berbew | 9a607d472b904df1ed61ed141137e61d7c006dd0050dd6a4e3224525de51ade2

Analysis

max time kernel
92s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10/10/2024, 05:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9a607d472b904df1ed61ed141137e61d7c006dd0050dd6a4e3224525de51ade2N.exe
Size

96KB
MD5

54e44fcd80fe9c17a7a5f5131e072490
SHA1

a0e0dbb2099c0a616fac678cc6de78a28715c2db
SHA256

9a607d472b904df1ed61ed141137e61d7c006dd0050dd6a4e3224525de51ade2
SHA512

05eff61813fc6dc3c539ecfef844421fe8c35deae1d62b3e41152d263dd0d9d2b8b7d0125629b3daa1c94b09fbd10387109d64b42b425bdc609d318099c72b23
SSDEEP

1536:c49+i9kBkgE5Aox2XQOqyPlOtiFPDAxMxO6io5DdJ3MV1br5M78S3EzRgNfevoWr:t9z9kGgESoQXQOqalOabAxMxGo3JiSvu

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bnpppgdj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Belebq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cajlhqjp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhfajjoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dfnjafap.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dknpmdfc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bffkij32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnpppgdj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnmcjg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfhhoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dejacond.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	9a607d472b904df1ed61ed141137e61d7c006dd0050dd6a4e3224525de51ade2N.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Calhnpgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dobfld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dknpmdfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cjmgfgdf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfdhkhjj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhmgki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Banllbdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cjbpaf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdhhdlid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Calhnpgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Daekdooc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cfdhkhjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cajlhqjp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhhdil32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjmgfgdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cagobalc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dodbbdbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bffkij32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Beglgani.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cagobalc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmcibama.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dfknkg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Delnin32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfnjafap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Daconoae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	9a607d472b904df1ed61ed141137e61d7c006dd0050dd6a4e3224525de51ade2N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bnbmefbg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dddhpjof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dddhpjof.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dodbbdbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dkkcge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bfhhoi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdfkolkf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Delnin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dhmgki32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daekdooc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bhhdil32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfknkg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dejacond.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cfbkeh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjbpaf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dhfajjoj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkkcge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Beglgani.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnbmefbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cdfkolkf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cdhhdlid.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daconoae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Belebq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dobfld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bnmcjg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Banllbdn.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Executes dropped EXE 33 IoCs

pid	Process
1112	Bffkij32.exe
1668	Bnmcjg32.exe
2704	Beglgani.exe
4692	Bfhhoi32.exe
2660	Bnpppgdj.exe
936	Banllbdn.exe
2424	Bhhdil32.exe
2192	Bnbmefbg.exe
2144	Belebq32.exe
3164	Cfbkeh32.exe
2356	Cjmgfgdf.exe
2216	Cagobalc.exe
2096	Cdfkolkf.exe
2828	Cfdhkhjj.exe
2688	Cajlhqjp.exe
3012	Cdhhdlid.exe
3392	Cjbpaf32.exe
1080	Calhnpgn.exe
968	Dhfajjoj.exe
3000	Dmcibama.exe
2520	Dejacond.exe
3644	Dfknkg32.exe
2052	Dobfld32.exe
2160	Delnin32.exe
3892	Dfnjafap.exe
3596	Dodbbdbb.exe
3112	Daconoae.exe
2268	Dhmgki32.exe
1516	Dkkcge32.exe
4908	Daekdooc.exe
4324	Dddhpjof.exe
3076	Dknpmdfc.exe
4220	Dmllipeg.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Dmjapi32.dll	Bffkij32.exe
File opened for modification	C:\Windows\SysWOW64\Banllbdn.exe	Bnpppgdj.exe
File created	C:\Windows\SysWOW64\Mkfdhbpg.dll	Bhhdil32.exe
File created	C:\Windows\SysWOW64\Echdno32.dll	Cjmgfgdf.exe
File created	C:\Windows\SysWOW64\Cajlhqjp.exe	Cfdhkhjj.exe
File created	C:\Windows\SysWOW64\Dfnjafap.exe	Delnin32.exe
File opened for modification	C:\Windows\SysWOW64\Dfnjafap.exe	Delnin32.exe
File opened for modification	C:\Windows\SysWOW64\Bnpppgdj.exe	Bfhhoi32.exe
File created	C:\Windows\SysWOW64\Bhhdil32.exe	Banllbdn.exe
File created	C:\Windows\SysWOW64\Ghekjiam.dll	Belebq32.exe
File created	C:\Windows\SysWOW64\Jffggf32.dll	Cagobalc.exe
File created	C:\Windows\SysWOW64\Cdhhdlid.exe	Cajlhqjp.exe
File created	C:\Windows\SysWOW64\Dmcibama.exe	Dhfajjoj.exe
File created	C:\Windows\SysWOW64\Dobfld32.exe	Dfknkg32.exe
File opened for modification	C:\Windows\SysWOW64\Delnin32.exe	Dobfld32.exe
File created	C:\Windows\SysWOW64\Dmllipeg.exe	Dknpmdfc.exe
File opened for modification	C:\Windows\SysWOW64\Bfhhoi32.exe	Beglgani.exe
File created	C:\Windows\SysWOW64\Gallfmbn.dll	Bnbmefbg.exe
File opened for modification	C:\Windows\SysWOW64\Cfbkeh32.exe	Belebq32.exe
File opened for modification	C:\Windows\SysWOW64\Cjmgfgdf.exe	Cfbkeh32.exe
File opened for modification	C:\Windows\SysWOW64\Cagobalc.exe	Cjmgfgdf.exe
File opened for modification	C:\Windows\SysWOW64\Dobfld32.exe	Dfknkg32.exe
File created	C:\Windows\SysWOW64\Fnmnbf32.dll	Dfnjafap.exe
File created	C:\Windows\SysWOW64\Daconoae.exe	Dodbbdbb.exe
File opened for modification	C:\Windows\SysWOW64\Dkkcge32.exe	Dhmgki32.exe
File created	C:\Windows\SysWOW64\Cdfkolkf.exe	Cagobalc.exe
File opened for modification	C:\Windows\SysWOW64\Cdfkolkf.exe	Cagobalc.exe
File opened for modification	C:\Windows\SysWOW64\Dmcibama.exe	Dhfajjoj.exe
File created	C:\Windows\SysWOW64\Dejacond.exe	Dmcibama.exe
File created	C:\Windows\SysWOW64\Cogflbdn.dll	Dejacond.exe
File created	C:\Windows\SysWOW64\Cfdhkhjj.exe	Cdfkolkf.exe
File created	C:\Windows\SysWOW64\Ghilmi32.dll	Cdfkolkf.exe
File opened for modification	C:\Windows\SysWOW64\Cdhhdlid.exe	Cajlhqjp.exe
File created	C:\Windows\SysWOW64\Fpdaoioe.dll	Daconoae.exe
File created	C:\Windows\SysWOW64\Nokpao32.dll	Dddhpjof.exe
File created	C:\Windows\SysWOW64\Bnmcjg32.exe	Bffkij32.exe
File created	C:\Windows\SysWOW64\Kofpij32.dll	Beglgani.exe
File created	C:\Windows\SysWOW64\Iqjikg32.dll	Banllbdn.exe
File created	C:\Windows\SysWOW64\Cjbpaf32.exe	Cdhhdlid.exe
File opened for modification	C:\Windows\SysWOW64\Dhfajjoj.exe	Calhnpgn.exe
File created	C:\Windows\SysWOW64\Hpnkaj32.dll	Dmcibama.exe
File created	C:\Windows\SysWOW64\Daekdooc.exe	Dkkcge32.exe
File opened for modification	C:\Windows\SysWOW64\Dmllipeg.exe	Dknpmdfc.exe
File created	C:\Windows\SysWOW64\Bffkij32.exe	9a607d472b904df1ed61ed141137e61d7c006dd0050dd6a4e3224525de51ade2N.exe
File created	C:\Windows\SysWOW64\Bmhnkg32.dll	Bnmcjg32.exe
File created	C:\Windows\SysWOW64\Bnpppgdj.exe	Bfhhoi32.exe
File created	C:\Windows\SysWOW64\Dhfajjoj.exe	Calhnpgn.exe
File created	C:\Windows\SysWOW64\Eokchkmi.dll	Calhnpgn.exe
File created	C:\Windows\SysWOW64\Alcidkmm.dll	Dfknkg32.exe
File opened for modification	C:\Windows\SysWOW64\Dddhpjof.exe	Daekdooc.exe
File opened for modification	C:\Windows\SysWOW64\Bnmcjg32.exe	Bffkij32.exe
File created	C:\Windows\SysWOW64\Kmfjodai.dll	Dhfajjoj.exe
File created	C:\Windows\SysWOW64\Gmcfdb32.dll	Dobfld32.exe
File created	C:\Windows\SysWOW64\Oammoc32.dll	Dodbbdbb.exe
File created	C:\Windows\SysWOW64\Dkkcge32.exe	Dhmgki32.exe
File opened for modification	C:\Windows\SysWOW64\Daekdooc.exe	Dkkcge32.exe
File created	C:\Windows\SysWOW64\Hfggmg32.dll	Bfhhoi32.exe
File opened for modification	C:\Windows\SysWOW64\Bhhdil32.exe	Banllbdn.exe
File created	C:\Windows\SysWOW64\Cjmgfgdf.exe	Cfbkeh32.exe
File opened for modification	C:\Windows\SysWOW64\Bnbmefbg.exe	Bhhdil32.exe
File created	C:\Windows\SysWOW64\Belebq32.exe	Bnbmefbg.exe
File created	C:\Windows\SysWOW64\Cagobalc.exe	Cjmgfgdf.exe
File opened for modification	C:\Windows\SysWOW64\Cjbpaf32.exe	Cdhhdlid.exe
File created	C:\Windows\SysWOW64\Poahbe32.dll	Delnin32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1232	4220	WerFault.exe	118

System Location Discovery: System Language Discovery 1 TTPs 34 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cajlhqjp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhfajjoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnbmefbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cagobalc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Delnin32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Calhnpgn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dejacond.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfknkg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfnjafap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfhhoi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Banllbdn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfbkeh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdfkolkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beglgani.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Belebq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfdhkhjj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmcibama.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmllipeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9a607d472b904df1ed61ed141137e61d7c006dd0050dd6a4e3224525de51ade2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnmcjg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhhdil32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjmgfgdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhmgki32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daekdooc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dknpmdfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bffkij32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnpppgdj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dobfld32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dodbbdbb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dddhpjof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdhhdlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjbpaf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daconoae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkkcge32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nokpao32.dll"	Dddhpjof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bffkij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gallfmbn.dll"	Bnbmefbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hpnkaj32.dll"	Dmcibama.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghilmi32.dll"	Cdfkolkf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dhfajjoj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dmcibama.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dejacond.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dobfld32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	9a607d472b904df1ed61ed141137e61d7c006dd0050dd6a4e3224525de51ade2N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bfhhoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Banllbdn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dfnjafap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dkkcge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dodbbdbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohmoom32.dll"	Dkkcge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kngpec32.dll"	Dknpmdfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Echdno32.dll"	Cjmgfgdf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cagobalc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cjbpaf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cdfkolkf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Alcidkmm.dll"	Dfknkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dfnjafap.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dodbbdbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Daekdooc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Beglgani.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iqjikg32.dll"	Banllbdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Belebq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cajlhqjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmcfdb32.dll"	Dobfld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Daconoae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dknpmdfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qihfjd32.dll"	Bnpppgdj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cjmgfgdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Clghpklj.dll"	Cfdhkhjj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Delnin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Delnin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dhmgki32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dkkcge32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dddhpjof.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}	9a607d472b904df1ed61ed141137e61d7c006dd0050dd6a4e3224525de51ade2N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bnmcjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dfknkg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cfbkeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cdhhdlid.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dejacond.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oammoc32.dll"	Dodbbdbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmjapi32.dll"	Bffkij32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bnpppgdj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Belebq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Naeheh32.dll"	Cjbpaf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fnmnbf32.dll"	Dfnjafap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpdaoioe.dll"	Daconoae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcbdhp32.dll"	Dhmgki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Amjknl32.dll"	Daekdooc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bnpppgdj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Banllbdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghekjiam.dll"	Belebq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bhhdil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jffggf32.dll"	Cagobalc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmfjodai.dll"	Dhfajjoj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dobfld32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	9a607d472b904df1ed61ed141137e61d7c006dd0050dd6a4e3224525de51ade2N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bffkij32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5028 wrote to memory of 1112	5028	9a607d472b904df1ed61ed141137e61d7c006dd0050dd6a4e3224525de51ade2N.exe	83
PID 5028 wrote to memory of 1112	5028	9a607d472b904df1ed61ed141137e61d7c006dd0050dd6a4e3224525de51ade2N.exe	83
PID 5028 wrote to memory of 1112	5028	9a607d472b904df1ed61ed141137e61d7c006dd0050dd6a4e3224525de51ade2N.exe	83
PID 1112 wrote to memory of 1668	1112	Bffkij32.exe	84
PID 1112 wrote to memory of 1668	1112	Bffkij32.exe	84
PID 1112 wrote to memory of 1668	1112	Bffkij32.exe	84
PID 1668 wrote to memory of 2704	1668	Bnmcjg32.exe	85
PID 1668 wrote to memory of 2704	1668	Bnmcjg32.exe	85
PID 1668 wrote to memory of 2704	1668	Bnmcjg32.exe	85
PID 2704 wrote to memory of 4692	2704	Beglgani.exe	86
PID 2704 wrote to memory of 4692	2704	Beglgani.exe	86
PID 2704 wrote to memory of 4692	2704	Beglgani.exe	86
PID 4692 wrote to memory of 2660	4692	Bfhhoi32.exe	87
PID 4692 wrote to memory of 2660	4692	Bfhhoi32.exe	87
PID 4692 wrote to memory of 2660	4692	Bfhhoi32.exe	87
PID 2660 wrote to memory of 936	2660	Bnpppgdj.exe	88
PID 2660 wrote to memory of 936	2660	Bnpppgdj.exe	88
PID 2660 wrote to memory of 936	2660	Bnpppgdj.exe	88
PID 936 wrote to memory of 2424	936	Banllbdn.exe	90
PID 936 wrote to memory of 2424	936	Banllbdn.exe	90
PID 936 wrote to memory of 2424	936	Banllbdn.exe	90
PID 2424 wrote to memory of 2192	2424	Bhhdil32.exe	91
PID 2424 wrote to memory of 2192	2424	Bhhdil32.exe	91
PID 2424 wrote to memory of 2192	2424	Bhhdil32.exe	91
PID 2192 wrote to memory of 2144	2192	Bnbmefbg.exe	92
PID 2192 wrote to memory of 2144	2192	Bnbmefbg.exe	92
PID 2192 wrote to memory of 2144	2192	Bnbmefbg.exe	92
PID 2144 wrote to memory of 3164	2144	Belebq32.exe	93
PID 2144 wrote to memory of 3164	2144	Belebq32.exe	93
PID 2144 wrote to memory of 3164	2144	Belebq32.exe	93
PID 3164 wrote to memory of 2356	3164	Cfbkeh32.exe	94
PID 3164 wrote to memory of 2356	3164	Cfbkeh32.exe	94
PID 3164 wrote to memory of 2356	3164	Cfbkeh32.exe	94
PID 2356 wrote to memory of 2216	2356	Cjmgfgdf.exe	96
PID 2356 wrote to memory of 2216	2356	Cjmgfgdf.exe	96
PID 2356 wrote to memory of 2216	2356	Cjmgfgdf.exe	96
PID 2216 wrote to memory of 2096	2216	Cagobalc.exe	97
PID 2216 wrote to memory of 2096	2216	Cagobalc.exe	97
PID 2216 wrote to memory of 2096	2216	Cagobalc.exe	97
PID 2096 wrote to memory of 2828	2096	Cdfkolkf.exe	98
PID 2096 wrote to memory of 2828	2096	Cdfkolkf.exe	98
PID 2096 wrote to memory of 2828	2096	Cdfkolkf.exe	98
PID 2828 wrote to memory of 2688	2828	Cfdhkhjj.exe	99
PID 2828 wrote to memory of 2688	2828	Cfdhkhjj.exe	99
PID 2828 wrote to memory of 2688	2828	Cfdhkhjj.exe	99
PID 2688 wrote to memory of 3012	2688	Cajlhqjp.exe	101
PID 2688 wrote to memory of 3012	2688	Cajlhqjp.exe	101
PID 2688 wrote to memory of 3012	2688	Cajlhqjp.exe	101
PID 3012 wrote to memory of 3392	3012	Cdhhdlid.exe	102
PID 3012 wrote to memory of 3392	3012	Cdhhdlid.exe	102
PID 3012 wrote to memory of 3392	3012	Cdhhdlid.exe	102
PID 3392 wrote to memory of 1080	3392	Cjbpaf32.exe	103
PID 3392 wrote to memory of 1080	3392	Cjbpaf32.exe	103
PID 3392 wrote to memory of 1080	3392	Cjbpaf32.exe	103
PID 1080 wrote to memory of 968	1080	Calhnpgn.exe	104
PID 1080 wrote to memory of 968	1080	Calhnpgn.exe	104
PID 1080 wrote to memory of 968	1080	Calhnpgn.exe	104
PID 968 wrote to memory of 3000	968	Dhfajjoj.exe	105
PID 968 wrote to memory of 3000	968	Dhfajjoj.exe	105
PID 968 wrote to memory of 3000	968	Dhfajjoj.exe	105
PID 3000 wrote to memory of 2520	3000	Dmcibama.exe	106
PID 3000 wrote to memory of 2520	3000	Dmcibama.exe	106
PID 3000 wrote to memory of 2520	3000	Dmcibama.exe	106
PID 2520 wrote to memory of 3644	2520	Dejacond.exe	107

C:\Users\Admin\AppData\Local\Temp\9a607d472b904df1ed61ed141137e61d7c006dd0050dd6a4e3224525de51ade2N.exe
"C:\Users\Admin\AppData\Local\Temp\9a607d472b904df1ed61ed141137e61d7c006dd0050dd6a4e3224525de51ade2N.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5028
- C:\Windows\SysWOW64\Bffkij32.exe
  C:\Windows\system32\Bffkij32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1112
- - C:\Windows\SysWOW64\Bnmcjg32.exe
    C:\Windows\system32\Bnmcjg32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1668
  - - C:\Windows\SysWOW64\Beglgani.exe
      C:\Windows\system32\Beglgani.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2704
    - - C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4692
      - C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2660
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:936
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2424
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2192
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2144
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3164
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2356
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2216
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2096
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2828
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2688
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3012
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3392
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1080
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:968
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3000
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2520
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3644
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2052
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2160
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3892
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3596
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3112
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2268
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1516
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4908
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4324
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3076
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        34⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4220
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4220 -s 408
        35⤵
        Program crash
        
        PID:1232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4220 -ip 4220
1⤵
PID:4632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Banllbdn.exe

Filesize
96KB

MD5
30e8394d20993a54a956877d87e398d0

SHA1
917e8d701ef33b453c731418607f45915629da92

SHA256
ea448794954db3cefd2e4ed0f1b3a14fc43b5efe665790d02a2d36a9109a9244

SHA512
7fb74f317e0f1074938fefa9277005a7ced543d5e9874e326689585cb23cc758182aff1d8f2658c786b17c66a1360263abf08962127bb2377959c405ca17ee6e

Download Submit
C:\Windows\SysWOW64\Beglgani.exe

Filesize
96KB

MD5
3671a04ca38b06358515a9b152653093

SHA1
36b320005213d97cdc89fdb988c62c7706d5984c

SHA256
0c5c68a9a80b78e9b54084210f79e39ca92a2f5405066311b2612277039bcac3

SHA512
8284ed4e61780970899544d33c0eaf1acc11f790b4b280955d11964bdf3090ed178280651502fa25a5a04cd4da9a4a01d66212a9c032555ebbc0378a02fe6025

Download Submit
C:\Windows\SysWOW64\Belebq32.exe

Filesize
96KB

MD5
b1bf6c339acd5bed123d2e8da17d23e8

SHA1
d47cb34d2653b91bb57dbd834569d06ca3202724

SHA256
77997b34cacaa5d0f7cca3670710cf8966853f7f4f9903baa00c54a47c69516e

SHA512
56086bfd10226e2a432f1412bc8e06fa310b35fb9af2eabc4801c202b6386a85f72f21c6a856f8a460a57a6635b5d005d2c6e3453a977f4b13ce20071c06285d

Download Submit
C:\Windows\SysWOW64\Bffkij32.exe

Filesize
96KB

MD5
d8b47e0d88a21eb18cd60856f9de5d86

SHA1
42b9c1e45a19da951ce6bb3d53d5f262c75d07a9

SHA256
6afaa032da3d8ec69c4b19dfa55ef20111d7694e46765dbf555d47de0f58c31f

SHA512
ca54cddb3056d5d417bcc096eac9d929d7bb6c2933f46e8d58b310fc074a42b85b918af89bc035b62a8be6cd5ab88d512a4b77b5eff7458f6556913e7ad8872f

Download Submit
C:\Windows\SysWOW64\Bfhhoi32.exe

Filesize
96KB

MD5
e0f81b4f935dc24931b18aa1b42a0fa2

SHA1
0c5a87e479c67d5f64933276ee46b85e15c029a8

SHA256
f35951cf9348bb55beb6e75010b34699f26934c5a5c9d4df28c71e1cb167f92f

SHA512
9d7263ad68b75b04cb8c49e365172382c191702f5e8ca780794f123b37d1a0ddb1941465bf4579c350646231a364be4d429ee446987d4376f30c8317dd619f7e

Download Submit
C:\Windows\SysWOW64\Bhhdil32.exe

Filesize
96KB

MD5
51bf798ba97a427d47b546cde9b02336

SHA1
dbaf03db2e5dde203ca3d21338169ad6d2811943

SHA256
580248960aa4f0699483b56639b74cb39bf33032dc35fbefb0f3fdc47e681e89

SHA512
09fcc6af6107b89d78c850fe12d7d8bfcc7576e71ff8e737294324c115ea2ae5d2ccdf9f078d60669c69c229a1500b2379d99aee480134f7bdf7d58aef1b2ec9

Download Submit
C:\Windows\SysWOW64\Bnbmefbg.exe

Filesize
96KB

MD5
d278da7b78d3810e5f44cfa50d6e7a04

SHA1
55d64569c02d18f964fbb11404b25f41648b7831

SHA256
84655ec734f4a62187992847bd2658085346c4ebb4df88d4bcfc4c34231e05fe

SHA512
f644ef187b2ff5763a898103d93a66c08bde92f29fbc59829ef0176e227c35c0895a7ad913c3c99d0fda11ea7c9e852736aff9639e73566289d1236c2553d9d6

Download Submit
C:\Windows\SysWOW64\Bnmcjg32.exe

Filesize
96KB

MD5
96e61f0df260d542f7955db23df4a250

SHA1
d988beab744e4125c03e24e425b73f50cd07d2eb

SHA256
2b3cec65d94866dea15e8bf81feec67219d7101fb71ed445512bb386dddf552f

SHA512
2c97d6deb1c05959f67500de84850e967baebcb776a6d737b97c35cf4196e440e4248e7752c591fe5965a4727d3e992e55ae0ddff4c33fb8f14847963626160b

Download Submit
C:\Windows\SysWOW64\Bnpppgdj.exe

Filesize
96KB

MD5
95242218998b9a6d13358e01b3a954c9

SHA1
96cc385996dd1de388fa9c82b4cd74ea4e1825eb

SHA256
d7a7c3f53733269fe262ef4a1ac6b17133f75b40a30b9c5d447187efd46cd231

SHA512
901a58b84a63fe54297abb3310b02a81d61e9ffcf9139198fbe3b9be272a07bace8deca27348b99e972a0f114047e1a990a4f146613dc81827110e3e61f21bea

Download Submit
C:\Windows\SysWOW64\Cagobalc.exe

Filesize
96KB

MD5
25b4db72761ce8fb56941f68891dcf27

SHA1
209894d683da2bd9664a268b04bc2d2b84a3cb1d

SHA256
24ced41a47ba0bb4e7f362166e37c7fa19f60d9fb988834b026ec5c063f221e3

SHA512
5439b3352c2e04ecd0f6c5b5c4318d7bb6e0b03fdba69e5d8f1c7b2cadc6509126847a65dbfb0d17f773e5be1c865c0adb994c3a270015a946ca408cf61bb06c

Download Submit
C:\Windows\SysWOW64\Cajlhqjp.exe

Filesize
96KB

MD5
29aeebe6fa132ee5ea3056015932b0b1

SHA1
87a410e58e3bc12ea1264adbdc3be82865f44391

SHA256
da8eb6730fcd16d32b6e47c697ea70a01e3f0715f91723b12882d84f834d55f3

SHA512
019cd87fb721ce460c7e6e3ca8593513e7c29ddce1bcabf6573053cee9c0e78780416b5f6bd60667887bdf4c1e83588e69fea9fae3d9b889596bc999eccc0b9c

Download Submit
C:\Windows\SysWOW64\Calhnpgn.exe

Filesize
96KB

MD5
3e28b88c890cb06ae5307ff5f5832bad

SHA1
dae88c0d35766bd53abe439e0b504e7c3f1b4741

SHA256
b1a4c6ed90dbf31869ab66e9535986de838a243d971ca2ba53a8b33a6c32af5b

SHA512
a8675d19a4c29d352518ee6f15188dfc3862a80ae9d80b06fa10a6fbe75b96328e4d9a765723e0cfdf4c300eefbccb0c555280a2bc0fffd6759874f653e00a2b

Download Submit
C:\Windows\SysWOW64\Cdfkolkf.exe

Filesize
96KB

MD5
529605f83a31d3d612068b13f6d00d97

SHA1
1f196cc8fd16d140731deadb7ad7b885945bf0e5

SHA256
acde24436f8bffde96d07df3b8f3ac626afee5d9bce311867a976f2e16613a1e

SHA512
35678719d99d0fa75f0608dad6b752e99e26e405071dbe7ed4c540b61a75d241b1ca8221f3d738689cecb3e4708df5815007a7a019d207cda98cb00211ad53ca

Download Submit
C:\Windows\SysWOW64\Cdhhdlid.exe

Filesize
96KB

MD5
cb52dd9ca6597e579887713658fb27e2

SHA1
905ba4ac0926c9f410e48d37bec057e02609c9b8

SHA256
2c397256d17b774a25c04f3a5ab9d1e5f94007754e0ca74810efd0bc7f0a9555

SHA512
c4c1682e05f79c90ee18b6bc1ea57cff57173e1472bd876e53a789e2495c8a65b9d3e91e9965a9c6c6d610b43be204cdfd480f295b8f1acf56042cf6d22742c8

Download Submit
C:\Windows\SysWOW64\Cdhhdlid.exe

Filesize
96KB

MD5
a573258db954845caea2b5f735b2ebe9

SHA1
b0603e9a698587d86e03883789d6102a01182c2a

SHA256
b95afe9b459425e0f964a8615b8417e278e90a0cda0c1cde45627513510623d0

SHA512
dd97e39731f4369bd369889a65e0c4029f1187a38f5141bc4d191a228de4c694d4e0e3f6804c7c917281a3098f8afb381ea7b5ad2b500d967325532f2762f2a2

Download Submit
C:\Windows\SysWOW64\Cfbkeh32.exe

Filesize
96KB

MD5
2cff9f4b04b4b8b43d5c708b665c0a19

SHA1
4d6062acac92ce2580ac8600afe1efa5a4a96768

SHA256
cc1d5d81494d90bb94975d663de208cda6e03345eb5c2b1399479fe32130193a

SHA512
ced7313d441331d91e1fbb6e3561b8950bbc57707eaf7333190b6390f02443d6a40f6d61c45d7c8e6ed527ecc510eca2a29efdb946c37dde67a03b1d1ead09b6

Download Submit
C:\Windows\SysWOW64\Cfdhkhjj.exe

Filesize
96KB

MD5
5dd6c768ed3223c4631a3b8d24a1287f

SHA1
afa1c28dfbbf8aeffe029e3555d7101acd10f267

SHA256
04b178e1cc6cfe5e7c9b0d157e16ff12e98b5dfecb4f413e9ef67408fe46bf4a

SHA512
f846e719f133afdafb073bee2cad262ae306868c6f1db9c74186499366fe40fb3fa4a54799b056b8769c9e453965745d2626c842970b8f6a5cbe6acde986af24

Download Submit
C:\Windows\SysWOW64\Cjbpaf32.exe

Filesize
96KB

MD5
5791301c4012b97632dcfa87c5e945b8

SHA1
c115a3ef581e0ea7a06a6bedadc6882f743a9d43

SHA256
d056b48caaf582b6e2fa34efe9ccec57028ba21f257adfddbeef7454b629a810

SHA512
9178babb53d0b69f3c9d944dad13dc7ef96483026aed9322ca99a07cab0f647f8d0045caa4413a701e846647330593badf44c68e49273f83eed4d0b8d16e1ffd

Download Submit
C:\Windows\SysWOW64\Cjmgfgdf.exe

Filesize
96KB

MD5
f86f1fdac7f4dde3b5c63027ffe87c06

SHA1
2491d2ca6839eb984eab646d3f6b3242e9f937fb

SHA256
059d5d72b5e992fd652c522d27e6944076277bd6ed842d3d66b0fba3af3a7a90

SHA512
51f1f8791e8f83217e220625ccd6b0d09f5bd569b46566789e9177fa9b96c16c974cb8506e1422c80f7fe854a5dfaab3fec2ebab6c9e6dedff9d7134640ebaf7

Download Submit
C:\Windows\SysWOW64\Daconoae.exe

Filesize
96KB

MD5
b64b854eceb42ce6d0c3ae041fd6a47f

SHA1
7ed516044ac9d7acdff0ae95fc1d2cab9fb7392b

SHA256
1c2977bc0b004f0667e9290192f5793b5f133a26c105ac529e4693785b82d59f

SHA512
e2cc726c8b0308335fddd8ee031930e121926507632e02457cc812046b2a9d4f0fecb7f1a571849e5b1b7afe93f5c8bcf7b8a8470bfd199b987fe2959ba8229a

Download Submit
C:\Windows\SysWOW64\Daekdooc.exe

Filesize
96KB

MD5
089712acb80718418e98eec70cef1502

SHA1
5a4692f7b592276cf072ed5bedf7c94df18358fe

SHA256
c309f176ae3bb7acc32819aebb1b7ac6a583d2ea427a782cb15c6006dfa4ac18

SHA512
016bf492f21a83cac16be2c223c9c79d5b55c445124161691162a7f7a067d9f1b3d98672f1263629fdd11c1b025d63fbdd412e5cbcced11b7aaf4796ed272358

Download Submit
C:\Windows\SysWOW64\Dddhpjof.exe

Filesize
96KB

MD5
653199b9d085d00ce145bdf7784350bb

SHA1
9fc86a50d22034d6ea13225dcafc6a9bbbc11114

SHA256
03fb912e5e82619ab3564ac026853d18d0ca3b2f5742148cbd36877739836c19

SHA512
133f8fd9b26ecac6fd9d876b71935bed9b206ca5a0636e64dc04227731ce1b655fd9f179a448aab312ceb5b8e80a62987cd83e9871e360b30f06e72f2181f322

Download Submit
C:\Windows\SysWOW64\Dejacond.exe

Filesize
96KB

MD5
80f0148130ffa6ca6a707978f0e13b9e

SHA1
e0cd3664d60a1a20731ed56230333bba9ea76a69

SHA256
3692d5803180dfab3b138a290bacb7ec4425aadff0958dabc0dfaa182b0fb1d9

SHA512
3b949abfd3e55cece6006bee112ced0ab12e90a0e754a2c14b615ecb7939f1abe6c109d3567376815b1650d880d56c9fd5acbf653c29fa849f126e3429dadacb

Download Submit
C:\Windows\SysWOW64\Delnin32.exe

Filesize
96KB

MD5
8bcdd3020ce721855cb0e1b42ce805b5

SHA1
895a847fff47ea5a1438afc3da3cad79624f8428

SHA256
d5f181114895aba538c86db34e9bc61c122d52e71de45c8eb95961a0411835df

SHA512
e8a3eb568b3096dcde14973d002321c339db513398873caf6c3f50f062bc4b54b07f5a22fb3d8f094c820ad60c7fc7ca6cb59ec451d3ccf414cdb6e3cd71216c

Download Submit
C:\Windows\SysWOW64\Dfknkg32.exe

Filesize
96KB

MD5
0728e89cadea8cd59a923dc032755114

SHA1
282bc54750a73668d6a7bacd41f5a6ef23d967f0

SHA256
14c499f3ceeadaf8167c55695d75a057b7f92a5b75c15409e0fa21ef204d69cb

SHA512
a4c44140990c4e21084794c8034cc3a2ed39a548c56452845065acc27184156fd614e10ffca91e4daa3df9694793000b8a60b7551fea6884777d2d0bb6ceb176

Download Submit
C:\Windows\SysWOW64\Dfknkg32.exe

Filesize
96KB

MD5
454ae99b10038e07a96192e66951ea01

SHA1
1df1a9f509c7c8cbf73ec1c406754168e231db72

SHA256
88322c2fe6f9c24dd13ca23cbb57e2843651782f60e7de8f1697e4c41f37703e

SHA512
19078dcbd6b948621e7de1cbdaf495450566de42a79b2b736508464a9a28fdcc5e852744749c8dd16313b4bfc5836b59c1a677aa90f72a59e01061b57f8c2f06

Download Submit
C:\Windows\SysWOW64\Dfnjafap.exe

Filesize
96KB

MD5
e7a9ed5f66bd85a1cff6e0f93b57b511

SHA1
a02f08735edc9efc787c249ffee6f1eec9bc64f4

SHA256
cc8bd2b9b70d97238d4067e464753b16fa9b089fa0a25f08de7cbe05741efaba

SHA512
0983797baa9f0b5015c7dd1813c14dd90b6db204e17617d0b3aab6bd6beca0340bc28aef5499d31699db1fd5886a140baaeb6f545ff5c0c54928c4d1c5d2b88f

Download Submit
C:\Windows\SysWOW64\Dhfajjoj.exe

Filesize
96KB

MD5
2df04776706716ca848aedf202bf86bb

SHA1
0894236d6f47dd178689cc24ea9528a7c0f33a0f

SHA256
8cfc3ed154b6ff5beeb1d72e2f89967af8fde16f465a0fa511f17b7fa55dee5e

SHA512
eb6b654da8070874614964ac627671e752e8223f23c3d708fe94a4726aaea51d4b33d990f06de9720728b9b061dcf681cecdbc626d1bed7b29da96b5cefd482e

Download Submit
C:\Windows\SysWOW64\Dhmgki32.exe

Filesize
96KB

MD5
d65eb43104df14162328eca2e50b51f8

SHA1
4635f53cbcef08ec3fa096e42ff390751aa49b85

SHA256
ef63ddcce93777fe5cc1afd77163e088b643b1d5400784eed8a00805e60d8984

SHA512
2ad949dd7927554ffa8f3969a481df7fd4e7183eded73a3da97eab22437b0b3af499f3f26d037c70c01e70ce96e1a6a0ee2410acf243bbfa79e21aed42ac4c84

Download Submit
C:\Windows\SysWOW64\Dkkcge32.exe

Filesize
96KB

MD5
48fe1a07182fc00aa0bc9f5392c225cc

SHA1
4f3ab9fbeb003f15dcff5633e233edca7e52c7af

SHA256
a116c09404e59ed0a0cd79f84a301bc528a0056f42f59ed79d09b550d3ad1595

SHA512
3a808fca715b121437f392ce89e5ed4aa66d1845565b1301763e3db214dcae8eed82c19ed50de172b167786f197748d755cbf45203f2d71f8bf48f7586b916ef

Download Submit
C:\Windows\SysWOW64\Dknpmdfc.exe

Filesize
96KB

MD5
833e3d80545caf0bb18b959c2a36b326

SHA1
c5921b2ff2d5f504f516c00201ee9ccd426f52f4

SHA256
19c36cd1ffa418ee95a60feba877ca24bb48931c0b9be641dd3864016a58cd14

SHA512
ca1ba51123d8c5a082e82a01b3a881520376a979cb96fe000f9e5c51a8ae0b633a2a2e63c4a4efd99c723c09967e4fefe7a9993de620b9b36990c946561be9dc

Download Submit
C:\Windows\SysWOW64\Dmcibama.exe

Filesize
96KB

MD5
b82eb3b6d3e02c4137f9270b797bffb9

SHA1
7837cc65e77d41d50b3c0ce3757915f9cd186fe8

SHA256
6de1f2df8a7cb8c1240777567912cdc13395d3de4d7619e2ff3ad90795928332

SHA512
3d85dd89658821f72f933f627e849eb2d42b6db427c2af01548b23f869c56a5104a194df806fb22dfc0b8396e77419f6c11d1558ced3c2c395e19fbc251580da

Download Submit
C:\Windows\SysWOW64\Dobfld32.exe

Filesize
96KB

MD5
1866b2b32ffd3480087a163d4f83f94b

SHA1
6cf47e9700c7c4dbcb1347cf658a1faeda827376

SHA256
7c1b5ea68cbaaf1e3683de612c109281d1affce2f3c29154854e5e07269acd35

SHA512
314e9bf65a78855faaf79a9a808686ade9eb828814b0c47d24b1a07e868f8675cc7e10d4df1a2db2c194e2b3b2c3aa6a6e288e580027198dcdf4f29144d34b94

Download Submit
C:\Windows\SysWOW64\Dodbbdbb.exe

Filesize
96KB

MD5
80a872909d4900de8c3677e739b5be06

SHA1
0aec70b95d2e029c110d8fde1e6cc5280c76e2bc

SHA256
0df7e095d88edf962bcbf911f06c778eaa942f36068f4771cedf231cdca5fd44

SHA512
e9246364e074507187f6a0b7496613cea8367d94ed1b805cd31f0359087c38e900c02c6522c17a5c6ebb870174a5d93e485fcdb4e621f71d4d1322eb7b84c2a4

Download Submit
C:\Windows\SysWOW64\Hfggmg32.dll

Filesize
7KB

MD5
f5ee1cd46449bd9925b8f6f95bc76a0b

SHA1
e8d2fa3a0a089456689dd0f4d36be00cc611a2f3

SHA256
9f55292b50a9383e0be3982993798b3c069522720919e195d199f1aeb5eca894

SHA512
35d5a4b0d4a77683680e20e0222541bf3ff33358de5776d2272306131ab5f04607565b7e7768a3a5f972e8d42621234608b13d37749ab8a11513a20f7bf673f5

Download Submit
memory/936-48-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/936-289-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/968-276-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/968-151-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1080-143-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1080-277-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1112-7-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1112-294-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1516-231-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1516-268-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1668-15-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1668-293-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2052-273-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2052-183-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2096-104-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2096-282-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2144-286-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2144-71-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2160-191-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2160-270-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2192-63-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2192-287-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2216-283-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2216-95-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2268-267-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2268-223-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2356-284-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2356-87-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2424-55-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2424-288-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2520-274-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2520-167-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2660-40-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2660-290-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2688-119-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2688-280-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2704-292-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2704-24-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2828-111-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2828-281-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3000-275-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3000-159-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3012-279-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3012-127-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3076-264-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3076-255-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3112-269-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3112-216-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3164-80-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3164-285-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3392-278-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3392-135-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3596-272-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3596-207-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3644-175-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3644-296-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3892-199-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3892-271-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4220-262-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4220-263-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4324-265-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4324-248-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4692-291-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4692-32-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4908-239-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4908-266-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/5028-0-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/5028-295-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads