berbew | 197714bd3ebdcad1b8ac29df3dd7560ce5e3c33605e28ea169741a26321fb70b

Analysis

max time kernel
94s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-10-2024 19:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

197714bd3ebdcad1b8ac29df3dd7560ce5e3c33605e28ea169741a26321fb70b.exe
Size

337KB
MD5

391b6207f2e124005806c5e30a4a1f03
SHA1

0cb403080746af81ab0161abe7ad44891950482f
SHA256

197714bd3ebdcad1b8ac29df3dd7560ce5e3c33605e28ea169741a26321fb70b
SHA512

8ef6efe454d0823bf429477a5a6a93df576a65e46c917fc96659e2c4ad6172a97c9a005bf58fd8160f82a4f4397de409194514b5ef312f29b2c8182599996e84
SSDEEP

3072:SzxiQf0Pxxx/T9ivBgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:Cx506vB1+fIyG5jZkCwi8r

Score

10^/10

berbew njrat backdoor discovery persistence trojan

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php

http://crutop.ru/index.php

http://mazafaka.ru/index.php

http://color-bank.ru/index.php

http://asechka.ru/index.php

http://trojan.ru/index.php

http://fuck.ru/index.php

http://goldensand.ru/index.php

http://filesearch.ru/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://lovingod.host.sk/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

http://promo.ru/index.htm

http://potleaf.chat.ru/index.htm

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nloiakho.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qmkadgpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qddfkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ampkof32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acjclpcf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdfkolkf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkifae32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnqbanmo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Olkhmi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ajfhnjhq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cdabcm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ojaelm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pqbdjfln.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmngqdpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bgcknmop.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhhdil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bnbmefbg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bapiabak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ngdmod32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pqbdjfln.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pqdqof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Amgapeea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dknpmdfc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfabnjjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhfajjoj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddonekbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	197714bd3ebdcad1b8ac29df3dd7560ce5e3c33605e28ea169741a26321fb70b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nfgmjqop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nfjjppmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oponmilc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ocdqjceo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdifoehl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bmngqdpj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aqppkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Afoeiklb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aminee32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcjlcn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dmgbnq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhocqigp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ndfqbhia.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Odkjng32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdabcm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nfgmjqop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ognpebpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pdfjifjo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aeiofcji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cdfkolkf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdhhdlid.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndfqbhia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qfcfml32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ampkof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aeklkchg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnmcjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cfmajipb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmgbnq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Onjegled.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qmkadgpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Agglboim.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afoeiklb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aepefb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bagflcje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnicfe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Agjhgngj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bhhdil32.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Executes dropped EXE 64 IoCs

pid	Process
4832	Nloiakho.exe
1456	Ndfqbhia.exe
4860	Ngdmod32.exe
3848	Nfgmjqop.exe
952	Nckndeni.exe
3180	Nfjjppmm.exe
2776	Nnqbanmo.exe
5072	Oponmilc.exe
3428	Odkjng32.exe
1768	Olfobjbg.exe
824	Ocpgod32.exe
4452	Ojjolnaq.exe
924	Odocigqg.exe
916	Ognpebpj.exe
4488	Olkhmi32.exe
3208	Ocdqjceo.exe
4348	Onjegled.exe
748	Oddmdf32.exe
1032	Ojaelm32.exe
4544	Pdfjifjo.exe
2912	Pjcbbmif.exe
2364	Pdifoehl.exe
3520	Pnakhkol.exe
8	Pflplnlg.exe
2332	Pqbdjfln.exe
396	Pfolbmje.exe
4112	Pqdqof32.exe
1528	Qmkadgpo.exe
4300	Qfcfml32.exe
1464	Qddfkd32.exe
2520	Ampkof32.exe
4916	Acjclpcf.exe
2372	Afhohlbj.exe
856	Ambgef32.exe
3084	Aeiofcji.exe
2056	Agglboim.exe
1392	Ajfhnjhq.exe
4156	Aqppkd32.exe
3856	Aeklkchg.exe
3468	Agjhgngj.exe
2288	Ajhddjfn.exe
2272	Amgapeea.exe
4152	Acqimo32.exe
2592	Afoeiklb.exe
1104	Aminee32.exe
5112	Aepefb32.exe
3360	Bfabnjjp.exe
2164	Bagflcje.exe
4856	Bfdodjhm.exe
3388	Bmngqdpj.exe
4056	Bgcknmop.exe
4852	Bnmcjg32.exe
1128	Bcjlcn32.exe
3600	Bjddphlq.exe
2324	Bnpppgdj.exe
3576	Bhhdil32.exe
3924	Bnbmefbg.exe
1584	Bapiabak.exe
4880	Bcoenmao.exe
636	Cfmajipb.exe
3564	Cmgjgcgo.exe
3604	Cdabcm32.exe
5052	Cjkjpgfi.exe
3172	Cmiflbel.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Ndfqbhia.exe	Nloiakho.exe
File created	C:\Windows\SysWOW64\Nnqbanmo.exe	Nfjjppmm.exe
File opened for modification	C:\Windows\SysWOW64\Pqbdjfln.exe	Pflplnlg.exe
File created	C:\Windows\SysWOW64\Dbagnedl.dll	Pflplnlg.exe
File created	C:\Windows\SysWOW64\Ambgef32.exe	Afhohlbj.exe
File created	C:\Windows\SysWOW64\Cmqmma32.exe	Cjbpaf32.exe
File created	C:\Windows\SysWOW64\Cegdnopg.exe	Cmqmma32.exe
File created	C:\Windows\SysWOW64\Pflplnlg.exe	Pnakhkol.exe
File created	C:\Windows\SysWOW64\Oicmfmok.dll	Agjhgngj.exe
File opened for modification	C:\Windows\SysWOW64\Pdfjifjo.exe	Ojaelm32.exe
File created	C:\Windows\SysWOW64\Iqjikg32.dll	Beihma32.exe
File opened for modification	C:\Windows\SysWOW64\Bcoenmao.exe	Bapiabak.exe
File opened for modification	C:\Windows\SysWOW64\Cjkjpgfi.exe	Cdabcm32.exe
File created	C:\Windows\SysWOW64\Cfbkeh32.exe	Ceqnmpfo.exe
File created	C:\Windows\SysWOW64\Dkifae32.exe	Ddonekbl.exe
File created	C:\Windows\SysWOW64\Kboeke32.dll	Acjclpcf.exe
File created	C:\Windows\SysWOW64\Hdhpgj32.dll	Dhfajjoj.exe
File created	C:\Windows\SysWOW64\Elkadb32.dll	Daekdooc.exe
File created	C:\Windows\SysWOW64\Dkkcge32.exe	Dhmgki32.exe
File created	C:\Windows\SysWOW64\Olkhmi32.exe	Ognpebpj.exe
File opened for modification	C:\Windows\SysWOW64\Qfcfml32.exe	Qmkadgpo.exe
File created	C:\Windows\SysWOW64\Ffcnippo.dll	Aeklkchg.exe
File created	C:\Windows\SysWOW64\Bagflcje.exe	Bfabnjjp.exe
File opened for modification	C:\Windows\SysWOW64\Bcjlcn32.exe	Bnmcjg32.exe
File created	C:\Windows\SysWOW64\Cjpckf32.exe	Chagok32.exe
File opened for modification	C:\Windows\SysWOW64\Djdmffnn.exe	Dhfajjoj.exe
File created	C:\Windows\SysWOW64\Ihidnp32.dll	Dkifae32.exe
File opened for modification	C:\Windows\SysWOW64\Dhocqigp.exe	Daekdooc.exe
File created	C:\Windows\SysWOW64\Ognpebpj.exe	Odocigqg.exe
File created	C:\Windows\SysWOW64\Agjhgngj.exe	Aeklkchg.exe
File opened for modification	C:\Windows\SysWOW64\Bnmcjg32.exe	Bgcknmop.exe
File created	C:\Windows\SysWOW64\Dmgbnq32.exe	Dkifae32.exe
File opened for modification	C:\Windows\SysWOW64\Ognpebpj.exe	Odocigqg.exe
File created	C:\Windows\SysWOW64\Gmdkpdef.dll	Onjegled.exe
File created	C:\Windows\SysWOW64\Danecp32.exe	Djdmffnn.exe
File created	C:\Windows\SysWOW64\Fjbodfcj.dll	Aepefb32.exe
File created	C:\Windows\SysWOW64\Jhbffb32.dll	Bnbmefbg.exe
File created	C:\Windows\SysWOW64\Cmiflbel.exe	Cjkjpgfi.exe
File opened for modification	C:\Windows\SysWOW64\Cjbpaf32.exe	Cdhhdlid.exe
File created	C:\Windows\SysWOW64\Eokchkmi.dll	Cegdnopg.exe
File created	C:\Windows\SysWOW64\Qmkadgpo.exe	Pqdqof32.exe
File created	C:\Windows\SysWOW64\Mmnbeadp.dll	Bapiabak.exe
File created	C:\Windows\SysWOW64\Imbajm32.dll	Bcoenmao.exe
File opened for modification	C:\Windows\SysWOW64\Cjpckf32.exe	Chagok32.exe
File created	C:\Windows\SysWOW64\Pkfhoiaf.dll	Odkjng32.exe
File created	C:\Windows\SysWOW64\Ojjolnaq.exe	Ocpgod32.exe
File created	C:\Windows\SysWOW64\Gjgfjhqm.dll	Pdifoehl.exe
File opened for modification	C:\Windows\SysWOW64\Bagflcje.exe	Bfabnjjp.exe
File created	C:\Windows\SysWOW64\Nckndeni.exe	Nfgmjqop.exe
File created	C:\Windows\SysWOW64\Dmgabj32.dll	Olkhmi32.exe
File created	C:\Windows\SysWOW64\Ceqnmpfo.exe	Cmiflbel.exe
File created	C:\Windows\SysWOW64\Ngdmod32.exe	Ndfqbhia.exe
File created	C:\Windows\SysWOW64\Jclhkbae.dll	Nnqbanmo.exe
File created	C:\Windows\SysWOW64\Pdfjifjo.exe	Ojaelm32.exe
File opened for modification	C:\Windows\SysWOW64\Pflplnlg.exe	Pnakhkol.exe
File opened for modification	C:\Windows\SysWOW64\Agjhgngj.exe	Aeklkchg.exe
File opened for modification	C:\Windows\SysWOW64\Acqimo32.exe	Amgapeea.exe
File created	C:\Windows\SysWOW64\Mglncdoj.dll	Amgapeea.exe
File created	C:\Windows\SysWOW64\Afhohlbj.exe	Acjclpcf.exe
File opened for modification	C:\Windows\SysWOW64\Ambgef32.exe	Afhohlbj.exe
File opened for modification	C:\Windows\SysWOW64\Agglboim.exe	Aeiofcji.exe
File created	C:\Windows\SysWOW64\Bcjlcn32.exe	Bnmcjg32.exe
File created	C:\Windows\SysWOW64\Qlgene32.dll	Cdfkolkf.exe
File opened for modification	C:\Windows\SysWOW64\Dknpmdfc.exe	Dhocqigp.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4160	4812	WerFault.exe	173

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfdodjhm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnmcjg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chagok32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Olfobjbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aeklkchg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfabnjjp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djdmffnn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Danecp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhmgki32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocpgod32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amgapeea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdabcm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojaelm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pflplnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cegdnopg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjpckf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nckndeni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ognpebpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beihma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Odocigqg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjddphlq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daekdooc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dknpmdfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nnqbanmo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oponmilc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojjolnaq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmiflbel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmqmma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmgbnq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	197714bd3ebdcad1b8ac29df3dd7560ce5e3c33605e28ea169741a26321fb70b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocdqjceo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Agjhgngj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhfajjoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnakhkol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aminee32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfmajipb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajfhnjhq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aepefb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcjlcn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnpppgdj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhocqigp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfolbmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qfcfml32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afoeiklb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bapiabak.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcoenmao.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdfkolkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjbpaf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddonekbl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nloiakho.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ndfqbhia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Onjegled.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkifae32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qddfkd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ambgef32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjkjpgfi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pqdqof32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajhddjfn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhhdil32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnbmefbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ceqnmpfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nfjjppmm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oddmdf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdfjifjo.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Acjclpcf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bmngqdpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nbgngp32.dll"	Danecp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pqdqof32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Amgapeea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cdhhdlid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dhmgki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhbopgfn.dll"	Nloiakho.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ndfqbhia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Olkhmi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pqbdjfln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bkjpmk32.dll"	Acqimo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Afhohlbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fjbodfcj.dll"	Aepefb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cjpckf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pqdqof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bfdodjhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cegdnopg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ojaelm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Agglboim.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aqppkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Afoeiklb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bjddphlq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cjkjpgfi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Chagok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifndpaoq.dll"	197714bd3ebdcad1b8ac29df3dd7560ce5e3c33605e28ea169741a26321fb70b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pdifoehl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bjddphlq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cdfkolkf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qddfkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bnmcjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dhhnpjmh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Daekdooc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nfjjppmm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ocpgod32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Odocigqg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Odocigqg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gokgpogl.dll"	Qmkadgpo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qfcfml32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nloiakho.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nloiakho.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ngdmod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ochpdn32.dll"	Pfolbmje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dpmdoo32.dll"	Aeiofcji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aminee32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bnmcjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bcoenmao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjcbnbmg.dll"	Nckndeni.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmgabj32.dll"	Olkhmi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qddfkd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cmqmma32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nfjjppmm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nnqbanmo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Onjegled.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hdhpgj32.dll"	Dhfajjoj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	197714bd3ebdcad1b8ac29df3dd7560ce5e3c33605e28ea169741a26321fb70b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Glgmkm32.dll"	Oponmilc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pfolbmje.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cjpckf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dmgbnq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oponmilc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hiclgb32.dll"	Ognpebpj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pjcbbmif.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bapiabak.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1472 wrote to memory of 4832	1472	197714bd3ebdcad1b8ac29df3dd7560ce5e3c33605e28ea169741a26321fb70b.exe	85
PID 1472 wrote to memory of 4832	1472	197714bd3ebdcad1b8ac29df3dd7560ce5e3c33605e28ea169741a26321fb70b.exe	85
PID 1472 wrote to memory of 4832	1472	197714bd3ebdcad1b8ac29df3dd7560ce5e3c33605e28ea169741a26321fb70b.exe	85
PID 4832 wrote to memory of 1456	4832	Nloiakho.exe	86
PID 4832 wrote to memory of 1456	4832	Nloiakho.exe	86
PID 4832 wrote to memory of 1456	4832	Nloiakho.exe	86
PID 1456 wrote to memory of 4860	1456	Ndfqbhia.exe	87
PID 1456 wrote to memory of 4860	1456	Ndfqbhia.exe	87
PID 1456 wrote to memory of 4860	1456	Ndfqbhia.exe	87
PID 4860 wrote to memory of 3848	4860	Ngdmod32.exe	88
PID 4860 wrote to memory of 3848	4860	Ngdmod32.exe	88
PID 4860 wrote to memory of 3848	4860	Ngdmod32.exe	88
PID 3848 wrote to memory of 952	3848	Nfgmjqop.exe	89
PID 3848 wrote to memory of 952	3848	Nfgmjqop.exe	89
PID 3848 wrote to memory of 952	3848	Nfgmjqop.exe	89
PID 952 wrote to memory of 3180	952	Nckndeni.exe	90
PID 952 wrote to memory of 3180	952	Nckndeni.exe	90
PID 952 wrote to memory of 3180	952	Nckndeni.exe	90
PID 3180 wrote to memory of 2776	3180	Nfjjppmm.exe	92
PID 3180 wrote to memory of 2776	3180	Nfjjppmm.exe	92
PID 3180 wrote to memory of 2776	3180	Nfjjppmm.exe	92
PID 2776 wrote to memory of 5072	2776	Nnqbanmo.exe	93
PID 2776 wrote to memory of 5072	2776	Nnqbanmo.exe	93
PID 2776 wrote to memory of 5072	2776	Nnqbanmo.exe	93
PID 5072 wrote to memory of 3428	5072	Oponmilc.exe	94
PID 5072 wrote to memory of 3428	5072	Oponmilc.exe	94
PID 5072 wrote to memory of 3428	5072	Oponmilc.exe	94
PID 3428 wrote to memory of 1768	3428	Odkjng32.exe	95
PID 3428 wrote to memory of 1768	3428	Odkjng32.exe	95
PID 3428 wrote to memory of 1768	3428	Odkjng32.exe	95
PID 1768 wrote to memory of 824	1768	Olfobjbg.exe	96
PID 1768 wrote to memory of 824	1768	Olfobjbg.exe	96
PID 1768 wrote to memory of 824	1768	Olfobjbg.exe	96
PID 824 wrote to memory of 4452	824	Ocpgod32.exe	97
PID 824 wrote to memory of 4452	824	Ocpgod32.exe	97
PID 824 wrote to memory of 4452	824	Ocpgod32.exe	97
PID 4452 wrote to memory of 924	4452	Ojjolnaq.exe	98
PID 4452 wrote to memory of 924	4452	Ojjolnaq.exe	98
PID 4452 wrote to memory of 924	4452	Ojjolnaq.exe	98
PID 924 wrote to memory of 916	924	Odocigqg.exe	99
PID 924 wrote to memory of 916	924	Odocigqg.exe	99
PID 924 wrote to memory of 916	924	Odocigqg.exe	99
PID 916 wrote to memory of 4488	916	Ognpebpj.exe	100
PID 916 wrote to memory of 4488	916	Ognpebpj.exe	100
PID 916 wrote to memory of 4488	916	Ognpebpj.exe	100
PID 4488 wrote to memory of 3208	4488	Olkhmi32.exe	101
PID 4488 wrote to memory of 3208	4488	Olkhmi32.exe	101
PID 4488 wrote to memory of 3208	4488	Olkhmi32.exe	101
PID 3208 wrote to memory of 4348	3208	Ocdqjceo.exe	102
PID 3208 wrote to memory of 4348	3208	Ocdqjceo.exe	102
PID 3208 wrote to memory of 4348	3208	Ocdqjceo.exe	102
PID 4348 wrote to memory of 748	4348	Onjegled.exe	103
PID 4348 wrote to memory of 748	4348	Onjegled.exe	103
PID 4348 wrote to memory of 748	4348	Onjegled.exe	103
PID 748 wrote to memory of 1032	748	Oddmdf32.exe	104
PID 748 wrote to memory of 1032	748	Oddmdf32.exe	104
PID 748 wrote to memory of 1032	748	Oddmdf32.exe	104
PID 1032 wrote to memory of 4544	1032	Ojaelm32.exe	105
PID 1032 wrote to memory of 4544	1032	Ojaelm32.exe	105
PID 1032 wrote to memory of 4544	1032	Ojaelm32.exe	105
PID 4544 wrote to memory of 2912	4544	Pdfjifjo.exe	106
PID 4544 wrote to memory of 2912	4544	Pdfjifjo.exe	106
PID 4544 wrote to memory of 2912	4544	Pdfjifjo.exe	106
PID 2912 wrote to memory of 2364	2912	Pjcbbmif.exe	107

C:\Users\Admin\AppData\Local\Temp\197714bd3ebdcad1b8ac29df3dd7560ce5e3c33605e28ea169741a26321fb70b.exe
"C:\Users\Admin\AppData\Local\Temp\197714bd3ebdcad1b8ac29df3dd7560ce5e3c33605e28ea169741a26321fb70b.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1472
- C:\Windows\SysWOW64\Nloiakho.exe
  C:\Windows\system32\Nloiakho.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4832
- - C:\Windows\SysWOW64\Ndfqbhia.exe
    C:\Windows\system32\Ndfqbhia.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1456
  - - C:\Windows\SysWOW64\Ngdmod32.exe
      C:\Windows\system32\Ngdmod32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4860
    - - C:\Windows\SysWOW64\Nfgmjqop.exe
        
        C:\Windows\system32\Nfgmjqop.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3848
      - C:\Windows\SysWOW64\Nckndeni.exe
        
        C:\Windows\system32\Nckndeni.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:952
        
        C:\Windows\SysWOW64\Nfjjppmm.exe
        
        C:\Windows\system32\Nfjjppmm.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3180
        
        C:\Windows\SysWOW64\Nnqbanmo.exe
        
        C:\Windows\system32\Nnqbanmo.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2776
        
        C:\Windows\SysWOW64\Oponmilc.exe
        
        C:\Windows\system32\Oponmilc.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5072
        
        C:\Windows\SysWOW64\Odkjng32.exe
        
        C:\Windows\system32\Odkjng32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3428
        
        C:\Windows\SysWOW64\Olfobjbg.exe
        
        C:\Windows\system32\Olfobjbg.exe
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1768
        
        C:\Windows\SysWOW64\Ocpgod32.exe
        
        C:\Windows\system32\Ocpgod32.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:824
        
        C:\Windows\SysWOW64\Ojjolnaq.exe
        
        C:\Windows\system32\Ojjolnaq.exe
        13⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4452
        
        C:\Windows\SysWOW64\Odocigqg.exe
        
        C:\Windows\system32\Odocigqg.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:924
        
        C:\Windows\SysWOW64\Ognpebpj.exe
        
        C:\Windows\system32\Ognpebpj.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:916
        
        C:\Windows\SysWOW64\Olkhmi32.exe
        
        C:\Windows\system32\Olkhmi32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4488
        
        C:\Windows\SysWOW64\Ocdqjceo.exe
        
        C:\Windows\system32\Ocdqjceo.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3208
        
        C:\Windows\SysWOW64\Onjegled.exe
        
        C:\Windows\system32\Onjegled.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4348
        
        C:\Windows\SysWOW64\Oddmdf32.exe
        
        C:\Windows\system32\Oddmdf32.exe
        19⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:748
        
        C:\Windows\SysWOW64\Ojaelm32.exe
        
        C:\Windows\system32\Ojaelm32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1032
        
        C:\Windows\SysWOW64\Pdfjifjo.exe
        
        C:\Windows\system32\Pdfjifjo.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4544
        
        C:\Windows\SysWOW64\Pjcbbmif.exe
        
        C:\Windows\system32\Pjcbbmif.exe
        22⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2912
        
        C:\Windows\SysWOW64\Pdifoehl.exe
        
        C:\Windows\system32\Pdifoehl.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2364
        
        C:\Windows\SysWOW64\Pnakhkol.exe
        
        C:\Windows\system32\Pnakhkol.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3520
        
        C:\Windows\SysWOW64\Pflplnlg.exe
        
        C:\Windows\system32\Pflplnlg.exe
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8
        
        C:\Windows\SysWOW64\Pqbdjfln.exe
        
        C:\Windows\system32\Pqbdjfln.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2332
        
        C:\Windows\SysWOW64\Pfolbmje.exe
        
        C:\Windows\system32\Pfolbmje.exe
        27⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:396
        
        C:\Windows\SysWOW64\Pqdqof32.exe
        
        C:\Windows\system32\Pqdqof32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4112
        
        C:\Windows\SysWOW64\Qmkadgpo.exe
        
        C:\Windows\system32\Qmkadgpo.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1528
        
        C:\Windows\SysWOW64\Qfcfml32.exe
        
        C:\Windows\system32\Qfcfml32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4300
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1464
        
        C:\Windows\SysWOW64\Ampkof32.exe
        
        C:\Windows\system32\Ampkof32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2520
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4916
        
        C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2372
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        35⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:856
        
        C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3084
        
        C:\Windows\SysWOW64\Agglboim.exe
        
        C:\Windows\system32\Agglboim.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2056
        
        C:\Windows\SysWOW64\Ajfhnjhq.exe
        
        C:\Windows\system32\Ajfhnjhq.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1392
        
        C:\Windows\SysWOW64\Aqppkd32.exe
        
        C:\Windows\system32\Aqppkd32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4156
        
        C:\Windows\SysWOW64\Aeklkchg.exe
        
        C:\Windows\system32\Aeklkchg.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3856
        
        C:\Windows\SysWOW64\Agjhgngj.exe
        
        C:\Windows\system32\Agjhgngj.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3468
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        42⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2288
        
        C:\Windows\SysWOW64\Amgapeea.exe
        
        C:\Windows\system32\Amgapeea.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2272
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        44⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4152
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2592
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1104
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5112
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3360
        
        C:\Windows\SysWOW64\Bagflcje.exe
        
        C:\Windows\system32\Bagflcje.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2164
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        50⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4856
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3388
        
        C:\Windows\SysWOW64\Bgcknmop.exe
        
        C:\Windows\system32\Bgcknmop.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4056
        
        C:\Windows\SysWOW64\Bnmcjg32.exe
        
        C:\Windows\system32\Bnmcjg32.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4852
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1128
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        55⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3600
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        56⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2324
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        57⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2768
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3576
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3924
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1584
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        61⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4880
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:636
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        63⤵
        Executes dropped EXE
        
        PID:3564
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3604
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5052
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        66⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3172
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        67⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1164
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        68⤵
        
        PID:4192
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3516
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3988
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        71⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4656
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        72⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2976
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5040
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        74⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5044
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        75⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3976
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        76⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3404
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4660
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        78⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3288
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        79⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2424
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        80⤵
        Modifies registry class
        
        PID:4900
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3788
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2208
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1436
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        84⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1892
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        85⤵
        
        PID:2644
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        86⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1388
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4768
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:1764
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        89⤵
        
        PID:4812
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 404
        90⤵
        Program crash
        
        PID:4160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4812 -ip 4812
1⤵
PID:4016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Acjclpcf.exe

Filesize
337KB

MD5
6a5ce2d16da53971dd81332ef933eb7d

SHA1
0abf0609703c7ffc352507eae223357624b79fa6

SHA256
0ffa9055adad4c751ff0606ee544b792e3336d486bf56fe2136e739f4b2b413c

SHA512
ace110eaa2f9ba76efa5c91b8b086965f98ef0ca19980f1e5eedf9cc26b177ac7f852725e2cf28924d8717f6dcbd36cb2b70371919ff22a5aa9b51eb59eabab7

Download Submit
C:\Windows\SysWOW64\Afoeiklb.exe

Filesize
64KB

MD5
954036ee652712bfbe86658c4557a8e2

SHA1
9906ba9f7c90bb0d6d040a6803eb3a74c1f731c5

SHA256
3f39b29a05eaacb8eda7d30a0f28700d31f41b5a96c230e29f53f8f381b17945

SHA512
72106e3b094b02db9381e85d16dd4edba3ca725f86b9a0fa560e4f780a1210a809499e78bff892b639834f4a54cf8d47681ecae423496b6fe7801748046cf46f

Download Submit
C:\Windows\SysWOW64\Amgapeea.exe

Filesize
337KB

MD5
7d72a069760ce209ec145836ba47d264

SHA1
2c45c761c00d30a123411fc0cc88cd9843a35000

SHA256
17b9925a7536b75d1f75ec533a67ac3eb1a13d56aa5fa156071a9f2ed0a34099

SHA512
7995fc230fd9fa0db85e7249b9316ff12488d094d9d7ff932f631bc2ab8a7163c43549c521f82a130f17372c408291686be9ae50042693f3813ced170b74e5a3

Download Submit
C:\Windows\SysWOW64\Ampkof32.exe

Filesize
337KB

MD5
62d65437e8725a90a834f36cc040e730

SHA1
9c72ae6edbec5fae1c4d8376709494dd36b89840

SHA256
d291a329aa1368da0ddbdd1157eb063a5c39d92261bff340f77b93f8a42aa229

SHA512
f9adfa06e38cdd8a4c56b18590ed2128f003e5d57ad1045c5c7846e1e172ec1fc6269d6818d2ef2f041d06fbd4b87d54e3d97656424e1cae4e76e892b9ee9f5a

Download Submit
C:\Windows\SysWOW64\Bfabnjjp.exe

Filesize
337KB

MD5
9dd0f8a892d075a4bed54f56be80e6a1

SHA1
a47512a3a9f20944d872bd56983a542a75e8954d

SHA256
92950d19374363d6755a6b557a8e9dc3e0866139cbc07df6f22c41aaebf21ba0

SHA512
b9f4ed0a306510802409677eaefbf5e717a9ab51099dc6c447d59967c14fc238addf07f41d1d175b3908226837173968c43165804fb737b90627453d85f14708

Download Submit
C:\Windows\SysWOW64\Bmngqdpj.exe

Filesize
337KB

MD5
183cffe070bde97dfe79eb590ac986bd

SHA1
e8d081d27929001996b26963707208047cefd81c

SHA256
88ad114e25cfa47f3c5c7602f2c70b97648f40bceb04e0dd56b4fe22dfb04db5

SHA512
0845e087ee36b02b7d23f3b18434b953be426970b0a4a07ad7022dba7a94b13f89f30b40f4944e8599989d2fb4af3031a601f781a98717bd3f248c897cb4f2c9

Download Submit
C:\Windows\SysWOW64\Cdabcm32.exe

Filesize
337KB

MD5
f1b04cbbe153ffe5617a121cf120e170

SHA1
c8590db8a2b723073a8f833a32089e39eb2e7e25

SHA256
3c7aac261a8e555fccbf4c6e90888c4e147cece846b8d7ab482cf917d44d98e8

SHA512
817a27694fe405020f80a3f313b0ca482217930b69c3563ae186648d573e0835e8477f2ee8db0df29c2e0bc5741d9cfcb6e6259fcb3d54e67df437bb04e2c224

Download Submit
C:\Windows\SysWOW64\Cdfkolkf.exe

Filesize
337KB

MD5
64dde58c09669ee20bab6f4b430cd5b9

SHA1
3caad69cd8fe2dfd3a11274ed8201e7857b0bd58

SHA256
e3a0d2827f6a00c313f6afd37fce4ac1214b1c8b049402daff15b50aa72f4034

SHA512
6dc81a398ac99d371884b7ca2ad139e20603470ff4ba36afdc24e924516127d449b620a6bbeca17d61a4e87f67b3b6ae9b93df9ae87eb0c13a7c2ab670e69292

Download Submit
C:\Windows\SysWOW64\Cfbkeh32.exe

Filesize
337KB

MD5
71934870b7d1fdd46d8c9ce71bcff686

SHA1
3cb4248070f02d2082689c234af6fdf3ef64905f

SHA256
29c59a89a997aa7804e25a7ae5bce194385c61163aa881690ac1439244e438f4

SHA512
397f8c7869bf8cce7c3ed6aaed92fc930262c1066318cba4ce08f4dfbbf3580d6469b1ff047ba246151f82cb625e8d99de6f7a76e2497dc44c2ebd27220e77d7

Download Submit
C:\Windows\SysWOW64\Cfmajipb.exe

Filesize
337KB

MD5
77ab09918aacd92a35f053b77339aaa6

SHA1
2db1af74d68f97ee1749693226255a8cc2ba4042

SHA256
82b3050b7d71020eaa59c2d43098137728de2b941a87aba7802ff5faec014879

SHA512
9fce84ceed46e289cdba14de9c783a84ef8babc7bc882b61065aaee3ba5bd1e4db7f193d5c28c8817af69238e12ca01261e1fc4f2d214e1279955ccb64c25f3c

Download Submit
C:\Windows\SysWOW64\Cjbpaf32.exe

Filesize
337KB

MD5
a7a95e748d7dbea2c8651ca82ac458f0

SHA1
6a24f29697798a15ac2cb399d4e7d163cfc35b8c

SHA256
24c9796a28d82d46e73fc6891f51da7ca0f4a47f2978ce52573b673c8d2de6a4

SHA512
fd7e5e21d87d9bfe2101f132bbc458eea63987e32e3aaf55ecf1f2d0fbe51d1a0ef7facaefdbebcbe40388ff1942336b2359e28dac07202618f55e512bffaea8

Download Submit
C:\Windows\SysWOW64\Cjpckf32.exe

Filesize
337KB

MD5
fae6f6e901d5e8280b087c97e5c6917b

SHA1
72f50e59974786a99bfee81ec88f580eacbe0c3d

SHA256
50d5ce1d8310c06a1f17584d3591c3c28ea8f9fce84bb8a7185971e9fe7745f4

SHA512
fa5b746338ccc638a865b88eca2512856e0df794bb963771f6924f2d17b9ad43e78c7b147fe8c077e158b54eac50e63bfcdd6fdad628dd57dfbcd7b49ad0cca2

Download Submit
C:\Windows\SysWOW64\Dhhnpjmh.exe

Filesize
337KB

MD5
4e55b0ba1feafe4d00223555d1830428

SHA1
dfbcd85f5eff733faa4d3791c89d8da99214e422

SHA256
768eed8f5593c7fa8e8db7f71dfb97efa4ba983c39b5af1465f30901fef4438d

SHA512
7ae01f4184b161943c13c4d6a76c718fac907e03e4585117e977646e715b1ef7faca41a89ce614fa7c7e4ccf2139a44c6f71b82394259d8261c6fa65d7dc2e7f

Download Submit
C:\Windows\SysWOW64\Dhocqigp.exe

Filesize
337KB

MD5
4ff8cf982b7086fd801a79bb2f52aa3b

SHA1
6b9e697cd7c19674cda7ce8e34f1375db9bfc8a2

SHA256
934c504afc4d6e81c7db615dbe32b5da29f37d06b468004541d781cc5a8f54b1

SHA512
bdd54320c53516d31c1191cccafc82c81047c206a9315e446dc1d5bdb77f3138604f03e180ec1d6f0d88b835f7722ad08a3a2824c58b041b5e922ea8f328147a

Download Submit
C:\Windows\SysWOW64\Dkifae32.exe

Filesize
337KB

MD5
346d73fc092d5fc1aa082309ac89584a

SHA1
48683e10ba25528d8c1cd7708ebaf9ee64b5242a

SHA256
602440d1951b3134891dc4288f77076e7814c6c3c44a2cf0b944041a2e26ac1b

SHA512
c471d5a7705527ce3ad966718b5910abb649a8d5c33649f1e96278b5eb6dc11303b362ec9c222d65a2a2c6a3ce2afa59ece3ec43da2ba70c0f5215e4d71503b5

Download Submit
C:\Windows\SysWOW64\Dkkcge32.exe

Filesize
337KB

MD5
daadac24e20e3191e5e3cbe8b3f757c2

SHA1
34be673610b630b6f301a60f7c2b7e411bd73a8a

SHA256
1f9284b75f7473294e8d9702ebce249fb698d1ee65defc3dd00869be0159e53d

SHA512
f1a0344f75cd2dadff6925b1579eecdfda3afae451c8fb5f88ca6f35c10899739dde8dc8290c8f7e98b641d47a488608ddbfb95fdffa94ad584df19d4ce79a4c

Download Submit
C:\Windows\SysWOW64\Nckndeni.exe

Filesize
337KB

MD5
7870605a6698888b69fc1ee79e46ff02

SHA1
3c7162396c4ed573548875730fddf741b2d15731

SHA256
26e6e9b51ce8d99779046dec15af4cbac70738035779537d73ba4818ded4dc00

SHA512
5cc5b029b9fd9c4cd8117d498ad21210f8ef3f5356c9e9ff1501848f558d3920bd56b4786dfa07e24bc75786ae8052d0e06ce31fb149a4aaf76885c6b79b4d51

Download Submit
C:\Windows\SysWOW64\Ndfqbhia.exe

Filesize
337KB

MD5
593400f15eec52724ca2854d4b7920bb

SHA1
c166fddf08bbbf45ed6fdc05445b01514689b58a

SHA256
38fcdcbafc8e15a9341b41ed9ab263d060db5f59066eee050f8b44101d415149

SHA512
3abe513119ec8c66346283104727ce579a242b0463da1d56771f4f5a96c747eaa5f816d2dcac991a81cd319fdfe88d511261fe6a3be36410727adbae7d0fbc13

Download Submit
C:\Windows\SysWOW64\Nfgmjqop.exe

Filesize
337KB

MD5
6ca4961afd17a611806ca4aeb2f01ebb

SHA1
ee41a7995cb0a92b15db1bf93028d3b6a2b839ce

SHA256
ba9240ccd210d9ff1c0dc7e99756c446edde462a46166a947f7b4fd5304bb824

SHA512
595bfd5b4f1460a1bd3728cd8dded1e75707fddfe428d6e54d1ff5f2071d9866d279594c298554dff00ecda54c9c5ba6f460d2cc21cfb455b7f20a99224aa8de

Download Submit
C:\Windows\SysWOW64\Nfjjppmm.exe

Filesize
337KB

MD5
9295877a40f4788f4f69119837f07368

SHA1
76941a75548410e9f7bb869b229958390dbf1f03

SHA256
c9747218757364690bdc1510a6ef4c6533d1fb0604e69c6280f485754fcec1ed

SHA512
3fc215459636d5ddd79610d81928cbd78e118bf23fe788b4ae2c6f867093b0ee39c77c954e0bf0583bb7aed9debcfd181361dee05de494dee1ca400e60743219

Download Submit
C:\Windows\SysWOW64\Ngdmod32.exe

Filesize
337KB

MD5
5f79f9c726b5e7e73ec957d5e43c7c4d

SHA1
854d71f2db4e781c03c173d38efa70fa97ac498e

SHA256
c0cbe83c225ee1980a90c4c186a9740507df9c7992aef2fdf8f23fca40eab75e

SHA512
ab52e77b3ac3620943973c7da229d498c0d6336e5ce5124976455f000f4931983fff565bebfd059d9927f7ac112e7d69364b9e35d6ca2da57bb43543e03f7f3b

Download Submit
C:\Windows\SysWOW64\Nloiakho.exe

Filesize
337KB

MD5
0829388bcbd4852f2cb8fea191b7097b

SHA1
f96f4aad7b0277424bfa74b9bca9b77774f33368

SHA256
0ea1531acdd1d1c6bf9be4538b6e27b3ffef21faf2d139a2437a4b99786a09e5

SHA512
2013abd804022b7696b278576b90a015bd73d0e2653c1c191f098c063b955683aa7fa673d27e6cb5b16802517d790ef370cfd374f499da445c138e1aa349575c

Download Submit
C:\Windows\SysWOW64\Nnqbanmo.exe

Filesize
337KB

MD5
91b81b9959d79a613b5c4b98eeaea5a6

SHA1
1d6013e1414239bb653cce7b8b2a2216a897c8db

SHA256
058494ce39ab78c48a3661d7e3cfed2709e6c302663b0903e2f7905f775372b9

SHA512
63c2dcdee778e876d2f98f9aef0091ad951b9172f4a802b8ad15b16355d090e9d656176c8d0d4985567561cae8fc1fb257fbc27f4287858225a49111ccda215c

Download Submit
C:\Windows\SysWOW64\Ocdqjceo.exe

Filesize
337KB

MD5
031d7c8f7eb1759ca993959f9a583256

SHA1
83feca85d907da2cdb1db4ae0d13ffd3e571ff93

SHA256
4026eed2f202e929d2599a285db9ce215110c8f10b8cddd6ac47c6c273e5dc6a

SHA512
6e146b8c2f898ea42f70ebbe5246db118f912c53d6c40cafe26941aef46194f2d596f61b29495967f28c0e3d3712cd5b9b720bd8fc9b4f960ac5d60ed63a9998

Download Submit
C:\Windows\SysWOW64\Ocpgod32.exe

Filesize
337KB

MD5
bff6d01b9123fed9b524496621ae8127

SHA1
a76f096225f89cd823d9276424b080437d90113a

SHA256
f14ddf96cfe7d93d77612a8344339df701128d1b1e13f28ed8cd5aedfc0afc6c

SHA512
dbe020a76816e33f3e3e4b362245bbde4629bedb711788d81940cc903fb832d05f04614918a7148e0d00d66a35585f5fb565e3de5e10d27f3ce960e83e7fe4ec

Download Submit
C:\Windows\SysWOW64\Oddmdf32.exe

Filesize
337KB

MD5
a9b3751d185df11bc97442167662eec3

SHA1
552de7832ddeb9fcce9cd7b9040630719b69a4bf

SHA256
f890483047720518ceb80a51cee30799d7d73dad97b9e33a5d8e9c15e5ebf4ab

SHA512
1f1788775e196debc19b51ca6ada4b11336941fe7322a879f7e8529b810477e91516a7cc2c4160cbfc9c9061b1e965fbfe2e6e4edec5cd00132198aed7afa570

Download Submit
C:\Windows\SysWOW64\Odkjng32.exe

Filesize
337KB

MD5
66466ac77ee7dcd4e03886f89b69ec4d

SHA1
1482e3e72fcd44d6ca7b7c10eac1221d26b6feb3

SHA256
b0b63fdae6a4a3583edf0a071a9a0a3a063f8c1a72b42b369c1ff0ddaced0288

SHA512
efff85b0c9d62a0c5601213f9ebefb29e17e01ffe57b3d782470e1ac53e19e521b2ebeb8eff79755ae809c3db2cba9067734c11f448b5cdf124a02affed5e546

Download Submit
C:\Windows\SysWOW64\Odocigqg.exe

Filesize
337KB

MD5
604bed72b5168cd8e6a3be21aace9b1a

SHA1
059e46a6f42cad51e3b132295df1e7904ae13787

SHA256
87f711e09221c264ab1798103fe9f84bc944ca3094a1dca4322c173089ebf2a8

SHA512
18dfa9d8aa3d121ea19fa5838cea251f4c9da5f803356e219ce25c5d4f0f7ce0a61a2e354c4d666b8831c84bc742de05fefb022ea1c15b5b3f81e069b28d1db9

Download Submit
C:\Windows\SysWOW64\Ognpebpj.exe

Filesize
337KB

MD5
be68137d4a813e9b38b42e6345f0b977

SHA1
a5166e6d87157edf7a57daca8e11b2c67fba179e

SHA256
063aa09e88a36c8c52f6dce5cbc3b9f52cb53b3cc8d07eca951d7406d2a6a8f4

SHA512
a86d3edf2ab7188fbf4b0894067ae04990bf15d56b141d7b9dd1bdcd1351e4a1f9b97823888fe982c03a97310e2b3388c992a2bb25de2452a734fb4f083bdd4e

Download Submit
C:\Windows\SysWOW64\Ojaelm32.exe

Filesize
337KB

MD5
f50004aaf353e8875ea6d0c80bf6871f

SHA1
088a716114aecdb022a6bcb829af429125be40e9

SHA256
df9e9cdf9801de248a7694113f9ad7be5b9682a65e68b46482d5ecbc157f5a8f

SHA512
e40025e58400d09afe2c23a32ff7fe898bf832aa3a7ebf80226720dec78666ab9e019523557c7769309422ee94319fa2923bd2aa95c42c3fc536a759d401b833

Download Submit
C:\Windows\SysWOW64\Ojjolnaq.exe

Filesize
337KB

MD5
f0dfc7bdb9c093f20932e015700cbfaf

SHA1
c097f8096589d0d3fbec0bfb1e6437009ad47bae

SHA256
a4992dfa9c463bbf2dcb68ad2b67cc7df01df854a54463608eb31cd02b6c4f36

SHA512
149a548d666f02d45a80522ec44ac6043e13b91c64d43d02ef06e1949e8bf65768365db159138ded288632b7c7762a38e690695ea13aef524dc0aa1898373c46

Download Submit
C:\Windows\SysWOW64\Olfobjbg.exe

Filesize
337KB

MD5
ed2d51e19e194d03071840c99bdd14e1

SHA1
8f9e2e9650dec7ab742b930e3c4fd7433f5c7876

SHA256
99a4ad935c708b87b5430f9934934d14f68c343c9f1b52f9127dcb60b75afa30

SHA512
9b5d046ede1a0bcccbb73f7af636bd1c446e51b2e3a15ffa502f21b9cc854788075043bf2d812dd9ce18f6213d46187c56ae0be76c201f0290959583b0af78d2

Download Submit
C:\Windows\SysWOW64\Olkhmi32.exe

Filesize
337KB

MD5
766ed741a27ce3c235e790d0da1f4961

SHA1
3958abcf95be9656afaa3e27c4e3db1075998cd1

SHA256
36917d95b001ba5523a89a8c16b9fbf82a57534f168a7d0240d6ac13270d9d2e

SHA512
0d31f9c27464e1ad39282ad56911f5bbb7d4233f278b2a575a5a8132256b7e53592487fc99d7b05a195bb172dd59d157604306ea9d11fc7aef58e3cc44312a12

Download Submit
C:\Windows\SysWOW64\Onjegled.exe

Filesize
337KB

MD5
81a2150d5b4a358289f919b87b74ea7f

SHA1
e509cea9d529624aeee95ed824433d7a5ad30f0e

SHA256
95a2e10e152faf7c66309a4157d32216608cdc94e0acb6f3a92d04f0e96a7e94

SHA512
4b857d4451aedd4a51ef6621a7feac3a1a0e86b509935011aa7d019b28fab78eedde15c5f4d859e55348dc54f17270babd34cf976e6c09b11a53b81c4c5525d8

Download Submit
C:\Windows\SysWOW64\Oponmilc.exe

Filesize
337KB

MD5
1feba2d1a030d1d86c6f0a068df57a73

SHA1
d96d701d04372c40ed0e86e96cdc728d0ea36c5b

SHA256
398757173bdfcf0fca11e923245dacbf3d0c320988ca1b417a73ebc6df8061b5

SHA512
d59eac4dca78e0b81db78acb918880239ac290ca99b521a3ae477d789d24aba1d19cef1884744169f316e064382f89382e0848fbf244cbb99361ab2c2e54c7b6

Download Submit
C:\Windows\SysWOW64\Pdfjifjo.exe

Filesize
337KB

MD5
748e083a4dfe77c8ea332c60d2f8ad2d

SHA1
e035f3bc8f4f3e6437378153c916f1b7025bd048

SHA256
39f8994b0ff6f548dab12d97408a9a93a3f3c0994ddf3ffe744f59114ba56daa

SHA512
4efbf7e06e954f858ae319d0ac27c10c0cdb9db7cc5be8374afb802e62ead95d19c1653c938078532c6a4681619a371fa2841924a5db2cf6c33aec4681d7d296

Download Submit
C:\Windows\SysWOW64\Pdifoehl.exe

Filesize
337KB

MD5
a64e3d00bccc5d5fcbbaaab5136e2b13

SHA1
7b9a2acf68b3af58cce850d4d9e023d4512ae9f8

SHA256
728539b714b3a62c97ab0a6fc395f21786606247820fd3fb377e8494206a57f4

SHA512
e417d72f3cbc634ce581d07dbe2ca66f0f55b7181c624b2c825ea0fd21c5513fbfbc762a274b2c34c4f0678a66d02aeef425f76c034d84758021163bf82d8c4a

Download Submit
C:\Windows\SysWOW64\Pflplnlg.exe

Filesize
337KB

MD5
a2dd411735b5c42e0addf648452b733c

SHA1
10718f8051143682f3d9b1e672c7f886c0cb9d77

SHA256
75c81b468d6894d51494b0a1640c479facc5202982c7d16e097525e5c951addc

SHA512
ad8127c769048a7ff78f5237d2c5100550be6d8a9e7117b3b77d6f4ff26cd84ab5e1fb272c82be5afcc785c6b00268c243b0c441b23869c7a4887dc3acbd0c5b

Download Submit
C:\Windows\SysWOW64\Pfolbmje.exe

Filesize
337KB

MD5
4da462e0ee986f3fcd5bb37c0f3ddfac

SHA1
e9b574e6113510f1d62192fe4848a4a00b92c470

SHA256
cd7ce3b1aaeeacb22748bd8a4614f1c73f0e5052b39fba2379ccbaaef7a0ab50

SHA512
f0b4bc80b0bc7f9aaf4a4431d1a3a6bb54461cd0bf7cf54146f9729446a6ebbfb1cae73acb2f372c7ac2f1aa8777df42aef56d5830a40e59b718fa6288cbf09c

Download Submit
C:\Windows\SysWOW64\Pjcbbmif.exe

Filesize
337KB

MD5
91dd5fca9386bc4afdcf66e1372a60cd

SHA1
0aa580d936337067e32fd3cbf013ee4c984e5e0b

SHA256
e55e0f7cf5fff352c88261fec89b0d37d94d6ec17860d1002872b6e817f4c1cc

SHA512
84054e75349b95f987959e38599cb600c39a472992a6b66e3b2802a1a9de31f0fef07e7d55dc1ec253c641c7873f709a9906c557f640f4a53878217f05b26cef

Download Submit
C:\Windows\SysWOW64\Pnakhkol.exe

Filesize
256KB

MD5
fa4f9aa17f5333231da2a075a35aef26

SHA1
f1453dea84ef41369040631044f0e1dfc651204e

SHA256
3cb6ab8f3b91e8569c8727b47f29024732c62831be492a5912e4c9043568e937

SHA512
006f886c18d9191650be35a3e098e26a6ec8a0217d5d548b5cee3606452059292f162efb64a925303484298dc0defe527bb1653a449e3691467fae6b531bba6b

Download Submit
C:\Windows\SysWOW64\Pnakhkol.exe

Filesize
337KB

MD5
03bf05e728a4df7693840cbeb3f2d7bd

SHA1
ab6bc9789e0b9d3b7698f5684eb6aed769717702

SHA256
bbabd46325a08cdb221b110875184153030ea8a7475964c35dd85cfe2184f824

SHA512
ce69c9f1d493ed3dbbc18683bfee51076a58567e1b0f16e1042160c94084bc8e861f78acb3336eeb0b0d91b4c0f79b166729a529954469191110a6a56f57ce7a

Download Submit
C:\Windows\SysWOW64\Pqbdjfln.exe

Filesize
337KB

MD5
3cb0f8aecbceff3e2383783b088476cb

SHA1
8602f1ae08014901b95dd4ecd69eb25cbfd498cf

SHA256
085844b546e621deb288f731b80acb815da470ca4fb1cdbc48186e6c4852ace1

SHA512
2c5ee2f5448c6316f9b587e1808fde943ef018dc596d913232a829119ef676bfb73c63984a144334961c510172bc9f41764356e4e207b308274bd82447f212fa

Download Submit
C:\Windows\SysWOW64\Pqdqof32.exe

Filesize
337KB

MD5
7b9be1590d2c2385af62c83a1becf5e8

SHA1
cd3905c685b00333eecb4f307871470eabf5f568

SHA256
75c87aec9c0dbbec075d0ab82280ee91f92c5760ae7c52fed37d981a578f15d8

SHA512
5e74e565806ee2b057cf4b247907de7ef73262010750fe48e08d58c32111259a857695fd01efcc3a0193d786f5d5fb1ee6e5665b770c9b8e29ace0edd4088d17

Download Submit
C:\Windows\SysWOW64\Qddfkd32.exe

Filesize
337KB

MD5
a163667c565d3a8fa9ea79551d4653c8

SHA1
ec73e03ca167db7d77301baaf25ea8c9324411a3

SHA256
31d8e1b57d8d21558fd9c676042523e381ba6aa403727290e51e22cebb764b7e

SHA512
66daff0d297fbbbaff02975333474f280bd673a40ea659db4fc4bb99622c83da008181fd17d4c169aaf72d1eb04f4565b09949155e1ce1cd8ba61168f9f08756

Download Submit
C:\Windows\SysWOW64\Qfcfml32.exe

Filesize
320KB

MD5
7091bd74cefe13a42b206054c5d674ea

SHA1
51f055d8182390a94ea69def421f161c311f876c

SHA256
58f4b5050fd7313d25c68c47cf956d6a8ef81f7ef889623e3eb5650a9e90eb22

SHA512
391221b8831ccff692d0f8b9af9431a79e371504d06581d66d493a17403a361c2d73d27889f591cb07cca4750a682ae81bb74d8e1acbc71cc3861b980c0df217

Download Submit
C:\Windows\SysWOW64\Qfcfml32.exe

Filesize
337KB

MD5
5d5ba81b916cdd87a9f71c8ba2da6d13

SHA1
ec66f34c5f27fd1e55537ee5e37a1cd015111927

SHA256
542f8cc9ef579bbef73438aba43763daad6c797b3b638023b6b85d3311fc16c2

SHA512
b365391f44d9ae486b3304b7d248e987f8192d6f790e9c02f54ba872e38ed7abba21be0a91323b62a8ce162e39202f5619d65c86431f7bcbbf0743f21f31632e

Download Submit
C:\Windows\SysWOW64\Qmkadgpo.exe

Filesize
337KB

MD5
59b74e3520cffccb967b94889a64d1c0

SHA1
62fb7bf10c597da2ae394c32b2c3e873698d87e7

SHA256
971ba34f24a9e4e44f7fa50a851ba9adf0e26cc5fd6eb7c7b415e24081830837

SHA512
0451e7dff3ba745bd3f4c3b5aad0b1107e555fa5eccd15290149075937b794cd8b77291ca9028822ffc1e8c583b6e26a10d6a22942894ec4dd6f20c5c74c067e

Download Submit
memory/8-192-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/396-208-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/636-426-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/748-145-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/824-88-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/856-269-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/916-112-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/924-104-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/952-574-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/952-40-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1032-152-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1104-335-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1128-383-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1164-456-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1388-575-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1392-287-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1436-555-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1456-554-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1456-17-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1464-240-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1472-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1472-534-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1472-1-0x0000000000431000-0x0000000000432000-memory.dmp

Filesize
4KB

Download
memory/1528-225-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1584-414-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1764-588-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1768-80-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1892-561-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2056-281-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2164-353-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2208-548-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2208-691-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2272-317-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2288-311-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2288-684-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2324-395-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2332-717-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2332-200-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2364-176-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2372-263-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2424-528-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2520-248-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2592-329-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2644-568-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2768-396-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2776-61-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2912-168-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2976-486-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3084-277-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3172-450-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3180-49-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3180-581-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3208-128-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3288-522-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3360-347-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3388-365-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3404-510-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3428-72-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3468-305-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3516-468-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3520-184-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3564-432-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3576-402-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3600-389-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3604-438-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3788-541-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3848-567-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3848-32-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3856-299-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3924-408-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3976-504-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3988-474-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4056-371-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4112-216-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4152-680-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4152-323-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4156-293-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4192-462-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4300-232-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4348-136-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4452-96-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4488-121-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4544-160-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4656-480-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4660-516-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4768-600-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4768-582-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4832-547-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4832-8-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4852-377-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4856-359-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4860-29-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4880-420-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4900-535-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4916-256-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5040-492-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5044-498-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5052-444-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5072-594-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5072-65-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5112-341-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads