berbew | bf24e092c15955c6d4e5339fecff26c07303fdab7a3c4e1f4203a882337f728c

Analysis

max time kernel
66s
max time network
18s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
13/10/2024, 02:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bf24e092c15955c6d4e5339fecff26c07303fdab7a3c4e1f4203a882337f728c.exe
Size

67KB
MD5

cf8f3e9dcc095e1fa785b5f817fe0e3b
SHA1

3daad6d1f676dd3c9a7989fb290f5686fd57602e
SHA256

bf24e092c15955c6d4e5339fecff26c07303fdab7a3c4e1f4203a882337f728c
SHA512

7da02268c3e3f9b5596b1ba5542210578da8800b91f8a9420d4afbe7399c857bab1036515895c507e3bedea374080de964b82d80d7b84c151d8442fcb0c6767f
SSDEEP

1536:h1h38XZOF4Xv4cq/gJ3Hr8124sJifTduD4oTxwf:h1h3yZ06vi4Hr8124sJibdMTxwf

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://tat-neftbank.ru/kkq.php

http://tat-neftbank.ru/wcmd.htm

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 14 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Empomd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Empomd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eclcon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ekghcq32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Egcfdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Egcfdn32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fpgnoo32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eclcon32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Emgdmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Emgdmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fpgnoo32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	bf24e092c15955c6d4e5339fecff26c07303fdab7a3c4e1f4203a882337f728c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	bf24e092c15955c6d4e5339fecff26c07303fdab7a3c4e1f4203a882337f728c.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ekghcq32.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Executes dropped EXE 7 IoCs

pid	Process
2904	Egcfdn32.exe
3060	Empomd32.exe
2688	Eclcon32.exe
2652	Ekghcq32.exe
2500	Emgdmc32.exe
1928	Fpgnoo32.exe
1976	Flnndp32.exe

Loads dropped DLL 18 IoCs

pid	Process
2476	bf24e092c15955c6d4e5339fecff26c07303fdab7a3c4e1f4203a882337f728c.exe
2476	bf24e092c15955c6d4e5339fecff26c07303fdab7a3c4e1f4203a882337f728c.exe
2904	Egcfdn32.exe
2904	Egcfdn32.exe
3060	Empomd32.exe
3060	Empomd32.exe
2688	Eclcon32.exe
2688	Eclcon32.exe
2652	Ekghcq32.exe
2652	Ekghcq32.exe
2500	Emgdmc32.exe
2500	Emgdmc32.exe
1928	Fpgnoo32.exe
1928	Fpgnoo32.exe
2544	WerFault.exe
2544	WerFault.exe
2544	WerFault.exe
2544	WerFault.exe

Drops file in System32 directory 21 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Cpokpklp.dll	bf24e092c15955c6d4e5339fecff26c07303fdab7a3c4e1f4203a882337f728c.exe
File opened for modification	C:\Windows\SysWOW64\Emgdmc32.exe	Ekghcq32.exe
File created	C:\Windows\SysWOW64\Fpgnoo32.exe	Emgdmc32.exe
File opened for modification	C:\Windows\SysWOW64\Flnndp32.exe	Fpgnoo32.exe
File created	C:\Windows\SysWOW64\Flnndp32.exe	Fpgnoo32.exe
File opened for modification	C:\Windows\SysWOW64\Egcfdn32.exe	bf24e092c15955c6d4e5339fecff26c07303fdab7a3c4e1f4203a882337f728c.exe
File opened for modification	C:\Windows\SysWOW64\Empomd32.exe	Egcfdn32.exe
File created	C:\Windows\SysWOW64\Eclcon32.exe	Empomd32.exe
File created	C:\Windows\SysWOW64\Mgnedp32.dll	Empomd32.exe
File opened for modification	C:\Windows\SysWOW64\Ekghcq32.exe	Eclcon32.exe
File created	C:\Windows\SysWOW64\Egcfdn32.exe	bf24e092c15955c6d4e5339fecff26c07303fdab7a3c4e1f4203a882337f728c.exe
File opened for modification	C:\Windows\SysWOW64\Eclcon32.exe	Empomd32.exe
File created	C:\Windows\SysWOW64\Hehaja32.dll	Eclcon32.exe
File created	C:\Windows\SysWOW64\Emgdmc32.exe	Ekghcq32.exe
File created	C:\Windows\SysWOW64\Onndkg32.dll	Fpgnoo32.exe
File created	C:\Windows\SysWOW64\Mjpdkq32.dll	Emgdmc32.exe
File created	C:\Windows\SysWOW64\Empomd32.exe	Egcfdn32.exe
File created	C:\Windows\SysWOW64\Mhibidgh.dll	Egcfdn32.exe
File created	C:\Windows\SysWOW64\Ekghcq32.exe	Eclcon32.exe
File created	C:\Windows\SysWOW64\Akomon32.dll	Ekghcq32.exe
File opened for modification	C:\Windows\SysWOW64\Fpgnoo32.exe	Emgdmc32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2544	1976	WerFault.exe	36

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Egcfdn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Empomd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eclcon32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ekghcq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Emgdmc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fpgnoo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Flnndp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bf24e092c15955c6d4e5339fecff26c07303fdab7a3c4e1f4203a882337f728c.exe

Modifies registry class 24 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	bf24e092c15955c6d4e5339fecff26c07303fdab7a3c4e1f4203a882337f728c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cpokpklp.dll"	bf24e092c15955c6d4e5339fecff26c07303fdab7a3c4e1f4203a882337f728c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Egcfdn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Empomd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Emgdmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Onndkg32.dll"	Fpgnoo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fpgnoo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	bf24e092c15955c6d4e5339fecff26c07303fdab7a3c4e1f4203a882337f728c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	bf24e092c15955c6d4e5339fecff26c07303fdab7a3c4e1f4203a882337f728c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mhibidgh.dll"	Egcfdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgnedp32.dll"	Empomd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Empomd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eclcon32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fpgnoo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjpdkq32.dll"	Emgdmc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	bf24e092c15955c6d4e5339fecff26c07303fdab7a3c4e1f4203a882337f728c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	bf24e092c15955c6d4e5339fecff26c07303fdab7a3c4e1f4203a882337f728c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hehaja32.dll"	Eclcon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eclcon32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ekghcq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akomon32.dll"	Ekghcq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ekghcq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Egcfdn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Emgdmc32.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 2904	2476	bf24e092c15955c6d4e5339fecff26c07303fdab7a3c4e1f4203a882337f728c.exe	30
PID 2476 wrote to memory of 2904	2476	bf24e092c15955c6d4e5339fecff26c07303fdab7a3c4e1f4203a882337f728c.exe	30
PID 2476 wrote to memory of 2904	2476	bf24e092c15955c6d4e5339fecff26c07303fdab7a3c4e1f4203a882337f728c.exe	30
PID 2476 wrote to memory of 2904	2476	bf24e092c15955c6d4e5339fecff26c07303fdab7a3c4e1f4203a882337f728c.exe	30
PID 2904 wrote to memory of 3060	2904	Egcfdn32.exe	31
PID 2904 wrote to memory of 3060	2904	Egcfdn32.exe	31
PID 2904 wrote to memory of 3060	2904	Egcfdn32.exe	31
PID 2904 wrote to memory of 3060	2904	Egcfdn32.exe	31
PID 3060 wrote to memory of 2688	3060	Empomd32.exe	32
PID 3060 wrote to memory of 2688	3060	Empomd32.exe	32
PID 3060 wrote to memory of 2688	3060	Empomd32.exe	32
PID 3060 wrote to memory of 2688	3060	Empomd32.exe	32
PID 2688 wrote to memory of 2652	2688	Eclcon32.exe	33
PID 2688 wrote to memory of 2652	2688	Eclcon32.exe	33
PID 2688 wrote to memory of 2652	2688	Eclcon32.exe	33
PID 2688 wrote to memory of 2652	2688	Eclcon32.exe	33
PID 2652 wrote to memory of 2500	2652	Ekghcq32.exe	34
PID 2652 wrote to memory of 2500	2652	Ekghcq32.exe	34
PID 2652 wrote to memory of 2500	2652	Ekghcq32.exe	34
PID 2652 wrote to memory of 2500	2652	Ekghcq32.exe	34
PID 2500 wrote to memory of 1928	2500	Emgdmc32.exe	35
PID 2500 wrote to memory of 1928	2500	Emgdmc32.exe	35
PID 2500 wrote to memory of 1928	2500	Emgdmc32.exe	35
PID 2500 wrote to memory of 1928	2500	Emgdmc32.exe	35
PID 1928 wrote to memory of 1976	1928	Fpgnoo32.exe	36
PID 1928 wrote to memory of 1976	1928	Fpgnoo32.exe	36
PID 1928 wrote to memory of 1976	1928	Fpgnoo32.exe	36
PID 1928 wrote to memory of 1976	1928	Fpgnoo32.exe	36
PID 1976 wrote to memory of 2544	1976	Flnndp32.exe	37
PID 1976 wrote to memory of 2544	1976	Flnndp32.exe	37
PID 1976 wrote to memory of 2544	1976	Flnndp32.exe	37
PID 1976 wrote to memory of 2544	1976	Flnndp32.exe	37

C:\Users\Admin\AppData\Local\Temp\bf24e092c15955c6d4e5339fecff26c07303fdab7a3c4e1f4203a882337f728c.exe
"C:\Users\Admin\AppData\Local\Temp\bf24e092c15955c6d4e5339fecff26c07303fdab7a3c4e1f4203a882337f728c.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Windows\SysWOW64\Egcfdn32.exe
  C:\Windows\system32\Egcfdn32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2904
- - C:\Windows\SysWOW64\Empomd32.exe
    C:\Windows\system32\Empomd32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3060
  - - C:\Windows\SysWOW64\Eclcon32.exe
      C:\Windows\system32\Eclcon32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2688
    - - C:\Windows\SysWOW64\Ekghcq32.exe
        
        C:\Windows\system32\Ekghcq32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2652
      - C:\Windows\SysWOW64\Emgdmc32.exe
        
        C:\Windows\system32\Emgdmc32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2500
        
        C:\Windows\SysWOW64\Fpgnoo32.exe
        
        C:\Windows\system32\Fpgnoo32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1928
        
        C:\Windows\SysWOW64\Flnndp32.exe
        
        C:\Windows\system32\Flnndp32.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1976
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1976 -s 140
        9⤵
        Loads dropped DLL
        Program crash
        
        PID:2544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Emgdmc32.exe

Filesize
67KB

MD5
c55d2fd2caa498bcb287dfa2552ca0b7

SHA1
6538dac53b3afea01493a7bc625252fa8b75e43d

SHA256
7eeb64801e2c15a29837f6a62ace21470707d226e18731bdf60d668c8c31fb63

SHA512
121400c3688ceab538bab869b97efa8a26d438a8892af797471535b8d2e3321d1a9fdff279bb6a18cdb9f86dd51b74372bd780900b38366c9a4acec77d522eb2

Download Submit
\Windows\SysWOW64\Eclcon32.exe

Filesize
67KB

MD5
6d511d075f45066d92e85c5c01c4cdc2

SHA1
2a2eedbdea1aa3bd1101c8b52c6875b77e94206b

SHA256
bf05185c5948ca79292b1c64e50ecdf12d592458a01ed2311014daef50ddcf46

SHA512
ecc6e6cd104708322d875e0317539d76e9af54fa5087d05678b984a28211289fd8d15ca64ed263392efdaa701e6570a4a858f716dcf05eca2c8d6f70bd9bb512

Download Submit
\Windows\SysWOW64\Egcfdn32.exe

Filesize
67KB

MD5
f2e89c69562d0399cdf8763c80ed4132

SHA1
4311ac77f4529f5f83f7b93c551b33dcd3f1691d

SHA256
99062cbc5eadba1eca00480cd88772e39b1ef8e0e21461f634cdc25472a9defc

SHA512
0af8b033fa698a7a63056d117b4b4cf9760dca29b7da8aee4316d811b63280a61d532d2c3e7c6fe63e2bc8d71b50c143e0d1ed94c81e8bdf7838e4f6fe59614d

Download Submit
\Windows\SysWOW64\Ekghcq32.exe

Filesize
67KB

MD5
5934691d922a52382113d9b017dcbc39

SHA1
0c9b67811a898e9fb16954a9e11fe41cd358204f

SHA256
11fad4f9df74b8ea5ffa62178c09d0b49babd07334c01345746328868fb89feb

SHA512
c253367544ad5c52e4ea1553e3e4d7e45d24e32079a62e0e4d1946eee4928f477d43a27c5190a6b6a6fa9c35eb2d8e657e005771be390db4351b9b28f37aeeae

Download Submit
\Windows\SysWOW64\Empomd32.exe

Filesize
67KB

MD5
7dd95712ce349863976b113be0c444a9

SHA1
3b965a96e752904a0ff673c07e5d226a50d7c327

SHA256
bfebfec29054f72a6e0b2aabb1e08cce19769fc8139d4d4af5e341fcff71395b

SHA512
ece0fa0bd3a84aeeaf0eee18c6404a1a70a67ca7ef48b984df837857694927cc507459de1a7c3b1d301e031ae7cd74efef0318b1d1f3763c081fa62f231b4bec

Download Submit
\Windows\SysWOW64\Flnndp32.exe

Filesize
67KB

MD5
2ed883d8bff4c4f8c16ce6420fbf11ce

SHA1
595068370a7ee4d382e8cb6e4851443a585841e6

SHA256
57dc1819e3acce01f4674bdc2a6ff73932223ee8afcffb3dae1d1521d71dae87

SHA512
9f4bb67392730c6fc57a6ec7ebeb28ce17aa39a526934a3bab4da5afa390a3809abd9673094e5a3b18873778b91ca5d7c6fa43e57bc596298d38452ae0ff94ca

Download Submit
\Windows\SysWOW64\Fpgnoo32.exe

Filesize
67KB

MD5
a35df7c1a158960ee572ed66c5ffbd79

SHA1
435212d890cb52dbff2da71fffd03e19582f5e83

SHA256
c5b0a968220240778aad8d74dd3cd3b0e649407aa0756f8b87082d7a0fce94c3

SHA512
859a177a4427de5f0dbd95e19f9daefe8b8dab7307d3c2553e06cbb75dceffa5d416bdc6f50f19017d79ba0f35bd96cf0e02a14d2482d2f09dd2a012b7fcf7d2

Download Submit
memory/1928-96-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1928-97-0x0000000000220000-0x000000000025B000-memory.dmp

Filesize
236KB

Download
memory/1976-106-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1976-99-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2476-67-0x0000000000220000-0x000000000025B000-memory.dmp

Filesize
236KB

Download
memory/2476-56-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2476-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2476-17-0x0000000000220000-0x000000000025B000-memory.dmp

Filesize
236KB

Download
memory/2500-69-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2500-77-0x0000000000220000-0x000000000025B000-memory.dmp

Filesize
236KB

Download
memory/2500-105-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2652-54-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2652-104-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2688-85-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2688-48-0x0000000000220000-0x000000000025B000-memory.dmp

Filesize
236KB

Download
memory/2904-25-0x00000000002B0000-0x00000000002EB000-memory.dmp

Filesize
236KB

Download
memory/2904-21-0x00000000002B0000-0x00000000002EB000-memory.dmp

Filesize
236KB

Download
memory/2904-18-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3060-81-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3060-40-0x0000000000300000-0x000000000033B000-memory.dmp

Filesize
236KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads