Analysis
-
max time kernel
110s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19-09-2024 06:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a37a87214a099e8d9ac9fc54ecc16de4a6c45310c27aaa9b7a6e86436bdb7668N.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
a37a87214a099e8d9ac9fc54ecc16de4a6c45310c27aaa9b7a6e86436bdb7668N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
120 seconds
General
-
Target
a37a87214a099e8d9ac9fc54ecc16de4a6c45310c27aaa9b7a6e86436bdb7668N.exe
-
Size
95KB
-
MD5
a4cc95187bda987e0171b7d679a36a70
-
SHA1
eb65b07fc5fd3c9ec962229d2f0a69aba35ab6e9
-
SHA256
a37a87214a099e8d9ac9fc54ecc16de4a6c45310c27aaa9b7a6e86436bdb7668
-
SHA512
ef46fe65fc2d6db9f5513b71f384e0ae2df011a27b19a692c64ce8e44cf3c86001001273c5789c2d048a5e0ba76b8c727248935c2a597b5806d03f7f77a0bbd1
-
SSDEEP
1536:89vo7PCP04csjuQcQDjIr2rJKhSCH4w20bpLRuBh8YgMHOM6bOLXi8PmCofGQ:uA2P04csAQIaJK0CH4w2005gMHDrLXfW
Score
10/10
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dnblicli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Nemifjkc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Biajbn32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cobhpg32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ciminm32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ejahjl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bchldcbg.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ndcjjgbh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Pjgaik32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Process not Found Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pqomqefe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Afgedk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Afokejdg.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oembmh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Fondlo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jbfnanka.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mhfemp32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ncgapjmo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Pladjg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Qnhgei32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jfmhadkk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kfnqha32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kqdnii32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Process not Found Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nchgkdgq.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bqflhb32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cebapo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Cjoihe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Pjgkoe32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jglqifoq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Njcfbd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ddmnfqpo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Dahepdiq.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Midcfpkm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Feafhj32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Process not Found Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eaahfb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bnmigfna.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Cgpfac32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Dpnhkfba.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eipojj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Edlihaje.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ogbfggge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kpglkm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Hnamnila.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jjlika32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lapndh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Naccae32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Nahanb32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Obfnopin.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Clfjfp32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lpbkgl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ldnghjeq.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bfdcal32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ajegpcmi.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dgiigb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Malabc32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Meigea32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Nikigoee.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oifahggl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Gapchckl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Dbpfhjjc.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Process not Found -
Executes dropped EXE 64 IoCs
pid Process 4148 Kfmago32.exe 5028 Kikncjef.exe 6120 Kpefpd32.exe 5152 Kfonmncp.exe 5548 Kmifjh32.exe 1512 Kdcofbbi.exe 1584 Kfakbnam.exe 5540 Kmkcohij.exe 4744 Kpjpkchn.exe 1324 Kbhlgoga.exe 5596 Kibddi32.exe 4324 Kpllacfk.exe 6000 Lgfdnm32.exe 6016 Lmpmjgee.exe 3884 Ldjegala.exe 6064 Laneqekk.exe 5912 Liijehif.exe 5972 Lpcbabpc.exe 5888 Labole32.exe 5828 Lkkcdjnf.exe 5500 Lphlmaln.exe 3240 Mgbdilck.exe 3888 Mmllfe32.exe 3496 Mcienm32.exe 3940 Mkpmpj32.exe 3060 Mpmehq32.exe 3180 Mckadl32.exe 2308 Malabc32.exe 2656 Mcmnilei.exe 5232 Mjgfff32.exe 5024 Mdmkco32.exe 5736 Mgkgpj32.exe 5376 Mneold32.exe 5700 Ndoginji.exe 4212 Nkipfh32.exe 5004 Nachbbic.exe 2992 Ncddjk32.exe 436 Njnmge32.exe 3224 Nnjhgcog.exe 992 Ncgapjmo.exe 5432 Nkniahna.exe 2532 Nahanb32.exe 3864 Ncinejkl.exe 836 Njcfbd32.exe 4600 Najncack.exe 4480 Nggfkhab.exe 688 Nnaohb32.exe 4824 Ogicahop.exe 5240 Okeoag32.exe 5356 Oqagjneq.exe 1256 Oglpfh32.exe 4336 Obaddq32.exe 5236 Ocbqkica.exe 5748 Ognmlg32.exe 3312 Obcaip32.exe 3692 Ocemah32.exe 3440 Ojoenbhl.exe 4056 Obfnopin.exe 2952 Ogbfggge.exe 5016 Oknbhe32.exe 3924 Pqkjpl32.exe 2044 Pciglhmi.exe 1504 Pjcoib32.exe 4732 Pdicfk32.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Emccchck.dll Bhcheb32.exe File created C:\Windows\SysWOW64\Jmmcnima.dll Cechje32.exe File created C:\Windows\SysWOW64\Bcfnog32.exe Bqhbcl32.exe File created C:\Windows\SysWOW64\Ajdpflin.exe Acjhibaa.exe File created C:\Windows\SysWOW64\Bjiial32.exe Bcoada32.exe File created C:\Windows\SysWOW64\Odoief32.exe Opcmegpb.exe File opened for modification C:\Windows\SysWOW64\Hefhjg32.exe Hnoqhj32.exe File opened for modification C:\Windows\SysWOW64\Ldfioa32.exe Process not Found File opened for modification C:\Windows\SysWOW64\Jpklpo32.exe Jmmpccan.exe File created C:\Windows\SysWOW64\Cfnaea32.dll Dknmcjac.exe File created C:\Windows\SysWOW64\Madmgd32.dll Mmiifpin.exe File opened for modification C:\Windows\SysWOW64\Obnoff32.exe Okggei32.exe File created C:\Windows\SysWOW64\Egaaho32.dll Malabc32.exe File opened for modification C:\Windows\SysWOW64\Coipmkho.exe Clkcaoil.exe File opened for modification C:\Windows\SysWOW64\Eaahfb32.exe Ecngkfjk.exe File created C:\Windows\SysWOW64\Qebfli32.exe Pnhnpode.exe File created C:\Windows\SysWOW64\Pnlgik32.exe Ogbomqci.exe File opened for modification C:\Windows\SysWOW64\Ckmkea32.exe Cinoif32.exe File created C:\Windows\SysWOW64\Ckagbd32.dll Process not Found File created C:\Windows\SysWOW64\Lpbkgl32.exe Lmdokp32.exe File created C:\Windows\SysWOW64\Dbddbiog.dll Ogeifl32.exe File created C:\Windows\SysWOW64\Hlcmeh32.dll Pommfmmi.exe File created C:\Windows\SysWOW64\Imcfcj32.dll Flbkpjfn.exe File created C:\Windows\SysWOW64\Ialflf32.dll Gcamgcif.exe File created C:\Windows\SysWOW64\Feccmjok.exe Fmlklm32.exe File created C:\Windows\SysWOW64\Ibhghgnn.dll Cgbcgc32.exe File opened for modification C:\Windows\SysWOW64\Ialkkpcl.exe Ikbcne32.exe File created C:\Windows\SysWOW64\Foifpn32.dll Oelkbb32.exe File created C:\Windows\SysWOW64\Ahdcljbk.exe Aakkop32.exe File created C:\Windows\SysWOW64\Ciqloeik.exe Cbgdbk32.exe File created C:\Windows\SysWOW64\Ncebnjdn.exe Process not Found File opened for modification C:\Windows\SysWOW64\Lkkcdjnf.exe Labole32.exe File opened for modification C:\Windows\SysWOW64\Ajqdpj32.exe Afehokla.exe File created C:\Windows\SysWOW64\Jnkkbb32.dll Bfejkb32.exe File opened for modification C:\Windows\SysWOW64\Oejombkg.exe Oblbaglc.exe File created C:\Windows\SysWOW64\Fmpfdfbk.dll Kkccpiqh.exe File created C:\Windows\SysWOW64\Jkqopc32.exe Jdfgcihb.exe File opened for modification C:\Windows\SysWOW64\Qljpfpdh.exe Qhndfa32.exe File opened for modification C:\Windows\SysWOW64\Hhhgflfh.exe Hpaoenff.exe File opened for modification C:\Windows\SysWOW64\Fceedjon.exe Process not Found File created C:\Windows\SysWOW64\Cfqdlb32.dll Cmclcl32.exe File opened for modification C:\Windows\SysWOW64\Bhjneadh.exe Blcmqp32.exe File created C:\Windows\SysWOW64\Qkdhdf32.dll Jbiilk32.exe File created C:\Windows\SysWOW64\Kabmod32.dll Ndamdhdk.exe File created C:\Windows\SysWOW64\Onneel32.dll Qgnohoil.exe File opened for modification C:\Windows\SysWOW64\Emjdpbed.exe Efplchng.exe File opened for modification C:\Windows\SysWOW64\Lidjob32.exe Kmmijacl.exe File created C:\Windows\SysWOW64\Oafkggkn.dll Odoief32.exe File created C:\Windows\SysWOW64\Cpjkjimb.dll Gopaaoaf.exe File created C:\Windows\SysWOW64\Afddpajl.dll Jklfddcd.exe File created C:\Windows\SysWOW64\Paolca32.exe Poqpgf32.exe File created C:\Windows\SysWOW64\Egmidc32.exe Edomhh32.exe File created C:\Windows\SysWOW64\Hqhkphai.dll Dpnhkfba.exe File opened for modification C:\Windows\SysWOW64\Kqgkni32.exe Kjmbaono.exe File created C:\Windows\SysWOW64\Gidamhkf.dll Fpgchb32.exe File created C:\Windows\SysWOW64\Cimdflkj.dll Gdoodojo.exe File created C:\Windows\SysWOW64\Qhpjadjh.dll Fhfhdd32.exe File created C:\Windows\SysWOW64\Olldea32.exe Oimhif32.exe File opened for modification C:\Windows\SysWOW64\Acjhibaa.exe Akcpheao.exe File opened for modification C:\Windows\SysWOW64\Hkofgb32.exe Process not Found File created C:\Windows\SysWOW64\Olokip32.dll Akahdc32.exe File opened for modification C:\Windows\SysWOW64\Hhkkfa32.exe Hfmojf32.exe File created C:\Windows\SysWOW64\Odicjbpg.dll Kecnin32.exe File created C:\Windows\SysWOW64\Mlmomf32.exe Mecfplcn.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 6192 8188 Process not Found 1267 -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Epiggdhc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kmmijacl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cmnfda32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nojgjomn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Obfnopin.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Chjfnfpc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dodgan32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lfgcnp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qkljgf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Chgihgaf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ahcnapgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mdmkco32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Odmmpfjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pfnbnl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qjlkdjhp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cqdaoj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qklniccn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mbeanfgf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mghcpd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mmbllnac.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hgndghkq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lphlmaln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eefnfb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jehehf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Deldfm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mmllfe32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Clfjfp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cechje32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dmahdjak.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Epcjmbpi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cdaojb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nmdhbnoa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ojiehm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Conihj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Blqhcfla.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pjdnie32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gpafoq32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Okggei32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lpcbabpc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jdbdbpoc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nlpdic32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ipmoamli.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Coipmkho.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Biajbn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gkdnfjfa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fedjhpcg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jcfhpnik.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mpqhhjpg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ggmkqjic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Blgemg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mcienm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aglbdc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eaokac32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ccqhpl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mckadl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pqomqefe.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jhfpbbhg.dll" Hkgjmm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Dimbejci.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Epldmcfa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ncinejkl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Mpnkcjbj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Dmdldp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Fggljb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gagcal32.dll" Jifnndep.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jnkkbb32.dll" Bfejkb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Lmpmjgee.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Bgngom32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Jfgjgbbq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Egfgih32.dll" Mmkelo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ealhdp32.dll" Jocpdj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Biajbn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ckmkea32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Habaic32.dll" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Mmbllnac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gbnofcan.dll" Gkgafp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Lipoefdk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Alblbhha.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Bebocgmo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Jpmieo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Beinip32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eioohgii.dll" Jdmdmkpm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Cjglmpld.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Eipojj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Iaeejqic.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Akahdc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nhldmkci.dll" Calede32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ogmogk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eknkahmp.dll" Aoaoijka.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Gaaqmp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ihbagqbi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ceqkde32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Capona32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Gecldg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Mpqhhjpg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Cjibhigf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ecngkfjk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Kfjngh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Bckgjfgj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Eacdlboc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Kemncekd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ghiejd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Qfphie32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Nggfkhab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ainfhb32.dll" Pjjnokjb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kekkhkbe.dll" Nngcji32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ijhppbpg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Mjkocm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Qjngjj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ajjgfh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kjceck32.dll" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ifinfd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Epkmbmbe.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1172 wrote to memory of 4148 1172 a37a87214a099e8d9ac9fc54ecc16de4a6c45310c27aaa9b7a6e86436bdb7668N.exe 84 PID 1172 wrote to memory of 4148 1172 a37a87214a099e8d9ac9fc54ecc16de4a6c45310c27aaa9b7a6e86436bdb7668N.exe 84 PID 1172 wrote to memory of 4148 1172 a37a87214a099e8d9ac9fc54ecc16de4a6c45310c27aaa9b7a6e86436bdb7668N.exe 84 PID 4148 wrote to memory of 5028 4148 Kfmago32.exe 85 PID 4148 wrote to memory of 5028 4148 Kfmago32.exe 85 PID 4148 wrote to memory of 5028 4148 Kfmago32.exe 85 PID 5028 wrote to memory of 6120 5028 Kikncjef.exe 86 PID 5028 wrote to memory of 6120 5028 Kikncjef.exe 86 PID 5028 wrote to memory of 6120 5028 Kikncjef.exe 86 PID 6120 wrote to memory of 5152 6120 Kpefpd32.exe 87 PID 6120 wrote to memory of 5152 6120 Kpefpd32.exe 87 PID 6120 wrote to memory of 5152 6120 Kpefpd32.exe 87 PID 5152 wrote to memory of 5548 5152 Kfonmncp.exe 88 PID 5152 wrote to memory of 5548 5152 Kfonmncp.exe 88 PID 5152 wrote to memory of 5548 5152 Kfonmncp.exe 88 PID 5548 wrote to memory of 1512 5548 Kmifjh32.exe 89 PID 5548 wrote to memory of 1512 5548 Kmifjh32.exe 89 PID 5548 wrote to memory of 1512 5548 Kmifjh32.exe 89 PID 1512 wrote to memory of 1584 1512 Kdcofbbi.exe 90 PID 1512 wrote to memory of 1584 1512 Kdcofbbi.exe 90 PID 1512 wrote to memory of 1584 1512 Kdcofbbi.exe 90 PID 1584 wrote to memory of 5540 1584 Kfakbnam.exe 91 PID 1584 wrote to memory of 5540 1584 Kfakbnam.exe 91 PID 1584 wrote to memory of 5540 1584 Kfakbnam.exe 91 PID 5540 wrote to memory of 4744 5540 Kmkcohij.exe 92 PID 5540 wrote to memory of 4744 5540 Kmkcohij.exe 92 PID 5540 wrote to memory of 4744 5540 Kmkcohij.exe 92 PID 4744 wrote to memory of 1324 4744 Kpjpkchn.exe 93 PID 4744 wrote to memory of 1324 4744 Kpjpkchn.exe 93 PID 4744 wrote to memory of 1324 4744 Kpjpkchn.exe 93 PID 1324 wrote to memory of 5596 1324 Kbhlgoga.exe 94 PID 1324 wrote to memory of 5596 1324 Kbhlgoga.exe 94 PID 1324 wrote to memory of 5596 1324 Kbhlgoga.exe 94 PID 5596 wrote to memory of 4324 5596 Kibddi32.exe 95 PID 5596 wrote to memory of 4324 5596 Kibddi32.exe 95 PID 5596 wrote to memory of 4324 5596 Kibddi32.exe 95 PID 4324 wrote to memory of 6000 4324 Kpllacfk.exe 96 PID 4324 wrote to memory of 6000 4324 Kpllacfk.exe 96 PID 4324 wrote to memory of 6000 4324 Kpllacfk.exe 96 PID 6000 wrote to memory of 6016 6000 Lgfdnm32.exe 97 PID 6000 wrote to memory of 6016 6000 Lgfdnm32.exe 97 PID 6000 wrote to memory of 6016 6000 Lgfdnm32.exe 97 PID 6016 wrote to memory of 3884 6016 Lmpmjgee.exe 98 PID 6016 wrote to memory of 3884 6016 Lmpmjgee.exe 98 PID 6016 wrote to memory of 3884 6016 Lmpmjgee.exe 98 PID 3884 wrote to memory of 6064 3884 Ldjegala.exe 99 PID 3884 wrote to memory of 6064 3884 Ldjegala.exe 99 PID 3884 wrote to memory of 6064 3884 Ldjegala.exe 99 PID 6064 wrote to memory of 5912 6064 Laneqekk.exe 100 PID 6064 wrote to memory of 5912 6064 Laneqekk.exe 100 PID 6064 wrote to memory of 5912 6064 Laneqekk.exe 100 PID 5912 wrote to memory of 5972 5912 Liijehif.exe 101 PID 5912 wrote to memory of 5972 5912 Liijehif.exe 101 PID 5912 wrote to memory of 5972 5912 Liijehif.exe 101 PID 5972 wrote to memory of 5888 5972 Lpcbabpc.exe 102 PID 5972 wrote to memory of 5888 5972 Lpcbabpc.exe 102 PID 5972 wrote to memory of 5888 5972 Lpcbabpc.exe 102 PID 5888 wrote to memory of 5828 5888 Labole32.exe 103 PID 5888 wrote to memory of 5828 5888 Labole32.exe 103 PID 5888 wrote to memory of 5828 5888 Labole32.exe 103 PID 5828 wrote to memory of 5500 5828 Lkkcdjnf.exe 104 PID 5828 wrote to memory of 5500 5828 Lkkcdjnf.exe 104 PID 5828 wrote to memory of 5500 5828 Lkkcdjnf.exe 104 PID 5500 wrote to memory of 3240 5500 Lphlmaln.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\a37a87214a099e8d9ac9fc54ecc16de4a6c45310c27aaa9b7a6e86436bdb7668N.exe"C:\Users\Admin\AppData\Local\Temp\a37a87214a099e8d9ac9fc54ecc16de4a6c45310c27aaa9b7a6e86436bdb7668N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Windows\SysWOW64\Kfmago32.exeC:\Windows\system32\Kfmago32.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Windows\SysWOW64\Kikncjef.exeC:\Windows\system32\Kikncjef.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Windows\SysWOW64\Kpefpd32.exeC:\Windows\system32\Kpefpd32.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6120 -
C:\Windows\SysWOW64\Kfonmncp.exeC:\Windows\system32\Kfonmncp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5152 -
C:\Windows\SysWOW64\Kmifjh32.exeC:\Windows\system32\Kmifjh32.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5548 -
C:\Windows\SysWOW64\Kdcofbbi.exeC:\Windows\system32\Kdcofbbi.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Windows\SysWOW64\Kfakbnam.exeC:\Windows\system32\Kfakbnam.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Windows\SysWOW64\Kmkcohij.exeC:\Windows\system32\Kmkcohij.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5540 -
C:\Windows\SysWOW64\Kpjpkchn.exeC:\Windows\system32\Kpjpkchn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Windows\SysWOW64\Kbhlgoga.exeC:\Windows\system32\Kbhlgoga.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Windows\SysWOW64\Kibddi32.exeC:\Windows\system32\Kibddi32.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5596 -
C:\Windows\SysWOW64\Kpllacfk.exeC:\Windows\system32\Kpllacfk.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Windows\SysWOW64\Lgfdnm32.exeC:\Windows\system32\Lgfdnm32.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6000 -
C:\Windows\SysWOW64\Lmpmjgee.exeC:\Windows\system32\Lmpmjgee.exe15⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:6016 -
C:\Windows\SysWOW64\Ldjegala.exeC:\Windows\system32\Ldjegala.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Windows\SysWOW64\Laneqekk.exeC:\Windows\system32\Laneqekk.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6064 -
C:\Windows\SysWOW64\Liijehif.exeC:\Windows\system32\Liijehif.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5912 -
C:\Windows\SysWOW64\Lpcbabpc.exeC:\Windows\system32\Lpcbabpc.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5972 -
C:\Windows\SysWOW64\Labole32.exeC:\Windows\system32\Labole32.exe20⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5888 -
C:\Windows\SysWOW64\Lkkcdjnf.exeC:\Windows\system32\Lkkcdjnf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5828 -
C:\Windows\SysWOW64\Lphlmaln.exeC:\Windows\system32\Lphlmaln.exe22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5500 -
C:\Windows\SysWOW64\Mgbdilck.exeC:\Windows\system32\Mgbdilck.exe23⤵
- Executes dropped EXE
PID:3240 -
C:\Windows\SysWOW64\Mmllfe32.exeC:\Windows\system32\Mmllfe32.exe24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3888 -
C:\Windows\SysWOW64\Mcienm32.exeC:\Windows\system32\Mcienm32.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3496 -
C:\Windows\SysWOW64\Mkpmpj32.exeC:\Windows\system32\Mkpmpj32.exe26⤵
- Executes dropped EXE
PID:3940 -
C:\Windows\SysWOW64\Mpmehq32.exeC:\Windows\system32\Mpmehq32.exe27⤵
- Executes dropped EXE
PID:3060 -
C:\Windows\SysWOW64\Mckadl32.exeC:\Windows\system32\Mckadl32.exe28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3180 -
C:\Windows\SysWOW64\Malabc32.exeC:\Windows\system32\Malabc32.exe29⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:2308 -
C:\Windows\SysWOW64\Mcmnilei.exeC:\Windows\system32\Mcmnilei.exe30⤵
- Executes dropped EXE
PID:2656 -
C:\Windows\SysWOW64\Mjgfff32.exeC:\Windows\system32\Mjgfff32.exe31⤵
- Executes dropped EXE
PID:5232 -
C:\Windows\SysWOW64\Mdmkco32.exeC:\Windows\system32\Mdmkco32.exe32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5024 -
C:\Windows\SysWOW64\Mgkgpj32.exeC:\Windows\system32\Mgkgpj32.exe33⤵
- Executes dropped EXE
PID:5736 -
C:\Windows\SysWOW64\Mneold32.exeC:\Windows\system32\Mneold32.exe34⤵
- Executes dropped EXE
PID:5376 -
C:\Windows\SysWOW64\Ndoginji.exeC:\Windows\system32\Ndoginji.exe35⤵
- Executes dropped EXE
PID:5700 -
C:\Windows\SysWOW64\Nkipfh32.exeC:\Windows\system32\Nkipfh32.exe36⤵
- Executes dropped EXE
PID:4212 -
C:\Windows\SysWOW64\Nachbbic.exeC:\Windows\system32\Nachbbic.exe37⤵
- Executes dropped EXE
PID:5004 -
C:\Windows\SysWOW64\Ncddjk32.exeC:\Windows\system32\Ncddjk32.exe38⤵
- Executes dropped EXE
PID:2992 -
C:\Windows\SysWOW64\Njnmge32.exeC:\Windows\system32\Njnmge32.exe39⤵
- Executes dropped EXE
PID:436 -
C:\Windows\SysWOW64\Nnjhgcog.exeC:\Windows\system32\Nnjhgcog.exe40⤵
- Executes dropped EXE
PID:3224 -
C:\Windows\SysWOW64\Ncgapjmo.exeC:\Windows\system32\Ncgapjmo.exe41⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:992 -
C:\Windows\SysWOW64\Nkniahna.exeC:\Windows\system32\Nkniahna.exe42⤵
- Executes dropped EXE
PID:5432 -
C:\Windows\SysWOW64\Nahanb32.exeC:\Windows\system32\Nahanb32.exe43⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2532 -
C:\Windows\SysWOW64\Ncinejkl.exeC:\Windows\system32\Ncinejkl.exe44⤵
- Executes dropped EXE
- Modifies registry class
PID:3864 -
C:\Windows\SysWOW64\Njcfbd32.exeC:\Windows\system32\Njcfbd32.exe45⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:836 -
C:\Windows\SysWOW64\Najncack.exeC:\Windows\system32\Najncack.exe46⤵
- Executes dropped EXE
PID:4600 -
C:\Windows\SysWOW64\Nggfkhab.exeC:\Windows\system32\Nggfkhab.exe47⤵
- Executes dropped EXE
- Modifies registry class
PID:4480 -
C:\Windows\SysWOW64\Nnaohb32.exeC:\Windows\system32\Nnaohb32.exe48⤵
- Executes dropped EXE
PID:688 -
C:\Windows\SysWOW64\Ogicahop.exeC:\Windows\system32\Ogicahop.exe49⤵
- Executes dropped EXE
PID:4824 -
C:\Windows\SysWOW64\Okeoag32.exeC:\Windows\system32\Okeoag32.exe50⤵
- Executes dropped EXE
PID:5240 -
C:\Windows\SysWOW64\Oqagjneq.exeC:\Windows\system32\Oqagjneq.exe51⤵
- Executes dropped EXE
PID:5356 -
C:\Windows\SysWOW64\Oglpfh32.exeC:\Windows\system32\Oglpfh32.exe52⤵
- Executes dropped EXE
PID:1256 -
C:\Windows\SysWOW64\Obaddq32.exeC:\Windows\system32\Obaddq32.exe53⤵
- Executes dropped EXE
PID:4336 -
C:\Windows\SysWOW64\Ocbqkica.exeC:\Windows\system32\Ocbqkica.exe54⤵
- Executes dropped EXE
PID:5236 -
C:\Windows\SysWOW64\Ognmlg32.exeC:\Windows\system32\Ognmlg32.exe55⤵
- Executes dropped EXE
PID:5748 -
C:\Windows\SysWOW64\Obcaip32.exeC:\Windows\system32\Obcaip32.exe56⤵
- Executes dropped EXE
PID:3312 -
C:\Windows\SysWOW64\Ocemah32.exeC:\Windows\system32\Ocemah32.exe57⤵
- Executes dropped EXE
PID:3692 -
C:\Windows\SysWOW64\Ojoenbhl.exeC:\Windows\system32\Ojoenbhl.exe58⤵
- Executes dropped EXE
PID:3440 -
C:\Windows\SysWOW64\Obfnopin.exeC:\Windows\system32\Obfnopin.exe59⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4056 -
C:\Windows\SysWOW64\Ogbfggge.exeC:\Windows\system32\Ogbfggge.exe60⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2952 -
C:\Windows\SysWOW64\Oknbhe32.exeC:\Windows\system32\Oknbhe32.exe61⤵
- Executes dropped EXE
PID:5016 -
C:\Windows\SysWOW64\Pqkjpl32.exeC:\Windows\system32\Pqkjpl32.exe62⤵
- Executes dropped EXE
PID:3924 -
C:\Windows\SysWOW64\Pciglhmi.exeC:\Windows\system32\Pciglhmi.exe63⤵
- Executes dropped EXE
PID:2044 -
C:\Windows\SysWOW64\Pjcoib32.exeC:\Windows\system32\Pjcoib32.exe64⤵
- Executes dropped EXE
PID:1504 -
C:\Windows\SysWOW64\Pdicfk32.exeC:\Windows\system32\Pdicfk32.exe65⤵
- Executes dropped EXE
PID:4732 -
C:\Windows\SysWOW64\Pclcagkg.exeC:\Windows\system32\Pclcagkg.exe66⤵PID:3840
-
C:\Windows\SysWOW64\Pbmcpo32.exeC:\Windows\system32\Pbmcpo32.exe67⤵PID:6124
-
C:\Windows\SysWOW64\Pqpdkliq.exeC:\Windows\system32\Pqpdkliq.exe68⤵PID:5200
-
C:\Windows\SysWOW64\Pgjlhfam.exeC:\Windows\system32\Pgjlhfam.exe69⤵PID:5508
-
C:\Windows\SysWOW64\Pbopeoqc.exeC:\Windows\system32\Pbopeoqc.exe70⤵PID:2676
-
C:\Windows\SysWOW64\Pdnmajpg.exeC:\Windows\system32\Pdnmajpg.exe71⤵PID:3144
-
C:\Windows\SysWOW64\Pjjeiann.exeC:\Windows\system32\Pjjeiann.exe72⤵PID:2804
-
C:\Windows\SysWOW64\Pbamknoq.exeC:\Windows\system32\Pbamknoq.exe73⤵PID:5536
-
C:\Windows\SysWOW64\Pepigjnd.exeC:\Windows\system32\Pepigjnd.exe74⤵PID:5040
-
C:\Windows\SysWOW64\Pnhnpode.exeC:\Windows\system32\Pnhnpode.exe75⤵
- Drops file in System32 directory
PID:2984 -
C:\Windows\SysWOW64\Qebfli32.exeC:\Windows\system32\Qebfli32.exe76⤵PID:4316
-
C:\Windows\SysWOW64\Qcefhfbl.exeC:\Windows\system32\Qcefhfbl.exe77⤵PID:4888
-
C:\Windows\SysWOW64\Qklniccn.exeC:\Windows\system32\Qklniccn.exe78⤵
- System Location Discovery: System Language Discovery
PID:6004 -
C:\Windows\SysWOW64\Qbfffn32.exeC:\Windows\system32\Qbfffn32.exe79⤵PID:2964
-
C:\Windows\SysWOW64\Qkokoc32.exeC:\Windows\system32\Qkokoc32.exe80⤵PID:5956
-
C:\Windows\SysWOW64\Qjakjphf.exeC:\Windows\system32\Qjakjphf.exe81⤵PID:4116
-
C:\Windows\SysWOW64\Agelcdgp.exeC:\Windows\system32\Agelcdgp.exe82⤵PID:5616
-
C:\Windows\SysWOW64\Akahdc32.exeC:\Windows\system32\Akahdc32.exe83⤵
- Drops file in System32 directory
- Modifies registry class
PID:2316 -
C:\Windows\SysWOW64\Anodpn32.exeC:\Windows\system32\Anodpn32.exe84⤵PID:3748
-
C:\Windows\SysWOW64\Ajfdeoda.exeC:\Windows\system32\Ajfdeoda.exe85⤵PID:4880
-
C:\Windows\SysWOW64\Anaqfnlj.exeC:\Windows\system32\Anaqfnlj.exe86⤵PID:432
-
C:\Windows\SysWOW64\Agjeoc32.exeC:\Windows\system32\Agjeoc32.exe87⤵PID:3464
-
C:\Windows\SysWOW64\Andmknjg.exeC:\Windows\system32\Andmknjg.exe88⤵PID:4560
-
C:\Windows\SysWOW64\Aabigiik.exeC:\Windows\system32\Aabigiik.exe89⤵PID:4936
-
C:\Windows\SysWOW64\Aglbdc32.exeC:\Windows\system32\Aglbdc32.exe90⤵
- System Location Discovery: System Language Discovery
PID:2664 -
C:\Windows\SysWOW64\Anfjamhe.exeC:\Windows\system32\Anfjamhe.exe91⤵PID:5264
-
C:\Windows\SysWOW64\Aepbngpa.exeC:\Windows\system32\Aepbngpa.exe92⤵PID:5636
-
C:\Windows\SysWOW64\Accbid32.exeC:\Windows\system32\Accbid32.exe93⤵PID:1568
-
C:\Windows\SysWOW64\Bjmkfnni.exeC:\Windows\system32\Bjmkfnni.exe94⤵PID:2512
-
C:\Windows\SysWOW64\Bnigfm32.exeC:\Windows\system32\Bnigfm32.exe95⤵PID:924
-
C:\Windows\SysWOW64\Bebocgmo.exeC:\Windows\system32\Bebocgmo.exe96⤵
- Modifies registry class
PID:3520 -
C:\Windows\SysWOW64\Bhakobmb.exeC:\Windows\system32\Bhakobmb.exe97⤵PID:2684
-
C:\Windows\SysWOW64\Bnkclm32.exeC:\Windows\system32\Bnkclm32.exe98⤵PID:5364
-
C:\Windows\SysWOW64\Bbfomklh.exeC:\Windows\system32\Bbfomklh.exe99⤵PID:4508
-
C:\Windows\SysWOW64\Bchldcbg.exeC:\Windows\system32\Bchldcbg.exe100⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4008 -
C:\Windows\SysWOW64\Bhcheb32.exeC:\Windows\system32\Bhcheb32.exe101⤵
- Drops file in System32 directory
PID:4504 -
C:\Windows\SysWOW64\Bnmpalbm.exeC:\Windows\system32\Bnmpalbm.exe102⤵PID:1332
-
C:\Windows\SysWOW64\Ballnhaq.exeC:\Windows\system32\Ballnhaq.exe103⤵PID:2456
-
C:\Windows\SysWOW64\Bhfdjb32.exeC:\Windows\system32\Bhfdjb32.exe104⤵PID:3228
-
C:\Windows\SysWOW64\Blaqkqaf.exeC:\Windows\system32\Blaqkqaf.exe105⤵PID:3456
-
C:\Windows\SysWOW64\Bnpmglpj.exeC:\Windows\system32\Bnpmglpj.exe106⤵PID:2780
-
C:\Windows\SysWOW64\Bejedfgg.exeC:\Windows\system32\Bejedfgg.exe107⤵PID:768
-
C:\Windows\SysWOW64\Bhhapafk.exeC:\Windows\system32\Bhhapafk.exe108⤵PID:4376
-
C:\Windows\SysWOW64\Blcmqp32.exeC:\Windows\system32\Blcmqp32.exe109⤵
- Drops file in System32 directory
PID:1716 -
C:\Windows\SysWOW64\Bhjneadh.exeC:\Windows\system32\Bhjneadh.exe110⤵PID:5180
-
C:\Windows\SysWOW64\Clfjfp32.exeC:\Windows\system32\Clfjfp32.exe111⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:3172 -
C:\Windows\SysWOW64\Cbpbcjdn.exeC:\Windows\system32\Cbpbcjdn.exe112⤵PID:4572
-
C:\Windows\SysWOW64\Cdaojb32.exeC:\Windows\system32\Cdaojb32.exe113⤵
- System Location Discovery: System Language Discovery
PID:5948 -
C:\Windows\SysWOW64\Clhglpkn.exeC:\Windows\system32\Clhglpkn.exe114⤵PID:5588
-
C:\Windows\SysWOW64\Cjkggl32.exeC:\Windows\system32\Cjkggl32.exe115⤵PID:6036
-
C:\Windows\SysWOW64\Caeodfif.exeC:\Windows\system32\Caeodfif.exe116⤵PID:5856
-
C:\Windows\SysWOW64\Ceqkde32.exeC:\Windows\system32\Ceqkde32.exe117⤵
- Modifies registry class
PID:5992 -
C:\Windows\SysWOW64\Clkcaoil.exeC:\Windows\system32\Clkcaoil.exe118⤵
- Drops file in System32 directory
PID:4688 -
C:\Windows\SysWOW64\Coipmkho.exeC:\Windows\system32\Coipmkho.exe119⤵
- System Location Discovery: System Language Discovery
PID:3540 -
C:\Windows\SysWOW64\Cechje32.exeC:\Windows\system32\Cechje32.exe120⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3848 -
C:\Windows\SysWOW64\Chadfp32.exeC:\Windows\system32\Chadfp32.exe121⤵PID:1216
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-