berbew | 501847b8cba2db1b77a47f2abccee4b66f0c29c2f4d9597203682eb8198bfadc

Analysis

max time kernel
93s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/10/2024, 00:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

501847b8cba2db1b77a47f2abccee4b66f0c29c2f4d9597203682eb8198bfadcN.exe
Size

96KB
MD5

0ce3722a5782d3d66a938e994e6b9620
SHA1

e5cd26926958de88e6edcd99d88e2d430866fd74
SHA256

501847b8cba2db1b77a47f2abccee4b66f0c29c2f4d9597203682eb8198bfadc
SHA512

7df909f5f00fb4e7008db75b972dcc913048801b15e1d46d3f2b5abdaf7f1bc198f10d558ed06ec925302379ff131329a64b0c05036670ca725199652daaba4d
SSDEEP

1536:vyCWliQ3EK6/KZ/hHvsn0b+SyREFsx8SSKE6gqScJwKo/BOm3VCMy0QiLiizHNQi:q9liQ39dG0fyREFsx8SSvcs5OmlCMyEr

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cfmajipb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cabfga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dfpgffpm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Deagdn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	501847b8cba2db1b77a47f2abccee4b66f0c29c2f4d9597203682eb8198bfadcN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bganhm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bcjlcn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bgehcmmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dgbdlf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmgbnq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ajkaii32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aminee32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Balpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Balpgb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfmajipb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cmiflbel.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chagok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aabmqd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfabnjjp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfdodjhm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bgcknmop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Deokon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bfabnjjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bebblb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cajlhqjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bmkjkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bnbmefbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cjmgfgdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Chagok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Accfbokl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Baicac32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dgbdlf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bapiabak.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjkjpgfi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chokikeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dfnjafap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aglemn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aminee32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjagjhnc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcjlcn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dogogcpo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajkaii32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Beihma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cjkjpgfi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfnjafap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bfdodjhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Baicac32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Banllbdn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnbmefbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bapiabak.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Calhnpgn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmefhako.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bebblb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bgcknmop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bjagjhnc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bgehcmmm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Deokon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Deagdn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dogogcpo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aabmqd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aglemn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chcddk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dmgbnq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfpgffpm.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Executes dropped EXE 42 IoCs

pid	Process
4892	Aabmqd32.exe
4292	Aglemn32.exe
4820	Ajkaii32.exe
2692	Aminee32.exe
700	Accfbokl.exe
2824	Bfabnjjp.exe
2084	Bmkjkd32.exe
4472	Bebblb32.exe
4576	Bganhm32.exe
3436	Bfdodjhm.exe
1472	Baicac32.exe
2232	Bgcknmop.exe
1648	Bjagjhnc.exe
4340	Balpgb32.exe
3648	Bcjlcn32.exe
4384	Bgehcmmm.exe
4832	Banllbdn.exe
4552	Beihma32.exe
2188	Bnbmefbg.exe
3612	Bapiabak.exe
3952	Bcoenmao.exe
624	Cfmajipb.exe
4564	Cabfga32.exe
3224	Cenahpha.exe
1004	Cjkjpgfi.exe
4476	Cmiflbel.exe
4900	Chokikeb.exe
1900	Cjmgfgdf.exe
4460	Chagok32.exe
3708	Cajlhqjp.exe
3040	Chcddk32.exe
3440	Calhnpgn.exe
3668	Dmcibama.exe
3272	Dmefhako.exe
1528	Dfnjafap.exe
548	Dmgbnq32.exe
1544	Deokon32.exe
5112	Dfpgffpm.exe
5100	Dogogcpo.exe
4144	Deagdn32.exe
2920	Dgbdlf32.exe
2928	Dmllipeg.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Qlgene32.dll	Cjmgfgdf.exe
File opened for modification	C:\Windows\SysWOW64\Dmcibama.exe	Calhnpgn.exe
File created	C:\Windows\SysWOW64\Mkijij32.dll	Cabfga32.exe
File created	C:\Windows\SysWOW64\Omocan32.dll	Cenahpha.exe
File opened for modification	C:\Windows\SysWOW64\Cajlhqjp.exe	Chagok32.exe
File created	C:\Windows\SysWOW64\Gidbim32.dll	Dmcibama.exe
File opened for modification	C:\Windows\SysWOW64\Dgbdlf32.exe	Deagdn32.exe
File opened for modification	C:\Windows\SysWOW64\Bcjlcn32.exe	Balpgb32.exe
File created	C:\Windows\SysWOW64\Bcoenmao.exe	Bapiabak.exe
File created	C:\Windows\SysWOW64\Cjmgfgdf.exe	Chokikeb.exe
File opened for modification	C:\Windows\SysWOW64\Aglemn32.exe	Aabmqd32.exe
File created	C:\Windows\SysWOW64\Mnjgghdi.dll	Aabmqd32.exe
File created	C:\Windows\SysWOW64\Bapiabak.exe	Bnbmefbg.exe
File created	C:\Windows\SysWOW64\Cabfga32.exe	Cfmajipb.exe
File opened for modification	C:\Windows\SysWOW64\Cabfga32.exe	Cfmajipb.exe
File opened for modification	C:\Windows\SysWOW64\Dfnjafap.exe	Dmefhako.exe
File created	C:\Windows\SysWOW64\Kahdohfm.dll	Dogogcpo.exe
File opened for modification	C:\Windows\SysWOW64\Bfabnjjp.exe	Accfbokl.exe
File opened for modification	C:\Windows\SysWOW64\Bjagjhnc.exe	Bgcknmop.exe
File created	C:\Windows\SysWOW64\Eflgme32.dll	Bgcknmop.exe
File created	C:\Windows\SysWOW64\Amfoeb32.dll	Dmgbnq32.exe
File created	C:\Windows\SysWOW64\Akmfnc32.dll	Bfabnjjp.exe
File opened for modification	C:\Windows\SysWOW64\Balpgb32.exe	Bjagjhnc.exe
File opened for modification	C:\Windows\SysWOW64\Banllbdn.exe	Bgehcmmm.exe
File opened for modification	C:\Windows\SysWOW64\Bgehcmmm.exe	Bcjlcn32.exe
File created	C:\Windows\SysWOW64\Qihfjd32.dll	Bgehcmmm.exe
File created	C:\Windows\SysWOW64\Bnbmefbg.exe	Beihma32.exe
File opened for modification	C:\Windows\SysWOW64\Bcoenmao.exe	Bapiabak.exe
File opened for modification	C:\Windows\SysWOW64\Dogogcpo.exe	Dfpgffpm.exe
File created	C:\Windows\SysWOW64\Mgbpghdn.dll	Aminee32.exe
File created	C:\Windows\SysWOW64\Bfabnjjp.exe	Accfbokl.exe
File opened for modification	C:\Windows\SysWOW64\Bfdodjhm.exe	Bganhm32.exe
File created	C:\Windows\SysWOW64\Bilonkon.dll	Cajlhqjp.exe
File created	C:\Windows\SysWOW64\Poahbe32.dll	Dmefhako.exe
File created	C:\Windows\SysWOW64\Dmllipeg.exe	Dgbdlf32.exe
File created	C:\Windows\SysWOW64\Bgehcmmm.exe	Bcjlcn32.exe
File created	C:\Windows\SysWOW64\Dmgbnq32.exe	Dfnjafap.exe
File created	C:\Windows\SysWOW64\Chokikeb.exe	Cmiflbel.exe
File opened for modification	C:\Windows\SysWOW64\Calhnpgn.exe	Chcddk32.exe
File created	C:\Windows\SysWOW64\Deokon32.exe	Dmgbnq32.exe
File created	C:\Windows\SysWOW64\Lbabpnmn.dll	Dfpgffpm.exe
File opened for modification	C:\Windows\SysWOW64\Dmllipeg.exe	Dgbdlf32.exe
File created	C:\Windows\SysWOW64\Qopkop32.dll	Bebblb32.exe
File created	C:\Windows\SysWOW64\Chcddk32.exe	Cajlhqjp.exe
File opened for modification	C:\Windows\SysWOW64\Dmefhako.exe	Dmcibama.exe
File created	C:\Windows\SysWOW64\Ajkaii32.exe	Aglemn32.exe
File created	C:\Windows\SysWOW64\Phiifkjp.dll	Bmkjkd32.exe
File created	C:\Windows\SysWOW64\Balpgb32.exe	Bjagjhnc.exe
File created	C:\Windows\SysWOW64\Ebdijfii.dll	Bcjlcn32.exe
File created	C:\Windows\SysWOW64\Aglemn32.exe	Aabmqd32.exe
File created	C:\Windows\SysWOW64\Aminee32.exe	Ajkaii32.exe
File created	C:\Windows\SysWOW64\Glbandkm.dll	Bganhm32.exe
File created	C:\Windows\SysWOW64\Bneljh32.dll	Bfdodjhm.exe
File created	C:\Windows\SysWOW64\Cfmajipb.exe	Bcoenmao.exe
File opened for modification	C:\Windows\SysWOW64\Chokikeb.exe	Cmiflbel.exe
File created	C:\Windows\SysWOW64\Bebblb32.exe	Bmkjkd32.exe
File opened for modification	C:\Windows\SysWOW64\Bebblb32.exe	Bmkjkd32.exe
File created	C:\Windows\SysWOW64\Baicac32.exe	Bfdodjhm.exe
File created	C:\Windows\SysWOW64\Mkfdhbpg.dll	Beihma32.exe
File created	C:\Windows\SysWOW64\Jhbffb32.dll	Bnbmefbg.exe
File created	C:\Windows\SysWOW64\Imbajm32.dll	Bcoenmao.exe
File opened for modification	C:\Windows\SysWOW64\Cjkjpgfi.exe	Cenahpha.exe
File created	C:\Windows\SysWOW64\Idnljnaa.dll	501847b8cba2db1b77a47f2abccee4b66f0c29c2f4d9597203682eb8198bfadcN.exe
File created	C:\Windows\SysWOW64\Gblnkg32.dll	Banllbdn.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4108	2928	WerFault.exe	127

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chokikeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Calhnpgn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfnjafap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aabmqd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfabnjjp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Banllbdn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnbmefbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcoenmao.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjmgfgdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cajlhqjp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	501847b8cba2db1b77a47f2abccee4b66f0c29c2f4d9597203682eb8198bfadcN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aglemn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Baicac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcjlcn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chagok32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dgbdlf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aminee32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfdodjhm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjagjhnc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bapiabak.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmcibama.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmgbnq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajkaii32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmkjkd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bganhm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beihma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfpgffpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Deagdn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmllipeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bebblb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Balpgb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cabfga32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chcddk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgcknmop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjkjpgfi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmefhako.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmiflbel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Deokon32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dogogcpo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Accfbokl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgehcmmm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfmajipb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cenahpha.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	501847b8cba2db1b77a47f2abccee4b66f0c29c2f4d9597203682eb8198bfadcN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bcjlcn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bcoenmao.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bnbmefbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dmcibama.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dgbdlf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cajlhqjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Glbandkm.dll"	Bganhm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bneljh32.dll"	Bfdodjhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Maickled.dll"	Chokikeb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Banllbdn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dogogcpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfghpl32.dll"	Deagdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmdjdl32.dll"	Deokon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mnjgghdi.dll"	Aabmqd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akmfnc32.dll"	Bfabnjjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bapiabak.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Balpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkfdhbpg.dll"	Beihma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mmnbeadp.dll"	Bapiabak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Chokikeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cjmgfgdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Aglemn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fjbodfcj.dll"	Accfbokl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bganhm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dmgbnq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Deokon32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dmcibama.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	501847b8cba2db1b77a47f2abccee4b66f0c29c2f4d9597203682eb8198bfadcN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Aglemn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bgehcmmm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Accfbokl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akichh32.dll"	Baicac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cmiflbel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}	501847b8cba2db1b77a47f2abccee4b66f0c29c2f4d9597203682eb8198bfadcN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qihfjd32.dll"	Bgehcmmm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bcoenmao.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cjmgfgdf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cmiflbel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	501847b8cba2db1b77a47f2abccee4b66f0c29c2f4d9597203682eb8198bfadcN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jhbffb32.dll"	Bnbmefbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cenahpha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gidbim32.dll"	Dmcibama.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Aabmqd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Aabmqd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Chagok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bilonkon.dll"	Cajlhqjp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Deagdn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Baicac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iphcjp32.dll"	Bjagjhnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bgehcmmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bfdodjhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Deokon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Balpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kahdohfm.dll"	Dogogcpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ajkaii32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bmkjkd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bganhm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Beihma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cfmajipb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkijij32.dll"	Cabfga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bbloam32.dll"	Cjkjpgfi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Chagok32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bgcknmop.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4208 wrote to memory of 4892	4208	501847b8cba2db1b77a47f2abccee4b66f0c29c2f4d9597203682eb8198bfadcN.exe	84
PID 4208 wrote to memory of 4892	4208	501847b8cba2db1b77a47f2abccee4b66f0c29c2f4d9597203682eb8198bfadcN.exe	84
PID 4208 wrote to memory of 4892	4208	501847b8cba2db1b77a47f2abccee4b66f0c29c2f4d9597203682eb8198bfadcN.exe	84
PID 4892 wrote to memory of 4292	4892	Aabmqd32.exe	85
PID 4892 wrote to memory of 4292	4892	Aabmqd32.exe	85
PID 4892 wrote to memory of 4292	4892	Aabmqd32.exe	85
PID 4292 wrote to memory of 4820	4292	Aglemn32.exe	86
PID 4292 wrote to memory of 4820	4292	Aglemn32.exe	86
PID 4292 wrote to memory of 4820	4292	Aglemn32.exe	86
PID 4820 wrote to memory of 2692	4820	Ajkaii32.exe	87
PID 4820 wrote to memory of 2692	4820	Ajkaii32.exe	87
PID 4820 wrote to memory of 2692	4820	Ajkaii32.exe	87
PID 2692 wrote to memory of 700	2692	Aminee32.exe	88
PID 2692 wrote to memory of 700	2692	Aminee32.exe	88
PID 2692 wrote to memory of 700	2692	Aminee32.exe	88
PID 700 wrote to memory of 2824	700	Accfbokl.exe	89
PID 700 wrote to memory of 2824	700	Accfbokl.exe	89
PID 700 wrote to memory of 2824	700	Accfbokl.exe	89
PID 2824 wrote to memory of 2084	2824	Bfabnjjp.exe	90
PID 2824 wrote to memory of 2084	2824	Bfabnjjp.exe	90
PID 2824 wrote to memory of 2084	2824	Bfabnjjp.exe	90
PID 2084 wrote to memory of 4472	2084	Bmkjkd32.exe	92
PID 2084 wrote to memory of 4472	2084	Bmkjkd32.exe	92
PID 2084 wrote to memory of 4472	2084	Bmkjkd32.exe	92
PID 4472 wrote to memory of 4576	4472	Bebblb32.exe	93
PID 4472 wrote to memory of 4576	4472	Bebblb32.exe	93
PID 4472 wrote to memory of 4576	4472	Bebblb32.exe	93
PID 4576 wrote to memory of 3436	4576	Bganhm32.exe	94
PID 4576 wrote to memory of 3436	4576	Bganhm32.exe	94
PID 4576 wrote to memory of 3436	4576	Bganhm32.exe	94
PID 3436 wrote to memory of 1472	3436	Bfdodjhm.exe	95
PID 3436 wrote to memory of 1472	3436	Bfdodjhm.exe	95
PID 3436 wrote to memory of 1472	3436	Bfdodjhm.exe	95
PID 1472 wrote to memory of 2232	1472	Baicac32.exe	96
PID 1472 wrote to memory of 2232	1472	Baicac32.exe	96
PID 1472 wrote to memory of 2232	1472	Baicac32.exe	96
PID 2232 wrote to memory of 1648	2232	Bgcknmop.exe	97
PID 2232 wrote to memory of 1648	2232	Bgcknmop.exe	97
PID 2232 wrote to memory of 1648	2232	Bgcknmop.exe	97
PID 1648 wrote to memory of 4340	1648	Bjagjhnc.exe	98
PID 1648 wrote to memory of 4340	1648	Bjagjhnc.exe	98
PID 1648 wrote to memory of 4340	1648	Bjagjhnc.exe	98
PID 4340 wrote to memory of 3648	4340	Balpgb32.exe	100
PID 4340 wrote to memory of 3648	4340	Balpgb32.exe	100
PID 4340 wrote to memory of 3648	4340	Balpgb32.exe	100
PID 3648 wrote to memory of 4384	3648	Bcjlcn32.exe	101
PID 3648 wrote to memory of 4384	3648	Bcjlcn32.exe	101
PID 3648 wrote to memory of 4384	3648	Bcjlcn32.exe	101
PID 4384 wrote to memory of 4832	4384	Bgehcmmm.exe	102
PID 4384 wrote to memory of 4832	4384	Bgehcmmm.exe	102
PID 4384 wrote to memory of 4832	4384	Bgehcmmm.exe	102
PID 4832 wrote to memory of 4552	4832	Banllbdn.exe	103
PID 4832 wrote to memory of 4552	4832	Banllbdn.exe	103
PID 4832 wrote to memory of 4552	4832	Banllbdn.exe	103
PID 4552 wrote to memory of 2188	4552	Beihma32.exe	104
PID 4552 wrote to memory of 2188	4552	Beihma32.exe	104
PID 4552 wrote to memory of 2188	4552	Beihma32.exe	104
PID 2188 wrote to memory of 3612	2188	Bnbmefbg.exe	105
PID 2188 wrote to memory of 3612	2188	Bnbmefbg.exe	105
PID 2188 wrote to memory of 3612	2188	Bnbmefbg.exe	105
PID 3612 wrote to memory of 3952	3612	Bapiabak.exe	106
PID 3612 wrote to memory of 3952	3612	Bapiabak.exe	106
PID 3612 wrote to memory of 3952	3612	Bapiabak.exe	106
PID 3952 wrote to memory of 624	3952	Bcoenmao.exe	107

C:\Users\Admin\AppData\Local\Temp\501847b8cba2db1b77a47f2abccee4b66f0c29c2f4d9597203682eb8198bfadcN.exe
"C:\Users\Admin\AppData\Local\Temp\501847b8cba2db1b77a47f2abccee4b66f0c29c2f4d9597203682eb8198bfadcN.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4208
- C:\Windows\SysWOW64\Aabmqd32.exe
  C:\Windows\system32\Aabmqd32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4892
- - C:\Windows\SysWOW64\Aglemn32.exe
    C:\Windows\system32\Aglemn32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4292
  - - C:\Windows\SysWOW64\Ajkaii32.exe
      C:\Windows\system32\Ajkaii32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4820
    - - C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2692
      - C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:700
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2824
        
        C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2084
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4472
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4576
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3436
        
        C:\Windows\SysWOW64\Baicac32.exe
        
        C:\Windows\system32\Baicac32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1472
        
        C:\Windows\SysWOW64\Bgcknmop.exe
        
        C:\Windows\system32\Bgcknmop.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2232
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1648
        
        C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4340
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3648
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4384
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4832
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4552
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2188
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3612
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3952
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:624
        
        C:\Windows\SysWOW64\Cabfga32.exe
        
        C:\Windows\system32\Cabfga32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4564
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3224
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1004
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4476
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4900
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1900
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4460
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3708
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3040
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3440
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3668
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3272
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1528
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:548
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1544
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5112
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5100
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4144
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2920
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        43⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2928
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2928 -s 220
        44⤵
        Program crash
        
        PID:4108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2928 -ip 2928
1⤵
PID:2176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aabmqd32.exe

Filesize
96KB

MD5
7337232694aba748624c4e5236e6fbe9

SHA1
db30931caad05dd87cc7ec5b4a57e4d148230c6c

SHA256
573e6808458f90cb1ba9a5ff0d90a15511022a6cba44c377101caa4b332ed025

SHA512
1bd1a85f1edfd156cc1e44bea0660c9779fac1cc023c3aa3c2c5bd67938261405cc739501e1a96ae86b5b45eec5ce49e9c6e7fa1d292f2544db8e97a820abc1a

Download Submit
C:\Windows\SysWOW64\Accfbokl.exe

Filesize
96KB

MD5
470587d1cdb52f2995c332b818a73302

SHA1
7f3fdbd72c7f3bc7bb934c52b335adde0ddc6092

SHA256
c4f16ff729f21bdbf2bd5f634be124ed96002327764fc4d75a76308f1ce2ccfd

SHA512
da5b4c4eb0d6314b7db1c27f5bf3cb70616f615ed80bbe5bf216b7aaa419476e5bf4e372d1e4f922547cb4dbf1c6323e05b859e246baf8ec2c74bea46987a30c

Download Submit
C:\Windows\SysWOW64\Aglemn32.exe

Filesize
96KB

MD5
d06921c34cc268f0eba0626b293bb796

SHA1
33611431be695696b9dff80766f5ea741778776a

SHA256
a5103d99d8712a8fd0d096ee30d607afdca7f92eba1af1fb624911d4ed6402c5

SHA512
5e2e2367b55e48bef80937ff178f642ce951181fab28ae1094dbf327034facb9202be0133bd0c52a176ae67e2e831be39374dba0de361c4bc93e2b8a5cf584e0

Download Submit
C:\Windows\SysWOW64\Ajkaii32.exe

Filesize
96KB

MD5
2f3be39e7193dc41a205f6d76513d59f

SHA1
8e77de02703fa37647e67d01cf6efaf68a93fafe

SHA256
56ef7ce775a8f15d073945478fd2defb2022b5037e827a8046336631de8a12ee

SHA512
c796e6c04af75940976c899941ae576c41a06f0fee20be09afecaca2a8f044df1ab0100a727f28b397a4b85eef8961010ea0f9432aaba689f7f9446535341a66

Download Submit
C:\Windows\SysWOW64\Aminee32.exe

Filesize
96KB

MD5
ed27cca1945ab7ebec7522ac9b055e69

SHA1
52d5ad86ab3050db93571ab6abcd932e2236a1d8

SHA256
ff89fc7f8405e20e0834ab9a0e316dc73a18a7d6415d4dc84fe56c272620440a

SHA512
30fb6e1417fc5b679eb07743270828e429db584e150ab3b8198afc00869c522e58fe619c0350dd6f34be5888a0b8a7f952200992daf16f66f0235b6f56d35497

Download Submit
C:\Windows\SysWOW64\Baicac32.exe

Filesize
96KB

MD5
592c9bcf4504bc83c48344a32a950cba

SHA1
32e2496688079c64e6acb528344ca1e1d4b434f3

SHA256
9e37465bb45c4524be1dc2f118c268be28316859a721e1d084af4d114dfa8d94

SHA512
ce4445cd7b06a91412da856f10f582860ecb16fb07fba4d86c8b7d4c249c74ccabbc8864fbef4a0854f1fa19ce7ac1d46da1e726ec575cf1355296d11e5633e7

Download Submit
C:\Windows\SysWOW64\Balpgb32.exe

Filesize
96KB

MD5
b0e1c3284e9be8bcc5fe649346e19ea8

SHA1
9d42f3e7980ef85e8432df4cf44838bbcd854a54

SHA256
abdfa3ca23a14b9a9bdc6436189f8b8e55281f14958d337549629f8ca44dd070

SHA512
ea885d6aa16d2981fd162cab926b20f388be76dc8e32ccdc8ac2d9d15c3c38fd0f0dd3813f312b250dba86ab0dccd7cac9064c57c0acc4e8a98990143bd53169

Download Submit
C:\Windows\SysWOW64\Banllbdn.exe

Filesize
96KB

MD5
f5d07675221bb1ac7b091de8bb446b6f

SHA1
ba0e342322a036d0e07cf4110141976796ac55ff

SHA256
e16cb985ea173911634e180d330a69c5afd9b01e101469c30ec63de83c4a5df1

SHA512
f563831b44d3981ea23abdf6186d77ad80b5c6e18b21f0cc802fbdb81424ad3367a1d01e2533cf4eef415a3dad129ce93db309260db2148cfa028ca730f6c895

Download Submit
C:\Windows\SysWOW64\Bapiabak.exe

Filesize
96KB

MD5
45803181d13cc80c607b3c7cd01ac681

SHA1
05dd11501d7bd49a924cfef0d0bf861759db3f4d

SHA256
44e2d34f3eedc12cf665d7a45b1df7060c5e8d34d45fcecce0995daa37093e76

SHA512
3bc5249c175b8880ec340df267d343b77f610e537e852551183ecaaafc7e4ef65dd1983ac5f3a683d8b0044b64df0bdbd00cce1fee587a530559f66f58e5a2a5

Download Submit
C:\Windows\SysWOW64\Bcjlcn32.exe

Filesize
96KB

MD5
fbf2adaa6d5f8339211d5deb14799f66

SHA1
7135d3b2846bd81a6f826e00418d45678898d5d2

SHA256
ef22605e993516447b3bc348f9db1043387e5d31320dc910832bd60d221c8433

SHA512
1328f9f821b8ceae138fe4fc36884d7d0faa88f7f0123027cdebc56273d6962537906152e7466be7af851c5dff6f7b96b032fcd10de97e4fb98a043647f7557a

Download Submit
C:\Windows\SysWOW64\Bcoenmao.exe

Filesize
96KB

MD5
b247b1706ac8b95787769585b6da59fd

SHA1
8a1851a70d2500d8675899a1e2bfff8cada3aa4b

SHA256
62661ee140a39beabd520679384ceb5cbfc7892a501680f5f28df4ef681077e3

SHA512
b4053398f5c724babc667d64f019260d0ba003766e1cc82d995055ac6cfa14aa3871595670bf95030f99467904248a2f951bb71d8ec65301630c1e80c967f140

Download Submit
C:\Windows\SysWOW64\Bebblb32.exe

Filesize
96KB

MD5
ffbb790add019231bb01058a64bcb3ea

SHA1
9db6cb4b4f7155b7a8aa952c5c0b2e2b1ac11f79

SHA256
3180204c84d665bfe8913245926ca7840abee605ca1ad07ea61794fedafcd651

SHA512
32efb82745d27c0b319ac5b54aa8a17764dc0cb77b2a4d622fd4ac1d4fe95c113ce29ebf662d4f91c48b8d9d1c848cd1e1fd1e992a933720574058ee520ba9dd

Download Submit
C:\Windows\SysWOW64\Beihma32.exe

Filesize
96KB

MD5
6754d19d3a02771ca99d81d16a4ed88d

SHA1
cf6a4f225c747d410f75c8b98e00e474adf13d7d

SHA256
f62465a4c4befe102be7c7db46e3172542502852eac3c55d7175443c5cb65a6f

SHA512
f4b95ed90faa7e92762d4f03a26212e18a5d9c5df699d07f74060a2a4dcbeda2998da3ceea86c4784b92ca434c939431caadd8711afbe0114f296d5e431aadbe

Download Submit
C:\Windows\SysWOW64\Bfabnjjp.exe

Filesize
96KB

MD5
2c7019dfd7cdda276fcb30d114de63de

SHA1
7b808ec217835474e01c983605192a63fe3ff42f

SHA256
d67a105e906e1ebd39ae918591bd8c619886c297e9fa575788243e5d6e793129

SHA512
8e26bee2721f8e8da24af59cdc60aabad5cf362e54b48bf95df9f80bbb0a73d8df41f7878ea7d09e15911f34b58bbf138b683d412d87b6875f0b9179735e19f3

Download Submit
C:\Windows\SysWOW64\Bfdodjhm.exe

Filesize
96KB

MD5
c7e10d23c295df722f7ab346f880b9f0

SHA1
384f7418311b7611b564c9512cd9ae8eef45f741

SHA256
b933ee3a188365c2fc132b530fa4629a5daa8931431ba1ee08ccb826b99d63d6

SHA512
d5badd920c68810ed07674a5f6b855224d2f66f75aa9bda3df52bd5678cfc4db961b257ee413f94f1f41f3575e8223c61094e690812eee00c016c2e16ba9485e

Download Submit
C:\Windows\SysWOW64\Bganhm32.exe

Filesize
96KB

MD5
3c84108d97b140623308b95381d08133

SHA1
273e921a6cc7437702c4c07438ff388c1401aa35

SHA256
5f663ade40b64e0b1df5bbfe4d9f89af97c1b90f528eea1ead1b87daeac73129

SHA512
fb480c74b0e2feb0bbbf4653972e92b22c221390f8fd53f3e4c29f1665a04fc608c48194b33391a7b199507a1e560156787a99a2067d3d873cbf2d978b5056a1

Download Submit
C:\Windows\SysWOW64\Bgcknmop.exe

Filesize
96KB

MD5
2bbc1758c7d3db25d78788d609939ae7

SHA1
24e566bcdfd3a7aac791600dbc1d80a1c6e884de

SHA256
c04d77b1d059ea529a6f52f70e412d1d3d7dde269e56ad0e961234a266f11c90

SHA512
30531c88c171b76d8497205f97006dcc11ec6e23ef2e1869e3daa416babe7265de86a7ac68ea74c6dde5ce80a7965c6153045be989026e8ed6889fbc19ec0e78

Download Submit
C:\Windows\SysWOW64\Bgehcmmm.exe

Filesize
96KB

MD5
9557f938ae8a94c9188ddf11583f127e

SHA1
42fc2668f3d8c4bfcca40b41daed2fbcd4936bb8

SHA256
c214938191effcd3c32c7f452f60717e2c431faaadb789d8619e3d5b8d575188

SHA512
06a50e93827731e5021027f9d53478e0464539489080e80c6b548fdd9a12ae2f40dd3e2730c8559a93cdb613953dd0aa0fbd3490d5cbf1157538a0e513d234ed

Download Submit
C:\Windows\SysWOW64\Bjagjhnc.exe

Filesize
96KB

MD5
4d88d5696e0106bcb8113fc2f355357d

SHA1
24ab223fdac706e5fb00fe97c691af0cc73629bb

SHA256
9a2f3bd2c0da579089f9e77c453b679237fc49ca3edfa49fd650ef99dd055fcc

SHA512
df48430903bce60ca11d04e5bb0cee66615dada46937479003e607deec8910e5aa042a2b5b416cdbe1fb225d599358a076483bdd175c4c392153eeff75b52c87

Download Submit
C:\Windows\SysWOW64\Bmkjkd32.exe

Filesize
96KB

MD5
12925ef33ea29a531be18369bad469de

SHA1
60b46e39c77577e7d1c3f09bc6d005869d1631a0

SHA256
b8adc43cbe9dc65bb53547632d1dc65b3c7eb1ba157b76080a0b47b604693f0a

SHA512
2b59c00f16fd4cf3bcd1e4a571f927c930279c4904d40bf1d2e1a27814df0a8df649b8bbea024513747b63c4874e0bf481039f4e1c10c7f9e83e9a716f6d576d

Download Submit
C:\Windows\SysWOW64\Bnbmefbg.exe

Filesize
96KB

MD5
515e2daf316a3f4dd4cba5e5fafbb9be

SHA1
1e5da1b2aa9a2fffe6991b66f4198b5851136a20

SHA256
b638597a7f7b502a8d5e03095db9bd0b2e5fbd3a393286c35af881ac59c80bc5

SHA512
7e2bbd2d4b5b5eeb6bbc54814f070d14cc6f53a0e5e2c24bcbebe82e6f7132437bfec5d8f97b35bbc261d8e3c385306121f73d0de388f7fbf267822494d1ee63

Download Submit
C:\Windows\SysWOW64\Cabfga32.exe

Filesize
96KB

MD5
dc95cc46fdcae0ef6c9d072bbb3f4762

SHA1
88595ecb59569db95aea4c26c7cdf68ea41612b4

SHA256
3781b037c2ee9e264e811a544cf03ee22c8ed702922d2c83aebbc64a409935ee

SHA512
72281857a89460f52fe81d0caa0bca9a05810115f90ab305cbfefa4fe5d3a50d8eb848a143b9eb44d32942700a483cd62c73adbda87c4bece328d34814b31e53

Download Submit
C:\Windows\SysWOW64\Cajlhqjp.exe

Filesize
96KB

MD5
8217eac353719429765d6c3333ae35fe

SHA1
dd6890837dbcbed0bbed47662d7ec4688e4f0e01

SHA256
69a344849a57f2b1c1c8c3dc3b44e6d0168dcfd7121a723508a622ccda6f4f84

SHA512
033bc95d903e4ec9ba539352042f23c5b85b17ec909f6a6d66b8863a727c24f720ea364bd9fbe681984cbdc46f68f9be83faf123f8adf72da2b365eed815241a

Download Submit
C:\Windows\SysWOW64\Calhnpgn.exe

Filesize
96KB

MD5
f31b001c9cee6577f8a3433caef50bda

SHA1
4a8e6dc68cb0ea5abc74214a1d3d250686819cef

SHA256
28fc9a9b0bbc2426f50c1dffd54bcbd5e2aa031c202f2ea4ec0c015849765cb6

SHA512
4fbd96524aee8551b99a27034311ec4babb75ad76a51b1e6e80fc0223220e5966aea8ed13ea82e31c5a9c430a60eeb40c5519ddc2f1d47bbfddc6ce82ca45d61

Download Submit
C:\Windows\SysWOW64\Cenahpha.exe

Filesize
96KB

MD5
e7a70f4d2e7688f35f52ec82641e8225

SHA1
28ad939ade8c8337309767bcb6027ffdbbf69182

SHA256
7c6b34817e68f1324b5b73dd3bdb27774fd9bb40e80eb287bbf6def8879ac8a0

SHA512
2130670cbafc3c360b22abd1166f7448943ad89c2aa03016fb79965bcbbda5ac5eb047513adfd5cb3a033fb8cfbdcf32d681ec45a8eb5134a1a768173c38eec1

Download Submit
C:\Windows\SysWOW64\Cfmajipb.exe

Filesize
96KB

MD5
32a31e58fe38e67dc4a552885b359941

SHA1
a4e770c8bb02bc782ff331ec9002a032e2df7c8e

SHA256
7901c92966fa10841854027ec80d0ec7d92ff1480768012fdeabe37dd78e7b3d

SHA512
7749b039ddbbb22115a30f4e662d6cf396ff9da3eaec662e5a0d03aa51fde83ca1666364407a93fef61091c91317bed2e03c0dde6834592e6997242f6ae4c702

Download Submit
C:\Windows\SysWOW64\Chagok32.exe

Filesize
96KB

MD5
8acff7419da31e1131c08026641825ff

SHA1
e9e3bed3a24f88309f8107b77c42eefd6da340c1

SHA256
5640967150582b3fd29e103a24dc72a8a36750576ca1ddd0845896ba997fdc7e

SHA512
3a35246b37dbb6af0b1e769fec24344c19eef1b5d15da82a7adf30c3fbb2d32954125352079c6e620e851a8e219a22871ca6e2a79ee87f58df5abfdce3b01847

Download Submit
C:\Windows\SysWOW64\Chcddk32.exe

Filesize
96KB

MD5
42acb7cdb01aabb0c9b8eb8124e48ad1

SHA1
07a43344e2487d90eca64beed3690df9981718e8

SHA256
2b7cfc156a32022f42dc84f8d1076c4c76989125a1b54af6cbe95c393f5ef5d2

SHA512
4c101e61aee2fdfaaa851a5901f868fb508f9f17f4f336f946ada0f806de20a84a7b8549c33bb4f94f32bbafad77acc8c89cc68e2c7d8121111e37ccc015bd05

Download Submit
C:\Windows\SysWOW64\Chokikeb.exe

Filesize
96KB

MD5
eff87e59b43bd300380ddb8b8f08adc4

SHA1
f25a42e2583cbb01e92d2cf69b53bf80f21fc4f0

SHA256
d45b03883ae61ba9875833cefe04481a2bc5feb92145f9ce39957800e70e5512

SHA512
7b62e57307945eca858bc309c9403c5724715330d566d477ebf3a7b6f150908c9a59b00fd0b1a609d7804a3f4d3cd365f0d383dae5503eaa9f37751c28895af3

Download Submit
C:\Windows\SysWOW64\Cjkjpgfi.exe

Filesize
96KB

MD5
afeea31d191c60f3904cdf441612b7fd

SHA1
5dd89664f5f5f953f60ad917fde92d7815382bc2

SHA256
710c11803ab2f51217affe29990f29f446e5658d136aa0fc383763e9b16409ad

SHA512
5a413ccee6462379830c7147feb8a0d72b56f2aebb32a2a6acfcd020428aaecc2a403248030c4ee3203c4a8e57876c1e622c9f1c292b3b725e9895de43217782

Download Submit
C:\Windows\SysWOW64\Cjmgfgdf.exe

Filesize
96KB

MD5
5fb3b9a8eb99c49ef765c0a747fba7fe

SHA1
020c126a926f95ae118405d74e252bb37e5e7607

SHA256
dcc8681a6891280b6521c19f61e9cb161fb951524ca62929d60fbc4330e7e137

SHA512
7b0efedaf46b7dbdb4c27255aa655f19ebad49a5fc215049bed46671dd8d51b08b7447f45bb41324a18fbc34d46d4df41618dbec6be88dc53dd41f3a6433f57f

Download Submit
C:\Windows\SysWOW64\Cmiflbel.exe

Filesize
96KB

MD5
c184cfb57d4e7e9e76f51c8135c30960

SHA1
d8be3ced658925ca55797c489deb26937a3cb583

SHA256
f4291377dad71179ded7b5bf99ab2c3f8c250686a6d297ed56cc7f5e6207d50d

SHA512
7f2d5dd7b81fddafbf1f560b2acb83a6ef202ab24e5d037708cd2d58c4cecd873a1d753ec8b1253db9fe8703df5362bce510af7dae736f1dc3bffefda8655f0d

Download Submit
C:\Windows\SysWOW64\Dmcibama.exe

Filesize
96KB

MD5
9f7256c9ee49c35d2bc77416925d8124

SHA1
a78c9bd6b33ece9473856700ff2c5638bd45e694

SHA256
c76dc93ab70a5ce21bb9faddadaa375bf767c92bc2b71a057384587c24621c28

SHA512
ee701bdb00327580d4a901c7188e5e532c11cf4d5b71fd946b95c51e75844d822ad640e7ac56d8486b591b3007f3db4020d2ad33c987088640862df2b8450ffb

Download Submit
C:\Windows\SysWOW64\Mgbpghdn.dll

Filesize
7KB

MD5
d3e893ab37c8e8f96f353a25a1ca737e

SHA1
537378400d79666807cf65abcf60f02af327e1cd

SHA256
59cecc166ec8817899d346ff2357c71eaef3e81d2686e74fd24ee7f564da210b

SHA512
b81e7dbcbe96fd1a3363d9d904510a9c078da53e9ce3fb23be716e878d3c90f12f63ac870ab42251460a5923246c368ceda15235b9970dd24b5526c6daf03cb7

Download Submit
memory/548-304-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/548-354-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/624-188-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/624-275-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/700-39-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/700-129-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1004-214-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1004-296-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1472-183-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1472-89-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1528-297-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1528-355-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1544-353-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1544-311-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1648-108-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1648-201-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1900-241-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1900-317-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2084-55-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2084-142-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2188-249-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2188-162-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2232-98-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2232-187-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2692-31-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2692-115-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2824-47-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2824-134-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2920-339-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2920-349-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2928-346-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2928-348-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3040-338-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3040-267-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3224-206-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3224-289-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3272-356-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3272-290-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3436-169-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3436-80-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3440-276-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3440-345-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3612-258-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3612-170-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3648-130-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3668-283-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3668-347-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3708-331-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3708-259-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3952-184-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4144-332-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4144-350-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4208-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4208-79-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4292-15-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4292-97-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4340-116-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4340-205-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4384-135-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4384-222-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4460-324-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4460-250-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4472-151-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4472-64-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4476-223-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4476-303-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4552-240-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4552-152-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4564-202-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4576-71-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4576-161-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4820-106-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4820-24-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4832-231-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4832-143-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4892-7-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4892-88-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4900-232-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4900-310-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/5100-325-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/5100-351-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/5112-352-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/5112-318-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads