271f9623a3d14d6b2b8859d4195dda206dbfeae5eaf064b7000686862

SHA512
49ccc2f262aa2ca578f60f3b038148406a1977219a6ac74f458013465ccd07cc488afb95cc4efa6f965784ecebe5bd3b6c94d53223c2846830b95a5fc35f3bee

Download Submit
\Windows\SysWOW64\Djmicm32.exe

Filesize
74KB

MD5
49018a805d074422460ec23c23ee89c1

SHA1
de0c5430687beab105885f81b09e64a9d7279a80

SHA256
78f5969ef8689b9ad5f3a4271ccc5e5721d1e6312e234b6a3b0e32057093450c

SHA512
1bc9a67b96a5fc229bef04ac323f26d6524aa4027faf1190a5b506d66dc7dce7c37452a8705dc5e09034b7c96ea9194274d7824d9a4b0f1e297584e00c2d50af

Download Submit
\Windows\SysWOW64\Dlgldibq.exe

Filesize
74KB

MD5
40274253014559531ef59c104c6ccbe0

SHA1
0623043198c11b7688396db593b4f6149eca8e84

SHA256
be4c2b0a1b5594666255694ff50a7e26ecf22a5db58721250268aeea9ebba6b0

SHA512
dcaca16f4b2b33e636a8b12d0b47141ab15f2ad93d741fcc4adaa80895302dfe9671d4a0adcc7c0f4506d697819c97dce80bd37e9958ef277b484dbca4bc15ae

Download Submit
\Windows\SysWOW64\Dliijipn.exe

Filesize
74KB

MD5
e3f19d0a9d70382422eea8fcc3673250

SHA1
5849fa44ee635b4367ae20872e6636d2678be862

SHA256
458e21dd2ae4e2afb3fabd7213c51ba3027949040ccb53abb00d48d6d20248b2

SHA512
6bfa057c6e3b81c840694e3e7adf7a230aa7a79ac14b642d3a0e77860dc3365824d8d876fa1425288b4188bcb7fb22dba4fc42cce994aec21f41d2a25f3f25b6

Download Submit
\Windows\SysWOW64\Dlnbeh32.exe

Filesize
74KB

MD5
f070b7fea29dd84cbcbcce4ba12c1e66

SHA1
26230ba96793e4b610ff23e58a5bcecfd7703a58

SHA256
4c9bd02b654c5dfc1788b2dd348c0cf6313d4b7bd5aa0ede2793cab196ae5f0e

SHA512
e448e107762f4cffa6e5f513c06cb9ac0f3eb1298cfc85e21c47f1c44b053e1b4eb1bbd938dc7b0feecf1f6eb522e999429a5ecc2a22f6925f69cc59b33a7391

Download Submit
\Windows\SysWOW64\Dojald32.exe

Filesize
74KB

MD5
22cdc752a10a09b5bae64d1ebece5b67

SHA1
82ef48c4264046f0adb8581b29becba8820d482f

SHA256
c8d27616b4e9cc28f6392a1284941da36ccdd608de4eefcd4ba1063ffd2f017a

SHA512
39336b0801b87fac93398565dfbfd3adde092816192dccfddc0c1ca14456b597eeb14b1e4b8fbc69f8f95cf2ee56e4dfdfa3eabfc6fd790c06e565c3311b6d29

Download Submit
\Windows\SysWOW64\Dolnad32.exe

Filesize
74KB

MD5
b2cef1511e0a1d78312b6684dae70bab

SHA1
4a77fc2563560e706c080f148e2ec5c13889a363

SHA256
7c955aefa37c837b766f86f1a9bf7196b1aac8e0bed9f7f00e335578585bd001

SHA512
016521b79ee0f3af72c49f1930c5947e4542431a93b7ab3192245ab8c7512e788174d3940be735d0e3837fd75954cf5fcaefecf6484fde12258effdd85655788

Download Submit
memory/396-186-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/396-424-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/396-194-0x0000000000250000-0x0000000000287000-memory.dmp

Filesize
220KB

Download
memory/536-416-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/604-414-0x0000000000250000-0x0000000000287000-memory.dmp

Filesize
220KB

Download
memory/604-404-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/704-269-0x0000000000250000-0x0000000000287000-memory.dmp

Filesize
220KB

Download
memory/704-264-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/964-302-0x0000000000280000-0x00000000002B7000-memory.dmp

Filesize
220KB

Download
memory/964-298-0x0000000000280000-0x00000000002B7000-memory.dmp

Filesize
220KB

Download
memory/964-433-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/964-292-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/980-276-0x0000000000440000-0x0000000000477000-memory.dmp

Filesize
220KB

Download
memory/980-270-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/980-280-0x0000000000440000-0x0000000000477000-memory.dmp

Filesize
220KB

Download
memory/980-431-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1036-439-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1036-378-0x0000000000250000-0x0000000000287000-memory.dmp

Filesize
220KB

Download
memory/1036-379-0x0000000000250000-0x0000000000287000-memory.dmp

Filesize
220KB

Download
memory/1036-371-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1168-251-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1168-430-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1188-285-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1188-290-0x0000000000330000-0x0000000000367000-memory.dmp

Filesize
220KB

Download
memory/1188-432-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1188-291-0x0000000000330000-0x0000000000367000-memory.dmp

Filesize
220KB

Download
memory/1408-105-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1408-418-0x0000000000250000-0x0000000000287000-memory.dmp

Filesize
220KB

Download
memory/1408-113-0x0000000000250000-0x0000000000287000-memory.dmp

Filesize
220KB

Download
memory/1408-417-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1628-421-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1628-146-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1636-333-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1636-334-0x0000000000280000-0x00000000002B7000-memory.dmp

Filesize
220KB

Download
memory/1716-219-0x0000000000310000-0x0000000000347000-memory.dmp

Filesize
220KB

Download
memory/1716-426-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1716-212-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1784-313-0x0000000000440000-0x0000000000477000-memory.dmp

Filesize
220KB

Download
memory/1784-312-0x0000000000440000-0x0000000000477000-memory.dmp

Filesize
220KB

Download
memory/1784-307-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1784-434-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1856-167-0x0000000000260000-0x0000000000297000-memory.dmp

Filesize
220KB

Download
memory/1856-422-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1856-159-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1916-391-0x0000000000250000-0x0000000000287000-memory.dmp

Filesize
220KB

Download
memory/1916-390-0x0000000000250000-0x0000000000287000-memory.dmp

Filesize
220KB

Download
memory/1916-384-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2016-401-0x00000000002D0000-0x0000000000307000-memory.dmp

Filesize
220KB

Download
memory/2016-403-0x00000000002D0000-0x0000000000307000-memory.dmp

Filesize
220KB

Download
memory/2016-397-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2056-425-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2060-227-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2060-229-0x0000000000250000-0x0000000000287000-memory.dmp

Filesize
220KB

Download
memory/2060-427-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2080-0-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2080-345-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2080-13-0x0000000000260000-0x0000000000297000-memory.dmp

Filesize
220KB

Download
memory/2080-346-0x0000000000260000-0x0000000000297000-memory.dmp

Filesize
220KB

Download
memory/2080-12-0x0000000000260000-0x0000000000297000-memory.dmp

Filesize
220KB

Download
memory/2092-373-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2092-48-0x00000000002D0000-0x0000000000307000-memory.dmp

Filesize
220KB

Download
memory/2208-314-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2208-435-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2208-332-0x0000000000310000-0x0000000000347000-memory.dmp

Filesize
220KB

Download
memory/2208-331-0x0000000000310000-0x0000000000347000-memory.dmp

Filesize
220KB

Download
memory/2336-428-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2336-238-0x0000000000340000-0x0000000000377000-memory.dmp

Filesize
220KB

Download
memory/2460-66-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2460-74-0x0000000000250000-0x0000000000287000-memory.dmp

Filesize
220KB

Download
memory/2460-402-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2484-389-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2552-14-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2552-347-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2588-356-0x0000000000280000-0x00000000002B7000-memory.dmp

Filesize
220KB

Download
memory/2588-437-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2588-357-0x0000000000280000-0x00000000002B7000-memory.dmp

Filesize
220KB

Download
memory/2604-436-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2604-344-0x0000000000280000-0x00000000002B7000-memory.dmp

Filesize
220KB

Download
memory/2604-335-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2664-359-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2664-438-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2728-27-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2728-358-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2728-34-0x0000000000440000-0x0000000000477000-memory.dmp

Filesize
220KB

Download
memory/2736-415-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2756-423-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2756-173-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2872-429-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2872-242-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2916-419-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2916-119-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2952-132-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2952-139-0x00000000002D0000-0x0000000000307000-memory.dmp

Filesize
220KB

Download
memory/2952-420-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2996-413-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2996-87-0x0000000000440000-0x0000000000477000-memory.dmp

Filesize
220KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads