berbew | 17a69b727df08a053f504984892487113b11f8dd920c67865ac11b0c8e10154b

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240910-en
resource tags

arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2024, 19:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17a69b727df08a053f504984892487113b11f8dd920c67865ac11b0c8e10154b.exe
Size

104KB
MD5

a8c123b09944feb9e7354c4d93555843
SHA1

447544ceccf155b7aaf386d5496d9c6c7db96e08
SHA256

17a69b727df08a053f504984892487113b11f8dd920c67865ac11b0c8e10154b
SHA512

c69f2d3b6d660c7471ef7a6e68858367a739a2c046165fc68fa5b4e981af601d2d75221cabc1e587aeec318b0fe10b3a625ae1d6a331e9441678400d255ac423
SSDEEP

3072:hvTWGnWF5Nzrw0wBfUQLYiBPQe54Ux7cEGrhkngpDvchkqbAIQS:hvTWGA5NIBbLYiZr5xx4brq2Ahn

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lajokiaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hnkhjdle.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Khabke32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Laffpi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kalcik32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hgcmbj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hnbnjc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Igjbci32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iencmm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hbknebqi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Loemnnhe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Leoejh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Logicn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hbiapb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hkaeih32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jhhodg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hkcbnh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jjkdlall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jhkljfok.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lhmafcnf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lkqgno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ilmedf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iloajfml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jhhodg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jlkafdco.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hjolie32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jaljbmkd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lhpnlclc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ielfgmnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kdkoef32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lahbei32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hgcmbj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jlkafdco.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Koimbpbc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Klddlckd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hcjmhk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ibgmaqfl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kkegbpca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lahbei32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lhmafcnf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Igmoih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jhfbog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Khdoqefq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdpiqehp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Indkpcdk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ilkhog32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jddiegbm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kaaldjil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jacpcl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kajfdk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kkbkmqed.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kblpcndd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Laffpi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lhbkac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hkaeih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Idhiii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kblpcndd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Leoejh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jhkljfok.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jhmhpfmi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jaemilci.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Khabke32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ieqpbm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ilmedf32.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Executes dropped EXE 64 IoCs

pid	Process
3100	Hjolie32.exe
4720	Hnkhjdle.exe
3536	Heepfn32.exe
1812	Hgcmbj32.exe
3068	Hbiapb32.exe
2808	Hcjmhk32.exe
1816	Hkaeih32.exe
4584	Hbknebqi.exe
3576	Hannao32.exe
264	Hkcbnh32.exe
916	Hnbnjc32.exe
1048	Ielfgmnj.exe
2972	Igjbci32.exe
2540	Indkpcdk.exe
2812	Iencmm32.exe
1400	Igmoih32.exe
1168	Ibbcfa32.exe
3424	Ieqpbm32.exe
2692	Ilkhog32.exe
2124	Ibdplaho.exe
2456	Ilmedf32.exe
4292	Ibgmaqfl.exe
2476	Idhiii32.exe
3980	Iloajfml.exe
3312	Jaljbmkd.exe
1228	Jhfbog32.exe
2928	Jjdokb32.exe
4084	Jblflp32.exe
4420	Jnbgaa32.exe
2580	Jhkljfok.exe
2824	Jlfhke32.exe
1472	Jacpcl32.exe
1544	Jhmhpfmi.exe
2908	Jjkdlall.exe
3824	Jaemilci.exe
416	Jddiegbm.exe
2756	Jlkafdco.exe
1220	Koimbpbc.exe
2096	Keceoj32.exe
3988	Khabke32.exe
1124	Kbgfhnhi.exe
3260	Kajfdk32.exe
3884	Khdoqefq.exe
1592	Kkbkmqed.exe
4904	Kalcik32.exe
1052	Kdkoef32.exe
3236	Kkegbpca.exe
1284	Kblpcndd.exe
1672	Kaopoj32.exe
4364	Klddlckd.exe
3416	Kbnlim32.exe
1852	Kaaldjil.exe
2304	Kdpiqehp.exe
1516	Loemnnhe.exe
3896	Leoejh32.exe
2340	Lhmafcnf.exe
3124	Logicn32.exe
3528	Laffpi32.exe
3744	Lhpnlclc.exe
2000	Lojfin32.exe
4488	Lahbei32.exe
4696	Lhbkac32.exe
860	Lkqgno32.exe
4272	Lajokiaa.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Ieqpbm32.exe	Ibbcfa32.exe
File created	C:\Windows\SysWOW64\Dcmnee32.dll	Jddiegbm.exe
File opened for modification	C:\Windows\SysWOW64\Kaopoj32.exe	Kblpcndd.exe
File created	C:\Windows\SysWOW64\Ofnfbijk.dll	Kaopoj32.exe
File created	C:\Windows\SysWOW64\Kdpiqehp.exe	Kaaldjil.exe
File opened for modification	C:\Windows\SysWOW64\Lhbkac32.exe	Lahbei32.exe
File created	C:\Windows\SysWOW64\Lajokiaa.exe	Lkqgno32.exe
File created	C:\Windows\SysWOW64\Hbfhni32.dll	Lkqgno32.exe
File opened for modification	C:\Windows\SysWOW64\Hjolie32.exe	17a69b727df08a053f504984892487113b11f8dd920c67865ac11b0c8e10154b.exe
File created	C:\Windows\SysWOW64\Hnbnjc32.exe	Hkcbnh32.exe
File opened for modification	C:\Windows\SysWOW64\Ielfgmnj.exe	Hnbnjc32.exe
File opened for modification	C:\Windows\SysWOW64\Igjbci32.exe	Ielfgmnj.exe
File created	C:\Windows\SysWOW64\Idhiii32.exe	Ibgmaqfl.exe
File created	C:\Windows\SysWOW64\Jnbgaa32.exe	Jhhodg32.exe
File created	C:\Windows\SysWOW64\Jjkdlall.exe	Jhmhpfmi.exe
File opened for modification	C:\Windows\SysWOW64\Jjkdlall.exe	Jhmhpfmi.exe
File created	C:\Windows\SysWOW64\Keceoj32.exe	Koimbpbc.exe
File created	C:\Windows\SysWOW64\Cboleq32.dll	Kalcik32.exe
File created	C:\Windows\SysWOW64\Jlbngnmk.dll	Jnbgaa32.exe
File created	C:\Windows\SysWOW64\Jacpcl32.exe	Jlfhke32.exe
File opened for modification	C:\Windows\SysWOW64\Kbgfhnhi.exe	Khabke32.exe
File created	C:\Windows\SysWOW64\Ekheml32.dll	Khabke32.exe
File created	C:\Windows\SysWOW64\Eqfnqg32.dll	Kbnlim32.exe
File opened for modification	C:\Windows\SysWOW64\Lojfin32.exe	Lhpnlclc.exe
File created	C:\Windows\SysWOW64\Heepfn32.exe	Hnkhjdle.exe
File opened for modification	C:\Windows\SysWOW64\Hcjmhk32.exe	Hbiapb32.exe
File created	C:\Windows\SysWOW64\Cobnge32.dll	Hkaeih32.exe
File created	C:\Windows\SysWOW64\Ibbcfa32.exe	Igmoih32.exe
File created	C:\Windows\SysWOW64\Icajjnkn.dll	Ibgmaqfl.exe
File created	C:\Windows\SysWOW64\Jaemilci.exe	Jjkdlall.exe
File created	C:\Windows\SysWOW64\Ifkqol32.dll	Jlkafdco.exe
File created	C:\Windows\SysWOW64\Khecje32.dll	Keceoj32.exe
File created	C:\Windows\SysWOW64\Kkegbpca.exe	Kdkoef32.exe
File created	C:\Windows\SysWOW64\Lahbei32.exe	Lojfin32.exe
File opened for modification	C:\Windows\SysWOW64\Hnkhjdle.exe	Hjolie32.exe
File created	C:\Windows\SysWOW64\Ibgmaqfl.exe	Ilmedf32.exe
File created	C:\Windows\SysWOW64\Kkbkmqed.exe	Khdoqefq.exe
File opened for modification	C:\Windows\SysWOW64\Kkbkmqed.exe	Khdoqefq.exe
File created	C:\Windows\SysWOW64\Hannao32.exe	Hbknebqi.exe
File created	C:\Windows\SysWOW64\Igjbci32.exe	Ielfgmnj.exe
File created	C:\Windows\SysWOW64\Dmehgibj.dll	Ilmedf32.exe
File opened for modification	C:\Windows\SysWOW64\Idhiii32.exe	Ibgmaqfl.exe
File created	C:\Windows\SysWOW64\Fbbojb32.dll	Kdkoef32.exe
File created	C:\Windows\SysWOW64\Ielfgmnj.exe	Hnbnjc32.exe
File created	C:\Windows\SysWOW64\Elmoqj32.dll	Jlfhke32.exe
File created	C:\Windows\SysWOW64\Jddiegbm.exe	Jaemilci.exe
File opened for modification	C:\Windows\SysWOW64\Kalcik32.exe	Kkbkmqed.exe
File created	C:\Windows\SysWOW64\Lhmafcnf.exe	Leoejh32.exe
File created	C:\Windows\SysWOW64\Logicn32.exe	Lhmafcnf.exe
File created	C:\Windows\SysWOW64\Hkcbnh32.exe	Hannao32.exe
File created	C:\Windows\SysWOW64\Koimbpbc.exe	Jlkafdco.exe
File opened for modification	C:\Windows\SysWOW64\Klddlckd.exe	Kaopoj32.exe
File created	C:\Windows\SysWOW64\Ichnpf32.dll	Loemnnhe.exe
File opened for modification	C:\Windows\SysWOW64\Lkqgno32.exe	Lhbkac32.exe
File created	C:\Windows\SysWOW64\Ompbfo32.dll	Hannao32.exe
File opened for modification	C:\Windows\SysWOW64\Indkpcdk.exe	Igjbci32.exe
File created	C:\Windows\SysWOW64\Ghikqj32.dll	Iencmm32.exe
File created	C:\Windows\SysWOW64\Iloajfml.exe	Idhiii32.exe
File created	C:\Windows\SysWOW64\Jlkafdco.exe	Jddiegbm.exe
File created	C:\Windows\SysWOW64\Kaaldjil.exe	Kbnlim32.exe
File created	C:\Windows\SysWOW64\Epaaihpg.dll	Ibdplaho.exe
File opened for modification	C:\Windows\SysWOW64\Jacpcl32.exe	Jlfhke32.exe
File created	C:\Windows\SysWOW64\Jjmannfj.dll	Jhmhpfmi.exe
File opened for modification	C:\Windows\SysWOW64\Jaemilci.exe	Jjkdlall.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3512	1080	WerFault.exe	153

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hcjmhk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Khdoqefq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lahbei32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hnkhjdle.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdpiqehp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lhbkac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lkqgno32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hjolie32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hgcmbj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hkaeih32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jaemilci.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lhmafcnf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	17a69b727df08a053f504984892487113b11f8dd920c67865ac11b0c8e10154b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hannao32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jhfbog32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ibbcfa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ilmedf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jblflp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jhmhpfmi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kajfdk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hbiapb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ielfgmnj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Igmoih32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kalcik32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdkoef32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lhpnlclc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keceoj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Khabke32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kkegbpca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logicn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Laffpi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hkcbnh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jnbgaa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Koimbpbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lajokiaa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Idhiii32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jlkafdco.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Heepfn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ibgmaqfl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kaopoj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kaaldjil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ldikgdpe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ieqpbm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jlfhke32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kblpcndd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jjkdlall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hbknebqi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Igjbci32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jjdokb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Indkpcdk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jhkljfok.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Loemnnhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lojfin32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ibdplaho.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jacpcl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Leoejh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jaljbmkd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Klddlckd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kbgfhnhi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kkbkmqed.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kbnlim32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hnbnjc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ilkhog32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jhhodg32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jjkdlall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jlkafdco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lamgof32.dll"	Kkegbpca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfeliqka.dll"	Lojfin32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lhbkac32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	17a69b727df08a053f504984892487113b11f8dd920c67865ac11b0c8e10154b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Hgcmbj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ompbfo32.dll"	Hannao32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ieqpbm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gqpbcn32.dll"	Jjdokb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jlfhke32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lhmafcnf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Lhmafcnf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fljloomi.dll"	17a69b727df08a053f504984892487113b11f8dd920c67865ac11b0c8e10154b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cobnge32.dll"	Hkaeih32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Igjbci32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbmoak32.dll"	Indkpcdk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Iloajfml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Khecje32.dll"	Keceoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Leoejh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lhpnlclc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Lojfin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	17a69b727df08a053f504984892487113b11f8dd920c67865ac11b0c8e10154b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mfodpbqp.dll"	Hjolie32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hbiapb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ilmedf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eilbckfb.dll"	Kdpiqehp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ichnpf32.dll"	Loemnnhe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jhfbog32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kkbkmqed.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kkegbpca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Klddlckd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kdlmhj32.dll"	Lahbei32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hbfhni32.dll"	Lkqgno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Lkqgno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ejioqkck.dll"	Hbiapb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bblnengb.dll"	Hkcbnh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jnbgaa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Koimbpbc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kkbkmqed.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Khdoqefq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hannao32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Hkcbnh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ibbcfa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jhhodg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jhkljfok.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gdqeooaa.dll"	Jacpcl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jaemilci.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kblpcndd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Indkpcdk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jhhodg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dcmnee32.dll"	Jddiegbm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Koimbpbc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lajokiaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ibgmaqfl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlbngnmk.dll"	Jnbgaa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kbgfhnhi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kalcik32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kaopoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Chbobjbh.dll"	Heepfn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Idhiii32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jhmhpfmi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kajfdk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kdpiqehp.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 3100	3048	17a69b727df08a053f504984892487113b11f8dd920c67865ac11b0c8e10154b.exe	87
PID 3048 wrote to memory of 3100	3048	17a69b727df08a053f504984892487113b11f8dd920c67865ac11b0c8e10154b.exe	87
PID 3048 wrote to memory of 3100	3048	17a69b727df08a053f504984892487113b11f8dd920c67865ac11b0c8e10154b.exe	87
PID 3100 wrote to memory of 4720	3100	Hjolie32.exe	88
PID 3100 wrote to memory of 4720	3100	Hjolie32.exe	88
PID 3100 wrote to memory of 4720	3100	Hjolie32.exe	88
PID 4720 wrote to memory of 3536	4720	Hnkhjdle.exe	89
PID 4720 wrote to memory of 3536	4720	Hnkhjdle.exe	89
PID 4720 wrote to memory of 3536	4720	Hnkhjdle.exe	89
PID 3536 wrote to memory of 1812	3536	Heepfn32.exe	90
PID 3536 wrote to memory of 1812	3536	Heepfn32.exe	90
PID 3536 wrote to memory of 1812	3536	Heepfn32.exe	90
PID 1812 wrote to memory of 3068	1812	Hgcmbj32.exe	91
PID 1812 wrote to memory of 3068	1812	Hgcmbj32.exe	91
PID 1812 wrote to memory of 3068	1812	Hgcmbj32.exe	91
PID 3068 wrote to memory of 2808	3068	Hbiapb32.exe	92
PID 3068 wrote to memory of 2808	3068	Hbiapb32.exe	92
PID 3068 wrote to memory of 2808	3068	Hbiapb32.exe	92
PID 2808 wrote to memory of 1816	2808	Hcjmhk32.exe	93
PID 2808 wrote to memory of 1816	2808	Hcjmhk32.exe	93
PID 2808 wrote to memory of 1816	2808	Hcjmhk32.exe	93
PID 1816 wrote to memory of 4584	1816	Hkaeih32.exe	94
PID 1816 wrote to memory of 4584	1816	Hkaeih32.exe	94
PID 1816 wrote to memory of 4584	1816	Hkaeih32.exe	94
PID 4584 wrote to memory of 3576	4584	Hbknebqi.exe	95
PID 4584 wrote to memory of 3576	4584	Hbknebqi.exe	95
PID 4584 wrote to memory of 3576	4584	Hbknebqi.exe	95
PID 3576 wrote to memory of 264	3576	Hannao32.exe	96
PID 3576 wrote to memory of 264	3576	Hannao32.exe	96
PID 3576 wrote to memory of 264	3576	Hannao32.exe	96
PID 264 wrote to memory of 916	264	Hkcbnh32.exe	97
PID 264 wrote to memory of 916	264	Hkcbnh32.exe	97
PID 264 wrote to memory of 916	264	Hkcbnh32.exe	97
PID 916 wrote to memory of 1048	916	Hnbnjc32.exe	98
PID 916 wrote to memory of 1048	916	Hnbnjc32.exe	98
PID 916 wrote to memory of 1048	916	Hnbnjc32.exe	98
PID 1048 wrote to memory of 2972	1048	Ielfgmnj.exe	99
PID 1048 wrote to memory of 2972	1048	Ielfgmnj.exe	99
PID 1048 wrote to memory of 2972	1048	Ielfgmnj.exe	99
PID 2972 wrote to memory of 2540	2972	Igjbci32.exe	100
PID 2972 wrote to memory of 2540	2972	Igjbci32.exe	100
PID 2972 wrote to memory of 2540	2972	Igjbci32.exe	100
PID 2540 wrote to memory of 2812	2540	Indkpcdk.exe	101
PID 2540 wrote to memory of 2812	2540	Indkpcdk.exe	101
PID 2540 wrote to memory of 2812	2540	Indkpcdk.exe	101
PID 2812 wrote to memory of 1400	2812	Iencmm32.exe	102
PID 2812 wrote to memory of 1400	2812	Iencmm32.exe	102
PID 2812 wrote to memory of 1400	2812	Iencmm32.exe	102
PID 1400 wrote to memory of 1168	1400	Igmoih32.exe	103
PID 1400 wrote to memory of 1168	1400	Igmoih32.exe	103
PID 1400 wrote to memory of 1168	1400	Igmoih32.exe	103
PID 1168 wrote to memory of 3424	1168	Ibbcfa32.exe	104
PID 1168 wrote to memory of 3424	1168	Ibbcfa32.exe	104
PID 1168 wrote to memory of 3424	1168	Ibbcfa32.exe	104
PID 3424 wrote to memory of 2692	3424	Ieqpbm32.exe	106
PID 3424 wrote to memory of 2692	3424	Ieqpbm32.exe	106
PID 3424 wrote to memory of 2692	3424	Ieqpbm32.exe	106
PID 2692 wrote to memory of 2124	2692	Ilkhog32.exe	107
PID 2692 wrote to memory of 2124	2692	Ilkhog32.exe	107
PID 2692 wrote to memory of 2124	2692	Ilkhog32.exe	107
PID 2124 wrote to memory of 2456	2124	Ibdplaho.exe	108
PID 2124 wrote to memory of 2456	2124	Ibdplaho.exe	108
PID 2124 wrote to memory of 2456	2124	Ibdplaho.exe	108
PID 2456 wrote to memory of 4292	2456	Ilmedf32.exe	109

C:\Users\Admin\AppData\Local\Temp\17a69b727df08a053f504984892487113b11f8dd920c67865ac11b0c8e10154b.exe
"C:\Users\Admin\AppData\Local\Temp\17a69b727df08a053f504984892487113b11f8dd920c67865ac11b0c8e10154b.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\SysWOW64\Hjolie32.exe
  C:\Windows\system32\Hjolie32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3100
- - C:\Windows\SysWOW64\Hnkhjdle.exe
    C:\Windows\system32\Hnkhjdle.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4720
  - - C:\Windows\SysWOW64\Heepfn32.exe
      C:\Windows\system32\Heepfn32.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3536
    - - C:\Windows\SysWOW64\Hgcmbj32.exe
        
        C:\Windows\system32\Hgcmbj32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1812
      - C:\Windows\SysWOW64\Hbiapb32.exe
        
        C:\Windows\system32\Hbiapb32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3068
        
        C:\Windows\SysWOW64\Hcjmhk32.exe
        
        C:\Windows\system32\Hcjmhk32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2808
        
        C:\Windows\SysWOW64\Hkaeih32.exe
        
        C:\Windows\system32\Hkaeih32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1816
        
        C:\Windows\SysWOW64\Hbknebqi.exe
        
        C:\Windows\system32\Hbknebqi.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4584
        
        C:\Windows\SysWOW64\Hannao32.exe
        
        C:\Windows\system32\Hannao32.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3576
        
        C:\Windows\SysWOW64\Hkcbnh32.exe
        
        C:\Windows\system32\Hkcbnh32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:264
        
        C:\Windows\SysWOW64\Hnbnjc32.exe
        
        C:\Windows\system32\Hnbnjc32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:916
        
        C:\Windows\SysWOW64\Ielfgmnj.exe
        
        C:\Windows\system32\Ielfgmnj.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1048
        
        C:\Windows\SysWOW64\Igjbci32.exe
        
        C:\Windows\system32\Igjbci32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2972
        
        C:\Windows\SysWOW64\Indkpcdk.exe
        
        C:\Windows\system32\Indkpcdk.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2540
        
        C:\Windows\SysWOW64\Iencmm32.exe
        
        C:\Windows\system32\Iencmm32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2812
        
        C:\Windows\SysWOW64\Igmoih32.exe
        
        C:\Windows\system32\Igmoih32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1400
        
        C:\Windows\SysWOW64\Ibbcfa32.exe
        
        C:\Windows\system32\Ibbcfa32.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1168
        
        C:\Windows\SysWOW64\Ieqpbm32.exe
        
        C:\Windows\system32\Ieqpbm32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3424
        
        C:\Windows\SysWOW64\Ilkhog32.exe
        
        C:\Windows\system32\Ilkhog32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2692
        
        C:\Windows\SysWOW64\Ibdplaho.exe
        
        C:\Windows\system32\Ibdplaho.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2124
        
        C:\Windows\SysWOW64\Ilmedf32.exe
        
        C:\Windows\system32\Ilmedf32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2456
        
        C:\Windows\SysWOW64\Ibgmaqfl.exe
        
        C:\Windows\system32\Ibgmaqfl.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4292
        
        C:\Windows\SysWOW64\Idhiii32.exe
        
        C:\Windows\system32\Idhiii32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2476
        
        C:\Windows\SysWOW64\Iloajfml.exe
        
        C:\Windows\system32\Iloajfml.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3980
        
        C:\Windows\SysWOW64\Jaljbmkd.exe
        
        C:\Windows\system32\Jaljbmkd.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3312
        
        C:\Windows\SysWOW64\Jhfbog32.exe
        
        C:\Windows\system32\Jhfbog32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1228
        
        C:\Windows\SysWOW64\Jjdokb32.exe
        
        C:\Windows\system32\Jjdokb32.exe
        28⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2928
        
        C:\Windows\SysWOW64\Jblflp32.exe
        
        C:\Windows\system32\Jblflp32.exe
        29⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4084
        
        C:\Windows\SysWOW64\Jhhodg32.exe
        
        C:\Windows\system32\Jhhodg32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4700
        
        C:\Windows\SysWOW64\Jnbgaa32.exe
        
        C:\Windows\system32\Jnbgaa32.exe
        31⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4420
        
        C:\Windows\SysWOW64\Jhkljfok.exe
        
        C:\Windows\system32\Jhkljfok.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2580
        
        C:\Windows\SysWOW64\Jlfhke32.exe
        
        C:\Windows\system32\Jlfhke32.exe
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2824
        
        C:\Windows\SysWOW64\Jacpcl32.exe
        
        C:\Windows\system32\Jacpcl32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1472
        
        C:\Windows\SysWOW64\Jhmhpfmi.exe
        
        C:\Windows\system32\Jhmhpfmi.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1544
        
        C:\Windows\SysWOW64\Jjkdlall.exe
        
        C:\Windows\system32\Jjkdlall.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2908
        
        C:\Windows\SysWOW64\Jaemilci.exe
        
        C:\Windows\system32\Jaemilci.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3824
        
        C:\Windows\SysWOW64\Jddiegbm.exe
        
        C:\Windows\system32\Jddiegbm.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:416
        
        C:\Windows\SysWOW64\Jlkafdco.exe
        
        C:\Windows\system32\Jlkafdco.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2756
        
        C:\Windows\SysWOW64\Koimbpbc.exe
        
        C:\Windows\system32\Koimbpbc.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1220
        
        C:\Windows\SysWOW64\Keceoj32.exe
        
        C:\Windows\system32\Keceoj32.exe
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2096
        
        C:\Windows\SysWOW64\Khabke32.exe
        
        C:\Windows\system32\Khabke32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3988
        
        C:\Windows\SysWOW64\Kbgfhnhi.exe
        
        C:\Windows\system32\Kbgfhnhi.exe
        43⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1124
        
        C:\Windows\SysWOW64\Kajfdk32.exe
        
        C:\Windows\system32\Kajfdk32.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3260
        
        C:\Windows\SysWOW64\Khdoqefq.exe
        
        C:\Windows\system32\Khdoqefq.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3884
        
        C:\Windows\SysWOW64\Kkbkmqed.exe
        
        C:\Windows\system32\Kkbkmqed.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1592
        
        C:\Windows\SysWOW64\Kalcik32.exe
        
        C:\Windows\system32\Kalcik32.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4904
        
        C:\Windows\SysWOW64\Kdkoef32.exe
        
        C:\Windows\system32\Kdkoef32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1052
        
        C:\Windows\SysWOW64\Kkegbpca.exe
        
        C:\Windows\system32\Kkegbpca.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3236
        
        C:\Windows\SysWOW64\Kblpcndd.exe
        
        C:\Windows\system32\Kblpcndd.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1284
        
        C:\Windows\SysWOW64\Kaopoj32.exe
        
        C:\Windows\system32\Kaopoj32.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1672
        
        C:\Windows\SysWOW64\Klddlckd.exe
        
        C:\Windows\system32\Klddlckd.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4364
        
        C:\Windows\SysWOW64\Kbnlim32.exe
        
        C:\Windows\system32\Kbnlim32.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3416
        
        C:\Windows\SysWOW64\Kaaldjil.exe
        
        C:\Windows\system32\Kaaldjil.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1852
        
        C:\Windows\SysWOW64\Kdpiqehp.exe
        
        C:\Windows\system32\Kdpiqehp.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2304
        
        C:\Windows\SysWOW64\Loemnnhe.exe
        
        C:\Windows\system32\Loemnnhe.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1516
        
        C:\Windows\SysWOW64\Leoejh32.exe
        
        C:\Windows\system32\Leoejh32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3896
        
        C:\Windows\SysWOW64\Lhmafcnf.exe
        
        C:\Windows\system32\Lhmafcnf.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2340
        
        C:\Windows\SysWOW64\Logicn32.exe
        
        C:\Windows\system32\Logicn32.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3124
        
        C:\Windows\SysWOW64\Laffpi32.exe
        
        C:\Windows\system32\Laffpi32.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3528
        
        C:\Windows\SysWOW64\Lhpnlclc.exe
        
        C:\Windows\system32\Lhpnlclc.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3744
        
        C:\Windows\SysWOW64\Lojfin32.exe
        
        C:\Windows\system32\Lojfin32.exe
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2000
        
        C:\Windows\SysWOW64\Lahbei32.exe
        
        C:\Windows\system32\Lahbei32.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4488
        
        C:\Windows\SysWOW64\Lhbkac32.exe
        
        C:\Windows\system32\Lhbkac32.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4696
        
        C:\Windows\SysWOW64\Lkqgno32.exe
        
        C:\Windows\system32\Lkqgno32.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:860
        
        C:\Windows\SysWOW64\Lajokiaa.exe
        
        C:\Windows\system32\Lajokiaa.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4272
        
        C:\Windows\SysWOW64\Ldikgdpe.exe
        
        C:\Windows\system32\Ldikgdpe.exe
        67⤵
        System Location Discovery: System Language Discovery
        
        PID:1080
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1080 -s 412
        68⤵
        Program crash
        
        PID:3512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1080 -ip 1080
1⤵
PID:1772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Hannao32.exe

Filesize
104KB

MD5
f3594a2a0af8dc23c76de5d0976be3a1

SHA1
a50853b62246d1343ce11416cae52d972f831019

SHA256
f9623cebb3a389fd6a319ce5c9da4b4f0357e7f10739a92684b68df2b98ed400

SHA512
17158657a863b5a9f5ed754e102405d8d29229b528d7ae2722f56b74b930ddb27fd15cf5dea951dc0bbe3b6026682d69aa95d3998e245ee30843ffd902ad4323

Download Submit
C:\Windows\SysWOW64\Hbiapb32.exe

Filesize
104KB

MD5
6e622099469dbde5bab54ab65a356b8b

SHA1
0dadce062d2e65b7d55c9e5cefa1c262c3302d16

SHA256
cb263044a6ab7d13e89f2d8a9e50fee65b07e3008a01b0253a0823e81c6a3532

SHA512
13777999d72f78d54abbbb5a67be1c60049ff08fc48b8f8d59d78ba46f1432817b66ba4783a50621db287e7fef14c7d2160c320787d8a085b8681af2d7b76521

Download Submit
C:\Windows\SysWOW64\Hbknebqi.exe

Filesize
104KB

MD5
4962866d6d67afc49751b1d1f84c78c6

SHA1
03c353bca9d63a4ada4727459a91a1647e3c6892

SHA256
b9d8ac780349255e2622a178e5596b3a518e374048070d1cd5373c8830f81cf1

SHA512
0bd4fb61b487248ada1bc7e9756217ac3b807286a69b6494e5a9262d634576ca4a77c4cebd1eb755222432bc13605a2770cf03d61c226b6cbfdacf1d33178779

Download Submit
C:\Windows\SysWOW64\Hcjmhk32.exe

Filesize
104KB

MD5
7840c4a25dceb56aff644a92d775abbe

SHA1
cc3952db26e96f95c184bd11ea5890b7fbe4a35b

SHA256
71efeb874685152a062506c7af82cd3f3e3c0facf9f4ac895ba7a36aaab693e2

SHA512
577d2c6b7c5cb7b5168677ba886ff00ba850ec11758113f7e04607201d0a0a36beaecf66cef33385cefd1f1cdb8babdbad454d2aa9efe31b208d3128f09b780c

Download Submit
C:\Windows\SysWOW64\Heepfn32.exe

Filesize
104KB

MD5
7a7d7c204b2b2e4f867b1b32992cc90d

SHA1
65f510e1b6d3b2e6d77ca42366645a83c6c10925

SHA256
734b8e5eea6663fb09d3ed84f0539ed9395cb42df3a78e57ad2ab174d434571f

SHA512
3104ead09219f15ddb5eb369dc9172cbeaad0294937d23305a8e6d4c3c7bdd0d62d29c74fb478e1a3483e363a5163d0d02472969f0d8877419a4f10f3b7286d6

Download Submit
C:\Windows\SysWOW64\Hgcmbj32.exe

Filesize
104KB

MD5
4ccf515f8e289abdc196d82faa7acef5

SHA1
c69b5a30c6364e8f6867b9a9af389459b9e5a4e7

SHA256
694ebe3ad02d044a6e7cf78e9ac936f70248c1307637632484837747223a900c

SHA512
bd37b1209d186d99a674b9fa8b132bafbdb126742611861490a881abbfe95688e84842af771a44786e0f88cad0d0399accb9c5998bb60c931bf4d95ca3ba8d24

Download Submit
C:\Windows\SysWOW64\Hjolie32.exe

Filesize
104KB

MD5
a614b9712392b3f29245517045ca4d0c

SHA1
861992fc0f72fc9062be285978325b9802865e86

SHA256
1e52ca60f686f8a5030965b1a7c52a6dab955f5ee9199989d82548288b43a6af

SHA512
e9583862d3bc8adc3c1e28795c747d85ac740de92dc78579f5e451aee67a79538473bce6a7fc41e68c2644c174f4c68be5ed94515338191a79ce78628943814a

Download Submit
C:\Windows\SysWOW64\Hkaeih32.exe

Filesize
104KB

MD5
98a4afb7a936ccaac7ec4ccd77286fbb

SHA1
9055c97b14418fbd2212bd988ef39ea6d7eeaa43

SHA256
c7c264a01dce0c67a971f5d0d7ab09c03e1ac294c54654513bebf8c24858c998

SHA512
a7ebe59149724bf86b1acaf545a31af5d12c60fc87e85e4127ec2f88d3b21c9238b5c30479c5a85fc2a26fece0358ccd5080819acc05c868d8effd659e45e8c4

Download Submit
C:\Windows\SysWOW64\Hkcbnh32.exe

Filesize
104KB

MD5
2657ddf533bf4426667f205820a07481

SHA1
ebe3ad7005ad243529f7f0c8d7fa418dbb1ac29d

SHA256
766b938a7be27a92eb095b15bfc29b24b84940a01cdb77b353af501edb006d13

SHA512
d2becd1289c3b26ff25506a9aa832bd4ac8077247e0977d0261c87cecf7564a43787aa9f7dfb54971c19398581569d95d654fa686886b16ed3258ba20342a878

Download Submit
C:\Windows\SysWOW64\Hnbnjc32.exe

Filesize
104KB

MD5
8788e555b38eb413af2e7e26586d8834

SHA1
ad00d5e23dcbc61e813d2af4beba456495c03eab

SHA256
bc151cfaa82140cb0e2ed8492660128faf050d0d3d278006d09232c7a10bd8ff

SHA512
6e5000ade7033d16a333612133c11ba520b5f77b449ba560641eaf71288d5d32f0e7c60729ce4777ddff75a79dea41c963bd1e16f87aca905aeb6b89da606a8c

Download Submit
C:\Windows\SysWOW64\Hnbnjc32.exe

Filesize
104KB

MD5
f719b46d031b82b50625bf8bb3157d56

SHA1
6a26be4596c1d2c64e5f7fe71f0da064e24c5554

SHA256
ddeb7077af8896dcc06aadfdc0e5b54892d632dfdf5ddabbeb43d96b09236458

SHA512
44d1d36cb744c484e46ea1134dd99d9306d481cda17e5a20a39e3169c9a97bdf869a0984ce6f37c45c2d29b3e94de301dca1d02840a5f7abaceeaf8a6c0b724b

Download Submit
C:\Windows\SysWOW64\Hnkhjdle.exe

Filesize
104KB

MD5
d714c1f1b0e8de9d035f151a8ff88204

SHA1
8150360321514b712390a7448b864a7ff501b188

SHA256
02931cd567ebae582529d910a8ccecb204a97f702d97dbe2b53553a94824df60

SHA512
7f80a8512ea9a41606dfeabe145b368d37aac354ce062db0cb8071f9cf694f58177b80ba6d2c9d225b22ca71403e22379e5b1c33b04d8eee96567c9369b04a3e

Download Submit
C:\Windows\SysWOW64\Ibbcfa32.exe

Filesize
104KB

MD5
1cd339fa41ea6f636ab74b8f1c1ab386

SHA1
a3dd26a0ae14a9fa7ec18a6a632f937c95539102

SHA256
7505ad0c50fd066a82d553fb9f1fc880ea45bfafd6aa20cd834819fbdb9a202e

SHA512
d45f54b087433ee4a9d812269be07334ff90d006fc65c32c3f0160eece6a474b5dc1c8e065ef8e8636b9179f0031b8e11abc88fb0fa20573d82ccbe7516feb05

Download Submit
C:\Windows\SysWOW64\Ibdplaho.exe

Filesize
104KB

MD5
2f7913efc202997d90ce9bf99d6f2b9b

SHA1
9115a2d027c099a6df79fa1d02f63cf846aeffea

SHA256
913a43fbb209da40c884edb5c39ddd3e749b5c50cafe745c65dece0ce9951ce4

SHA512
e9157a92fe279044a3162ef84d80d132de4862548f3b71b3dea7d0377946288267a6749d3b32f1ff19c5e193bcb7056794477961732442e6d3c2571572c36933

Download Submit
C:\Windows\SysWOW64\Ibgmaqfl.exe

Filesize
104KB

MD5
a7b8e1d35a0d68d5369faa82fc245ba6

SHA1
c638a7c2a63fcbf03550da20d5ece5d71dcbe046

SHA256
cadcb368d642e153066e190febbfde9ac885eea01198d1e96c42e839bd12b8e1

SHA512
3f0983c702aff6bff4ee131e5b1d86c899e8f02bd6b5c72e28f45141b2239194eba07066326bf7dc852b07c87c34f8bcbe2b4be34efb50b89a39885ca27e5993

Download Submit
C:\Windows\SysWOW64\Idhiii32.exe

Filesize
104KB

MD5
7765e127f21c0ae1b6a55196311797a5

SHA1
bda128f39b11600d70103e1c3f2a13f71a1a6448

SHA256
4ea83a540e8446ee0c4baf49454c1dd6ec2bfcb5f0e601a9b9aef70cee44fba1

SHA512
b6b62360f9f2863b890b5b428951f2493a8eadd32785cf3dbeb45c7477d9f4226b5ff67117713d091746aed5ffe9f41131c8c6c7d0f89cc590dbe29582b06276

Download Submit
C:\Windows\SysWOW64\Ielfgmnj.exe

Filesize
104KB

MD5
606d31f7ecc0447d7adc367fc45ca24d

SHA1
b1a7c9212a6bb9b8b73d87257460f568439004d4

SHA256
978731a251fde1bb67e2b9dcaf96108ae4fc89efa6bfc4fe0e88cb70abcfbf53

SHA512
479541b1d0bb282996f33389a2a34e61566b93d8977c9f5e8f76b9e4f52688bf2804a1dc4dbc86dadd2a723178aa7baaa243039f3a10a9ec88a750fb2c9068c7

Download Submit
C:\Windows\SysWOW64\Iencmm32.exe

Filesize
104KB

MD5
09ad0ad1975ffa295ad20828773b10d1

SHA1
bcf83313951b0c9a0b6acc0aecfe1a491606456c

SHA256
43e94d3c3ddb6a2230584e7d163bc80208cb55ef2db7867bfb0e8e0b1466838c

SHA512
05d4e56c905dcbe1130b8a44b812edf9fbbd0e6f16827f719344af16f354d1ded98987452e32337cecdb9f379ec75f708fb97303fc1558678b3da964649cd4e2

Download Submit
C:\Windows\SysWOW64\Ieqpbm32.exe

Filesize
104KB

MD5
c0a9185a7e69ee717d102da03949de66

SHA1
74f4b2ee511849a1a1ab5068146a970f1536762c

SHA256
2492687dc9171a8d882752e21451a8ae497534192f623eabdb6158524c49af11

SHA512
428232807c51ac5e43957a49bef5373254f4324b10ad3b9bac28109e4e4efc3bd77a77f86f123054900446a83852081b566d51d0196a973cf8311ba9ebe1f059

Download Submit
C:\Windows\SysWOW64\Igjbci32.exe

Filesize
104KB

MD5
394e27faf62acda4e0c31a7234f7ea12

SHA1
64f66e3d6be8d32b061674957470c98836076e76

SHA256
6b5792c39578603415054c2ea2bf6953df52417f886adb64faf24d6deeb5f1ae

SHA512
eeb8e8345b234fed157fa099718b7943d2a7f3f62aa7608fc59dce0d12a092670ef41a6410c8beb1e491fd36d43ece548a6814b0b124481e485aa79541a7aa16

Download Submit
C:\Windows\SysWOW64\Igmoih32.exe

Filesize
104KB

MD5
35105609199e194c8f55a12b522fb4da

SHA1
dc0597eda47685e21ca1d465efa9c2ce8635bf3d

SHA256
4995029977d79bb10682ab4e9b16b489c258c6ac0af26eb82752f5d23d867de0

SHA512
186d774c01fabc47de8f8bae037c5068395b11af33a8f722931e1e8ebbb228d047e573c81ad983c48874882b6e6a8e634a37262c48e9ec10cedc30f3051c1546

Download Submit
C:\Windows\SysWOW64\Ilkhog32.exe

Filesize
104KB

MD5
0be4ebe38b9c038745819459d384e034

SHA1
ee2bfc7509d9666589c3440ebf4e93124a99e5c9

SHA256
4bba60bb79aa54d69ee01f22215d7227dece7ad64b0b91673101661b9c4f789e

SHA512
0228a08b438a458867d9d2ed2a64a4dbae65480f3e55ae0cf2683936550c9c59766b59d6875d6516f1f0aa708119344fe6253be5edd6d6ffa6c8dc47b506b768

Download Submit
C:\Windows\SysWOW64\Ilmedf32.exe

Filesize
104KB

MD5
b0a87cca43ea136e2f20db404ac45deb

SHA1
525c78c5b635ca2f294ea28a973acc6b2ec1d204

SHA256
b83c851dace3497d793eac227d58c814260a40ff190d0b707994d3a5d5e44e3f

SHA512
a046019d1a0ddfe72cd29b66602d70efb2a127d6a16ba72257ed47eafa33325977d223e24e764f07a460abe539cf4e54b6b294268933b965c61c67dc666ab832

Download Submit
C:\Windows\SysWOW64\Iloajfml.exe

Filesize
104KB

MD5
2312c6ca0cdc6400f46e57638cfd3660

SHA1
7c2a4695680411478b97be98caa8d2e4aab2d418

SHA256
6933b7ca8bf9a3f59a5e6d098f1196144638d83a887da46b34988baad07f4825

SHA512
dad439d95a83eb48df387e74c72d67adb71b805e8b609f546fc7feb6446112762db5b0aa3fff089c0021d39d13976a7152aac0041a46a85e86fdb43972710aa1

Download Submit
C:\Windows\SysWOW64\Indkpcdk.exe

Filesize
104KB

MD5
e5d3f671995be823eb0a51217ac01e46

SHA1
2b20c89e74a2c4186ae3a73f6d23d97ae2df7a21

SHA256
3a80b25170fef8c19835146c002852242e0bdd9254b5bbb2a7e8d0051d5779dc

SHA512
068371120303edd51e4b094f3593e8957ea7b67481267feebc9e736a2e02e57eb770e2122677aaf746b81de4473b035318b83b6b9bb8ae9c72a5424293f99fe5

Download Submit
C:\Windows\SysWOW64\Jacpcl32.exe

Filesize
104KB

MD5
d616a5b0f92bf0a4b8ce2e8d8bc32e88

SHA1
c047fcb2404861ef4d447fa27e563c81789b0294

SHA256
c94b3e8bdd8dffb1f2a05328f5553ba2bb4ff6c1ce94fdc2d2c46d35ac8077ac

SHA512
23ee0f601375ee58f2ffacc256000abdf5afc748339491adc86a529bfbd7b8b4901050108068ed0c16a788cc0cd4554221209273973573965b8c2165720ae831

Download Submit
C:\Windows\SysWOW64\Jaljbmkd.exe

Filesize
104KB

MD5
d2985a8ac20e45149cec0a6bfa023cf1

SHA1
3f83c81572c3f2639d68b691705b97100c03afd7

SHA256
edb97fd005cd885c53325e5e5b81da70e1a189a1c4352ca05cfeafc700a452e8

SHA512
6b82d7b71f1047969686df3726f0b63956d5973b771541e8a36ce23abc37d5bd8ab929e05c6a19723a11d8d38796e3ac7084f14308fb544434d7b390b32f4046

Download Submit
C:\Windows\SysWOW64\Jaljbmkd.exe

Filesize
104KB

MD5
2f91678700b3d6d8dc8bac43a90c15f6

SHA1
6250275d2f56bf73e01ba433f6427f464b9a1c50

SHA256
d94020fdb1bdf412dd93a4a03a8a79a49c35e5734ff4238b06a2b36525f97aff

SHA512
fdfec4dca166087654f05784e0d716ced34f75d861f8f7b0054719a4a59fe1e5b48ae3eee7547d436357097ffb8e4ed880286f87f32336a1aa811b6c0213fbf1

Download Submit
C:\Windows\SysWOW64\Jblflp32.exe

Filesize
104KB

MD5
50cbd442c8f448e1eddffb6332581a32

SHA1
1d8c5ff0419baa5756981395049745da7539d64e

SHA256
b9b054d136134a4034397cb8b9c533a8c5870e2c9b2b0ec9d23ebaa76bd2e86d

SHA512
8a985de54af3f241dcd0369d126d6e56232ef603525e31a6563b63fbb6d657d792a8b71f8c65f2ef7b4c1d5f57108c3abcc1dde7baeaf758886851f283eea0da

Download Submit
C:\Windows\SysWOW64\Jhbejblj.dll

Filesize
7KB

MD5
80f251d7d232078fb7c121c44011a2b7

SHA1
a14fc33ed728f0f245911c3788709c9c9dff326c

SHA256
4b27d1963a7e389ec04a8c1b77eddf8aa78d79a13d8a42fb0ca7ade0bcd398b3

SHA512
f746f7493ba756829342d9f09aff9bfcaca7afd97fa6e13b6bf36898e7ae13a706a1c076f75b1272e83260adffd234e614f8ca4f3c0548120a0c51592e56028a

Download Submit
C:\Windows\SysWOW64\Jhfbog32.exe

Filesize
104KB

MD5
6ba0e7194c1ed230069cd5ecf4b28ec5

SHA1
c1eebc02806eea7c2d0478bb2a3373d82794a860

SHA256
e90669010b95ffa5908e2e110a87d60e72e4bb80f6a50f1a477c617310822ec4

SHA512
3e0dc049ca24c9f5b869330e39f4ec01d59fbcffd50ae5a08e4492fe7913e84456c7906e0b254ea17fd63c60c9a60cfdc46c92b84c3a9af182db06a11a321644

Download Submit
C:\Windows\SysWOW64\Jhkljfok.exe

Filesize
104KB

MD5
75d74c874a32163fc53156f22bc07536

SHA1
84dd43f40bd132a7f7c44ece276d76ae0f3b3243

SHA256
e3fd5f6fa1d66d8e1aa87e580bcee25d668af68a68e35b35396aa6358708f6b5

SHA512
6e4eee7838e967858baa23692d94479c13379b4577b0bb3aed2a93493600f90ea2c7823d124f76c4dcb5d7d2b164d5c823892ea68a0713f4f2fbe7d4c503ae3a

Download Submit
C:\Windows\SysWOW64\Jhmhpfmi.exe

Filesize
104KB

MD5
4306f0e99fc5f9d19da8c9127b82b469

SHA1
dcd1f6c4736f31867487a8bd38e7c21284c7fe0d

SHA256
c6b167c60b3fa10fc630761cf5e5960acde20a281cd2a3b84dada4b646b381d5

SHA512
047b9dbd9a2c782f8bef60f62deaa0362691d2bf85f5332ca6227fa6675a6ba797add28abd9cb6ead18545131136999b82d26114ffcfd7749097360eb0708e1b

Download Submit
C:\Windows\SysWOW64\Jjdokb32.exe

Filesize
104KB

MD5
8c5939c5608ea34ec6f88d64271255da

SHA1
09c5524bf609c3be11da26d724f4bddc247cfb01

SHA256
89aa1def609d2df5556ef0d405ffaed0565b26e16929635f2dd7c6316eeabdcb

SHA512
209b2b25438d35f45926fa9701c4ec3372d613110d5461328436b6ac3d18454c1790fcfce2421b394fdc56e6c78e0e23befa4c3892693c9b98f246c0454ce484

Download Submit
C:\Windows\SysWOW64\Jlfhke32.exe

Filesize
104KB

MD5
200beb45fc68fbbc1f154c37cfe597ee

SHA1
2ff4fb4f3caf5b8439c6f8e774b9f93850f3021d

SHA256
cd882422c00d4970dbf4028828d476bf0e8cde4119fb57f65cb9b54273651a23

SHA512
81335aba70017e4ed4040c3bbf20e9b5ad38681409c8f7341142609fc67171187d0599f53705c36263dc58239b8b5c1b5403075f493ed907c280ed223300ecc6

Download Submit
C:\Windows\SysWOW64\Jnbgaa32.exe

Filesize
104KB

MD5
0df619ca9d60587ca8da40568a1fbe3e

SHA1
d3b255059674b1115dfe75ddc07aa239c639f1bd

SHA256
42a5095eb8c073a77588b049538f00e0cf964e4fcca11002b69773ce20d319f8

SHA512
2cb8de0266b1570e183c3647e4f141520272ab56280f9470e3f727c279c36d54304fd83f94616b407f39c56cddb7769dd0c225245e4c7cf58440fa13ad0c19c1

Download Submit
C:\Windows\SysWOW64\Leoejh32.exe

Filesize
104KB

MD5
226097eb855810286bae62503729927c

SHA1
f50bb9fe08f9ac65f8314480bf7c334b3286335c

SHA256
dae2a03ae71d41ec724ff943580eb3333936c0cf69cf31b13adf63fd9b6b3401

SHA512
87ce39a1fb4d2dc0078a7088afb1306d8d02517381900d731471361173ec4a172f6e8e608d594f01664d3b19643d66ea969c07c379d52670d7c3930416fe3293

Download Submit
C:\Windows\SysWOW64\Loemnnhe.exe

Filesize
104KB

MD5
d0ba2a061e158b6bba8df12879c85669

SHA1
03e9b9620746433b974ca33f06e058d8188e9b64

SHA256
eb0567aa1b19ed53fc9def491c603e81701007c50463d35a8f943fd437763ee8

SHA512
d864dd1a9f2d20112f5471f60a63dabc1fb5df7b75fb8682519f77b4be7d65b04d05f05c49e5c84827a405a5583e7caac2b86481a1aa9aea25e430941ebc61fe

Download Submit
memory/264-79-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/416-281-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/860-458-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/860-443-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/916-87-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1048-96-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1052-341-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1052-475-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1080-455-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1080-456-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1124-480-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1124-311-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1168-135-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1220-293-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1220-483-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1228-207-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1284-353-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1284-473-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1400-128-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1472-256-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1516-467-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1516-389-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1544-263-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1592-329-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1592-477-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1672-359-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1672-472-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1812-31-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1816-55-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1852-469-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1852-377-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2000-461-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2000-425-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2096-482-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2096-299-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2124-159-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2304-468-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2304-383-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2340-465-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2340-401-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2456-168-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2476-183-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2540-111-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2580-245-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2692-151-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2756-484-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2756-287-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2808-48-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2812-119-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2824-248-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2908-269-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2928-216-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2972-103-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3048-0-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3068-39-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3100-12-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3124-407-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3124-464-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3236-474-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3236-347-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3260-317-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3260-479-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3312-199-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3416-371-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3416-470-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3424-144-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3528-463-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3528-413-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3536-23-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3576-71-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3744-419-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3744-462-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3824-275-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3884-323-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3884-478-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3896-466-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3896-395-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3980-191-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3988-481-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3988-305-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4084-223-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4272-457-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4272-449-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4292-175-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4364-365-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4364-471-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4420-231-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4488-431-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4488-460-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4584-63-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4696-437-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4696-459-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4700-228-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4720-16-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4904-476-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4904-335-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads