Analysis
- max time kernel
94s - max time network
95s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
27/09/2024, 07:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c20ce886068fabc5327538f1d7a0276cf9b9714f286601a57b01986dbb86acc7N.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
120 seconds
Behavioral task
behavioral2
Sample
c20ce886068fabc5327538f1d7a0276cf9b9714f286601a57b01986dbb86acc7N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
8 signatures
120 seconds
General
- Target c20ce886068fabc5327538f1d7a0276cf9b9714f286601a57b01986dbb86acc7N.exe
- Size 669KB
- Sample240927-h69zsa1epp
- SHA256 c20ce886068fabc5327538f1d7a0276cf9b9714f286601a57b01986dbb86acc7
- MD5 57d7b2e9b86dd3e436283dafc18ad4c0
- SHA1 523404d1638fbf2852bf7539614a2389347a58b3
- SHA512 2397244973486e3d42a3477b18e19137d6aec516e6039ecaed45f1e5e764e4afb8aaf5bdea0b60af7a66e5e906ff22b513cf1b6ae3a53d7b37d87d273ee1c066
- SSDEEP 12288:8EDHG3FeVKhMpQnqr+cI3a72LXrY6x46UbR/qYglMi:DDG30chMpQnqrdX72LbY6x46uR/qYglN
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
berbew
C2
-
http://f/wcmd.htm
-
http://f/ppslog.php
-
http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d
Signatures
- Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 20 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dddhpjof.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Dddhpjof.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad c20ce886068fabc5327538f1d7a0276cf9b9714f286601a57b01986dbb86acc7N.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ddjejl32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dodbbdbb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Dfknkg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Djgjlelk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" c20ce886068fabc5327538f1d7a0276cf9b9714f286601a57b01986dbb86acc7N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ceehho32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ddjejl32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Djgjlelk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Dodbbdbb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dkkcge32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cmnpgb32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ceehho32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Dopigd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Dkkcge32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Cmnpgb32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dopigd32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dfknkg32.exe - Executes dropped EXE 10 IoCs
pid Process 3784 Cmnpgb32.exe 4860 Ceehho32.exe 4900 Ddjejl32.exe 3152 Dopigd32.exe 1168 Dfknkg32.exe 2872 Djgjlelk.exe 5012 Dodbbdbb.exe 2640 Dkkcge32.exe 2436 Dddhpjof.exe 1232 Dmllipeg.exe - Drops file in System32 directory 30 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Dopigd32.exe Ddjejl32.exe File created C:\Windows\SysWOW64\Dfknkg32.exe Dopigd32.exe File opened for modification C:\Windows\SysWOW64\Dodbbdbb.exe Djgjlelk.exe File created C:\Windows\SysWOW64\Amjknl32.dll Dkkcge32.exe File created C:\Windows\SysWOW64\Ffpmlcim.dll c20ce886068fabc5327538f1d7a0276cf9b9714f286601a57b01986dbb86acc7N.exe File created C:\Windows\SysWOW64\Jekpanpa.dll Cmnpgb32.exe File created C:\Windows\SysWOW64\Ddjejl32.exe Ceehho32.exe File opened for modification C:\Windows\SysWOW64\Ddjejl32.exe Ceehho32.exe File created C:\Windows\SysWOW64\Kngpec32.dll Dddhpjof.exe File created C:\Windows\SysWOW64\Hfanhp32.dll Ceehho32.exe File created C:\Windows\SysWOW64\Hcjccj32.dll Ddjejl32.exe File created C:\Windows\SysWOW64\Beeppfin.dll Dfknkg32.exe File created C:\Windows\SysWOW64\Fnmnbf32.dll Djgjlelk.exe File opened for modification C:\Windows\SysWOW64\Dkkcge32.exe Dodbbdbb.exe File created C:\Windows\SysWOW64\Dopigd32.exe Ddjejl32.exe File created C:\Windows\SysWOW64\Dddhpjof.exe Dkkcge32.exe File created C:\Windows\SysWOW64\Dmllipeg.exe Dddhpjof.exe File opened for modification C:\Windows\SysWOW64\Dfknkg32.exe Dopigd32.exe File opened for modification C:\Windows\SysWOW64\Dmllipeg.exe Dddhpjof.exe File created C:\Windows\SysWOW64\Cmnpgb32.exe c20ce886068fabc5327538f1d7a0276cf9b9714f286601a57b01986dbb86acc7N.exe File opened for modification C:\Windows\SysWOW64\Cmnpgb32.exe c20ce886068fabc5327538f1d7a0276cf9b9714f286601a57b01986dbb86acc7N.exe File created C:\Windows\SysWOW64\Ceehho32.exe Cmnpgb32.exe File opened for modification C:\Windows\SysWOW64\Dddhpjof.exe Dkkcge32.exe File opened for modification C:\Windows\SysWOW64\Ceehho32.exe Cmnpgb32.exe File created C:\Windows\SysWOW64\Dodbbdbb.exe Djgjlelk.exe File created C:\Windows\SysWOW64\Dkkcge32.exe Dodbbdbb.exe File created C:\Windows\SysWOW64\Cogflbdn.dll Dopigd32.exe File created C:\Windows\SysWOW64\Djgjlelk.exe Dfknkg32.exe File opened for modification C:\Windows\SysWOW64\Djgjlelk.exe Dfknkg32.exe File created C:\Windows\SysWOW64\Jcbdhp32.dll Dodbbdbb.exe - Program crash 1 IoCs
pid pid_target Process procid_target 1584 1232 WerFault.exe 91 - System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cmnpgb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ceehho32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ddjejl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dopigd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dodbbdbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dkkcge32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dmllipeg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c20ce886068fabc5327538f1d7a0276cf9b9714f286601a57b01986dbb86acc7N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Djgjlelk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dddhpjof.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dfknkg32.exe - Modifies registry class 33 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jekpanpa.dll" Cmnpgb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Djgjlelk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Dodbbdbb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Cmnpgb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hfanhp32.dll" Ceehho32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hcjccj32.dll" Ddjejl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cogflbdn.dll" Dopigd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Djgjlelk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fnmnbf32.dll" Djgjlelk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ddjejl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Dddhpjof.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcbdhp32.dll" Dodbbdbb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Dkkcge32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 c20ce886068fabc5327538f1d7a0276cf9b9714f286601a57b01986dbb86acc7N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" c20ce886068fabc5327538f1d7a0276cf9b9714f286601a57b01986dbb86acc7N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ceehho32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ceehho32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ddjejl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Dodbbdbb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ffpmlcim.dll" c20ce886068fabc5327538f1d7a0276cf9b9714f286601a57b01986dbb86acc7N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Dopigd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Dfknkg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Amjknl32.dll" Dkkcge32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Dopigd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kngpec32.dll" Dddhpjof.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717} c20ce886068fabc5327538f1d7a0276cf9b9714f286601a57b01986dbb86acc7N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Cmnpgb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Beeppfin.dll" Dfknkg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Dfknkg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Dddhpjof.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node c20ce886068fabc5327538f1d7a0276cf9b9714f286601a57b01986dbb86acc7N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID c20ce886068fabc5327538f1d7a0276cf9b9714f286601a57b01986dbb86acc7N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Dkkcge32.exe - Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 1684 wrote to memory of 3784 1684 c20ce886068fabc5327538f1d7a0276cf9b9714f286601a57b01986dbb86acc7N.exe 82 PID 1684 wrote to memory of 3784 1684 c20ce886068fabc5327538f1d7a0276cf9b9714f286601a57b01986dbb86acc7N.exe 82 PID 1684 wrote to memory of 3784 1684 c20ce886068fabc5327538f1d7a0276cf9b9714f286601a57b01986dbb86acc7N.exe 82 PID 3784 wrote to memory of 4860 3784 Cmnpgb32.exe 83 PID 3784 wrote to memory of 4860 3784 Cmnpgb32.exe 83 PID 3784 wrote to memory of 4860 3784 Cmnpgb32.exe 83 PID 4860 wrote to memory of 4900 4860 Ceehho32.exe 84 PID 4860 wrote to memory of 4900 4860 Ceehho32.exe 84 PID 4860 wrote to memory of 4900 4860 Ceehho32.exe 84 PID 4900 wrote to memory of 3152 4900 Ddjejl32.exe 85 PID 4900 wrote to memory of 3152 4900 Ddjejl32.exe 85 PID 4900 wrote to memory of 3152 4900 Ddjejl32.exe 85 PID 3152 wrote to memory of 1168 3152 Dopigd32.exe 86 PID 3152 wrote to memory of 1168 3152 Dopigd32.exe 86 PID 3152 wrote to memory of 1168 3152 Dopigd32.exe 86 PID 1168 wrote to memory of 2872 1168 Dfknkg32.exe 87 PID 1168 wrote to memory of 2872 1168 Dfknkg32.exe 87 PID 1168 wrote to memory of 2872 1168 Dfknkg32.exe 87 PID 2872 wrote to memory of 5012 2872 Djgjlelk.exe 88 PID 2872 wrote to memory of 5012 2872 Djgjlelk.exe 88 PID 2872 wrote to memory of 5012 2872 Djgjlelk.exe 88 PID 5012 wrote to memory of 2640 5012 Dodbbdbb.exe 89 PID 5012 wrote to memory of 2640 5012 Dodbbdbb.exe 89 PID 5012 wrote to memory of 2640 5012 Dodbbdbb.exe 89 PID 2640 wrote to memory of 2436 2640 Dkkcge32.exe 90 PID 2640 wrote to memory of 2436 2640 Dkkcge32.exe 90 PID 2640 wrote to memory of 2436 2640 Dkkcge32.exe 90 PID 2436 wrote to memory of 1232 2436 Dddhpjof.exe 91 PID 2436 wrote to memory of 1232 2436 Dddhpjof.exe 91 PID 2436 wrote to memory of 1232 2436 Dddhpjof.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\c20ce886068fabc5327538f1d7a0276cf9b9714f286601a57b01986dbb86acc7N.exe"C:\Users\Admin\AppData\Local\Temp\c20ce886068fabc5327538f1d7a0276cf9b9714f286601a57b01986dbb86acc7N.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Windows\SysWOW64\Cmnpgb32.exeC:\Windows\system32\Cmnpgb32.exe2⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\Windows\SysWOW64\Ceehho32.exeC:\Windows\system32\Ceehho32.exe3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Windows\SysWOW64\Ddjejl32.exeC:\Windows\system32\Ddjejl32.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Windows\SysWOW64\Dopigd32.exeC:\Windows\system32\Dopigd32.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Windows\SysWOW64\Dfknkg32.exeC:\Windows\system32\Dfknkg32.exe6⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Windows\SysWOW64\Djgjlelk.exeC:\Windows\system32\Djgjlelk.exe7⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\SysWOW64\Dodbbdbb.exeC:\Windows\system32\Dodbbdbb.exe8⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Windows\SysWOW64\Dkkcge32.exeC:\Windows\system32\Dkkcge32.exe9⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\SysWOW64\Dddhpjof.exeC:\Windows\system32\Dddhpjof.exe10⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Windows\SysWOW64\Dmllipeg.exeC:\Windows\system32\Dmllipeg.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1232 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1232 -s 42012⤵
- Program crash
PID:1584
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1232 -ip 12321⤵PID:3524
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\Ceehho32.exe
- Size 669KB
- SHA256 18ec1b7806fb7a8141b502900156fd3f00fdc6c6b6b1ccddf53f2c2c58b6f0df
- MD5 c7bca23cc528820b6a8a5e621ee4d191
- SHA1 08e586e1bf2e9fa6d6018ccf19e24f211223baa5
- SHA512 887810fbf59cc45150f689477fa1fe8a97fc9b4f216249b7256abfd39fe994cc8c19ebc2381bb9af35d39bbd2e7d89cd131e121bb8ae881483a5a3405e48ec89
- SSDEEP 12288:P/sjueVKhMpQnqr+cI3a72LXrY6x46UbR/qYglMi:XEchMpQnqrdX72LbY6x46uR/qYglMi
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Cmnpgb32.exe
- Size 669KB
- SHA256 70a886eab6787d1ac46d2e14b04201b89af3152b7ea03f06253ef2559f786e4d
- MD5 7d41bb6d3be13002d7db0d0a447d768a
- SHA1 756f1105fd069a7c014d1e6426eb508138894efe
- SHA512 4ae2cc1bc5d3649322fe1cd56347cd7b261d77a07c7794706a2e167ef3fec79171bab33e13785a2b89a2ae140a294552479d008957f065df6106d16fd682d1fd
- SSDEEP 12288:iJzU0/eVKhMpQnqr+cI3a72LXrY6x46UbR/qYglMi:iG0mchMpQnqrdX72LbY6x46uR/qYglMi
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Cogflbdn.dll
- Size 7KB
- SHA256 bb637dfaf0a945c646fd2ed03e02b3fede60604a4a632b15c9b44a234d95138a
- MD5 75facb95220ded041838c8ba7d030390
- SHA1 baa21c14cbe745964c318de863573b9f45c03dca
- SHA512 c47985d675dab0a82f777939c1cfbe707e52f5caac0bc9acf74b5b817a899e19add773226697099822601fc3c817f0b68194410642c22845bf9361b47aa3e02f
- SSDEEP 48:66ay5YVO3EVkApc2wp8hH1NZn5EquglQ067YbPWHMbABbgL3q9J5S2hmc:b3EVkApcX4Hiv0hbPSjq3qX5S2hV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Dddhpjof.exe
- Size 669KB
- SHA256 48bdb36fefa5cab55ec32cfed17ec08a3d2163d80ebe26c05510f81e87768f08
- MD5 e70bcd3d887825642762e0e868284e97
- SHA1 0c6594be2102dcd2ed173fb25d6897d404cd3ae8
- SHA512 041cef7e2e2bba14dc7dd4b53367aa8e9545337cb4353a77c06109a2d4fe81494431b52f52d96198e19d58b9047c3b22678f34275a9a5161c40566547cf5c22a
- SSDEEP 12288:gzfV0eVKhMpQnqr+cI3a72LXrY6x46UbR/qYglMi:grBchMpQnqrdX72LbY6x46uR/qYglMi
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Ddjejl32.exe
- Size 669KB
- SHA256 a9f312f01dabdc09f4e5183471e28da5a5bab38a09f8b54c2d907a28da141d2c
- MD5 c5a6a4f2f4a90c2077fe2e69dbefdbc8
- SHA1 25d5bb722e0939fd5dcd37104a6869f8d0070543
- SHA512 c2c31633c1d1db88e93c8562f4164b091cc2e29d781755e02e857b5817c3e10cdcbb30deca16c92b46d730f4997972b2772bed169e4518dabeddaaf82aebcb1c
- SSDEEP 12288:0VgJeVKhMpQnqr+cI3a72LXrY6x46UbR/qYglMi:LIchMpQnqrdX72LbY6x46uR/qYglMi
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Dfknkg32.exe
- Size 669KB
- SHA256 67eb55f698873bbb09b48954899b52029484e8018e3b726dfdc2208d069a6dc9
- MD5 87f7695b538bf5bf39426b96042bce96
- SHA1 91b7f8041d78b5a1bd9689d4aa9e1c5daedcd1e8
- SHA512 8e7196e128f3637664b65533d4e7739011d6565902b7349aafe7b4708c795c680f0778f0474c702597755c56e9903b4ba0ada0e0745200698fe41dc082b755a9
- SSDEEP 12288:45ghAeVKhMpQnqr+cI3a72LXrY6x46UbR/qYglMi:4U7chMpQnqrdX72LbY6x46uR/qYglMi
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Djgjlelk.exe
- Size 669KB
- SHA256 db58799846db180426bb7f76916d682c4764835be02b37ed2479833aad374909
- MD5 b1d03c783458c418ef546fe509c7594e
- SHA1 e8cbab7de537c3fbd5cba4da49beff6e6a71ec11
- SHA512 5c3b49e0bb7452af9164509aea22f5e00e2c75f95af3c9e0b865fb03c917653a8e4de9a1c55880dbc329ac28f9ee22eb3bd92afa23be47df53d2319d8b56e937
- SSDEEP 12288:KgXy1eVKhMpQnqr+cI3a72LXrY6x46UbR/qYglMi:gEchMpQnqrdX72LbY6x46uR/qYglMi
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Dkkcge32.exe
- Size 669KB
- SHA256 94f451c2e2309a5e762968153dc4ac0e43ab42ffb169263595b90214b41f9194
- MD5 ad05228fa54ce681e3ffa8b27a032cb6
- SHA1 73f4860eec80d6634381871606ff0f53bcd8c02f
- SHA512 f77a2a3b9362bf2d4158df8bed455b67e6c0ab4c4d4454ecf4ff53a0e72bfad1857d800ea5745a42f478ab683dc2a6ebfc557d0e2c12a649c0dbf811dec383d3
- SSDEEP 12288:duCggE8eVKhMpQnqr+cI3a72LXrY6x46UbR/qYglMi:duqEXchMpQnqrdX72LbY6x46uR/qYglN
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Dmllipeg.exe
- Size 669KB
- SHA256 fe35931ca803e43d21cf966363e8956cc196b9ba97b25946e1bafa9b65702c26
- MD5 55725d2bfe377079c8426bada0aead3e
- SHA1 9fcd5a3fba9be94626f21745e2b168d7c96b2c2c
- SHA512 34d24073cf232672c6853cac79bbd5f3e7c2aca71127eb748c717f56ae45b0a04f8838e63107c93c6d8aac7fbe439f7c8118c033a4448c7297f19d5c64c731ce
- SSDEEP 12288:gBzJeVKhMpQnqr+cI3a72LXrY6x46UbR/qYglMi:gBzIchMpQnqrdX72LbY6x46uR/qYglMi
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Dodbbdbb.exe
- Size 669KB
- SHA256 427507567607e783b58759f15a418ea3c59d2f33373caf1429c4bd57351195ca
- MD5 98cad5974f3e850af697a91e65183023
- SHA1 b19be7688a10d2e71694c98ad88244af638f5f3b
- SHA512 05d7e39ae3e83e63a31f0395aaaa49e852fd68e1b4169462f29b85a24b7beb22c74590aa5c78a9cca1b10c1c5c819e0fe216cc0a884eb6e7fe19cdd6c4ca044e
- SSDEEP 12288:78HeVKhMpQnqr+cI3a72LXrY6x46UbR/qYglMi:78+chMpQnqrdX72LbY6x46uR/qYglMi
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Dopigd32.exe
- Size 448KB
- SHA256 53a49919383c6c7612c61c5b40bd019c08f18488133594850474552cdf753a3b
- MD5 466b1932f8ebc76643b48f02b1af04e2
- SHA1 21f36d9ed9b262711a8759c9ed632171a2acbf83
- SHA512 3a79d394c91698fe0273ed2f648bb4e1dfd3167ad91760b8a05536e7b57532e0a6a26795adc29f4e10ef3177555193f525a8ea59c802f33ca8ff518797dc347c
- SSDEEP 6144:CZVgRONLereLVmhgK8mMpWV4sijqqj3CHfc+bgqN3x46:0VgJeVKhMpQnqr+cI3v
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Dopigd32.exe
- Size 669KB
- SHA256 e70acc431c56e171d01c794bde146dd7ed022a5e9eb7a1840cf82a8c9cfeaec3
- MD5 083cf7e2452f58e0d9dcded8152ad7a6
- SHA1 4d09ae10fcaeec6fbf5d1efb1ca1713d30fb8fe7
- SHA512 8059b506f21eeef67454cef720064ae336f127187278b1083006c6d4797729bcb579fbbd74ab98ffe4cd02350796ed3a4284f29480a911ec5630c89a7bdeca6c
- SSDEEP 12288:xI+WcepmeVKhMpQnqr+cI3a72LXrY6x46UbR/qYglMi:+RchMpQnqrdX72LbY6x46uR/qYglMi
- MD5 SHA1 SHA512 SSDEEP