7fe6f50f071134b03b27f9d7c95af4940466e88bab9673e9cf4d526c3f0d5069

Analysis

max time kernel
114s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13/09/2024, 01:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ac751a18a1d90dd80cfe76bf04dd84e0N.exe
Size

295KB
MD5

ac751a18a1d90dd80cfe76bf04dd84e0
SHA1

73e484eb2b25c7e4c763ec74ed851dbdf1836b6e
SHA256

7fe6f50f071134b03b27f9d7c95af4940466e88bab9673e9cf4d526c3f0d5069
SHA512

97e06f6f7eb4bb048f22f575a0821262cbab5a94c95ef522ad099e495e030306e57b9073aa6908a096239f726aed0dafb8e2fe3c9ac38845ee8a6e8e72d7e337
SSDEEP

6144:nzcsV7BgJirnP41PY1PRe19V+tbFOLM77OLY:nAs1BgJmg6fe0tsNM

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 44 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bahdob32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cgifbhid.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cocjiehd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cocjiehd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Coegoe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dgcihgaj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dpkmal32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ddgibkpc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	ac751a18a1d90dd80cfe76bf04dd84e0N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bahdob32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdmfllhn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dddllkbf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dojqjdbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dnmaea32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	ac751a18a1d90dd80cfe76bf04dd84e0N.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cacckp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dpiplm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dpiplm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dddllkbf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bnoddcef.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnjdpaki.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dnmaea32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dpkmal32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddgibkpc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dhbebj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bddcenpi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnoddcef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dojqjdbl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhbebj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dgcihgaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bddcenpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cdmfllhn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cglbhhga.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cglbhhga.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Coegoe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cdbpgl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Conanfli.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cgifbhid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cacckp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cgqlcg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cnjdpaki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Conanfli.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdbpgl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cgqlcg32.exe

Executes dropped EXE 22 IoCs

pid	Process
4580	Bddcenpi.exe
4780	Bahdob32.exe
988	Bnoddcef.exe
4548	Conanfli.exe
2500	Cgifbhid.exe
468	Cdmfllhn.exe
3340	Cglbhhga.exe
3676	Cocjiehd.exe
760	Coegoe32.exe
4572	Cacckp32.exe
3620	Cdbpgl32.exe
452	Cgqlcg32.exe
748	Cnjdpaki.exe
3508	Dpiplm32.exe
1984	Dddllkbf.exe
2896	Dgcihgaj.exe
4584	Dojqjdbl.exe
976	Dnmaea32.exe
3812	Dpkmal32.exe
3864	Ddgibkpc.exe
2224	Dhbebj32.exe
4964	Dkqaoe32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Bnoddcef.exe	Bahdob32.exe
File created	C:\Windows\SysWOW64\Lahoec32.dll	Bahdob32.exe
File created	C:\Windows\SysWOW64\Cocjiehd.exe	Cglbhhga.exe
File created	C:\Windows\SysWOW64\Fmamhbhe.dll	Cocjiehd.exe
File created	C:\Windows\SysWOW64\Cdbpgl32.exe	Cacckp32.exe
File opened for modification	C:\Windows\SysWOW64\Dhbebj32.exe	Ddgibkpc.exe
File created	C:\Windows\SysWOW64\Ndikch32.dll	ac751a18a1d90dd80cfe76bf04dd84e0N.exe
File created	C:\Windows\SysWOW64\Cacckp32.exe	Coegoe32.exe
File created	C:\Windows\SysWOW64\Cgqlcg32.exe	Cdbpgl32.exe
File created	C:\Windows\SysWOW64\Jhijep32.dll	Cdbpgl32.exe
File created	C:\Windows\SysWOW64\Dpiplm32.exe	Cnjdpaki.exe
File created	C:\Windows\SysWOW64\Gelfeh32.dll	Dddllkbf.exe
File created	C:\Windows\SysWOW64\Ddgibkpc.exe	Dpkmal32.exe
File created	C:\Windows\SysWOW64\Bjlfmfbi.dll	Cdmfllhn.exe
File created	C:\Windows\SysWOW64\Aamebb32.dll	Coegoe32.exe
File opened for modification	C:\Windows\SysWOW64\Cdbpgl32.exe	Cacckp32.exe
File opened for modification	C:\Windows\SysWOW64\Cgqlcg32.exe	Cdbpgl32.exe
File created	C:\Windows\SysWOW64\Nalhik32.dll	Dpiplm32.exe
File created	C:\Windows\SysWOW64\Dojqjdbl.exe	Dgcihgaj.exe
File opened for modification	C:\Windows\SysWOW64\Cdmfllhn.exe	Cgifbhid.exe
File created	C:\Windows\SysWOW64\Pghien32.dll	Cglbhhga.exe
File created	C:\Windows\SysWOW64\Dgcihgaj.exe	Dddllkbf.exe
File created	C:\Windows\SysWOW64\Cglbhhga.exe	Cdmfllhn.exe
File created	C:\Windows\SysWOW64\Dllfqd32.dll	Dgcihgaj.exe
File created	C:\Windows\SysWOW64\Glfdiedd.dll	Dhbebj32.exe
File opened for modification	C:\Windows\SysWOW64\Bddcenpi.exe	ac751a18a1d90dd80cfe76bf04dd84e0N.exe
File opened for modification	C:\Windows\SysWOW64\Conanfli.exe	Bnoddcef.exe
File created	C:\Windows\SysWOW64\Cgifbhid.exe	Conanfli.exe
File created	C:\Windows\SysWOW64\Bddcenpi.exe	ac751a18a1d90dd80cfe76bf04dd84e0N.exe
File opened for modification	C:\Windows\SysWOW64\Dpiplm32.exe	Cnjdpaki.exe
File created	C:\Windows\SysWOW64\Dnmaea32.exe	Dojqjdbl.exe
File opened for modification	C:\Windows\SysWOW64\Dkqaoe32.exe	Dhbebj32.exe
File created	C:\Windows\SysWOW64\Conanfli.exe	Bnoddcef.exe
File created	C:\Windows\SysWOW64\Mgnddp32.dll	Cgifbhid.exe
File opened for modification	C:\Windows\SysWOW64\Dpkmal32.exe	Dnmaea32.exe
File opened for modification	C:\Windows\SysWOW64\Cocjiehd.exe	Cglbhhga.exe
File created	C:\Windows\SysWOW64\Coegoe32.exe	Cocjiehd.exe
File created	C:\Windows\SysWOW64\Ennamn32.dll	Cgqlcg32.exe
File created	C:\Windows\SysWOW64\Dgihjf32.dll	Ddgibkpc.exe
File created	C:\Windows\SysWOW64\Hcjnlmph.dll	Cnjdpaki.exe
File opened for modification	C:\Windows\SysWOW64\Dddllkbf.exe	Dpiplm32.exe
File opened for modification	C:\Windows\SysWOW64\Ddgibkpc.exe	Dpkmal32.exe
File opened for modification	C:\Windows\SysWOW64\Bnoddcef.exe	Bahdob32.exe
File opened for modification	C:\Windows\SysWOW64\Dnmaea32.exe	Dojqjdbl.exe
File created	C:\Windows\SysWOW64\Dhbebj32.exe	Ddgibkpc.exe
File opened for modification	C:\Windows\SysWOW64\Bahdob32.exe	Bddcenpi.exe
File opened for modification	C:\Windows\SysWOW64\Cacckp32.exe	Coegoe32.exe
File created	C:\Windows\SysWOW64\Eekgliip.dll	Cacckp32.exe
File opened for modification	C:\Windows\SysWOW64\Cnjdpaki.exe	Cgqlcg32.exe
File created	C:\Windows\SysWOW64\Domdocba.dll	Bddcenpi.exe
File created	C:\Windows\SysWOW64\Hikemehi.dll	Bnoddcef.exe
File created	C:\Windows\SysWOW64\Omjbpn32.dll	Dnmaea32.exe
File created	C:\Windows\SysWOW64\Nchkcb32.dll	Dpkmal32.exe
File opened for modification	C:\Windows\SysWOW64\Cgifbhid.exe	Conanfli.exe
File created	C:\Windows\SysWOW64\Cdmfllhn.exe	Cgifbhid.exe
File opened for modification	C:\Windows\SysWOW64\Cglbhhga.exe	Cdmfllhn.exe
File opened for modification	C:\Windows\SysWOW64\Coegoe32.exe	Cocjiehd.exe
File created	C:\Windows\SysWOW64\Cnjdpaki.exe	Cgqlcg32.exe
File created	C:\Windows\SysWOW64\Dddllkbf.exe	Dpiplm32.exe
File created	C:\Windows\SysWOW64\Dkqaoe32.exe	Dhbebj32.exe
File created	C:\Windows\SysWOW64\Bahdob32.exe	Bddcenpi.exe
File created	C:\Windows\SysWOW64\Okhbek32.dll	Conanfli.exe
File opened for modification	C:\Windows\SysWOW64\Dgcihgaj.exe	Dddllkbf.exe
File opened for modification	C:\Windows\SysWOW64\Dojqjdbl.exe	Dgcihgaj.exe

Program crash 1 IoCs

pid	pid_target	Process
4332	4964	WerFault.exe

System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Coegoe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dgcihgaj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnoddcef.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Conanfli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cgifbhid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cgqlcg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dpiplm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dojqjdbl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddgibkpc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkqaoe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ac751a18a1d90dd80cfe76bf04dd84e0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdbpgl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dddllkbf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dpkmal32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bahdob32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdmfllhn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cglbhhga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cocjiehd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cacckp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnjdpaki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dnmaea32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhbebj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bddcenpi.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cocjiehd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eekgliip.dll"	Cacckp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dddllkbf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ddgibkpc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bnoddcef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cglbhhga.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pghien32.dll"	Cglbhhga.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmamhbhe.dll"	Cocjiehd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cacckp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	ac751a18a1d90dd80cfe76bf04dd84e0N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hikemehi.dll"	Bnoddcef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dnmaea32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Conanfli.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cglbhhga.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dnmaea32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dpkmal32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aamebb32.dll"	Coegoe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cdbpgl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dpiplm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dojqjdbl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	ac751a18a1d90dd80cfe76bf04dd84e0N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	ac751a18a1d90dd80cfe76bf04dd84e0N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bjlfmfbi.dll"	Cdmfllhn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cgqlcg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gelfeh32.dll"	Dddllkbf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dhbebj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Conanfli.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cdmfllhn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cdmfllhn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}	ac751a18a1d90dd80cfe76bf04dd84e0N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bahdob32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ddgibkpc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Coegoe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dgcihgaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bnoddcef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgnddp32.dll"	Cgifbhid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cocjiehd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cacckp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ennamn32.dll"	Cgqlcg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dpiplm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lahoec32.dll"	Bahdob32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bahdob32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dhbebj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dllfqd32.dll"	Dgcihgaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dojqjdbl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dddllkbf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Okhbek32.dll"	Conanfli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hcjnlmph.dll"	Cnjdpaki.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cgifbhid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jhijep32.dll"	Cdbpgl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cdbpgl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nalhik32.dll"	Dpiplm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dgihjf32.dll"	Ddgibkpc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	ac751a18a1d90dd80cfe76bf04dd84e0N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ndikch32.dll"	ac751a18a1d90dd80cfe76bf04dd84e0N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cnjdpaki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jilpfgkh.dll"	Dojqjdbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nchkcb32.dll"	Dpkmal32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dpkmal32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bddcenpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cgifbhid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Glfdiedd.dll"	Dhbebj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bddcenpi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cgqlcg32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4208 wrote to memory of 4580	4208	ac751a18a1d90dd80cfe76bf04dd84e0N.exe	91
PID 4208 wrote to memory of 4580	4208	ac751a18a1d90dd80cfe76bf04dd84e0N.exe	91
PID 4208 wrote to memory of 4580	4208	ac751a18a1d90dd80cfe76bf04dd84e0N.exe	91
PID 4580 wrote to memory of 4780	4580	Bddcenpi.exe	92
PID 4580 wrote to memory of 4780	4580	Bddcenpi.exe	92
PID 4580 wrote to memory of 4780	4580	Bddcenpi.exe	92
PID 4780 wrote to memory of 988	4780	Bahdob32.exe	95
PID 4780 wrote to memory of 988	4780	Bahdob32.exe	95
PID 4780 wrote to memory of 988	4780	Bahdob32.exe	95
PID 988 wrote to memory of 4548	988	Bnoddcef.exe	96
PID 988 wrote to memory of 4548	988	Bnoddcef.exe	96
PID 988 wrote to memory of 4548	988	Bnoddcef.exe	96
PID 4548 wrote to memory of 2500	4548	Conanfli.exe	98
PID 4548 wrote to memory of 2500	4548	Conanfli.exe	98
PID 4548 wrote to memory of 2500	4548	Conanfli.exe	98
PID 2500 wrote to memory of 468	2500	Cgifbhid.exe	99
PID 2500 wrote to memory of 468	2500	Cgifbhid.exe	99
PID 2500 wrote to memory of 468	2500	Cgifbhid.exe	99
PID 468 wrote to memory of 3340	468	Cdmfllhn.exe	100
PID 468 wrote to memory of 3340	468	Cdmfllhn.exe	100
PID 468 wrote to memory of 3340	468	Cdmfllhn.exe	100
PID 3340 wrote to memory of 3676	3340	Cglbhhga.exe	101
PID 3340 wrote to memory of 3676	3340	Cglbhhga.exe	101
PID 3340 wrote to memory of 3676	3340	Cglbhhga.exe	101
PID 3676 wrote to memory of 760	3676	Cocjiehd.exe	102
PID 3676 wrote to memory of 760	3676	Cocjiehd.exe	102
PID 3676 wrote to memory of 760	3676	Cocjiehd.exe	102
PID 760 wrote to memory of 4572	760	Coegoe32.exe	103
PID 760 wrote to memory of 4572	760	Coegoe32.exe	103
PID 760 wrote to memory of 4572	760	Coegoe32.exe	103
PID 4572 wrote to memory of 3620	4572	Cacckp32.exe	104
PID 4572 wrote to memory of 3620	4572	Cacckp32.exe	104
PID 4572 wrote to memory of 3620	4572	Cacckp32.exe	104
PID 3620 wrote to memory of 452	3620	Cdbpgl32.exe	105
PID 3620 wrote to memory of 452	3620	Cdbpgl32.exe	105
PID 3620 wrote to memory of 452	3620	Cdbpgl32.exe	105
PID 452 wrote to memory of 748	452	Cgqlcg32.exe	106
PID 452 wrote to memory of 748	452	Cgqlcg32.exe	106
PID 452 wrote to memory of 748	452	Cgqlcg32.exe	106
PID 748 wrote to memory of 3508	748	Cnjdpaki.exe	107
PID 748 wrote to memory of 3508	748	Cnjdpaki.exe	107
PID 748 wrote to memory of 3508	748	Cnjdpaki.exe	107
PID 3508 wrote to memory of 1984	3508	Dpiplm32.exe	108
PID 3508 wrote to memory of 1984	3508	Dpiplm32.exe	108
PID 3508 wrote to memory of 1984	3508	Dpiplm32.exe	108
PID 1984 wrote to memory of 2896	1984	Dddllkbf.exe	109
PID 1984 wrote to memory of 2896	1984	Dddllkbf.exe	109
PID 1984 wrote to memory of 2896	1984	Dddllkbf.exe	109
PID 2896 wrote to memory of 4584	2896	Dgcihgaj.exe	110
PID 2896 wrote to memory of 4584	2896	Dgcihgaj.exe	110
PID 2896 wrote to memory of 4584	2896	Dgcihgaj.exe	110
PID 4584 wrote to memory of 976	4584	Dojqjdbl.exe	111
PID 4584 wrote to memory of 976	4584	Dojqjdbl.exe	111
PID 4584 wrote to memory of 976	4584	Dojqjdbl.exe	111
PID 976 wrote to memory of 3812	976	Dnmaea32.exe	112
PID 976 wrote to memory of 3812	976	Dnmaea32.exe	112
PID 976 wrote to memory of 3812	976	Dnmaea32.exe	112
PID 3812 wrote to memory of 3864	3812	Dpkmal32.exe	113
PID 3812 wrote to memory of 3864	3812	Dpkmal32.exe	113
PID 3812 wrote to memory of 3864	3812	Dpkmal32.exe	113
PID 3864 wrote to memory of 2224	3864	Ddgibkpc.exe	114
PID 3864 wrote to memory of 2224	3864	Ddgibkpc.exe	114
PID 3864 wrote to memory of 2224	3864	Ddgibkpc.exe	114
PID 2224 wrote to memory of 4964	2224	Dhbebj32.exe	115

C:\Users\Admin\AppData\Local\Temp\ac751a18a1d90dd80cfe76bf04dd84e0N.exe
"C:\Users\Admin\AppData\Local\Temp\ac751a18a1d90dd80cfe76bf04dd84e0N.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4208
- C:\Windows\SysWOW64\Bddcenpi.exe
  C:\Windows\system32\Bddcenpi.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4580
- - C:\Windows\SysWOW64\Bahdob32.exe
    C:\Windows\system32\Bahdob32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4780
  - - C:\Windows\SysWOW64\Bnoddcef.exe
      C:\Windows\system32\Bnoddcef.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:988
    - - C:\Windows\SysWOW64\Conanfli.exe
        
        C:\Windows\system32\Conanfli.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4548
      - C:\Windows\SysWOW64\Cgifbhid.exe
        
        C:\Windows\system32\Cgifbhid.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2500
        
        C:\Windows\SysWOW64\Cdmfllhn.exe
        
        C:\Windows\system32\Cdmfllhn.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:468
        
        C:\Windows\SysWOW64\Cglbhhga.exe
        
        C:\Windows\system32\Cglbhhga.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3340
        
        C:\Windows\SysWOW64\Cocjiehd.exe
        
        C:\Windows\system32\Cocjiehd.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3676
        
        C:\Windows\SysWOW64\Coegoe32.exe
        
        C:\Windows\system32\Coegoe32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:760
        
        C:\Windows\SysWOW64\Cacckp32.exe
        
        C:\Windows\system32\Cacckp32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4572
        
        C:\Windows\SysWOW64\Cdbpgl32.exe
        
        C:\Windows\system32\Cdbpgl32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3620
        
        C:\Windows\SysWOW64\Cgqlcg32.exe
        
        C:\Windows\system32\Cgqlcg32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:452
        
        C:\Windows\SysWOW64\Cnjdpaki.exe
        
        C:\Windows\system32\Cnjdpaki.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:748
        
        C:\Windows\SysWOW64\Dpiplm32.exe
        
        C:\Windows\system32\Dpiplm32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3508
        
        C:\Windows\SysWOW64\Dddllkbf.exe
        
        C:\Windows\system32\Dddllkbf.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1984
        
        C:\Windows\SysWOW64\Dgcihgaj.exe
        
        C:\Windows\system32\Dgcihgaj.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2896
        
        C:\Windows\SysWOW64\Dojqjdbl.exe
        
        C:\Windows\system32\Dojqjdbl.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4584
        
        C:\Windows\SysWOW64\Dnmaea32.exe
        
        C:\Windows\system32\Dnmaea32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:976
        
        C:\Windows\SysWOW64\Dpkmal32.exe
        
        C:\Windows\system32\Dpkmal32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3812
        
        C:\Windows\SysWOW64\Ddgibkpc.exe
        
        C:\Windows\system32\Ddgibkpc.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3864
        
        C:\Windows\SysWOW64\Dhbebj32.exe
        
        C:\Windows\system32\Dhbebj32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2224
        
        C:\Windows\SysWOW64\Dkqaoe32.exe
        
        C:\Windows\system32\Dkqaoe32.exe
        23⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4964
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4964 -s 412
        24⤵
        Program crash
        
        PID:4332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4964 -ip 4964
1⤵
PID:4320

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4276,i,10065386245627775856,6567048529106473151,262144 --variations-seed-version --mojo-platform-channel-handle=1436 /prefetch:8
1⤵
PID:4204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Bahdob32.exe

Filesize
295KB

MD5
68a16749dc604380178d1828c53b3530

SHA1
a0be700a0efe0dc5e4eaf145588b804c2dc162d1

SHA256
e95abc9189a619d6bffeabbfb5e4a1cc54644ea319256bee4cdc27dea0cb4a10

SHA512
6b20ece24a92bf6dfeb921906936d03130bc818a08d630b772c76a13e80d040c1a22949f77b3ac6bf149f446968af9837ae9453cbb39be5f18d3ef92f30b218f

Download Submit
C:\Windows\SysWOW64\Bddcenpi.exe

Filesize
295KB

MD5
534c8d70cacd987dad0c4a4e081c2d2e

SHA1
cc76c6429a23e8ce3e161e68ffa233b5a98afb10

SHA256
735120c5fe198948f01b33ef48332aa963f2e37e64ce1363fa7597fdfb3607dd

SHA512
82dfc074ce778ee910028940d97ff5292bdbc6b1394ecd4d2fed10ab315fb73281a288acb2bcfce724031ff05f6315e799c28ab6f40d47dfbdcaae1fc9718a31

Download Submit
C:\Windows\SysWOW64\Bnoddcef.exe

Filesize
295KB

MD5
272553c4c7bc91134222990231627d9f

SHA1
09550979cb40aa6241ebc8c31275f1d5561bdd48

SHA256
b8540acd2ea083040323fc6c09ab937e4cec8812263be8489f94833abfbb37f3

SHA512
e906b13bb0b73c36f8923efc1b36b35ac21916d2ecc967edc6c12004b14770897dce1e468a08d02195818c458a116533962d04efe307459e736ddeeae91ef8b6

Download Submit
C:\Windows\SysWOW64\Cacckp32.exe

Filesize
295KB

MD5
f0c604b95987bff7d712700ec1a395af

SHA1
7339823bd2c27fae2d34235c0622ba5aa66cc84d

SHA256
96e07e1c481214564bd62d79cfbd1f89ae422a9c528e26094b79ae62b00f6500

SHA512
c70565e3b18b9b2634114ef8f648fd6999496cbd711e1cc3c45de19085a708dd8218d566dee31949408bb919991a8b68fd2accedd4bc5397e6f33eb80b79f86e

Download Submit
C:\Windows\SysWOW64\Cdbpgl32.exe

Filesize
295KB

MD5
793ffa6e224811afb494a7112d3d21a9

SHA1
212c30453162774594788259efe2ec0762b099b4

SHA256
7dfcb8fd69c45de6f4d05de9aebeddb796ce622eb09314b436e35a056433840f

SHA512
f95b6665e2dc67ff1fa060daf419b23520a7b29084318bb50382d536d58b101e66c7c363e11c2bb4946061517e2f8d92d9ece1fe59b660371928a186b5078904

Download Submit
C:\Windows\SysWOW64\Cdmfllhn.exe

Filesize
295KB

MD5
59fbfc4d5c9d82972ffc2e199c806b5f

SHA1
3c19f8b9b4278ae980e42b45a77967c41d00ba01

SHA256
67f398e63634fb204d640c27ea5b55d0cdcc1bc0c0a7f6ceed688b1746bccd40

SHA512
351846fbae4dce6690701ae69e145a986700d2ec1d41370ea1e321ffd42624290cbcf9a11cb6eedf1ca49547ae305b53fbe2a620c88c1d9743ab683e281f3b6a

Download Submit
C:\Windows\SysWOW64\Cgifbhid.exe

Filesize
295KB

MD5
4c3ab191aedbc5238277c66af4dfe325

SHA1
c60b461dddcd38135d82182a331d8c6ab215f5a7

SHA256
1dd2789d341f32fb9b6c58a67b0866a231b848bf4f229bd9369b6592c7a02c8f

SHA512
e14012a08390eada5ed363190076e0328d8365fa00b07c8ac0929f36a7e1b88ee6e32bfb05109d83e32379d1b52682bff30864437934e8b1ff6bcfe300c62459

Download Submit
C:\Windows\SysWOW64\Cglbhhga.exe

Filesize
295KB

MD5
63513309405be1c9392b499db3198301

SHA1
94a846ac84c36955e1b02066bdb458c836ed3f7b

SHA256
dc3f9e9af64356ef8d4c0c4f1f4da1f6635492a2ba9fcb07dd69c0173158c2c6

SHA512
3787f660b2913b5c55337642eb2f4fa504f49921c384053dd11577e99e5998dd43efbaa3d217b3ba576244e1f0f20978d5fd52584f4d4213837d99c0d206edb5

Download Submit
C:\Windows\SysWOW64\Cgqlcg32.exe

Filesize
295KB

MD5
78d59a02fcf49bcbaee89fcd489dd699

SHA1
69c0cd5a360ec4188285a1e009c849fb3760ad81

SHA256
cfc35c08f2d55d09297ba0e514cb336c994b06fee171acdc58b3400f515278ab

SHA512
0601e8ac94df852dd6042349a75300811d9279ce7f4b27c93da2e516ea7d32a32663f059bbfa516438afdb9f819053988a290a33038ff45c691ffc5775d2ec8e

Download Submit
C:\Windows\SysWOW64\Cnjdpaki.exe

Filesize
295KB

MD5
5146528692df236cf2eafb9644a21369

SHA1
d79a37389a95e0f862c8d142e7619e7545088b41

SHA256
5ff22d6af3ec7a6d4074d511b683faaddea151b9b1551eb0f0c6389120420db9

SHA512
9506ad40289c1dba2a739ead0ced71e285cd2203de65416c5decb17c54181b70834ba09d58a501b430ca08a7abb0d2a7c5e085e58405a65462b14340e756b45e

Download Submit
C:\Windows\SysWOW64\Cocjiehd.exe

Filesize
295KB

MD5
e53056fed68b3275c0764530c017c2aa

SHA1
7f11705a6a27d1b23cd2aa267ac1696dd1f4f089

SHA256
283ba7d77739d20ec927149456d7182f4cbda0ff78487ea1bb24bb07abd4db76

SHA512
d2a69abd7f9effeaba63c3efdf70b1afea562081123d9f0471e43d30950152bcec6f0216ef418c5efffddce5e5e5b90684a61463a5f003782459f2ad17bdd730

Download Submit
C:\Windows\SysWOW64\Coegoe32.exe

Filesize
295KB

MD5
e9204e3c040d90c908f836bb0849df14

SHA1
9dbb86437157b444f570b15669656f350fdade25

SHA256
6ba6b75b5f81ecc565fe94fc656ea78c713e5d3c4f8b20ef19c059ac978af327

SHA512
5b7a71aedb1f8b45d6c7d5c18383ce8b5569be20f47ba764ce02ae81adbd02cbe89ccb9004eb576f58c3f9580f7fe4ceab471461ca63fb82de2ff9907d0ec250

Download Submit
C:\Windows\SysWOW64\Conanfli.exe

Filesize
295KB

MD5
978b19ad0cafff90beb27b2f451a1b48

SHA1
f533748edec2df2e490b06b1c30d3997cb9089a5

SHA256
2a42f47b96519f6502c0f86852fdaafac4d73f19d96217e2a4e565193eb95d31

SHA512
3538c909049907f14d838af2c2cf2f6ae60769fec6f0e8970aaf454e3b04165a0036697c100d8acc96e0c1d8db24391c535b11ca25f33c99630aa097463d1485

Download Submit
C:\Windows\SysWOW64\Dddllkbf.exe

Filesize
295KB

MD5
465d3371736e9350a38b36438adcf8ee

SHA1
a162aa77ea543c171c846766ddd6f528daa63221

SHA256
8220aed1a3bda6c0936eb722f818e3bbd3652b8607b6388d1f028025df2f9e1f

SHA512
d0091e9d5e1dfbf9bd2af44affe3e3bf55c53b55a3b8513241ca88dd1219b6812d43662b06674a245806110b141e5f62371738b7db1efd66cfc4a73701a07ed2

Download Submit
C:\Windows\SysWOW64\Ddgibkpc.exe

Filesize
295KB

MD5
b99e3da3e1b362862adc0e272c4def68

SHA1
cb1535716538d02a9b0ece8fab088a48d6260902

SHA256
660dc2750bcd5ada76af7ccad8b888c1c19bb36f24a5b318e31b9ba51844a45b

SHA512
940566e4ba1e79ac368d101a601c4f491f65f5aac4ed11ce66f926c533c0afa75facee2873e909e213bfbb4495029460b910239fafa04850a0fcc239639088a4

Download Submit
C:\Windows\SysWOW64\Dgcihgaj.exe

Filesize
295KB

MD5
fa27ebc44afa0add0509a067354ecac9

SHA1
26676fd45c1c515669544ba8baf4396668009b69

SHA256
cefc67b5496f1de053d28048d23e2edaf343b946df66a078522a0d2be704e6f0

SHA512
4d5d4b01ffbbe702bc7486419184046655ae1d6acbdc63ea248c10a842b99600ba0904c3cb15b840c09612e9bdca392c7ee68fa26c845b99fdecdc590ef561d6

Download Submit
C:\Windows\SysWOW64\Dhbebj32.exe

Filesize
295KB

MD5
2e7d204eb134c9c2a30ae35fbab5983a

SHA1
67ce56665fb7b7aa2378e981e2deb66484c2d39f

SHA256
6e3bfa6bd849e033bce49befab49d3fd21530060000cb1dd825ae69da95a59aa

SHA512
dbf96da3de007703893a243ae1c4109f8402f43d3e399dd2a40060823ddf00ae1ada01708e99846448a22530d4dcbaec49667f0be65b7fb2ec3ab7fbfef62e75

Download Submit
C:\Windows\SysWOW64\Dkqaoe32.exe

Filesize
295KB

MD5
bc76039288adff857fc90ff2e854d19b

SHA1
02202bdea2132eb93aa1e5382e7af0384b028b89

SHA256
d91605fd5ba608cd7c86183ead7f837a1ba16afd3a667b8c0400e6d133bfa0a8

SHA512
0af866b89f90f3e1e6b98f33760a87812e339acfdf6d83a642626d312c3c4a283073136a19a596683a8d14aa134de523d73733ec94365cf247a9d79377449590

Download Submit
C:\Windows\SysWOW64\Dnmaea32.exe

Filesize
295KB

MD5
8cdffb43e9a7d045d0daeff4bccd8a68

SHA1
88ae615f542a12edad0e17a9646aefadcda9a046

SHA256
f7532e5ebd75ba232d5ec67b50a1fd2fd504691466ad4401ff4738f87a24dcde

SHA512
d513eadf328a52dda9a48f59b1d53e7be34d76af35e916c8f8635d373d53c4ad6345fe16f81008777cd5b71a7e068d9d03fb6dd32940101913d4a6a679c814da

Download Submit
C:\Windows\SysWOW64\Dojqjdbl.exe

Filesize
295KB

MD5
0ddf5282b4135672ccfd76932dad1e8d

SHA1
d33979dee1de9434545300f018a0e11274cfc802

SHA256
05d291de20f7dbfd30ddf0ca966d03175b5620da11f330bf73525be4c7d3634d

SHA512
78c0f22f87cee38b9d645bd1447889d619b9ab74849e089b1c4e427e087f0a6c622e6ce0693c2993360c09880186670f586bf9934d8fcb2ad0dd1b84c3996859

Download Submit
C:\Windows\SysWOW64\Dpiplm32.exe

Filesize
295KB

MD5
e0c03f8fbabeedb49b8edaabae76e8de

SHA1
db50a1bf4bcffd60708e41eb815351d9218a385f

SHA256
d83adb72113519ca1366350c2246054bf73f429cc320b497328c1d6aba0fb15d

SHA512
352473e2d64b2726e79092a7b34e35b5e66abff954619d37dbdae5208ab2826ca5ef80897533ec79931868c35ec0e44ea2ecc3334a3a521b2bd21ff114bfab67

Download Submit
C:\Windows\SysWOW64\Dpkmal32.exe

Filesize
295KB

MD5
fd9f4f54f29924e16ea47839d0b1c374

SHA1
720300b45a4b30021195dd2595a40a7293eee588

SHA256
982a8c546c05288b5cf65d40770217ae5c956c8158933369a347f11266d39e98

SHA512
1a47d0539811d468df8943dbb9419ec91999d389dd2ca61ea60aa95b5fe6d556857bacb3fb2eabadd33280ab3316e69f6ed98d727888e295a1752efb66411fcc

Download Submit
C:\Windows\SysWOW64\Okhbek32.dll

Filesize
7KB

MD5
c7ac23fd1501cd8549ae7c244fc28060

SHA1
e73def7053d05db08b2884e2fc0237a688ec4446

SHA256
75918ac7fcd68b89c27ea1667168e6c22191a7f5e2c4e11b3ad1a570f780c67d

SHA512
8e14006435b3022aab35c204403f13baa46bf5c8168213ad6a3479fd0272265ab84e456a54e97644d3aa84f685775679fc71a33354084b55b488ddd647bdb251

Download Submit
memory/452-198-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/452-95-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/468-210-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/468-47-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/748-109-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/748-196-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/760-72-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/760-204-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/976-148-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/976-186-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/988-23-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/988-216-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/1984-192-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/1984-124-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2224-180-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2224-173-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2500-39-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2500-212-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2896-132-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2896-190-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/3340-56-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/3340-208-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/3508-194-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/3508-117-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/3620-200-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/3620-92-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/3676-64-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/3676-206-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/3812-184-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/3812-156-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/3864-182-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/3864-164-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/4208-222-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/4208-0-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/4548-214-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/4548-31-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/4572-202-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/4572-84-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/4580-220-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/4580-7-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/4584-140-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/4584-188-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/4780-218-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/4780-15-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/4964-178-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/4964-176-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads