berbew | d272cfeb8c2ea21ca332d6380d0786fbfc75793fa3a5ca9a2de5c2824244ed7c

Analysis

max time kernel
114s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/10/2024, 01:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d272cfeb8c2ea21ca332d6380d0786fbfc75793fa3a5ca9a2de5c2824244ed7cN.exe
Size

347KB
MD5

a7c0d010bad71993da19afeaf4e64250
SHA1

9b4d9d8ddfe36a8b200996aee13f176ebe5ac50e
SHA256

d272cfeb8c2ea21ca332d6380d0786fbfc75793fa3a5ca9a2de5c2824244ed7c
SHA512

d366e04af26cc0d6e4e2f8b7e9c4584bb3faa6a676649ce2df8e1cc9a00ff535f7db068cce1cb03ab36311e25cc567fc71a53afa7e89001d7effabe2db1947ab
SSDEEP

6144:xAWZNl01SZZ5qx4brq2Ah1FM6234lKm3mo8Yvi4KsLTFM6234lKm3qk9:RnHcx4brRGFB24lwR45FB24lEk

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pbgqdb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aijlgkjq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ohcmpn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcpgmf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Apkjddke.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bemlhj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bbalaoda.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dgdgijhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ohqpjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pfeijqqe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aijlgkjq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dbcbnlcl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dpjompqc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ohqpjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Okceaikl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ohhfknjf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Albkieqj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bifkcioc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bemlhj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bpemkcck.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ciknefmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	d272cfeb8c2ea21ca332d6380d0786fbfc75793fa3a5ca9a2de5c2824244ed7cN.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ohhfknjf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Qkfkng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ofdqcc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Albkieqj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cffkhl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ohcmpn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cefoni32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pkklbh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pkklbh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afnlpohj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Abgjkpll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cbmlmmjd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmdmpe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ciknefmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pcpgmf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dlqpaafg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmimdg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cffkhl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cpqlfa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dgdgijhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Afnlpohj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Qkdohg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cmdmpe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pecpknke.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dpgbgpbe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dipgpf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cpqlfa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bifkcioc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bbalaoda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dbcbnlcl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Defheg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Afqifo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Okceaikl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pdngpo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bipnihgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bipnihgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dpjompqc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	d272cfeb8c2ea21ca332d6380d0786fbfc75793fa3a5ca9a2de5c2824244ed7cN.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pecpknke.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qkdohg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Abgjkpll.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dipgpf32.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Executes dropped EXE 39 IoCs

pid	Process
3040	Ohqpjo32.exe
4968	Ofdqcc32.exe
5060	Ohcmpn32.exe
4088	Okceaikl.exe
5024	Ohhfknjf.exe
2720	Pdngpo32.exe
1228	Pcpgmf32.exe
1720	Pkklbh32.exe
2376	Pecpknke.exe
3684	Pbgqdb32.exe
3456	Pfeijqqe.exe
2816	Qkdohg32.exe
1536	Qkfkng32.exe
4284	Aijlgkjq.exe
3192	Afnlpohj.exe
704	Afqifo32.exe
4864	Abgjkpll.exe
4744	Apkjddke.exe
4228	Albkieqj.exe
2676	Bifkcioc.exe
1964	Bemlhj32.exe
4604	Bbalaoda.exe
4556	Bpemkcck.exe
1036	Bmimdg32.exe
348	Bipnihgi.exe
2276	Cefoni32.exe
3832	Cffkhl32.exe
4964	Cbmlmmjd.exe
4480	Cpqlfa32.exe
2416	Cmdmpe32.exe
3136	Ciknefmk.exe
4576	Dbcbnlcl.exe
2148	Dpgbgpbe.exe
1904	Dipgpf32.exe
2036	Dpjompqc.exe
312	Dgdgijhp.exe
4572	Defheg32.exe
1404	Dlqpaafg.exe
3432	Dbkhnk32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Ofdqcc32.exe	Ohqpjo32.exe
File created	C:\Windows\SysWOW64\Pkklbh32.exe	Pcpgmf32.exe
File created	C:\Windows\SysWOW64\Dbkhnk32.exe	Dlqpaafg.exe
File created	C:\Windows\SysWOW64\Ehepld32.dll	Bpemkcck.exe
File created	C:\Windows\SysWOW64\Fjgnln32.dll	Defheg32.exe
File created	C:\Windows\SysWOW64\Paajfjdm.dll	Ohcmpn32.exe
File created	C:\Windows\SysWOW64\Ciknefmk.exe	Cmdmpe32.exe
File created	C:\Windows\SysWOW64\Oihlnd32.dll	Dbcbnlcl.exe
File opened for modification	C:\Windows\SysWOW64\Dgdgijhp.exe	Dpjompqc.exe
File opened for modification	C:\Windows\SysWOW64\Pkklbh32.exe	Pcpgmf32.exe
File created	C:\Windows\SysWOW64\Cmdmpe32.exe	Cpqlfa32.exe
File opened for modification	C:\Windows\SysWOW64\Ohhfknjf.exe	Okceaikl.exe
File created	C:\Windows\SysWOW64\Lhlaofoa.dll	Afnlpohj.exe
File created	C:\Windows\SysWOW64\Abgjkpll.exe	Afqifo32.exe
File created	C:\Windows\SysWOW64\Defheg32.exe	Dgdgijhp.exe
File created	C:\Windows\SysWOW64\Qkfkng32.exe	Qkdohg32.exe
File created	C:\Windows\SysWOW64\Cbmlmmjd.exe	Cffkhl32.exe
File opened for modification	C:\Windows\SysWOW64\Cbmlmmjd.exe	Cffkhl32.exe
File created	C:\Windows\SysWOW64\Jcokoo32.dll	Ohqpjo32.exe
File opened for modification	C:\Windows\SysWOW64\Aijlgkjq.exe	Qkfkng32.exe
File created	C:\Windows\SysWOW64\Cpqlfa32.exe	Cbmlmmjd.exe
File created	C:\Windows\SysWOW64\Naefjl32.dll	Dlqpaafg.exe
File created	C:\Windows\SysWOW64\Kpmmhc32.dll	d272cfeb8c2ea21ca332d6380d0786fbfc75793fa3a5ca9a2de5c2824244ed7cN.exe
File created	C:\Windows\SysWOW64\Ofdqcc32.exe	Ohqpjo32.exe
File opened for modification	C:\Windows\SysWOW64\Ohcmpn32.exe	Ofdqcc32.exe
File created	C:\Windows\SysWOW64\Bpemkcck.exe	Bbalaoda.exe
File created	C:\Windows\SysWOW64\Oijflc32.dll	Pdngpo32.exe
File created	C:\Windows\SysWOW64\Aijlgkjq.exe	Qkfkng32.exe
File created	C:\Windows\SysWOW64\Albkieqj.exe	Apkjddke.exe
File created	C:\Windows\SysWOW64\Cefoni32.exe	Bipnihgi.exe
File created	C:\Windows\SysWOW64\Afqifo32.exe	Afnlpohj.exe
File opened for modification	C:\Windows\SysWOW64\Apkjddke.exe	Abgjkpll.exe
File created	C:\Windows\SysWOW64\Mondkfmh.dll	Cpqlfa32.exe
File created	C:\Windows\SysWOW64\Pcpgmf32.exe	Pdngpo32.exe
File created	C:\Windows\SysWOW64\Nkebqokl.dll	Apkjddke.exe
File opened for modification	C:\Windows\SysWOW64\Dbkhnk32.exe	Dlqpaafg.exe
File created	C:\Windows\SysWOW64\Ldbeqlcg.dll	Dgdgijhp.exe
File created	C:\Windows\SysWOW64\Ohqpjo32.exe	d272cfeb8c2ea21ca332d6380d0786fbfc75793fa3a5ca9a2de5c2824244ed7cN.exe
File created	C:\Windows\SysWOW64\Lgkkbg32.dll	Bipnihgi.exe
File opened for modification	C:\Windows\SysWOW64\Cffkhl32.exe	Cefoni32.exe
File created	C:\Windows\SysWOW64\Fgpoahbe.dll	Dpjompqc.exe
File created	C:\Windows\SysWOW64\Cffkhl32.exe	Cefoni32.exe
File created	C:\Windows\SysWOW64\Okceaikl.exe	Ohcmpn32.exe
File created	C:\Windows\SysWOW64\Afnlpohj.exe	Aijlgkjq.exe
File created	C:\Windows\SysWOW64\Plmiie32.dll	Abgjkpll.exe
File opened for modification	C:\Windows\SysWOW64\Bipnihgi.exe	Bmimdg32.exe
File created	C:\Windows\SysWOW64\Pbgqdb32.exe	Pecpknke.exe
File opened for modification	C:\Windows\SysWOW64\Abgjkpll.exe	Afqifo32.exe
File opened for modification	C:\Windows\SysWOW64\Bifkcioc.exe	Albkieqj.exe
File created	C:\Windows\SysWOW64\Jfdqcf32.dll	Albkieqj.exe
File opened for modification	C:\Windows\SysWOW64\Pcpgmf32.exe	Pdngpo32.exe
File opened for modification	C:\Windows\SysWOW64\Pecpknke.exe	Pkklbh32.exe
File opened for modification	C:\Windows\SysWOW64\Bmimdg32.exe	Bpemkcck.exe
File created	C:\Windows\SysWOW64\Hgfjbh32.dll	Cefoni32.exe
File created	C:\Windows\SysWOW64\Bemlhj32.exe	Bifkcioc.exe
File created	C:\Windows\SysWOW64\Mkfbmfbn.dll	Cbmlmmjd.exe
File opened for modification	C:\Windows\SysWOW64\Dbcbnlcl.exe	Ciknefmk.exe
File opened for modification	C:\Windows\SysWOW64\Pbgqdb32.exe	Pecpknke.exe
File created	C:\Windows\SysWOW64\Iipkfmal.dll	Pecpknke.exe
File created	C:\Windows\SysWOW64\Odlpkg32.dll	Pbgqdb32.exe
File opened for modification	C:\Windows\SysWOW64\Albkieqj.exe	Apkjddke.exe
File opened for modification	C:\Windows\SysWOW64\Afqifo32.exe	Afnlpohj.exe
File created	C:\Windows\SysWOW64\Bmimdg32.exe	Bpemkcck.exe
File created	C:\Windows\SysWOW64\Dbcbnlcl.exe	Ciknefmk.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3092	3432	WerFault.exe	127

System Location Discovery: System Language Discovery 1 TTPs 40 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bifkcioc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cefoni32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dbkhnk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ohcmpn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Okceaikl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afnlpohj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bipnihgi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cffkhl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cbmlmmjd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cpqlfa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmdmpe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pkklbh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfeijqqe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dlqpaafg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dipgpf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Defheg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmimdg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Abgjkpll.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bbalaoda.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofdqcc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dbcbnlcl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dpgbgpbe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dpjompqc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pbgqdb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qkdohg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afqifo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bpemkcck.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ciknefmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dgdgijhp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d272cfeb8c2ea21ca332d6380d0786fbfc75793fa3a5ca9a2de5c2824244ed7cN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ohhfknjf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pecpknke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qkfkng32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aijlgkjq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Apkjddke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ohqpjo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdngpo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bemlhj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcpgmf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Albkieqj.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Okceaikl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bbalaoda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbooabbb.dll"	Pfeijqqe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Defheg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dlqpaafg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pecpknke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmmppdij.dll"	Qkfkng32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bpemkcck.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cffkhl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kpmmhc32.dll"	d272cfeb8c2ea21ca332d6380d0786fbfc75793fa3a5ca9a2de5c2824244ed7cN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmjaeema.dll"	Ofdqcc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Idcdeb32.dll"	Bemlhj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iojghflb.dll"	Cmdmpe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ofdqcc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pkklbh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifgeebem.dll"	Afqifo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cpqlfa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	d272cfeb8c2ea21ca332d6380d0786fbfc75793fa3a5ca9a2de5c2824244ed7cN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Albkieqj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hgfjbh32.dll"	Cefoni32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dpgbgpbe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}	d272cfeb8c2ea21ca332d6380d0786fbfc75793fa3a5ca9a2de5c2824244ed7cN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pcpgmf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Qkdohg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Abgjkpll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehepld32.dll"	Bpemkcck.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bipnihgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Paajfjdm.dll"	Ohcmpn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ohcmpn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cpqlfa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dpgbgpbe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Defheg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pbgqdb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pfeijqqe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ohcmpn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Albkieqj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cmdmpe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oihlnd32.dll"	Dbcbnlcl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ohqpjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bemlhj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cmdmpe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fiinbn32.dll"	Dipgpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dgdgijhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iipkfmal.dll"	Pecpknke.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cefoni32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pfeijqqe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lgkkbg32.dll"	Bipnihgi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cffkhl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cbmlmmjd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pdngpo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lcoeiajc.dll"	Pkklbh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pbgqdb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Afqifo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dipgpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Debaqh32.dll"	Ohhfknjf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Qkfkng32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dbcbnlcl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	d272cfeb8c2ea21ca332d6380d0786fbfc75793fa3a5ca9a2de5c2824244ed7cN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Abgjkpll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nfcnnnil.dll"	Cffkhl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Aijlgkjq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lhlaofoa.dll"	Afnlpohj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bifkcioc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qhfaig32.dll"	Bbalaoda.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 3040	2912	d272cfeb8c2ea21ca332d6380d0786fbfc75793fa3a5ca9a2de5c2824244ed7cN.exe	89
PID 2912 wrote to memory of 3040	2912	d272cfeb8c2ea21ca332d6380d0786fbfc75793fa3a5ca9a2de5c2824244ed7cN.exe	89
PID 2912 wrote to memory of 3040	2912	d272cfeb8c2ea21ca332d6380d0786fbfc75793fa3a5ca9a2de5c2824244ed7cN.exe	89
PID 3040 wrote to memory of 4968	3040	Ohqpjo32.exe	90
PID 3040 wrote to memory of 4968	3040	Ohqpjo32.exe	90
PID 3040 wrote to memory of 4968	3040	Ohqpjo32.exe	90
PID 4968 wrote to memory of 5060	4968	Ofdqcc32.exe	91
PID 4968 wrote to memory of 5060	4968	Ofdqcc32.exe	91
PID 4968 wrote to memory of 5060	4968	Ofdqcc32.exe	91
PID 5060 wrote to memory of 4088	5060	Ohcmpn32.exe	92
PID 5060 wrote to memory of 4088	5060	Ohcmpn32.exe	92
PID 5060 wrote to memory of 4088	5060	Ohcmpn32.exe	92
PID 4088 wrote to memory of 5024	4088	Okceaikl.exe	93
PID 4088 wrote to memory of 5024	4088	Okceaikl.exe	93
PID 4088 wrote to memory of 5024	4088	Okceaikl.exe	93
PID 5024 wrote to memory of 2720	5024	Ohhfknjf.exe	94
PID 5024 wrote to memory of 2720	5024	Ohhfknjf.exe	94
PID 5024 wrote to memory of 2720	5024	Ohhfknjf.exe	94
PID 2720 wrote to memory of 1228	2720	Pdngpo32.exe	95
PID 2720 wrote to memory of 1228	2720	Pdngpo32.exe	95
PID 2720 wrote to memory of 1228	2720	Pdngpo32.exe	95
PID 1228 wrote to memory of 1720	1228	Pcpgmf32.exe	96
PID 1228 wrote to memory of 1720	1228	Pcpgmf32.exe	96
PID 1228 wrote to memory of 1720	1228	Pcpgmf32.exe	96
PID 1720 wrote to memory of 2376	1720	Pkklbh32.exe	97
PID 1720 wrote to memory of 2376	1720	Pkklbh32.exe	97
PID 1720 wrote to memory of 2376	1720	Pkklbh32.exe	97
PID 2376 wrote to memory of 3684	2376	Pecpknke.exe	98
PID 2376 wrote to memory of 3684	2376	Pecpknke.exe	98
PID 2376 wrote to memory of 3684	2376	Pecpknke.exe	98
PID 3684 wrote to memory of 3456	3684	Pbgqdb32.exe	99
PID 3684 wrote to memory of 3456	3684	Pbgqdb32.exe	99
PID 3684 wrote to memory of 3456	3684	Pbgqdb32.exe	99
PID 3456 wrote to memory of 2816	3456	Pfeijqqe.exe	100
PID 3456 wrote to memory of 2816	3456	Pfeijqqe.exe	100
PID 3456 wrote to memory of 2816	3456	Pfeijqqe.exe	100
PID 2816 wrote to memory of 1536	2816	Qkdohg32.exe	101
PID 2816 wrote to memory of 1536	2816	Qkdohg32.exe	101
PID 2816 wrote to memory of 1536	2816	Qkdohg32.exe	101
PID 1536 wrote to memory of 4284	1536	Qkfkng32.exe	102
PID 1536 wrote to memory of 4284	1536	Qkfkng32.exe	102
PID 1536 wrote to memory of 4284	1536	Qkfkng32.exe	102
PID 4284 wrote to memory of 3192	4284	Aijlgkjq.exe	103
PID 4284 wrote to memory of 3192	4284	Aijlgkjq.exe	103
PID 4284 wrote to memory of 3192	4284	Aijlgkjq.exe	103
PID 3192 wrote to memory of 704	3192	Afnlpohj.exe	104
PID 3192 wrote to memory of 704	3192	Afnlpohj.exe	104
PID 3192 wrote to memory of 704	3192	Afnlpohj.exe	104
PID 704 wrote to memory of 4864	704	Afqifo32.exe	105
PID 704 wrote to memory of 4864	704	Afqifo32.exe	105
PID 704 wrote to memory of 4864	704	Afqifo32.exe	105
PID 4864 wrote to memory of 4744	4864	Abgjkpll.exe	106
PID 4864 wrote to memory of 4744	4864	Abgjkpll.exe	106
PID 4864 wrote to memory of 4744	4864	Abgjkpll.exe	106
PID 4744 wrote to memory of 4228	4744	Apkjddke.exe	107
PID 4744 wrote to memory of 4228	4744	Apkjddke.exe	107
PID 4744 wrote to memory of 4228	4744	Apkjddke.exe	107
PID 4228 wrote to memory of 2676	4228	Albkieqj.exe	108
PID 4228 wrote to memory of 2676	4228	Albkieqj.exe	108
PID 4228 wrote to memory of 2676	4228	Albkieqj.exe	108
PID 2676 wrote to memory of 1964	2676	Bifkcioc.exe	109
PID 2676 wrote to memory of 1964	2676	Bifkcioc.exe	109
PID 2676 wrote to memory of 1964	2676	Bifkcioc.exe	109
PID 1964 wrote to memory of 4604	1964	Bemlhj32.exe	110

C:\Users\Admin\AppData\Local\Temp\d272cfeb8c2ea21ca332d6380d0786fbfc75793fa3a5ca9a2de5c2824244ed7cN.exe
"C:\Users\Admin\AppData\Local\Temp\d272cfeb8c2ea21ca332d6380d0786fbfc75793fa3a5ca9a2de5c2824244ed7cN.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\SysWOW64\Ohqpjo32.exe
  C:\Windows\system32\Ohqpjo32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3040
- - C:\Windows\SysWOW64\Ofdqcc32.exe
    C:\Windows\system32\Ofdqcc32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4968
  - - C:\Windows\SysWOW64\Ohcmpn32.exe
      C:\Windows\system32\Ohcmpn32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:5060
    - - C:\Windows\SysWOW64\Okceaikl.exe
        
        C:\Windows\system32\Okceaikl.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4088
      - C:\Windows\SysWOW64\Ohhfknjf.exe
        
        C:\Windows\system32\Ohhfknjf.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5024
        
        C:\Windows\SysWOW64\Pdngpo32.exe
        
        C:\Windows\system32\Pdngpo32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2720
        
        C:\Windows\SysWOW64\Pcpgmf32.exe
        
        C:\Windows\system32\Pcpgmf32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1228
        
        C:\Windows\SysWOW64\Pkklbh32.exe
        
        C:\Windows\system32\Pkklbh32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1720
        
        C:\Windows\SysWOW64\Pecpknke.exe
        
        C:\Windows\system32\Pecpknke.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2376
        
        C:\Windows\SysWOW64\Pbgqdb32.exe
        
        C:\Windows\system32\Pbgqdb32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3684
        
        C:\Windows\SysWOW64\Pfeijqqe.exe
        
        C:\Windows\system32\Pfeijqqe.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3456
        
        C:\Windows\SysWOW64\Qkdohg32.exe
        
        C:\Windows\system32\Qkdohg32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2816
        
        C:\Windows\SysWOW64\Qkfkng32.exe
        
        C:\Windows\system32\Qkfkng32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1536
        
        C:\Windows\SysWOW64\Aijlgkjq.exe
        
        C:\Windows\system32\Aijlgkjq.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4284
        
        C:\Windows\SysWOW64\Afnlpohj.exe
        
        C:\Windows\system32\Afnlpohj.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3192
        
        C:\Windows\SysWOW64\Afqifo32.exe
        
        C:\Windows\system32\Afqifo32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:704
        
        C:\Windows\SysWOW64\Abgjkpll.exe
        
        C:\Windows\system32\Abgjkpll.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4864
        
        C:\Windows\SysWOW64\Apkjddke.exe
        
        C:\Windows\system32\Apkjddke.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4744
        
        C:\Windows\SysWOW64\Albkieqj.exe
        
        C:\Windows\system32\Albkieqj.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4228
        
        C:\Windows\SysWOW64\Bifkcioc.exe
        
        C:\Windows\system32\Bifkcioc.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2676
        
        C:\Windows\SysWOW64\Bemlhj32.exe
        
        C:\Windows\system32\Bemlhj32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1964
        
        C:\Windows\SysWOW64\Bbalaoda.exe
        
        C:\Windows\system32\Bbalaoda.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4604
        
        C:\Windows\SysWOW64\Bpemkcck.exe
        
        C:\Windows\system32\Bpemkcck.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4556
        
        C:\Windows\SysWOW64\Bmimdg32.exe
        
        C:\Windows\system32\Bmimdg32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1036
        
        C:\Windows\SysWOW64\Bipnihgi.exe
        
        C:\Windows\system32\Bipnihgi.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:348
        
        C:\Windows\SysWOW64\Cefoni32.exe
        
        C:\Windows\system32\Cefoni32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2276
        
        C:\Windows\SysWOW64\Cffkhl32.exe
        
        C:\Windows\system32\Cffkhl32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3832
        
        C:\Windows\SysWOW64\Cbmlmmjd.exe
        
        C:\Windows\system32\Cbmlmmjd.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4964
        
        C:\Windows\SysWOW64\Cpqlfa32.exe
        
        C:\Windows\system32\Cpqlfa32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4480
        
        C:\Windows\SysWOW64\Cmdmpe32.exe
        
        C:\Windows\system32\Cmdmpe32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2416
        
        C:\Windows\SysWOW64\Ciknefmk.exe
        
        C:\Windows\system32\Ciknefmk.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3136
        
        C:\Windows\SysWOW64\Dbcbnlcl.exe
        
        C:\Windows\system32\Dbcbnlcl.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4576
        
        C:\Windows\SysWOW64\Dpgbgpbe.exe
        
        C:\Windows\system32\Dpgbgpbe.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2148
        
        C:\Windows\SysWOW64\Dipgpf32.exe
        
        C:\Windows\system32\Dipgpf32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1904
        
        C:\Windows\SysWOW64\Dpjompqc.exe
        
        C:\Windows\system32\Dpjompqc.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2036
        
        C:\Windows\SysWOW64\Dgdgijhp.exe
        
        C:\Windows\system32\Dgdgijhp.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:312
        
        C:\Windows\SysWOW64\Defheg32.exe
        
        C:\Windows\system32\Defheg32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4572
        
        C:\Windows\SysWOW64\Dlqpaafg.exe
        
        C:\Windows\system32\Dlqpaafg.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1404
        
        C:\Windows\SysWOW64\Dbkhnk32.exe
        
        C:\Windows\system32\Dbkhnk32.exe
        40⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3432
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3432 -s 420
        41⤵
        Program crash
        
        PID:3092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3432 -ip 3432
1⤵
PID:1972

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4056,i,12198811467968044966,17227406646827438786,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:8
1⤵
PID:1076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Abgjkpll.exe

Filesize
347KB

MD5
6d6d8dbaeb544bee76770183bf95c138

SHA1
99a684ecade15cae612dca548b539d0b98eb6a23

SHA256
f246d46c44a1343780d85ff97bef97c24165d3c1b57327edd8b07b6fc5df00c9

SHA512
708606d17d35316de31f1c72c0b7999504c3de122598a94851dbfd3426973a2b59a31e122e26f574e2b4a386a3bf607efe6589b40561b4cef432fb94819a103e

Download Submit
C:\Windows\SysWOW64\Afnlpohj.exe

Filesize
347KB

MD5
a9a053e234a87bd5be4db8c408810a6b

SHA1
091f8631cbb8a8f008653292254e2f3ffd5a1c4a

SHA256
fc6e90c0b6fbc9480579b3a5a233ed1b892a9b506e37325ac6c317fa072f7107

SHA512
a61da3715586811de610a0efa63b521142f9b8fc9dca184b55e8fe3d6b2229f5aa9d3b93cabc6a4b5f2f77dcf9fcc631e2f73fdb87d34010895cbcee3992cf4a

Download Submit
C:\Windows\SysWOW64\Afqifo32.exe

Filesize
128KB

MD5
ca7824d36b28bd3ddafdd595171d51f8

SHA1
fb43386151dc113b4dbd9a0cf40f3dd4a965a4b8

SHA256
f51cbe99cae25d3203d1b9b633f5f97531c0aa3bc67a3bd2673260899557147b

SHA512
61bcfc2d3e0058b97152013e237e2f1951fb8a76b04c61deb95cee9d38c66ba9074320c194bb82195882ca2a6165c1f000c1438451fb0c5cc394ba830e0c6d3e

Download Submit
C:\Windows\SysWOW64\Afqifo32.exe

Filesize
347KB

MD5
9d4fbccc65f590485da95432523747d3

SHA1
a2293ecc7b65a3ab13fcdd490c11c755c5832578

SHA256
9db67feefe934680d35efa3d8035dadb4089f8e440e427cb14394e94946539b9

SHA512
2c2782ccb8856ab256748ce16c708e52b8510610e606ba18a3cc2dbfd9ee63f6b9bb416dd8613e3bd031335f645520229d1d7222263e77bfb88a4e57b94cd725

Download Submit
C:\Windows\SysWOW64\Aijlgkjq.exe

Filesize
347KB

MD5
a19aeecccf48e0bd6ab4f1ba57d99db9

SHA1
9cdf0a04fdc789dd00508330de68b36df3dc58fd

SHA256
cb083a652b2dad3708ad218a1e251a57d892101ada5633b672070dda2c8620db

SHA512
6c2f3bdc1ff4a48462c059b0074005dfb123bbf4e8ee2737be501ae520db78e78c49bb99641a35bfeb463d16d0c48a954f81b7edb48752facc9489814a85e5ff

Download Submit
C:\Windows\SysWOW64\Albkieqj.exe

Filesize
347KB

MD5
04fb4e0cda549224516251eab178ce70

SHA1
8f89e49e0473ecae70ea6fb08d4e4480ca3be483

SHA256
e06e137f1330e6a11f9e8e03dd67b9b3ebf1b3b82680039baaf62df189329dad

SHA512
f66f4db2e0a72718bfd9b2382e7cfd990fac85db576d8c9aaf6f4d24b6f764d71969013581ff279b5136e3bc748f0131dc427f02fa33216e37f444027ca31271

Download Submit
C:\Windows\SysWOW64\Apkjddke.exe

Filesize
347KB

MD5
6eec3bb4d6ba888e74eb2eaf5ddfc5d4

SHA1
17c18a91f77cc5df6b46bb5787635bde61b7841f

SHA256
54d51065ebe43166ab4cca3e1ab1e7007fc9876e22112b8743c4ea48913a7568

SHA512
6e8d29ed00356ca58d7ac847cc10797447b35f407b4f196db12cbb6fd2f1e55d5d2d0d2e84ee8726d7b8564038d75f7f8b184d3ca4f9b39250728bbf78f1b93e

Download Submit
C:\Windows\SysWOW64\Bbalaoda.exe

Filesize
347KB

MD5
2de440e2d1d7b22d75e07dae60d2301c

SHA1
fc2328407bf7ac2967651a858b1e3e9255f7f9fb

SHA256
9f3b179cf18ebb07c0150549aaf8acf0ee87e9582e0650870d576373d03c29a2

SHA512
000d7ea08b8ef7f820d8feb5386486f793ca48cc3d4fb4787984b3e7db56ad0ee66ce3d14992f46fdd397ed97db9625adc71a3e8be4136e575458abb72441eb2

Download Submit
C:\Windows\SysWOW64\Bemlhj32.exe

Filesize
347KB

MD5
56cd8b1a5c3d14179a9ed826f2eb4e69

SHA1
a98130583ac1d87ecf5114cb8ef0ad084e7d15e3

SHA256
0c57adb08839d1979fc5c3fcfd5ca5d12f39eee884b4ecd4c50a4bd77ff89e5d

SHA512
d0856e774799651d3a7751219ca0eeaa381fd7af92870435fd2ad7a76a145f74d7238c429a1d2c23c6fba7171e3bc7921d824966be5c1ad1bbdd64c5f3429d59

Download Submit
C:\Windows\SysWOW64\Bifkcioc.exe

Filesize
347KB

MD5
bc62fe5a5197eecdce1c27ff90abd9c7

SHA1
3ca7200c74989b614de9b1ad3b28b30dbb880be5

SHA256
872e6a33adc935726f85d47ffb7b2b0d621d1fd8ab65967cbaf0e2312db7b1b4

SHA512
2393cf7e70e35394c85176dd3d7626ae7797ea5c24e5d95d402f00b6d349178beb4ef48f02782e8bbc438f007ebb9f1e15163ca88ac7b06362ca0580515606da

Download Submit
C:\Windows\SysWOW64\Bipnihgi.exe

Filesize
347KB

MD5
3be262aea5e6b34c4f5f2bd2099057de

SHA1
d6d4b7f22b1c497602b4e3ccce2ddfc69919cbc7

SHA256
7ff04258243215695d6d4ceb752950dc614a760703161b0dac46c8c608f32269

SHA512
29953c2d0c7d7a6ccd13f2766bed2fa080a50437186a5c814e8693b9d63ad5e5ddc5d1648792199e1b47ee5e974828461674d52fc1283d840722a39bde3b558b

Download Submit
C:\Windows\SysWOW64\Bmimdg32.exe

Filesize
347KB

MD5
ffaa727eafbcdc3b40ebbf500efffe4b

SHA1
d2218b7d1b90410d396693c721e87ac0e2390507

SHA256
28ddaf657b8251f8993b14cc466744a505493ef33f16de61339f0ef8db876081

SHA512
f6af3abf46ff193eab37c4fa651238bbd08c180d6ce263824adf6680ccd0b9e1a53648cd7cbd3d68e75139ff0b2af4f2104b04e35d2706e152945bd799bdc15c

Download Submit
C:\Windows\SysWOW64\Bpemkcck.exe

Filesize
347KB

MD5
6109d9870ece221700ed5a836fcf3a5a

SHA1
5731e8a57970ae1215ed3f969a27c92196676b34

SHA256
3edba216cb2249411e3b0adc13a97ece0385bec0d60bb070f174e0e1a374f887

SHA512
072c250dcfca62f1be1a5d22c6ea1c50b1fa093b4c68713c96713c2d53af96d2e06892767b71841cb9cad3af204b267eeacfbf25a53010e42a662c5fefc9c2dc

Download Submit
C:\Windows\SysWOW64\Cbmlmmjd.exe

Filesize
347KB

MD5
738febcffd18cbfcb668f1599e1cd044

SHA1
6d54487cbdb22d0717383ef28972a3ba5d3b1748

SHA256
34c3d6cf6e8d2e73c623d272a9b4db50d88535aff8d6480045f7961f2afbbb66

SHA512
0fd098f18485b5ff24d9a069c4ef86c0d026fac1e8c72fed3053e9b5a6e7c340dde34b572dd546898023474d310d74cd010ffae04e55e8f2c3d67af38b7d84fb

Download Submit
C:\Windows\SysWOW64\Cefoni32.exe

Filesize
347KB

MD5
810d942c8ab94e8e3a15ef442289c3aa

SHA1
7517f910ff09b6cdd5a360acf9b040f5579cd2a1

SHA256
f384065279202757549a687b17dc1048f3edfa1f64aacb39a2feda492fa1c2ef

SHA512
dc08f0812096e7b3ca5f41ec5c720cec6e2539cfeb0dcb4a08e99a099e5e0d80776776028076ba686ddd7bfed1cc05aab879112489a7f258b4663759f13aa19a

Download Submit
C:\Windows\SysWOW64\Cffkhl32.exe

Filesize
347KB

MD5
05d36492f8f25188e5438e5f62e72a96

SHA1
e9050ece3275ce379d813e2921b16a1d1e4edd59

SHA256
f1200bf4b52774c2ea2e00afd70325d92db2308f3ecee95ea2607baaa2feadc1

SHA512
f664cce0e00b67e57492e959086b750c4235e5bd603cbdd4b5f0bd845ba5c606a1560deeb4489ab948f7a32f1b5064bb178d27df157c304bc7d2f86027d76488

Download Submit
C:\Windows\SysWOW64\Ciknefmk.exe

Filesize
347KB

MD5
06dcca561dc369eeeeae01d58ee7ecf0

SHA1
87df6d79a37c8c7016266145a9162136c909a593

SHA256
9df69f04992e342f587a8770f5dff430efa92a8cc136ef29bdde805da9f665bf

SHA512
a54cfbd0f64fd7a57d5d72c3994e71320aa57cc1c800fbc681ceb819da00527a666530f35f0715dc5472a3340e0aede38b637dc40351e0b0c9b1f96d88be4411

Download Submit
C:\Windows\SysWOW64\Cmdmpe32.exe

Filesize
347KB

MD5
e7c929e202012eef436b10891381be8c

SHA1
ca0ad3e4f9712f6acfd90c609621a7092820cbde

SHA256
5adc42f7c2d1645ec8d52352f999760b1c08cfad80f47e977b07477e29841801

SHA512
899d919fd7caec408f1855cd82541acabad0108fa926faf78f6c2f9e4a953cb7efce363aaf4078c8569d599118eedcc1cd9fee1a7090c1b42125de7ed7a523db

Download Submit
C:\Windows\SysWOW64\Cpqlfa32.exe

Filesize
347KB

MD5
a22c86f3aec2b1ddd38e54122316169b

SHA1
76e4455db3213edc7a7f938f910924687f20e132

SHA256
f79915ab3f24a3d8704b9275e8d363b6cc21f7ba2061a10019db30d3b2d792fa

SHA512
6dd9632f964a0f187f988941c1b67078f514b2ab7f34261050f05f5c44611fe7184619a1207661296ff0265f419b667d265581159e7accba98e2866e88a7f654

Download Submit
C:\Windows\SysWOW64\Dbcbnlcl.exe

Filesize
347KB

MD5
84e010b7392756bf3d8e7074aa6747c1

SHA1
f95a3b62aa7a96cadf31b2b3cafe9267c7720f53

SHA256
3099bbf4cdfd27e855b12adf1898057e419978795e65e39bd56391f05ca8d533

SHA512
1d5750dd975cafbe0e47952b1a33233dd024fd9cf607ec00b841f6b1ddf115f8f8bf99b34f07a6b7d38e546f0837d98646407e3ea673defe9ff3eeb5f6683d0f

Download Submit
C:\Windows\SysWOW64\Dbkhnk32.exe

Filesize
347KB

MD5
7630fe6dd7ab9f573f22d87110de4a19

SHA1
898bf58fc4e33cebd543ba3189322d923b11c3e9

SHA256
4382aa47862afe088c82298d0f7f01cd6dba2a511a4d28dffb3b7734e90996e1

SHA512
7f4e08506a0372a7fa4784e49fcafb1c5132898caffe0fb1e6e3b65eb02640303ebf1285c0bd51a325c39acc90198993469754f2c658c615388c8fa0dc57bd73

Download Submit
C:\Windows\SysWOW64\Dipgpf32.exe

Filesize
64KB

MD5
072329bc7ac485d7de1e40c42ec32eb7

SHA1
e38d07ee2a9c62cdb20efa495bb73eacc231b506

SHA256
77c454d76ba76b2f87e18bbf0a9c5a0a2a7a5f8d21147afabc577d81afaebd99

SHA512
8d9cc47da10d765d32eef63deb57a7f22ed226f7543ad6dd11935fc217364a659d33e9e0e4702a0aebb1757707bd7de9af3fa187c215051b1d625e0d19df9f25

Download Submit
C:\Windows\SysWOW64\Dpgbgpbe.exe

Filesize
347KB

MD5
0923e5feb82676f9e26e46f0a0d21f23

SHA1
acb68b7d1e6ff2bdb45bd03fecffba217b28f760

SHA256
353a9faf442bec5080b0a76af07da24cc83f8ac2a09c2407c1cab3408de81e66

SHA512
ab0a524d6f37d554f806578159a7c0336269f38db59d48b29833ad0c61fc9297c3f9963fac81d6da8ebd36f80c220e2ff5cbe983663191398aef6f3db42f796a

Download Submit
C:\Windows\SysWOW64\Ofdqcc32.exe

Filesize
347KB

MD5
1ea8924cc2aabfe1a44853a3a3502ecd

SHA1
ae3141955d2d55f525e10759304965a4a9bbe22b

SHA256
706655da6e8aaad8092851b05027f8efb437a6466df84a28627c38bc22bd5859

SHA512
7f1f4cf490bc05df4b6fa9e4d1ba5a63d1caf96f628c107be6ab3ebcb2c58c35629b2c525ee1e471c0224a979f9b164427bdf093d740ed6a8a62932d2a8ac4f8

Download Submit
C:\Windows\SysWOW64\Ohcmpn32.exe

Filesize
347KB

MD5
ce7601216c0a0a7bb4c627f4a81e03d1

SHA1
129df2970035e5fba56964482cb69aff3969495b

SHA256
ae581125515eb1adf6ca747f88ff5d6635359e52ea02e77fa46c8ddaf5a8240b

SHA512
4520e28a381579c6beedd71bf035347b1c53cc9a2b902bae35569d49491ea30c00ad4b888fd6cd0e6577e1c3eef2b76df540d598c7ed8cafc000092e100555b5

Download Submit
C:\Windows\SysWOW64\Ohhfknjf.exe

Filesize
347KB

MD5
9a9da87dafa8b675541315073d14377e

SHA1
f578756b70f56596cdee03cc850ac248565533e3

SHA256
57bebb0a65573818d2beb1b2f48b2a051844a82393357d26316882c71d8f2e8c

SHA512
a3dfa5f5da52b41f768147426ee690347e2f26b7025a762f27042961e1884ffd2c382f3939d8c1a80e99597faf3e6ead3072dc4b223366d2c1e3f7d654600961

Download Submit
C:\Windows\SysWOW64\Ohqpjo32.exe

Filesize
347KB

MD5
cab8835320a9d0f3148cfc55fd4bc25a

SHA1
8162a5456431f69d5b23316dac64a05ead50c802

SHA256
41e1b7361aba53153bcfa93552854f9a652c84912de4d43c0b1f88f2c1a4402c

SHA512
fa110cc37f1707ad01c0ac6caaf3b91f5f15c79356e5126031b81438157f0cf58f39818a7540cdc3b1a38cc2e86a347a3608f0f2ab04a96e93297bd73327d680

Download Submit
C:\Windows\SysWOW64\Okceaikl.exe

Filesize
347KB

MD5
dea884ff27f1f211945a56d0ef026f33

SHA1
c7b0bac86d5061fc12565aa5e7faa5200a604b6a

SHA256
3618344e6ccf9a3529e7ef38489218d28f349fe1e2b01742fd0084f8c6431668

SHA512
12a8c2b15f93c3bc8d59fe6c2a21cae3884071478d99bafe8af97f83af40ab5a64a2ac2d9243e365f03808ddc5e59f779bb71e19341d61308880198ff023a461

Download Submit
C:\Windows\SysWOW64\Pbgqdb32.exe

Filesize
347KB

MD5
b01f9ada287bd4b0b6fd3542dc77e433

SHA1
95925c645c58ecab74611142f7c16ae426764ce9

SHA256
5d4bb402d3f727fd74f71d4d8524de819d55f160025fad3b5b6fd9f4ff462879

SHA512
fdeb3b20d38a2aae3f1ab4f356e42d88f5b79c9f6aa1846ffe12c5225c7fe9777f0bbc9990d9765888a9a1a132d5e7b0031d4aec5af0f3d98191d9529dc0866a

Download Submit
C:\Windows\SysWOW64\Pcpgmf32.exe

Filesize
347KB

MD5
b38bf328b47a41d70922d5b0793c52e6

SHA1
7231dde165afab2339679527283f84a5242e816e

SHA256
6f25cd04d4402f75093e8999c3b3181a323fdd65fda224046b9662965a54eda7

SHA512
6143525edf7c126cf9d508c390ca422a3b0af099142b5b086cc83a0d915ea1d0f59e5d038e7d861e92f04d041b62bdecb1f12505f39da89066c6ee1bd23102ea

Download Submit
C:\Windows\SysWOW64\Pdngpo32.exe

Filesize
347KB

MD5
9c7eda1f148212273700b386cf5f57df

SHA1
79fef37628c7e2f460f3a0dd0694e945372e1339

SHA256
915dbe45439ec3c64827e15a6b6ee4e6ddb888f26a61ef6b6585d86b370b2814

SHA512
2f25d462a3aa422d8246b2536752ea1cd877fd12bd9506f0f6307aa1faa79e9c4c36614a2c2aa00157d4b6b801d214841556062b9adb6378550b86db52c38a7e

Download Submit
C:\Windows\SysWOW64\Pecpknke.exe

Filesize
347KB

MD5
23ce7455cdf3c1efdc1355f3b2d28a2a

SHA1
e65c931540f2d050cb74e5b618695b760348e2b1

SHA256
07db3b9a423d37b525f112f62a9d34fc1772ab3699ccb00d02e8b3297324dc32

SHA512
a0261e1850f3cb7e7375b8b9b020168485d092a2406fb6e65d19fd7a6b53a19c3736badaef72f575bf01f2a8eb2bc3a90555f8a562c1e27ff271bbe31a36404f

Download Submit
C:\Windows\SysWOW64\Pfeijqqe.exe

Filesize
347KB

MD5
e49f18db8eb9b7c6d81b9eff151bfd9c

SHA1
f7a9068f9feecd8a1147e3588ae317be5d4a3a68

SHA256
357fa5445f9463ad14bc0c303d4e430a5f95fd2cd72f9ce46b3b46657ded5c8f

SHA512
fbcb4e90006aade4956a69a294acd68b701cbffeed099a7f311b81e67228e0eb96637592c43d6148d9e773d16ee616842777cec4ae787ec2aefd2dc69c874cb7

Download Submit
C:\Windows\SysWOW64\Pkklbh32.exe

Filesize
347KB

MD5
e82841c0929ccd562bebb7cc42e39c8e

SHA1
c56dd7d1f18a017f08ef3f1b7619038fcca18002

SHA256
17ce466493dbd4d94c4c28e22c3226357ec109ea680855928fe4a9b47d92a74b

SHA512
2e2a574789460ab3e338f053bf1e4e4aeb0e03c13e03c2fa0b2a64cc0cbe251e58c38ffd691bb51ea54e681b74bbc8e4949b15ae1a083fad8c3c9d6313eee9e0

Download Submit
C:\Windows\SysWOW64\Pqoppk32.dll

Filesize
7KB

MD5
f67c1b2bb950032c8436d27a5dd7a258

SHA1
de44d81a430e8691e9acbb0b9dc57d6027d49167

SHA256
b50117770af8f64c001f78591b396ca28c4ab5d79c7bde0ffbff10daba7d3f56

SHA512
bbc349cfe3fbff628a51bcb4fa1c2c4ff22e5b8cb37587347f92f421646468ebbcb15cb8310e2e769587aaa20f018cd956ee3d675aca827019c34583afb8a281

Download Submit
C:\Windows\SysWOW64\Qkdohg32.exe

Filesize
347KB

MD5
191025b729296f0b5f1cc933e365f0f8

SHA1
b255587b54fdae7d6c8fbddb89a98f9f5dc83f86

SHA256
f0ce7576c1cf043d75e19f2943f90bf6e5a367e70d7d5f89862f5fccdb8146a5

SHA512
bbe63d1d5713020f9cad27cb473b8363ccc9c50201167f89cd3e6daa4ad07243e2607a9a61ca0d83f8a2753d8943b4f3d07c2f9c99cb631eedf959297e4274a5

Download Submit
C:\Windows\SysWOW64\Qkfkng32.exe

Filesize
347KB

MD5
56ce621680476b5fb142e7cc75251395

SHA1
e0f0229781223479156d4d192787baf08cb8b35a

SHA256
97d27f8ed3e778750f790feedd3970c5a596db33fe9ac0bf9206a66649593f50

SHA512
ae3ae757e0408c7ddf7b0906bedcbeeaaaec00d57a43ba1926e0ccd1f6062a52b17a0b3aa6ddd32ce8b1bc7edca8ccd5d737df34d23e2f46007bc71b9ad7e218

Download Submit
memory/312-305-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/312-284-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/348-338-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/348-199-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/704-127-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/704-321-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1036-191-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1036-313-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1228-330-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1228-56-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1404-292-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1404-300-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1536-324-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1536-103-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1720-329-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1720-63-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1904-268-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1904-303-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1964-167-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1964-316-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2036-274-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2036-302-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2148-262-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2148-304-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2276-312-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2276-207-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2376-328-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2376-71-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2416-307-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2416-239-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2676-317-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2676-159-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2720-48-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2720-331-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2816-325-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2816-95-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2912-337-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2912-0-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3040-336-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3040-8-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3136-247-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3136-310-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3192-119-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3192-322-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3432-298-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3432-299-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3456-326-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3456-87-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3684-79-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3684-327-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3832-216-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3832-311-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4088-333-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4088-31-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4228-318-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4228-151-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4284-323-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4284-111-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4480-308-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4480-231-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4556-314-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4556-183-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4572-286-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4572-301-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4576-255-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4576-306-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4604-175-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4604-315-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4744-143-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4744-319-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4864-320-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4864-135-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4964-309-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4964-223-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4968-16-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4968-335-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5024-332-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5024-40-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5060-23-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5060-334-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads